User can delete their AI conversation history

GDPR Article 17 (Right to Erasure) and CCPA §1798.105 (Right to Delete) give users the explicit right to request deletion of their personal data, including AI conversation history. When no self-service delete mechanism exists, every deletion request becomes a manual support ticket requiring engineering intervention — a workflow that does not scale and that many teams fail to process within the regulatory 30-day window. Worse, without a delete UI, most users do not know they can ask, meaning their data persists indefinitely by default rather than by informed choice.

Add a DELETE endpoint scoped to the requesting user's records. Never delete by ID alone — always verify ownership before deleting.

// app/api/conversations/[id]/route.ts
export async function DELETE(
  req: Request,
  { params }: { params: { id: string } }
) {
  const session = await getServerSession()
  if (!session?.user?.id) return new Response('Unauthorized', { status: 401 })

  const conversation = await db.conversation.findFirst({
    where: { id: params.id, userId: session.user.id }
  })
  if (!conversation) return new Response('Not Found', { status: 404 })

  await db.conversation.delete({ where: { id: params.id } })
  return new Response(null, { status: 204 })
}

Also expose a "Clear all history" action that deletes every conversation for the current user in a single operation. Surface both in the account settings UI, not buried in a help article.