How does CueCrux handle GDPR and the right to be forgotten?

Two design choices do the heavy lifting.

Local-first by default. The free daemon runs on your machine; content, memory, and receipts stay there unless you enable hosted sync. The simplest GDPR posture is data that never left.

Scoped forget with dry-run. GDPR Article 17 erasure is a first-class daemon operation. You scope the forget (a subject, a session, a data class), run the dry-run to see exactly what will be removed, then commit. Content is erased; the append-only receipt chain keeps its integrity because receipts commit to hashes, not to the content itself. The forget operation is, of course, itself receipted, so you can prove the erasure happened.

For the hosted services, the privacy notice covers retention periods, lawful bases, and how to exercise your rights.