End-user data requests

Look the person up by the user id your app passes to Cueston.identify().

In the dashboard: Settings → Data & privacy → One person's data. Review what's stored, download it as JSON, or delete it.

From your server, with a secret API key (sk_) created by an owner or admin:

Export

curl "https://app.cueston.com/api/end-users/usr_1842/export" \
  -H "Authorization: Bearer $CUESTON_SECRET_KEY" -o usr_1842.json

Delete

curl -X DELETE "https://app.cueston.com/api/end-users/usr_1842" \
  -H "Authorization: Bearer $CUESTON_SECRET_KEY"

The answer says how much was deleted, by kind of data:

{
  "endUser": { "reference": "eu_3f9a6c2e0b1d4a7f9c8e5d2b1a0f6e3c", "anonymousIds": 2 },
  "deleted": { "contentEvents": 182, "trackEvents": 41, "dailyEventCounts": 12, "viewState": 6,
               "checklistProgress": 1, "surveyResponses": 2, "profiles": 1, "segmentInboundEvents": 0,
               "segmentDeliveries": 0, "webhookDeliveries": 3, "featureUsage": 0, "frictionEvents": 0,
               "legacyTourAnalytics": 0 },
  "total": 248
}

What's covered

• Both cover rows with the person's user id, and the anonymous activity of the browsers they used (any anonymous id stored next to their user id).
• To include a visitor who was never identified, add ?anonymousId= with the id from their browser's cst_aid key (up to 20).
• Encode the user id for the URL (encodeURIComponent).

Deleting is immediate, in one transaction, and safe to repeat. The audit log records that it happened with a reference (a keyed hash of the user id, eu_…), never the user id itself. Anything the snippet sends afterwards is recorded again, so stop identifying the person first.

Exports and deletes are rate-limited: 60 exports an hour and 60 deletes a minute per workspace.