GDPR Compliance: warn users their account will be deleted after two years inactivity

[spwoodcock]

Describe the bug

• We must warn users about inactivity and delete their account after two years inactivity.
• If they log in again, then this is reset.
• If they don't respond / login, we delete their user.

Solution

• Warn them three times, perhaps three weeks prior to the deletion?
• Warnings via email / OSM message?
• Write out a default email for this / get wording right for GDPR compliance.

[Anuj-Gupta4]

We first need to decide what classifies as users being active or inactive in order to figure out how this issue can be addressed.

[spwoodcock]

Do you think adding a last_active_at field to the users table would be a good approach?

Then update it at every login

[Anuj-Gupta4]

I was thinking the same thing. This probably works the best.