diff --git a/components/dashboard/account/ProfileSettings.module.css b/components/dashboard/account/ProfileSettings.module.css
index 552daa72..7a3cfd75 100644
--- a/components/dashboard/account/ProfileSettings.module.css
+++ b/components/dashboard/account/ProfileSettings.module.css
@@ -160,6 +160,49 @@
     cursor: default;
 }
 
+/* Where the export currently stands: preparing, ready to download, or lapsed.
+   Sits under the request row, inside the same dashed container. */
+.exportStatus {
+    display: flex;
+    justify-content: space-between;
+    align-items: center;
+    gap: 16px;
+    padding: 12px 16px;
+    border-top: 1px solid var(--separator);
+    background-color: var(--secondary);
+}
+
+.exportStatusText {
+    font-size: 0.85rem;
+    color: #666;
+}
+
+.exportDownloadBtn {
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+    gap: 8px;
+    flex-shrink: 0;
+    background-color: transparent;
+    color: var(--primary-text);
+    border: 1px solid var(--primary-text);
+    padding: 6px 14px;
+    border-radius: 40px;
+    cursor: pointer;
+    font-weight: 600;
+    font-size: 0.85rem;
+    transition: opacity 0.2s;
+}
+
+.exportDownloadBtn:hover {
+    opacity: 0.7;
+}
+
+.exportDownloadBtn:disabled {
+    opacity: 0.5;
+    cursor: default;
+}
+
 /* Shown in the delete-account dialog when a live subscription is at stake */
 .subscriptionWarning {
     display: flex;
diff --git a/components/dashboard/account/ProfileSettings.tsx b/components/dashboard/account/ProfileSettings.tsx
index f48259d6..f7e5e5ae 100644
--- a/components/dashboard/account/ProfileSettings.tsx
+++ b/components/dashboard/account/ProfileSettings.tsx
@@ -1,7 +1,7 @@
 "use client";
 
 import { useEffect, useState } from "react";
-import { editUserInfo, deleteUser, requestDataExport } from "@src/lib/utils/requests";
+import { editUserInfo, deleteUser, requestDataExport, downloadDataExport } from "@src/lib/utils/requests";
 import { signOut } from "next-auth/react";
 import { isTauri } from "@tauri-apps/api/core";
 import { useRouter } from "next/navigation";
@@ -14,7 +14,8 @@ import styles from "./ProfileSettings.module.css";
 import dangerStyles from "../project/DangerZone.module.css";
 import modal from "../../utils/ModalBtn.module.css";
 import { ApiResponse } from "@src/lib/utils/api-utils";
-import { useUser } from "@src/lib/utils/hooks";
+import { useDataExport, useUser } from "@src/lib/utils/hooks";
+import { saveBlob } from "@src/lib/utils/save-file";
 import { useLocale } from "@src/context/LocaleContext";
 
 const PRESET_COLORS = [
@@ -30,6 +31,7 @@ const PRESET_COLORS = [
 
 const ProfileSettings = ({ dangerOpen, onDangerToggle }: { dangerOpen: boolean; onDangerToggle: () => void }) => {
     const { user, mutate } = useUser();
+    const { dataExport, mutate: mutateExport } = useDataExport();
     const router = useRouter();
     const t = useTranslations("profile");
     const tCommon = useTranslations("common");
@@ -60,10 +62,23 @@ const ProfileSettings = ({ dangerOpen, onDangerToggle }: { dangerOpen: boolean;
     const [deleteLoading, setDeleteLoading] = useState(false);
     const [deleteError, setDeleteError] = useState<string | null>(null);
     const [exportLoading, setExportLoading] = useState(false);
+    const [exportRequested, setExportRequested] = useState(false);
+    const [downloadLoading, setDownloadLoading] = useState(false);
     const [exportMessage, setExportMessage] = useState<{ type: "success" | "error"; text: string } | null>(
         null,
     );
 
+    // The server is the authority on whether another export is allowed — a reload
+    // must not hand back a button the API would only answer with 429. `exportRequested`
+    // just covers the blink between the request landing and the state refetching.
+    const isExportBlocked =
+        exportLoading || exportRequested || !!dataExport?.canRequestAt || dataExport?.status === "PENDING";
+    const exportExpiryDate = dataExport?.expiresAt
+        ? new Intl.DateTimeFormat(locale, { year: "numeric", month: "long", day: "numeric" }).format(
+              new Date(dataExport.expiresAt),
+          )
+        : "";
+
     // Sync state when settings load
     useEffect(() => {
         if (user && !initialized) {
@@ -85,18 +100,22 @@ const ProfileSettings = ({ dangerOpen, onDangerToggle }: { dangerOpen: boolean;
         setMessage(null);
     };
 
-    // GDPR data-access request: the server bundles everything in the background
-    // and emails a download link, so the only feedback here is "check your inbox".
+    // GDPR data-access request. The server bundles the zip in the background and
+    // keeps it for 7 days; the panel below polls until it is ready to download,
+    // and the email that goes out is only a notification.
     const handleRequestExport = async () => {
-        if (exportLoading) return;
+        if (isExportBlocked) return;
         setExportLoading(true);
         setExportMessage(null);
         try {
             const res = await requestDataExport();
             if (res.ok) {
+                setExportRequested(true);
                 setExportMessage({ type: "success", text: t("exportRequested") });
             } else if (res.status === 409) {
                 setExportMessage({ type: "error", text: t("exportPending") });
+            } else if (res.status === 429) {
+                setExportMessage({ type: "error", text: t("exportThrottled") });
             } else {
                 setExportMessage({ type: "error", text: t("exportFailed") });
             }
@@ -104,6 +123,31 @@ const ProfileSettings = ({ dangerOpen, onDangerToggle }: { dangerOpen: boolean;
             setExportMessage({ type: "error", text: t("exportFailed") });
         } finally {
             setExportLoading(false);
+            mutateExport();
+        }
+    };
+
+    // Streamed through the API rather than linked to, so the archive is only ever
+    // handed to a request carrying this user's session.
+    const handleDownloadExport = async () => {
+        if (!dataExport?.id || downloadLoading) return;
+        setDownloadLoading(true);
+        setExportMessage(null);
+        try {
+            const res = await downloadDataExport(dataExport.id);
+            if (!res.ok) throw new Error("Download failed");
+
+            await saveBlob(await res.blob(), "scriptio-data-export.zip", {
+                label: t("exportArchive"),
+                extension: "zip",
+            });
+        } catch {
+            // Most likely the archive lapsed while the panel was open — refetch so
+            // the state stops offering a download that no longer exists.
+            setExportMessage({ type: "error", text: t("exportDownloadFailed") });
+            mutateExport();
+        } finally {
+            setDownloadLoading(false);
         }
     };
 
@@ -171,12 +215,31 @@ const ProfileSettings = ({ dangerOpen, onDangerToggle }: { dangerOpen: boolean;
                             <button
                                 className={styles.exportBtn}
                                 onClick={handleRequestExport}
-                                disabled={exportLoading}
+                                disabled={isExportBlocked}
                             >
-                                <Download size={16} />
                                 {exportLoading ? t("exportRequesting") : t("exportBtn")}
                             </button>
                         </div>
+                        {dataExport && dataExport.status !== "NONE" && (
+                            <div className={styles.exportStatus}>
+                                <span className={styles.exportStatusText}>
+                                    {dataExport.status === "PENDING" && t("exportStatePreparing")}
+                                    {dataExport.status === "READY" &&
+                                        t("exportStateReady", { date: exportExpiryDate })}
+                                    {dataExport.status === "EXPIRED" && t("exportStateExpired")}
+                                </span>
+                                {dataExport.status === "READY" && (
+                                    <button
+                                        className={styles.exportDownloadBtn}
+                                        onClick={handleDownloadExport}
+                                        disabled={downloadLoading}
+                                    >
+                                        <Download size={16} />
+                                        {downloadLoading ? t("exportDownloading") : t("exportDownload")}
+                                    </button>
+                                )}
+                            </div>
+                        )}
                     </div>
                     {exportMessage && (
                         <div className={`${styles.message} ${styles[exportMessage.type]}`}>
diff --git a/components/dashboard/project/ProjectSettings.tsx b/components/dashboard/project/ProjectSettings.tsx
index 4430d4c0..d68a3faa 100644
--- a/components/dashboard/project/ProjectSettings.tsx
+++ b/components/dashboard/project/ProjectSettings.tsx
@@ -1,11 +1,12 @@
 "use client";
 
-import { cropImageBase64 } from "@src/lib/utils/misc";
 import Image from "next/image";
 import { useTranslations } from "next-intl";
 import { editProject } from "@src/lib/utils/requests";
 import { useContext, useEffect, useState } from "react";
 import { useProjectMembership, useCachedProjectInfo, useProjectIdFromUrl } from "@src/lib/utils/hooks";
+import { savePosterFromFile } from "@src/lib/posters/poster-store";
+import { usePosterUrl } from "@src/lib/posters/use-poster-url";
 import { ProjectContext } from "@src/context/ProjectContext";
 import UploadButton from "@components/projects/UploadButton";
 import DangerZone from "./DangerZone";
@@ -28,19 +29,27 @@ const ProjectSettings = ({ dangerOpen, onDangerToggle }: { dangerOpen: boolean;
 
     const [isDirty, setDirty] = useState<boolean>(false);
     const [selectedFile, setSelectedFile] = useState<File | null>(null);
-    const [previewUrl, setPreviewUrl] = useState<string | null>(membership?.project.poster || null);
+    const [filePreviewUrl, setFilePreviewUrl] = useState<string | null>(null);
     const [loading, setLoading] = useState(false);
 
