Event Tracking — Data Model

Owns no tables. PostHog is the system of record for captured events. The Taikan DB does not store an audit / event log from this module.

External persistence

• PostHog cloud (EU region by default).
• Retention per PostHog plan.

Multi-org isolation

• Events are attributed to an org through the PostHog organization group. Call sites pass it as $groups: { organization: orgId } in the properties; EventTrackingService.track() hoists that to capture’s own top-level groups field, which is the only input the wire format turns into a group. See behavior.md for why the hoist exists (TKN-349) and why it stays after an SDK upgrade.
• Some events additionally carry org_id / orgId as a plain property. That is a convenience for SQL insights, not the isolation mechanism, and it is not applied consistently — member_workout_viewed and workout_assigned have it, workout_created and workout_done do not.
• PostHog itself does not enforce tenant isolation — that’s the caller’s responsibility when building dashboards / filters. A dashboard filtering on the group is only as correct as the group actually arriving on the event.

PII handling

• Event properties may carry PII if callers pass it. No automatic redaction.
• The PostHog EU host is the only mitigation today for GDPR data-residency.
• distinctId is the Taikan user UUID; PostHog person records use this id.

Soft / hard delete

n/a — Taikan DB owns no rows for this feature. Deletion would happen in PostHog.