McDossier Auto-Redact for Loyalty Data

Who it's for

Privacy-conscious customers who request their data under GDPR/CCPA and currently receive massive unreadable PDFs/JSON dumps from loyalty programs, banks, or retailers; they cope by ignoring the dump or manually scrolling for sensitive fields.

The problem

Time: reading a 515-page dossier takes hours; legal: most users can't identify violations or craft a proper deletion request; payment: potential fines if they are a business and mishandle customer data.

How to build it

CLI tool (Python/Rust) that parses common export formats (PDF, CSV, JSON), uses regex + optional local LLM to flag sensitive fields (name, address, purchase history, location, inferences), generates a redacted PDF and a deletion-request letter template, all offline.

How it makes money

Consumers pay $9.99 one-time for a polished tool that saves them 2-5 hours of manual review and generates a legally valid deletion request; businesses with compliance obligations pay $49/month for a batch version that audits multiple data exports and provides audit trails. Free alternatives are generic PDF redactors that don't understand loyalty data structure or generate the deletion letter.

Why it doesn't exist yet

Incumbents (McDonald's, retailers) have no incentive to make their data dumps readable or expose their own inferences; they comply with the letter of the law but bury users in unusable volume. An indie can build a narrow parser for the most common formats and charge a small fee for the convenience — the gap is the lack of a user-side tool that turns legal compliance into action.

First users

The 10 users come from the Wired article spike — people who read about the 515-page dossier and think 'I should request my own data' but then realize they can't make sense of it; plus HN privacy enthusiasts who want to check what companies have on them.

Build size

1 person x 6 weeks — includes parsers for top 5 loyalty export formats (McDonald's, Starbucks, Amazon, Target, generic CSV/PDF), sensitive-field detection rules, redaction engine, and deletion-letter generator; excludes browser extension or mobile app.

Biggest risk

A major privacy nonprofit (e.g., EFF) or a data-export platform (e.g., a startup that already aggregates such requests) ships a free open-source tool with the same features, undercutting the paid model before traction.

Conditions for a hit (all 3 required)

• Accepts a PDF or CSV/JSON export from a loyalty program (tested with 100+ page PDFs) and produces a redacted PDF within 3 minutes on a standard laptop, with all detected PII (name, address, phone, email, location) blacked out.
• Generates a one-page summary listing the data categories found (e.g., purchases, location, device IDs, inferences) with counts per category, in a human-readable format.
• Outputs a pre-filled deletion/access request letter addressed to the data controller, citing GDPR/CCPA sections, with placeholders for user's contact info, ready to send.

How it's judged (in 6 months)

GitHub repo reaches 500 stars and at least 20 positive reviews on Product Hunt (top 10 daily) or 1,000 paid downloads on Gumroad.(judgment date 2027-02-14)

AI self-confidence 62/100 — self-reported likelihood of meeting the criterion, not a business success rate