+    // The saved poster comes from the local store (works offline and for
+    // local-only projects); a freshly picked file previews over it until saved.
+    const savedPosterUrl = usePosterUrl(projectId);
+    const previewUrl = filePreviewUrl ?? savedPosterUrl;
+
     // Get project data from membership or local info
     const projectTitle = membership?.project.title || localTitle;
     const projectDescription = membership?.project.description || localDescription;
     const projectAuthor = membership?.project.author || localAuthor;
 
     useEffect(() => {
-        if (!selectedFile) return;
+        if (!selectedFile) {
+            setFilePreviewUrl(null);
+            return;
+        }
         const objectUrl = URL.createObjectURL(selectedFile);
         setDirty(true);
-        setPreviewUrl(objectUrl);
+        setFilePreviewUrl(objectUrl);
         return () => URL.revokeObjectURL(objectUrl);
     }, [selectedFile]);
 
@@ -68,19 +77,24 @@ const ProjectSettings = ({ dangerOpen, onDangerToggle }: { dangerOpen: boolean;
             console.error("[ProjectSettings] Failed to save local project:", error);
         }
 
+        // The poster is stored locally first and mirrored to the cloud from
+        // there, so this works the same for local-only, cloud and offline projects.
+        if (selectedFile) {
+            try {
+                await savePosterFromFile(projectId, selectedFile);
+                setSelectedFile(null);
+            } catch (error) {
+                console.error("[ProjectSettings] Failed to save poster:", error);
+            }
+        }
+
         if (!isLocalOnly && membership) {
             // Also save to remote API
-            const body: { title: string; description: string; author: string; poster?: string } = {
+            await editProject(membership.project.id, {
                 title: newTitle,
                 description: newDescription,
                 author: newAuthor,
-            };
-
-            if (selectedFile) {
-                body.poster = await cropImageBase64(selectedFile, 600, 900);
-            }
-
-            await editProject(membership.project.id, body);
+            });
         }
 
         // Sync title/author to Yjs metadata (updates title page editor)
@@ -140,25 +154,23 @@ const ProjectSettings = ({ dangerOpen, onDangerToggle }: { dangerOpen: boolean;
                 />
             </div>
 
-            {/* Poster - only show for remote projects */}
-            {!isLocalOnly && (
-                <div className={styles.formGroup}>
-                    <label className={form.label}>{t("posterLabel")}</label>
-                    <div className={styles.posterUploadArea}>
-                        <div className={styles.posterPreview}>
-                            {previewUrl ? (
-                                <Image src={previewUrl} alt="Preview" width={120} height={180} />
-                            ) : (
-                                <div className={styles.posterPlaceholder}>{t("noPoster")}</div>
-                            )}
-                        </div>
-                        <div className={styles.uploadControls}>
-                            <p className={styles.helpText}>{t("posterHelp")}</p>
-                            <UploadButton setSelectedFile={setSelectedFile} selectedFile={selectedFile} />
-                        </div>
+            {/* Poster */}
+            <div className={styles.formGroup}>
+                <label className={form.label}>{t("posterLabel")}</label>
+                <div className={styles.posterUploadArea}>
+                    <div className={styles.posterPreview}>
+                        {previewUrl ? (
+                            <Image src={previewUrl} alt="Preview" width={120} height={180} />
+                        ) : (
+                            <div className={styles.posterPlaceholder}>{t("noPoster")}</div>
+                        )}
+                    </div>
+                    <div className={styles.uploadControls}>
+                        <p className={styles.helpText}>{t("posterHelp")}</p>
+                        <UploadButton setSelectedFile={setSelectedFile} selectedFile={selectedFile} />
                     </div>
                 </div>
-            )}
+            </div>
 
             <div className={styles.formActions}>
                 <button type="submit" className={`${styles.formBtn}`} disabled={loading || !isDirty}>
diff --git a/components/editor/EditorPanel.module.css b/components/editor/EditorPanel.module.css
index 435d7609..3375e1e8 100644
--- a/components/editor/EditorPanel.module.css
+++ b/components/editor/EditorPanel.module.css
@@ -69,6 +69,22 @@
     display: block;
 }
 
+@media (pointer: coarse) {
+    .container,
+    .editor_wrapper,
+    .page_shift {
+        -webkit-user-select: none;
+        user-select: none;
+        -webkit-touch-callout: none;
+    }
+
+    .container :global(.ProseMirror) {
+        -webkit-user-select: text;
+        user-select: text;
+        -webkit-touch-callout: default;
+    }
+}
+
 .editor_shadow {
     position: sticky;
     top: 0;
diff --git a/components/project/ProjectWorkspace.module.css b/components/project/ProjectWorkspace.module.css
index 233675d3..ae2617bf 100644
--- a/components/project/ProjectWorkspace.module.css
+++ b/components/project/ProjectWorkspace.module.css
@@ -72,9 +72,11 @@
     }
 }
 
-.right_sidebar_toggle:hover {
-    opacity: 1;
-    background-color: var(--tertiary-hover);
+@media (hover: hover) {
+    .right_sidebar_toggle:hover {
+        opacity: 1;
+        background-color: var(--tertiary-hover);
+    }
 }
 
 /* Dim + tap-to-close layer behind the phone sidebar drawers. Sits above the
diff --git a/components/project/SplitPanelContainer.module.css b/components/project/SplitPanelContainer.module.css
index bcfe253f..deb484d5 100644
--- a/components/project/SplitPanelContainer.module.css
+++ b/components/project/SplitPanelContainer.module.css
@@ -181,9 +181,11 @@
     border: none;
 }
 
-.panel_switcher_btn:hover {
-    opacity: 1;
-    background-color: var(--secondary-hover);
+@media (hover: hover) {
+    .panel_switcher_btn:hover {
+        opacity: 1;
+        background-color: var(--secondary-hover);
+    }
 }
 
 /* Touch devices (phone + iPad): enlarge to a comfortable tap target, matching
diff --git a/components/projects/ProjectItem.tsx b/components/projects/ProjectItem.tsx
index 8fe33ec1..05ae5366 100644
--- a/components/projects/ProjectItem.tsx
+++ b/components/projects/ProjectItem.tsx
@@ -7,6 +7,7 @@ import Image from "next/image";
 import item from "./ProjectItem.module.css";
 import { useAppNavigation } from "@src/lib/utils/navigation";
 import { ProjectMembershipPayload } from "@src/server/repository/project-repository";
+import { usePosterUrl } from "@src/lib/posters/use-poster-url";
 import { CloudCheck, HardDrive } from "lucide-react";
 
 type Props = {
@@ -18,6 +19,9 @@ const ProjectItem = ({ project, isLocalOnly = false }: Props) => {
     const t = useTranslations("projects");
     const { goToProject } = useAppNavigation();
     const tDates = useTranslations("dates");
+    // Resolved from the local poster store, so local-only projects show a poster
+    // and cloud ones keep showing theirs offline.
+    const posterUrl = usePosterUrl(project.id, !isLocalOnly);
     const elapsedDays = getElapsedDaysFrom(project.updatedAt);
     const lastUpdated =
         elapsedDays === 0
@@ -30,9 +34,7 @@ const ProjectItem = ({ project, isLocalOnly = false }: Props) => {
                   ? tDates("monthsAgo", { months: Math.round(elapsedDays / 30) })
                   : tDates("moreThanYearAgo");
 
