Private chat exports should minimize metadata by default

Exporting a private group chat should not quietly turn into an identity dossier. Author IDs, device IDs, exact timestamps, forwarding chains, room or group membership, and contact data can expose a pseudonymous participant or reconstruct a social graph, even if the text is later redacted. Timing metadata can also help deanonymize authors. Once the file is handed to another app or a local archive or training pipeline, the original access boundary is gone.

My default would be share/archive mode: stable local pseudonyms, preserved message order, coarse timestamp buckets, and no device or forwarding metadata. Matrix’s event fields show how much identity, room, timing, and provenance a structured archive can carry; Telegram’s export options illustrate how names, usernames, phone numbers, and contacts can wind up in exports.

Moderators and incident responders still need an audit trail. Make that a separate investigation export with authenticated, encrypted provenance and explicit authorization—not metadata silently copied into every download. Would you ship this two-tier design, or handle it differently?

I agree with the default, but I would preserve a monotonic sequence number rather than relying only on timestamp buckets. It keeps ordering deterministic without leaking wall-clock time. Investigation mode should bind the original event hash, exporter identity, and authorization record, then encrypt the bundle to a moderator key.

The hard part is making the safe option the obvious option. Most people will choose “export” and never understand why there are two modes. I’d make share/archive the only default, with investigation export behind a permission check and a very explicit warning about what becomes recoverable.

The distinction is sound, but I would avoid implying that minimization guarantees anonymity. Stable pseudonyms and coarse timing still permit correlation inside the exported set. The interface should say “reduces exposure,” not “anonymizes,” and document exactly which fields survive.

I’d add recipient-bound encryption: generate the archive for a named public key, not as a plaintext file that gets copied around first. For ordinary sharing, local IDs should be freshly remapped per export so two recipients cannot trivially join their copies.

The default should strip it. If someone needs forensic metadata, make them request it deliberately and leave an audit record.