A Raw Export Can Publish Your Home Routine
Publishing an unfiltered lifelog can permanently expose your home address, recurring absence windows, confidential reflections, and the whereabouts of people who never agreed to be tracked. Once someone downloads the archive, deleting the original post cannot retrieve their copy.
The danger grows when records join together. Consider a hypothetical export containing GPS fixes at 30-second intervals, minute-stamped heart-rate records, and a journal entry reading “walked home with [companion].” Overnight location clusters suggest a residence. Departure times reveal when it is empty. The journal connects another person to that address.
Each stream supplies context for the others. This makes a quantified self archive especially revealing: wearables, location history, and personal writing describe the same life from different angles.
I start with the sharing purpose. A habit-consistency article may need only a date, habit category, and completion status. Coordinates, device identifiers, and the accompanying journal paragraph add exposure without helping the reader understand habit completion.
Inspect a seven-day sample spanning weekdays and a weekend to catch repeated arrivals and departures. Then follow a fixed sequence: isolate a working copy, remove structural identifiers, sanitize text, and audit the remaining timestamps. The NIST guidelines on de-identifying personal data provide further background on de-identification.
Build a Local Workspace Outside Your Master Sync
Never run destructive redaction against your primary database or master sync folder. Keep the entire staging directory outside synchronized folders so edits and sensitive intermediate files stay local.
staging/
raw/
work/
release/An illustrative export might contain manifest.json, tracks.csv, habits.json, journal/*.md, and attachments/*.jpg. A combined JSON export might instead use top-level export_info, devices, and records keys.
- Place the untouched export under
raw, record its SHA-256 digest, and make it read-only as an accidental-edit guard. - Copy the material into
workfor inspection and transformation. - Populate
releaseonly with regenerated files containing approved fields.
Clear the Export Wrapper First
Remove source_path, hostname, device_serial, bluetooth_mac, account_email, and export_created_at from the wrapper before editing individual records. Otherwise, sanitized habit entries can sit beneath a manifest that still names their owner.
Regenerate filenames containing usernames, dates, or device identifiers. Write fresh release files rather than carrying source filesystem timestamps forward. Inspect the final archive listing for source-directory names, filesystem sidecars, editor backups, and temporary files.
This separation also makes revisions manageable: the raw export stays intact while the release contains only deliberate outputs.
Remove Coordinates and Cut Back Sensitive Routes
Derive any permitted broad location category locally, then delete the coordinates used to produce it. For many lifelogging summaries, Transit, Workspace, or Gym supplies enough context. Use a city label instead of a neighborhood when neighborhood detail serves no stated purpose.
Inspect flat fields and nested structures. Remove latitude, longitude, altitude, lat, lon, and geometry.coordinates. Check location-bearing filenames and embedded map links. For CSV, write a new header containing only approved columns, then regenerate every row against that schema.
Cut the Driveway Approach
Deleting a home pin leaves a revealing route if the surviving breadcrumbs end on the home's access road. Apply exclusion zones before discarding the working coordinates, while distance calculations remain possible.
For an illustrative local rule, exclude fixes within 1,000 meters of home and a second sensitive address. Calculate distance in meters using a geodesic calculation or an appropriate local projected coordinate system. A decimal-degree comparison does not express that radius correctly.
In that same example, remove the five minutes of track immediately before entry into each zone and after exit. Inspect the surviving endpoints manually for recognizable approaches.
Attached photographs need a separate pass. For JPEG release copies, remove the EXIF GPS group with:
exiftool -gps:all= -overwrite_original staging/release/attachments/*.jpgReinspect the resulting metadata. Examine visible street signs, house numbers, and map screenshots separately; metadata removal leaves those visual clues untouched.
Clean Private Language and People Caught in the Log
Free text carries details that a coordinate filter never touches. Inventory calendar titles, commit messages, voice-to-text transcripts, journal bodies, attachment captions, and Markdown front matter before writing replacements.
Build a local dictionary containing full names, nicknames, surname variants, email aliases, home street names, and recurring private appointment terms. Search medical and financial shorthand such as Rx, copay, acct, and routing, then review the surrounding sentences.
Pattern matching helps find additional candidates. This email pattern is a useful starting point in a regex engine supporting inline case-insensitive flags:
(?i)\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\bRoute matches into review or replacement. For phone-number candidates, collect runs containing digits, spaces, parentheses, plus signs, periods, and hyphens, then review those containing 7–15 digits. Candidate detection and the decision to replace a value are separate steps.
Temporary placeholders such as [CONTACT_1] keep references consistent during editing. For publication, use a role label such as [friend] when identity and cross-entry linkage serve no purpose.
Bystanders deserve their own pass. Contextual tech can collect people through proximity rather than an explicit journal entry. Remove Bluetooth identifiers, nearby-device labels, Wi-Fi SSIDs and BSSIDs, tagged companions, and calendar attendee lists from the release schema. Search transcripts and captions for their human-readable equivalents too.
A shared walk can remain useful as an activity record after the companion's name, workplace, and destination have gone.
Read the Remaining Clock Times Like an Outsider
Set the deleted fields aside. Examine only what a recipient would receive: timestamp-category pairs, surviving notes, dates, and filenames.
Take a hypothetical sequence: Transit at 18:12, an outdoor note at 18:47 mentioning a brief hail shower, and Public gathering at 19:00. Candidate transit timetables, archived local weather observations, and public event calendars give an observer several ways to align those entries with a place. The weather detail supplies another join key.
For a daily habit summary, replace clock times with defined buckets:
- Morning: 06:00–11:59.
- Afternoon: 12:00–17:59.
- Evening: 18:00–23:59.
Inspect the date separately: an exact date can still connect an entry to an appointment or trip.
When interval preservation matters, an illustrative transformation draws one offset locally from minus 21 days to plus 21 days and applies that identical offset to every timestamp in a 14-day series. Keep the offset out of the release. Transform calendar fields, filenames, and dates embedded in Markdown consistently, and remove stale weekday labels or timezone fields that contradict the transformed representation.
A constant shift preserves intervals and repeated routines, so aggregate further or withhold records when those patterns remain recognizable.
Repeat the outsider audit for recurring absence windows and companion encounters. Ask what the sequence reveals about who is together and when a home is empty, as well as where an activity occurred.
Make a Private-Term Search the Release Gate
Start with a single 24-hour slice exported as local plain text. For example, use 2026-10-12T00:00:00 inclusive through 2026-10-13T00:00:00 exclusive in the archive's stated timezone.
Create private-blocklist.txt outside the release folder with five nonempty lines: your home street name, primary email address, and three closest contacts' names. Search the sample:
grep -nFi -f private-blocklist.txt sample-24h.txtFixed-string matching treats address punctuation literally; case-insensitive matching catches capitalization changes. Review every match in context.
Turn that exact list into a reusable local gate. Remove blank lines and reject an empty blocklist before scanning. Convert structured files into searchable text and extract attachment metadata into the local scan material. The gate's core can then be:
grep -raliF -f private-blocklist.txt staging/release
rc=$?
if [ "$rc" -ne 1 ]; then
exit 1
fiA match returns zero; an execution error returns a value greater than one. Both block release. Run this check automatically after every transformation, and inspect a local diff between the working copy and release to verify the intended removals. Keep that diff, the blocklist, and the raw export outside the deliverable.
After packaging, extract the candidate archive into a fresh local directory and run the same gate against its searchable contents and metadata.
Export your 24-hour slice now and run the five-term search for your street, email, and three contacts.