-    let posterPath;
-    if (project.poster) posterPath = project.poster;
-    else posterPath = "/images/default-poster.png";
+    const posterPath = posterUrl ?? "/images/default-poster.png";
 
     const storageLabel = isLocalOnly ? t("item.localOnly") : t("item.syncedToCloud");
     const StorageIcon = isLocalOnly ? HardDrive : CloudCheck;
diff --git a/messages/de.json b/messages/de.json
index 3b3152f0..5afdd8b6 100644
--- a/messages/de.json
+++ b/messages/de.json
@@ -239,12 +239,20 @@
     "saving": "Speichern...",
     "dangerZoneTitle": "Gefahrenzone",
     "exportData": "Meine Daten exportieren",
-    "exportDataDesc": "Fordern Sie eine Kopie Ihrer persönlichen Daten an: Kontoinformationen, Einstellungen und Projektmitgliedschaften. Sie erhalten einen Download-Link per E-Mail, gültig für 7 Tage.",
+    "exportDataDesc": "Fordern Sie eine Kopie Ihrer persönlichen Daten an: Kontoinformationen, Einstellungen und Projektmitgliedschaften. Sie steht hier 7 Tage lang zum Download bereit.",
     "exportBtn": "Export anfordern",
     "exportRequesting": "Wird angefordert...",
-    "exportRequested": "Export gestartet — Sie erhalten in Kürze eine E-Mail mit einem Download-Link. Der Link ist 7 Tage gültig.",
-    "exportPending": "Ein Export wird bereits vorbereitet. Bitte warten Sie auf die E-Mail.",
+    "exportRequested": "Export gestartet — er steht gleich hier zum Download bereit und bleibt 7 Tage verfügbar.",
+    "exportPending": "Ein Export wird bereits vorbereitet. Er erscheint hier, sobald er fertig ist.",
+    "exportThrottled": "Sie haben kürzlich bereits einen Export angefordert. In einer Stunde können Sie einen neuen anfordern.",
     "exportFailed": "Der Export konnte nicht angefordert werden. Bitte versuchen Sie es erneut.",
+    "exportStatePreparing": "Ihr Export wird vorbereitet. Das dauert nur einen Moment.",
+    "exportStateReady": "Ihr Export steht bis zum {date} zum Download bereit.",
+    "exportStateExpired": "Ihr letzter Export ist abgelaufen. Fordern Sie einen neuen an, um Ihre Daten erneut herunterzuladen.",
+    "exportDownload": "Herunterladen",
+    "exportDownloading": "Wird heruntergeladen...",
+    "exportDownloadFailed": "Der Export konnte nicht heruntergeladen werden. Möglicherweise ist er abgelaufen — fordern Sie einen neuen an.",
+    "exportArchive": "ZIP-Archiv",
     "deleteAccount": "Konto löschen",
     "deleteAccountDesc": "Löschen Sie dauerhaft Ihr Konto und alle verknüpften Daten. Dies kann nicht rückgängig gemacht werden.",
     "deleteBtn": "Löschen",
diff --git a/messages/en.json b/messages/en.json
index 03428e2f..3f7f24e5 100644
--- a/messages/en.json
+++ b/messages/en.json
@@ -238,12 +238,20 @@
     "saving": "Saving...",
     "dangerZoneTitle": "Danger zone",
     "exportData": "Export my data",
-    "exportDataDesc": "Request a copy of your personal data: account information, settings and project memberships. You'll receive a download link by email, valid for 7 days.",
+    "exportDataDesc": "Request a copy of your personal data: account information, settings and project memberships. It stays available to download here for 7 days.",
     "exportBtn": "Request export",
     "exportRequesting": "Requesting...",
-    "exportRequested": "Export started — you'll receive an email with a download link shortly. The link stays valid for 7 days.",
-    "exportPending": "An export is already being prepared. Please wait for the email.",
+    "exportRequested": "Export started — it will be ready to download here in a moment, and stays available for 7 days.",
+    "exportPending": "An export is already being prepared. It will appear here once it's ready.",
+    "exportThrottled": "You already requested an export recently. You can request a new one in an hour.",
     "exportFailed": "Failed to request the export. Please try again.",
+    "exportStatePreparing": "Your export is being prepared. This only takes a moment.",
+    "exportStateReady": "Your export is ready to download until {date}.",
+    "exportStateExpired": "Your last export has expired. Request a new one to download your data again.",
+    "exportDownload": "Download",
+    "exportDownloading": "Downloading...",
+    "exportDownloadFailed": "Failed to download the export. It may have expired — try requesting a new one.",
+    "exportArchive": "ZIP archive",
     "deleteAccount": "Delete account",
     "deleteAccountDesc": "Permanently delete your account and all associated data. This cannot be undone.",
     "deleteBtn": "Delete",
diff --git a/messages/es.json b/messages/es.json
index b1c594c1..0344b141 100644
--- a/messages/es.json
+++ b/messages/es.json
@@ -238,12 +238,20 @@
     "saving": "Guardando...",
     "dangerZoneTitle": "Zona de peligro",
     "exportData": "Exportar mis datos",
-    "exportDataDesc": "Solicita una copia de tus datos personales: información de la cuenta, configuración y membresías de proyectos. Recibirás un enlace de descarga por correo, válido durante 7 días.",
+    "exportDataDesc": "Solicita una copia de tus datos personales: información de la cuenta, configuración y membresías de proyectos. Estará disponible para descargar aquí durante 7 días.",
     "exportBtn": "Solicitar exportación",
     "exportRequesting": "Solicitando...",
-    "exportRequested": "Exportación iniciada — pronto recibirás un correo con un enlace de descarga. El enlace es válido durante 7 días.",
-    "exportPending": "Ya se está preparando una exportación. Espera el correo electrónico.",
+    "exportRequested": "Exportación iniciada — estará lista para descargar aquí en un momento y permanecerá disponible 7 días.",
+    "exportPending": "Ya se está preparando una exportación. Aparecerá aquí cuando esté lista.",
+    "exportThrottled": "Ya solicitaste una exportación recientemente. Podrás solicitar otra dentro de una hora.",
     "exportFailed": "No se pudo solicitar la exportación. Inténtalo de nuevo.",
+    "exportStatePreparing": "Tu exportación se está preparando. Solo tomará un momento.",
+    "exportStateReady": "Tu exportación está disponible para descargar hasta el {date}.",
+    "exportStateExpired": "Tu última exportación ha caducado. Solicita una nueva para descargar tus datos de nuevo.",
+    "exportDownload": "Descargar",
+    "exportDownloading": "Descargando...",
+    "exportDownloadFailed": "No se pudo descargar la exportación. Puede haber caducado: solicita una nueva.",
+    "exportArchive": "Archivo ZIP",
     "deleteAccount": "Eliminar cuenta",
     "deleteAccountDesc": "Elimina permanentemente tu cuenta y todos los datos asociados. Esto no se puede deshacer.",
     "deleteBtn": "Eliminar",
diff --git a/messages/fr.json b/messages/fr.json
index e8b5c9ef..34131384 100644
--- a/messages/fr.json
+++ b/messages/fr.json
@@ -239,12 +239,20 @@
     "saving": "Enregistrement...",
     "dangerZoneTitle": "Zone dangereuse",
     "exportData": "Exporter mes données",
-    "exportDataDesc": "Demandez une copie de vos données personnelles : informations du compte, paramètres et participations aux projets. Vous recevrez un lien de téléchargement par e-mail, valide 7 jours.",
+    "exportDataDesc": "Demandez une copie de vos données personnelles : informations du compte, paramètres et participations aux projets. Elle reste téléchargeable ici pendant 7 jours.",
     "exportBtn": "Demander l'export",
     "exportRequesting": "Demande en cours...",
-    "exportRequested": "Export lancé — vous recevrez bientôt un e-mail avec un lien de téléchargement. Le lien reste valide 7 jours.",
-    "exportPending": "Un export est déjà en cours de préparation. Veuillez attendre l'e-mail.",
+    "exportRequested": "Export lancé — il sera téléchargeable ici dans un instant, et restera disponible 7 jours.",
+    "exportPending": "Un export est déjà en cours de préparation. Il apparaîtra ici une fois prêt.",
+    "exportThrottled": "Vous avez déjà demandé un export récemment. Vous pourrez en demander un nouveau dans une heure.",
     "exportFailed": "Échec de la demande d'export. Veuillez réessayer.",
+    "exportStatePreparing": "Votre export est en cours de préparation. Cela ne prend qu'un instant.",
+    "exportStateReady": "Votre export est téléchargeable jusqu'au {date}.",
+    "exportStateExpired": "Votre dernier export a expiré. Demandez-en un nouveau pour télécharger vos données.",
+    "exportDownload": "Télécharger",
+    "exportDownloading": "Téléchargement...",
+    "exportDownloadFailed": "Échec du téléchargement de l'export. Il a peut-être expiré — demandez-en un nouveau.",
+    "exportArchive": "Archive ZIP",
     "deleteAccount": "Supprimer le compte",
     "deleteAccountDesc": "Supprimez définitivement votre compte et toutes les données associées. Cette action est irréversible.",
     "deleteBtn": "Supprimer",
diff --git a/messages/ja.json b/messages/ja.json
index b8f11e31..13105f25 100644
--- a/messages/ja.json
+++ b/messages/ja.json
@@ -238,12 +238,20 @@
     "saving": "保存中...",
     "dangerZoneTitle": "危険ゾーン",
     "exportData": "データをエクスポート",
-    "exportDataDesc": "個人データ（アカウント情報、設定、プロジェクトのメンバーシップ）のコピーをリクエストできます。ダウンロードリンク（7日間有効）がメールで届きます。",
+    "exportDataDesc": "個人データ（アカウント情報、設定、プロジェクトのメンバーシップ）のコピーをリクエストできます。ここから7日間ダウンロードできます。",
     "exportBtn": "エクスポートを申請",
     "exportRequesting": "申請中...",
-    "exportRequested": "エクスポートを開始しました。まもなくダウンロードリンクを記載したメールが届きます。リンクは7日間有効です。",
-    "exportPending": "エクスポートは既に準備中です。メールをお待ちください。",
+    "exportRequested": "エクスポートを開始しました。まもなくここからダウンロードできるようになり、7日間利用できます。",
+    "exportPending": "エクスポートは既に準備中です。準備ができるとここに表示されます。",
+    "exportThrottled": "最近エクスポートを申請済みです。1時間後に再度申請できます。",
     "exportFailed": "エクスポートの申請に失敗しました。もう一度お試しください。",
+    "exportStatePreparing": "エクスポートを準備しています。少しお待ちください。",
+    "exportStateReady": "エクスポートは {date} までダウンロードできます。",
+    "exportStateExpired": "前回のエクスポートは期限切れです。データを再度ダウンロードするには、新しく申請してください。",
+    "exportDownload": "ダウンロード",
+    "exportDownloading": "ダウンロード中...",
+    "exportDownloadFailed": "エクスポートをダウンロードできませんでした。期限が切れている可能性があります。新しく申請してください。",
+    "exportArchive": "ZIP アーカイブ",
     "deleteAccount": "アカウントを削除",
     "deleteAccountDesc": "アカウントとすべての関連データを完全に削除します。この操作は取り消せません。",
     "deleteBtn": "削除",
diff --git a/messages/ko.json b/messages/ko.json
index 764637ce..fe959ccf 100644
--- a/messages/ko.json
+++ b/messages/ko.json
@@ -238,12 +238,20 @@
     "saving": "저장 중...",
     "dangerZoneTitle": "위험 구역",
     "exportData": "내 데이터 내보내기",
-    "exportDataDesc": "개인 데이터(계정 정보, 설정, 프로젝트 멤버십)의 사본을 요청합니다. 7일간 유효한 다운로드 링크가 이메일로 전송됩니다.",
+    "exportDataDesc": "개인 데이터(계정 정보, 설정, 프로젝트 멤버십)의 사본을 요청합니다. 여기에서 7일 동안 다운로드할 수 있습니다.",
     "exportBtn": "내보내기 요청",
     "exportRequesting": "요청 중...",
-    "exportRequested": "내보내기가 시작되었습니다. 곧 다운로드 링크가 포함된 이메일이 도착합니다. 링크는 7일간 유효합니다.",
-    "exportPending": "이미 내보내기가 준비 중입니다. 이메일을 기다려 주세요.",
+    "exportRequested": "내보내기가 시작되었습니다. 잠시 후 여기에서 다운로드할 수 있으며 7일 동안 유지됩니다.",
+    "exportPending": "이미 내보내기가 준비 중입니다. 준비되면 여기에 표시됩니다.",
+    "exportThrottled": "최근에 이미 내보내기를 요청했습니다. 1시간 후에 다시 요청할 수 있습니다.",
     "exportFailed": "내보내기 요청에 실패했습니다. 다시 시도해 주세요.",
+    "exportStatePreparing": "내보내기를 준비하고 있습니다. 잠시만 기다려 주세요.",
+    "exportStateReady": "{date}까지 내보내기를 다운로드할 수 있습니다.",
+    "exportStateExpired": "마지막 내보내기가 만료되었습니다. 데이터를 다시 다운로드하려면 새로 요청하세요.",
+    "exportDownload": "다운로드",
+    "exportDownloading": "다운로드 중...",
+    "exportDownloadFailed": "내보내기를 다운로드하지 못했습니다. 만료되었을 수 있으니 새로 요청해 주세요.",
+    "exportArchive": "ZIP 아카이브",
     "deleteAccount": "계정 삭제",
     "deleteAccountDesc": "계정과 모든 데이터를 영구적으로 삭제합니다. 이 작업은 취소할 수 없습니다.",
     "deleteBtn": "삭제",
diff --git a/messages/pl.json b/messages/pl.json
index 8acc588f..2abe334c 100644
--- a/messages/pl.json
+++ b/messages/pl.json
@@ -238,12 +238,20 @@
     "saving": "Zapisywanie...",
     "dangerZoneTitle": "Strefa niebezpieczeństwa",
     "exportData": "Eksportuj moje dane",
-    "exportDataDesc": "Poproś o kopię swoich danych osobowych: informacji o koncie, ustawień i członkostw w projektach. Otrzymasz link do pobrania e-mailem, ważny przez 7 dni.",
+    "exportDataDesc": "Poproś o kopię swoich danych osobowych: informacji o koncie, ustawień i członkostw w projektach. Będzie ją można pobrać tutaj przez 7 dni.",
     "exportBtn": "Poproś o eksport",
     "exportRequesting": "Wysyłanie prośby...",
-    "exportRequested": "Eksport rozpoczęty — wkrótce otrzymasz e-mail z linkiem do pobrania. Link jest ważny przez 7 dni.",
-    "exportPending": "Eksport jest już przygotowywany. Poczekaj na e-mail.",
+    "exportRequested": "Eksport rozpoczęty — za chwilę będzie go można pobrać tutaj i pozostanie dostępny przez 7 dni.",
+    "exportPending": "Eksport jest już przygotowywany. Pojawi się tutaj, gdy będzie gotowy.",
+    "exportThrottled": "Niedawno poproszono już o eksport. Kolejny możesz zamówić za godzinę.",
     "exportFailed": "Nie udało się zażądać eksportu. Spróbuj ponownie.",
+    "exportStatePreparing": "Twój eksport jest przygotowywany. To zajmie tylko chwilę.",
+    "exportStateReady": "Eksport możesz pobrać do {date}.",
+    "exportStateExpired": "Twój ostatni eksport wygasł. Poproś o nowy, aby ponownie pobrać swoje dane.",
+    "exportDownload": "Pobierz",
+    "exportDownloading": "Pobieranie...",
+    "exportDownloadFailed": "Nie udało się pobrać eksportu. Mógł wygasnąć — poproś o nowy.",
+    "exportArchive": "Archiwum ZIP",
     "deleteAccount": "Usuń konto",
     "deleteAccountDesc": "Trwale usuń swoje konto i wszystkie powiązane dane. Tej akcji nie można cofnąć.",
     "deleteBtn": "Usuń",
diff --git a/messages/zh.json b/messages/zh.json
index 170de38a..a1152310 100644
--- a/messages/zh.json
+++ b/messages/zh.json
@@ -238,12 +238,20 @@
     "saving": "正在保存...",
     "dangerZoneTitle": "危险区域",
     "exportData": "导出我的数据",
-    "exportDataDesc": "申请获取您的个人数据副本：账户信息、设置及项目成员资格。下载链接将通过邮件发送，有效期 7 天。",
+    "exportDataDesc": "申请获取您的个人数据副本：账户信息、设置及项目成员资格。可在此处下载，有效期 7 天。",
     "exportBtn": "申请导出",
     "exportRequesting": "申请中...",
-    "exportRequested": "导出已开始 — 您很快会收到包含下载链接的邮件。链接有效期为 7 天。",
-    "exportPending": "已有导出正在准备中，请等待邮件。",
+    "exportRequested": "导出已开始 — 稍后即可在此处下载，有效期 7 天。",
+    "exportPending": "已有导出正在准备中，准备好后会显示在此处。",
+    "exportThrottled": "您最近已申请过导出，请在一小时后再试。",
     "exportFailed": "导出申请失败，请重试。",
+    "exportStatePreparing": "正在准备您的导出，请稍候。",
+    "exportStateReady": "您的导出可在 {date} 前下载。",
+    "exportStateExpired": "您上次的导出已过期。请重新申请以再次下载您的数据。",
+    "exportDownload": "下载",
+    "exportDownloading": "下载中...",
+    "exportDownloadFailed": "导出下载失败，可能已过期 — 请重新申请。",
+    "exportArchive": "ZIP 压缩包",
     "deleteAccount": "注销账户",
     "deleteAccountDesc": "永久删除账户及数据。不可恢复。",
     "deleteBtn": "删除",
diff --git a/prisma/schema.prisma b/prisma/schema.prisma
index 8a1ef199..b9ede8d0 100644
--- a/prisma/schema.prisma
+++ b/prisma/schema.prisma
@@ -151,7 +151,7 @@ model ProjectAsset {
 }
 
 // One GDPR data-access request. The zip lives in R2 at `key` until `expiresAt`
-// (7 days); a PENDING row younger than an hour blocks duplicate requests.
+// (7 days); any non-FAILED row younger than an hour blocks a new request.
 model DataExport {
   id                  String            @id @default(uuid(7))
   status              DataExportStatus  @default(PENDING)
diff --git a/src/app/api/projects/[projectId]/poster/route.ts b/src/app/api/projects/[projectId]/poster/route.ts
new file mode 100644
index 00000000..1f4d006a
--- /dev/null
+++ b/src/app/api/projects/[projectId]/poster/route.ts
@@ -0,0 +1,92 @@
+import { NextRequest, NextResponse } from "next/server";
+import { ProjectRole } from "../../../../../generated/client/client";
+
+import * as S3 from "@src/lib/s3";
+import * as ProjectService from "@src/server/service/project-service";
+import * as Roles from "@src/lib/utils/roles";
+import { apiHandler, AuthApiContext } from "@src/lib/utils/api-handler";
+import {
+    BodyFieldError,
+    ForbiddenError,
+    InternalServerError,
+    NotFoundError,
+    ProjectNotFoundError,
+    Success,
+    validate,
+} from "@src/lib/utils/api-utils";
+import { MAX_POSTER_SIZE_BYTES } from "@src/lib/utils/storage-limits";
+
+import z from "zod";
+
+const QuerySchema = z.object({
+    projectId: z.string(),
+});
+
+/** Posters are always JPEG: the client re-encodes whatever the user picked, and
+ *  the GET below advertises this type for every stored poster. */
+const POSTER_MIME = "image/jpeg";
+
+const posterKey = (projectId: string) => `poster-${projectId}`;
+
+/**
+ * GET `/projects/[projectId]/poster`
+ *
+ * Streams the project's poster through the (same-origin) API — the client
+ * caches the bytes in IndexedDB so the poster renders offline too. Proxying
+ * keeps the bucket private and avoids R2 CORS setup. Any member (VIEWER+) reads.
+ */
+async function getPoster(req: NextRequest, { routeParams, user }: AuthApiContext) {
+    const { projectId } = validate(QuerySchema, routeParams);
+
+    const membership = await ProjectService.getMembership(projectId, user.id);
+    if (!membership) throw new ProjectNotFoundError();
+    if (!membership.project.hasPoster) throw new NotFoundError("Poster not found");
+
+    const bytes = await S3.getObjectBytes(posterKey(projectId));
+    if (!bytes) throw new NotFoundError("Poster not found");
+
+    return new NextResponse(bytes as BodyInit, {
+        headers: {
+            "Content-Type": POSTER_MIME,
+            "Content-Length": String(bytes.byteLength),
+            // A poster is replaced in place at a fixed key, so it must never be
+            // served from a stale cache — freshness is the client's IndexedDB copy.
+            "Cache-Control": "private, no-store",
+        },
+    });
+}
+
+/**
+ * PUT `/projects/[projectId]/poster`
+ *
+ * Replaces the project's poster. Body is the raw image bytes (the client
+ * re-encodes to a 600x900 JPEG first). EDITOR+ only. Posters are one small
+ * fixed-size object per project, so they are not metered against the owner's
+ * asset quota.
+ */
+async function putPoster(req: NextRequest, { routeParams, user }: AuthApiContext) {
+    const { projectId } = validate(QuerySchema, routeParams);
+
+    const membership = await ProjectService.getMembership(projectId, user.id);
+    if (!membership) throw new ProjectNotFoundError();
+    if (!Roles.hasRoleOrGreater(membership.role, ProjectRole.EDITOR)) throw new ForbiddenError();
+
+    if (req.headers.get("Content-Type") !== POSTER_MIME) {
+        throw new BodyFieldError("Poster must be a JPEG image");
+    }
+
+    const bytes = new Uint8Array(await req.arrayBuffer());
+    if (bytes.byteLength === 0) throw new BodyFieldError("Empty poster body");
+    if (bytes.byteLength > MAX_POSTER_SIZE_BYTES) throw new BodyFieldError("Poster exceeds maximum size");
+
+    const ok = await S3.putObject(posterKey(projectId), bytes, POSTER_MIME);
+    if (!ok) throw new InternalServerError();
+
+    const updated = await ProjectService.update({ projectId, hasPoster: true });
+    if (!updated) throw new InternalServerError();
+
+    return Success({ hasPoster: true });
+}
+
+export const GET = apiHandler(getPoster);
+export const PUT = apiHandler(putPoster);
diff --git a/src/app/api/projects/[projectId]/route.ts b/src/app/api/projects/[projectId]/route.ts
index 075642a5..65947a33 100644
--- a/src/app/api/projects/[projectId]/route.ts
+++ b/src/app/api/projects/[projectId]/route.ts
@@ -1,6 +1,5 @@
 import { ProjectRole } from "../../../../generated/client/client";
 
-import * as S3 from "@src/lib/s3";
 import * as ProjectService from "@src/server/service/project-service";
 import * as Roles from "@src/lib/utils/roles";
 import { destroyProjectCompletely } from "@src/server/service/project-teardown-service";
@@ -54,7 +53,7 @@ async function updateProject(req: NextRequest, { routeParams, user }: AuthApiCon
     }
 
     const body = await req.json();
-    const { title, description, author, poster } = validate(UpdateProjectBodySchema, body);
+    const { title, description, author } = validate(UpdateProjectBodySchema, body);
 
     if (title && (title.length < 1 || title.length > 256)) {
         throw new BodyFieldError("Title must be between 1 and 256 characters");
@@ -70,17 +69,14 @@ async function updateProject(req: NextRequest, { routeParams, user }: AuthApiCon
         throw new ForbiddenError();
     }
 
-    let hasPoster = false;
-    if (poster) {
-        hasPoster = await S3.upload(`poster-${projectId}`, poster);
-    }
-
+    // `hasPoster` is deliberately left alone: the poster is owned by
+    // `PUT /projects/[projectId]/poster`, and folding it in here used to reset
+    // the flag to false on every unrelated edit.
     const updated = await ProjectService.update({
         projectId,
         title,
         description,
         author,
-        hasPoster,
     });
 
     if (!updated) {
diff --git a/src/app/api/projects/route.ts b/src/app/api/projects/route.ts
index 78609845..c0357502 100644
--- a/src/app/api/projects/route.ts
+++ b/src/app/api/projects/route.ts
@@ -1,5 +1,4 @@
 import { NextRequest } from "next/server";
-import * as S3 from "@src/lib/s3";
 import * as ProjectService from "@src/server/service/project-service";
 import {
     InternalServerError,
@@ -38,7 +37,7 @@ async function createProject(req: NextRequest, { user }: AuthApiContext) {
     await requirePro(user.id);
 
     const body = await req.json();
-    const { title, description, author, poster } = validate(CreateProjectBodySchema, body);
+    const { title, description, author } = validate(CreateProjectBodySchema, body);
 
     if (title.length < 1 || title.length > 256) {
         throw new BodyFieldError("Title must be between 1 and 256 characters");
@@ -55,15 +54,12 @@ async function createProject(req: NextRequest, { user }: AuthApiContext) {
         description,
         author,
         userId: user.id,
-        hasPoster: poster !== undefined,
+        hasPoster: false,
     });
 
     if (!newProject) {
         throw new InternalServerError();
     }
-    if (poster) {
-        await S3.upload(`poster-${newProject.id}`, poster);
-    }
 
     return SuccessCreated(newProject);
 }
diff --git a/src/app/api/users/export/download/route.ts b/src/app/api/users/export/download/route.ts
new file mode 100644
index 00000000..bbec3bd6
--- /dev/null
+++ b/src/app/api/users/export/download/route.ts
@@ -0,0 +1,37 @@
+import { NextRequest, NextResponse } from "next/server";
+
+import * as GdprExportService from "@src/server/service/gdpr-export-service";
+import { apiHandler, AuthApiContext } from "@src/lib/utils/api-handler";
+import { validate } from "@src/lib/utils/api-utils";
+
+import z from "zod";
+
+const QuerySchema = z.object({
+    id: z.string(),
+});
+
+/**
+ * GET `/users/export/download?id=<exportId>`
+ *
+ * Serves the export zip to the account settings, streamed through the API so
+ * the bucket stays private and no pre-signed URL ever leaves the server. The
+ * archive is personal data in bulk and reachable only by the signed-in user who
+ * requested it — nothing about it is delivered by email.
+ */
+async function downloadDataExport(req: NextRequest, { searchParams, user }: AuthApiContext) {
+    const { id } = validate(QuerySchema, searchParams);
+
+    const { bytes, filename } = await GdprExportService.getExportArchive(id, user.id);
+
+    return new NextResponse(bytes as BodyInit, {
+        headers: {
+            "Content-Type": "application/zip",
+            "Content-Length": String(bytes.byteLength),
+            "Content-Disposition": `attachment; filename="${filename}"`,
+            // Personal data: no cache may keep a copy of this response.
+            "Cache-Control": "no-store, private",
+        },
+    });
+}
+
+export const GET = apiHandler(downloadDataExport);
diff --git a/src/app/api/users/export/route.ts b/src/app/api/users/export/route.ts
index b303e65e..e7839b72 100644
--- a/src/app/api/users/export/route.ts
+++ b/src/app/api/users/export/route.ts
@@ -4,13 +4,23 @@ import * as GdprExportService from "@src/server/service/gdpr-export-service";
 import { apiHandler, AuthApiContext } from "@src/lib/utils/api-handler";
 import { Success } from "@src/lib/utils/api-utils";
 
+/**
+ * GET `/users/export`
+ *
+ * What the account settings render: whether an export is being prepared, ready
+ * to download, or expired, and when a new one may be requested.
+ */
+async function getDataExportState(req: NextRequest, { user }: AuthApiContext) {
+    return Success(await GdprExportService.getDataExportState(user.id));
+}
+
 /**
  * POST `/users/export`
  *
  * GDPR data-access request. Records the request and returns immediately; the
- * zip is bundled in the background (`after`) and a signed download link, valid
- * 7 days, is emailed to the user. 409 while a previous request is still
- * building.
+ * zip is bundled in the background (`after`) and stays downloadable from the
+ * settings for 7 days, with a notification email once it is ready. 409 while a
+ * previous request is still building, 429 within an hour of the last one.
  */
 async function requestDataExport(req: NextRequest, { user }: AuthApiContext) {
     const exportId = await GdprExportService.beginDataExport(user.id);
@@ -18,4 +28,5 @@ async function requestDataExport(req: NextRequest, { user }: AuthApiContext) {
     return Success({ requested: true });
 }
 
+export const GET = apiHandler(getDataExportState);
 export const POST = apiHandler(requestDataExport);
diff --git a/src/context/ProjectContext.tsx b/src/context/ProjectContext.tsx
index 0bd23b63..9fc0551b 100644
--- a/src/context/ProjectContext.tsx
+++ b/src/context/ProjectContext.tsx
@@ -43,6 +43,7 @@ import {
 } from "@src/lib/screenplay/revisions";
 import { SearchMatch } from "@src/lib/screenplay/extensions/search-highlight-extension";
 import { useAssetGc } from "@src/lib/assets/use-asset-gc";
+import { pushPendingPoster } from "@src/lib/posters/poster-store";
 
 // Import types only - these don't cause module loading
 import type { ThrottledWebsocketProvider } from "@src/lib/cloud/utils";
@@ -534,6 +535,13 @@ export const ProjectProvider = ({ children, projectId }: ProjectProviderProps) =
     // Keep IndexedDB image assets reconciled with the document (orphan sweep).
     useAssetGc(projectId, repository, isYjsReady);
 
+    // Re-upload a poster set while offline (no-op for local-only projects and
+    // once the cloud already holds these bytes).
+    useEffect(() => {
+        if (!projectId) return;
+        void pushPendingPoster(projectId);
+    }, [projectId]);
+
     // The DO pushes a role-changed message whenever an admin updates this
     // user's role. Mirror it into local state so isReadOnly flips and the
     // editor/repository gates apply immediately, without waiting for an SWR
diff --git a/src/lib/adapters/screenplay-adapter.ts b/src/lib/adapters/screenplay-adapter.ts
index 1550d6ad..ee0b061d 100644
--- a/src/lib/adapters/screenplay-adapter.ts
+++ b/src/lib/adapters/screenplay-adapter.ts
@@ -1,7 +1,5 @@
-import FileSaver from "file-saver";
-import { isTauri } from "@tauri-apps/api/core";
-import { isIOS } from "../utils/platform";
 import { replaceScreenplay } from "../screenplay/editor";
+import { saveBlob } from "../utils/save-file";
 import { Editor } from "@tiptap/react";
 import { LayoutData, ProjectData, ProjectMetadata, ProjectState } from "../project/project-state";
 import { ProjectRepository } from "../project/project-repository";
@@ -63,78 +61,16 @@ export abstract class ProjectAdapter<TExportOptions extends BaseExportOptions =
         try {
             const blob = await this.convertTo(project, options);
 
-            if (isTauri() && isIOS()) {
-                await this.exportIOS(blob, options, target);
-            } else if (isTauri()) {
-                await this.exportDesktop(blob, options, target);
-            } else {
-                FileSaver.saveAs(blob, `${options.title}.${target.extension}`);
-            }
+            await saveBlob(blob, `${options.title}.${target.extension}`, {
+                label: this.label,
+                extension: target.extension,
+            });
         } catch (error) {
             console.error(`Failed to export to ${this.label}`, error);
             throw new Error("Export failed");
         }
     }
 
-    /**
-     * iOS has no "choose a path, then write to it" dialog. `UIDocumentPicker` in
-     * `.exportToService` mode only moves an *existing* file to a location the
-     * user picks, so tauri-plugin-dialog's `save()` fakes the cross-platform
-     * shape: it creates a placeholder at `<Documents>/<fileName>`, hands that to
-     * the picker, and returns where the user put it.
-     *
-     * The copy therefore happens when the user confirms — before we ever get the
-     * path back. Writing after `save()` resolves, the way desktop does, exports
-     * the empty placeholder and leaves a 0-byte file: the destination URL is
-     * outside our sandbox, so the later write lands nowhere the user can see.
-     *
-     * So stage the real bytes at exactly the path the plugin will use and let
-     * the picker export those. It only creates the placeholder
-     * (`if !fileManager.fileExists`) when nothing is there, so a pre-written file
-     * survives — this hooks that, rather than fighting it.
-     *
-     * The staged copy is left behind on purpose. The app declares neither
-     * `UIFileSharingEnabled` nor `LSSupportsOpeningDocumentsInPlace`, so
-     * `<Documents>` is invisible to the user, one file per title at most; and
-     * deleting it would race the picker's copy for cloud destinations.
-     */
-    private async exportIOS(blob: Blob, options: TExportOptions, target: ExportTarget): Promise<void> {
-        const { save } = await import("@tauri-apps/plugin-dialog");
-        const { writeFile, BaseDirectory } = await import("@tauri-apps/plugin-fs");
-
-        // The plugin derives its staging path with `PathBuf::file_name()`, which
-        // would drop everything before a separator in the title and stage under a
-        // name we never wrote. Keep the two in lockstep.
-        const fileName = `${options.title.replace(/[\\/:*?"<>|]/g, "-")}.${target.extension}`;
-
-        const buffer = new Uint8Array(await blob.arrayBuffer());
-        await writeFile(fileName, buffer, { baseDir: BaseDirectory.Document });
-
-        // Resolves to the chosen destination, or null if cancelled. Either way the
-        // export is already done — there is nothing left for us to write.
-        await save({
-            defaultPath: fileName,
-            filters: [{ name: this.label, extensions: [target.extension] }],
-        });
-    }
-
-    private async exportDesktop(blob: Blob, options: TExportOptions, target: ExportTarget): Promise<void> {
-        const { save } = await import("@tauri-apps/plugin-dialog");
-        const { writeFile } = await import("@tauri-apps/plugin-fs");
-        const { revealItemInDir } = await import("@tauri-apps/plugin-opener");
-
-        const filePath = await save({
-            defaultPath: `${options.title}.${target.extension}`,
-            filters: [{ name: this.label, extensions: [target.extension] }],
-        });
-
-        if (!filePath) return;
-
-        const buffer = new Uint8Array(await blob.arrayBuffer());
-        await writeFile(filePath, buffer);
-        await revealItemInDir(filePath);
-    }
-
     public import(
         rawContent: ArrayBuffer,
         editor?: Editor | null,
diff --git a/src/lib/mail/mail.ts b/src/lib/mail/mail.ts
index 17c74007..8c4e2502 100644
--- a/src/lib/mail/mail.ts
+++ b/src/lib/mail/mail.ts
@@ -21,10 +21,16 @@ export const sendProjectInviteEmail = async (email: string, projectTitle: string
     sendFormattedEmail(email, "Project Invitation", "Project Invitation", content, "Join project", link);
 };
 
-export const sendDataExportEmail = async (email: string, link: string) => {
-    const content = `Your personal data export is ready. Click the button below to download the archive containing your account information and project memberships. The link expires in 7 days.`;
+/**
+ * Notification only — deliberately carries no download link. The archive is
+ * fetched from the account settings by the signed-in user, so this mail is
+ * worth nothing to anyone who intercepts it, and it lets the account holder
+ * spot an export they never asked for.
+ */
+export const sendDataExportEmail = async (email: string) => {
+    const content = `Your personal data export is ready. Open Scriptio and go to Settings → Account → Profile to download the archive containing your account information and project memberships. You have 7 days to download it. If you did not request this export, someone may have access to your account — change how you sign in and contact us.`;
 
-    sendFormattedEmail(email, "Your data export", "Your data export is ready", content, "Download my data", link);
+    sendFormattedEmail(email, "Your data export", "Your data export is ready", content, "Open Scriptio", BASE_URL);
 };
 
 export const sendMagicLinkEmail = async (email: string, token: string) => {
diff --git a/src/lib/persistence/storage-provider/indexeddb-storage-provider.ts b/src/lib/persistence/storage-provider/indexeddb-storage-provider.ts
index 28443517..dcafa0fb 100644
--- a/src/lib/persistence/storage-provider/indexeddb-storage-provider.ts
+++ b/src/lib/persistence/storage-provider/indexeddb-storage-provider.ts
@@ -7,7 +7,7 @@
  */
 
 import type { InstalledDictionary, UserSettings } from "@src/lib/utils/types";
-import { CachedProject, ProjectEntryInput, StorageProvider, StoredAsset } from "./storage-provider";
+import { CachedProject, ProjectEntryInput, StorageProvider, StoredAsset, StoredPoster } from "./storage-provider";
 import {
     ASSETS_BY_PROJECT_INDEX,
     CURRENT_STORE_VERSION,
@@ -22,6 +22,7 @@ const SETTINGS_STORE = STORE_NAMES.SETTINGS;
 const DICTIONARIES_STORE = STORE_NAMES.DICTIONARIES;
 const MIGRATION_BACKUPS_STORE = STORE_NAMES.MIGRATION_BACKUPS;
 const ASSETS_STORE = STORE_NAMES.ASSETS;
+const POSTERS_STORE = STORE_NAMES.POSTERS;
 const SETTINGS_KEY = "global";
 
 /** Primary key for an asset record: `${projectId}/${hash}`. */
@@ -457,4 +458,41 @@ export class IndexedDBStorageProvider implements StorageProvider {
             tx.onerror = () => reject(tx.error);
         });
     }
+
+    // ── Posters ───────────────────────────────────────────────────────────────
+
+    async putPoster(poster: StoredPoster): Promise<void> {
+        const db = await getBrowserDb();
+        return new Promise((resolve, reject) => {
+            const tx = db.transaction(POSTERS_STORE, "readwrite");
+            tx.objectStore(POSTERS_STORE).put(poster);
+            tx.oncomplete = () => resolve();
+            tx.onerror = () => reject(tx.error);
+        });
+    }
+
+    async getPoster(projectId: string): Promise<StoredPoster | null> {
+        const db = await getBrowserDb();
+        return new Promise((resolve, reject) => {
+            const req = db.transaction(POSTERS_STORE, "readonly").objectStore(POSTERS_STORE).get(projectId);
+            req.onsuccess = () => resolve((req.result as StoredPoster | undefined) ?? null);
+            req.onerror = () => reject(req.error);
+        });
+    }
+
+    async deletePoster(projectId: string): Promise<void> {
+        const db = await getBrowserDb();
+        return new Promise((resolve, reject) => {
+            const tx = db.transaction(POSTERS_STORE, "readwrite");
+            tx.objectStore(POSTERS_STORE).delete(projectId);
+            tx.oncomplete = () => resolve();
+            tx.onerror = () => reject(tx.error);
+        });
+    }
+
+    async copyPoster(fromProjectId: string, toProjectId: string): Promise<void> {
+        const source = await this.getPoster(fromProjectId);
+        if (!source) return;
+        await this.putPoster({ ...source, projectId: toProjectId });
+    }
 }
diff --git a/src/lib/persistence/storage-provider/local-persistence.ts b/src/lib/persistence/storage-provider/local-persistence.ts
index dd33d2b1..8054be99 100644
--- a/src/lib/persistence/storage-provider/local-persistence.ts
+++ b/src/lib/persistence/storage-provider/local-persistence.ts
@@ -5,6 +5,7 @@
 
 import type { UserSettings } from "@src/lib/utils/types";
 import { getStorageProvider, type CachedProject, type ProjectEntryInput } from "./storage-provider";
+import { pushPendingPoster } from "@src/lib/posters/poster-store";
 import { yjsDbKey } from "../y-local-provider";
 
 export type { CachedProject };
@@ -60,9 +61,11 @@ export async function touchCachedProject(id: string): Promise<void> {
 export async function deleteCachedProject(id: string): Promise<void> {
     const provider = await getStorageProvider();
     await provider.delete(id);
-    // Reclaim the project's binary assets (board images). This is the chokepoint
-    // every deletion flow funnels through (DangerZone + discardCloudProjectData).
+    // Reclaim the project's binary assets (board images) and its poster. This is
+    // the chokepoint every deletion flow funnels through (DangerZone +
+    // discardCloudProjectData).
     await provider.deleteProjectAssets(id);
+    await provider.deletePoster(id);
 }
 
 export async function isCachedProject(projectId: string): Promise<boolean> {
@@ -138,7 +141,14 @@ export async function migrateToCachedProject(
 
     // 3b. Copy the project's binary assets to the new id (they are keyed by
     // projectId, so the copied board cards would otherwise reference nothing).
-    await (await getStorageProvider()).copyProjectAssets(oldProjectId, newProject.id);
+    const provider = await getStorageProvider();
+    await provider.copyProjectAssets(oldProjectId, newProject.id);
+
+    // 3c. Carry the poster over too, flagged as pending: the copy lives only on
+    // this device now, so a later promotion to the cloud has to upload it.
+    await provider.copyPoster(oldProjectId, newProject.id);
+    const copiedPoster = await provider.getPoster(newProject.id);
+    if (copiedPoster) await provider.putPoster({ ...copiedPoster, pendingUpload: true });
 
     // 4. Clean up old project data
     await discardCloudProjectData(oldProjectId);
@@ -199,6 +209,10 @@ export async function promoteLocalProjectToCloud(projectId: string): Promise<voi
             console.warn("[assets] failed to upload asset on cloud promotion:", e);
         }
     }
+
+    // The poster the project already had locally now belongs in the cloud too.
+    // Best-effort: it stays flagged pending and is retried on the next open.
+    await pushPendingPoster(projectId);
 }
 
 /**
diff --git a/src/lib/persistence/storage-provider/migrations/store-migrations.ts b/src/lib/persistence/storage-provider/migrations/store-migrations.ts
index 3fbc4130..0aed1ea9 100644
--- a/src/lib/persistence/storage-provider/migrations/store-migrations.ts
+++ b/src/lib/persistence/storage-provider/migrations/store-migrations.ts
@@ -26,6 +26,7 @@ export const STORE_NAMES = {
     DICTIONARIES: "dictionaries",
     MIGRATION_BACKUPS: "migration_backups",
     ASSETS: "assets",
+    POSTERS: "posters",
 } as const;
 
 /** Index on the `assets` store used to list/delete every asset of a project. */
@@ -75,9 +76,27 @@ const addMigrationBackupsStore: StoreMigration = {
     },
 };
 
+/**
+ * v2 → v3: add a `posters` store. A project's poster is kept locally (keyed by
+ * projectId, one per project) so local-only projects can have one at all and
+ * cloud projects still render theirs offline. Not content-addressed like
+ * `assets`: a poster is replaced in place, so the project id is the key.
+ */
+const addPostersStore: StoreMigration = {
+    from: 2,
+    to: 3,
+    description: "Add posters store for local-first project posters",
+    run: (db) => {
+        if (!db.objectStoreNames.contains(STORE_NAMES.POSTERS)) {
+            db.createObjectStore(STORE_NAMES.POSTERS, { keyPath: "projectId" });
+        }
+    },
+};
+
 export const STORE_MIGRATIONS: StoreMigration[] = [
     baselineV1,
     addMigrationBackupsStore,
+    addPostersStore,
 ];
 
 export const CURRENT_STORE_VERSION =
diff --git a/src/lib/persistence/storage-provider/storage-provider.ts b/src/lib/persistence/storage-provider/storage-provider.ts
index e5fe5023..4b8246f4 100644
--- a/src/lib/persistence/storage-provider/storage-provider.ts
+++ b/src/lib/persistence/storage-provider/storage-provider.ts
@@ -48,6 +48,28 @@ export interface StoredAsset {
     createdAt: number;
 }
 
+/**
+ * A project's poster image, stored locally so it survives offline and exists at
+ * all for local-only projects. One per project (replaced in place, not
+ * content-addressed), which is why the project id is the key.
+ */
+export interface StoredPoster {
+    /** Primary key: the owning project id. */
+    projectId: string;
+    mime: string;
+    /** Raw image bytes. ArrayBuffer (not Blob) for WebKit IndexedDB
+     *  compatibility, matching the assets/dictionaries stores. */
+    data: ArrayBuffer;
+    /** SHA-256 hex of `data`, used to skip no-op writes when revalidating
+     *  against the cloud copy. */
+    hash: string;
+    /** True while these bytes exist only on this device — either the project is
+     *  local-only, or it is cloud-synced but the upload hasn't landed yet
+     *  (offline edit). Cleared once the cloud holds the same bytes. */
+    pendingUpload: boolean;
+    updatedAt: number;
+}
+
 export interface StorageProvider {
     // Project CRUD
     createProject(id: string, title: string, description?: string, synced?: boolean, author?: string): Promise<void>;
@@ -89,6 +111,13 @@ export interface StorageProvider {
     deleteProjectAssets(projectId: string): Promise<void>;
     /** Duplicate every asset of `fromProjectId` under `toProjectId` (id-changing copy). */
     copyProjectAssets(fromProjectId: string, toProjectId: string): Promise<void>;
+
+    // Posters: one image per project, stored locally for offline / local-only use.
+    putPoster(poster: StoredPoster): Promise<void>;
+    getPoster(projectId: string): Promise<StoredPoster | null>;
+    deletePoster(projectId: string): Promise<void>;
+    /** Duplicate the poster of `fromProjectId` under `toProjectId` (id-changing copy). */
+    copyPoster(fromProjectId: string, toProjectId: string): Promise<void>;
 }
 
 // Singleton cache
diff --git a/src/lib/posters/cloud-poster-sync.ts b/src/lib/posters/cloud-poster-sync.ts
new file mode 100644
index 00000000..06888145
--- /dev/null
+++ b/src/lib/posters/cloud-poster-sync.ts
@@ -0,0 +1,50 @@
+/**
+ * Cloud (R2) side of the poster store.
+ *
+ * Mirrors the local IndexedDB poster to R2 at `poster-{projectId}`, proxied
+ * through the same-origin API so the bucket stays private (no R2 CORS setup),
+ * exactly like board assets. Used only for cloud-synced projects; a local-only
+ * project never touches the network.
+ */
+
+import { apiFetch } from "@src/lib/api-client";
+
+/** Push the poster bytes to R2, flipping the project's `hasPoster` flag. */
+export async function uploadPosterToCloud(projectId: string, data: ArrayBuffer, mime: string): Promise<void> {
+    const res = await apiFetch(`/api/projects/${projectId}/poster`, {
+        method: "PUT",
+        headers: { "Content-Type": mime },
+        body: data,
+    });
+
+    if (!res.ok) throw new Error(`Poster upload failed (${res.status})`);
+}
+
+/**
+ * The outcome of asking the cloud for a project's poster. "none" and
+ * "unavailable" are deliberately distinct: the first is an answer (this project
+ * has no cloud poster), the second is the absence of one (offline), and only
+ * the latter is worth retrying.
+ */
+export type CloudPosterResult =
+    | { status: "ok"; data: ArrayBuffer; mime: string }
+    | { status: "none" }
+    | { status: "unavailable" };
+
+/** Fetch the project's poster bytes from the API, ready to cache locally. */
+export async function fetchPosterFromCloud(projectId: string): Promise<CloudPosterResult> {
+    let res: Response;
+    try {
+        res = await apiFetch(`/api/projects/${projectId}/poster`, { method: "GET" });
+    } catch {
+        return { status: "unavailable" }; // offline
+    }
+
+    if (res.status === 404) return { status: "none" };
+    if (!res.ok) return { status: "unavailable" };
+
+    const data = await res.arrayBuffer();
+    if (data.byteLength === 0) return { status: "none" };
+
+    return { status: "ok", data, mime: res.headers.get("Content-Type") || "image/jpeg" };
+}
diff --git a/src/lib/posters/poster-store.ts b/src/lib/posters/poster-store.ts
new file mode 100644
index 00000000..901cd941
--- /dev/null
+++ b/src/lib/posters/poster-store.ts
@@ -0,0 +1,214 @@
+/**
+ * Poster store façade.
+ *
+ * The single chokepoint for reading/writing a project's poster image. Posters
+ * are local-first, exactly like board assets: the bytes always land in
+ * IndexedDB (so a local-only project can have one, and a cloud project still
+ * renders its poster offline), and for cloud-synced projects this seam also
+ * mirrors them to R2 — upload on save, fetch on a local cache miss — via
+ * {@link ./cloud-poster-sync}.
+ *
+ * One poster per project, replaced in place, so it is keyed by project id
+ * rather than content-addressed.
+ */
+
+import { getStorageProvider, type StoredPoster } from "../persistence/storage-provider/storage-provider";
+import { sha256Hex } from "../assets/asset-hash";
+import { cropImageToJpegBlob } from "../utils/misc";
+
+/** Poster canvas size — a 2:3 movie-poster ratio, matching the settings hint. */
+export const POSTER_WIDTH = 600;
+export const POSTER_HEIGHT = 900;
+
+/**
+ * Whether a project syncs to the cloud, so network calls never fire for a
+ * local-only one. The local cache is authoritative whenever it knows the
+ * project; `hint` only covers the window before a freshly listed cloud project
+ * has been written to the cache (its membership payload already says so).
+ */
+async function isCloudSynced(projectId: string, hint?: boolean): Promise<boolean> {
+    const cached = await (await getStorageProvider()).get(projectId);
+    if (cached) return !cached.isLocalOnly;
+    return hint ?? false;
+}
+
+// ── Change notification ──────────────────────────────────────────────────────
+// A poster is mutable at a fixed key, so consumers can't cache it by identity
+// the way they can a content-addressed asset. Bumping a per-project version
+// tells every mounted `usePosterUrl` to re-read the bytes.
+
+const versions = new Map<string, number>();
+const listeners = new Set<() => void>();
+
+export function getPosterVersion(projectId: string | null | undefined): number {
+    return projectId ? (versions.get(projectId) ?? 0) : 0;
+}
+
+export function subscribeToPosters(listener: () => void): () => void {
+    listeners.add(listener);
+    return () => listeners.delete(listener);
+}
+
+function notifyPosterChanged(projectId: string): void {
+    versions.set(projectId, getPosterVersion(projectId) + 1);
+    for (const listener of listeners) listener();
+}
+
+// ── Read ─────────────────────────────────────────────────────────────────────
+
+/** Projects whose poster has already been settled against the cloud this
+ *  session — checked once per session, not on every render. Covers both answers:
+ *  "here it is" and "there is none", so a posterless project stops costing a
+ *  request every time the project list is rendered. */
+const checkedWithCloud = new Set<string>();
+
+/**
+ * The project's poster as a Blob, or null when it has none.
+ *
+ * Local bytes win so the poster paints instantly and works offline; a cloud
+ * project with nothing cached (a fresh device) pulls from R2 and caches the
+ * result. When a local copy is served, a one-shot background revalidation picks
+ * up a poster changed on another device and notifies subscribers.
+ */
+export async function loadPosterBlob(projectId: string, cloudSyncedHint?: boolean): Promise<Blob | null> {
+    const provider = await getStorageProvider();
+    const local = await provider.getPoster(projectId);
+
+    if (local) {
+        void revalidatePoster(projectId, cloudSyncedHint).catch(() => {});
+        return new Blob([local.data], { type: local.mime });
+    }
+
+    if (checkedWithCloud.has(projectId)) return null;
+
+    const fetched = await fetchAndCachePoster(projectId, cloudSyncedHint);
+    return fetched ? new Blob([fetched.data], { type: fetched.mime }) : null;
+}
+
+/** Pull the cloud copy into the local cache. Null for local-only projects, when
+ *  the project has no cloud poster, or when the request fails (offline). */
+async function fetchAndCachePoster(projectId: string, cloudSyncedHint?: boolean): Promise<StoredPoster | null> {
+    if (!(await isCloudSynced(projectId, cloudSyncedHint))) return null;
+
+    const { fetchPosterFromCloud } = await import("./cloud-poster-sync");
+    const remote = await fetchPosterFromCloud(projectId);
+    // "none" is a real answer and worth remembering; only an offline attempt is
+    // left open for the next try.
+    if (remote.status === "none") checkedWithCloud.add(projectId);
+    if (remote.status !== "ok") return null;
+
+    const stored: StoredPoster = {
+        projectId,
+        mime: remote.mime,
+        data: remote.data,
+        hash: await sha256Hex(remote.data),
+        pendingUpload: false,
+        updatedAt: Date.now(),
+    };
+
+    const provider = await getStorageProvider();
+    await provider.putPoster(stored);
+    checkedWithCloud.add(projectId);
+    return stored;
+}
+
+/**
+ * Refresh the cached poster from the cloud once per session, so a poster set on
+ * another device shows up here. Skipped while a local upload is still pending —
+ * those bytes are the newer ones and must not be overwritten by the stale copy
+ * the cloud still holds.
+ */
+export async function revalidatePoster(projectId: string, cloudSyncedHint?: boolean): Promise<void> {
+    if (checkedWithCloud.has(projectId)) return;
+    if (!(await isCloudSynced(projectId, cloudSyncedHint))) return;
+
+    const provider = await getStorageProvider();
+    const local = await provider.getPoster(projectId);
+    if (local?.pendingUpload) return;
+
+    checkedWithCloud.add(projectId);
+
+    const { fetchPosterFromCloud } = await import("./cloud-poster-sync");
+    const remote = await fetchPosterFromCloud(projectId);
+    if (remote.status === "unavailable") {
+        // Offline: keep the cached poster and let the next open try again.
+        checkedWithCloud.delete(projectId);
+        return;
+    }
+    // "none" — the cloud has no poster for this project (e.g. promoted before it
+    // had one). Keep whatever is cached; a stale poster beats a blank one.
+    if (remote.status === "none") return;
+
+    const hash = await sha256Hex(remote.data);
+    if (local && local.hash === hash) return;
+
+    await provider.putPoster({
+        projectId,
+        mime: remote.mime,
+        data: remote.data,
+        hash,
+        pendingUpload: false,
+        updatedAt: Date.now(),
+    });
+    notifyPosterChanged(projectId);
+}
+
+// ── Write ────────────────────────────────────────────────────────────────────
+
+/**
+ * Set a project's poster from a user-picked image file.
+ *
+ * The image is re-encoded to a {@link POSTER_WIDTH}x{@link POSTER_HEIGHT} JPEG
+ * and stored locally first, so the change is instant and survives being offline
+ * or local-only. The cloud push is best-effort: if it fails the record stays
+ * flagged `pendingUpload` and {@link pushPendingPoster} retries on next open.
+ */
+export async function savePosterFromFile(projectId: string, file: File): Promise<void> {
+    const blob = await cropImageToJpegBlob(file, POSTER_WIDTH, POSTER_HEIGHT);
+    const data = await blob.arrayBuffer();
+
+    const provider = await getStorageProvider();
+    await provider.putPoster({
+        projectId,
+        mime: blob.type || "image/jpeg",
+        data,
+        hash: await sha256Hex(data),
+        pendingUpload: true,
+        updatedAt: Date.now(),
+    });
+    // These bytes are now the newest ones — a pending revalidation must not
+    // clobber them with the copy the cloud still holds.
+    checkedWithCloud.add(projectId);
+    notifyPosterChanged(projectId);
+
+    await pushPendingPoster(projectId);
+}
+
+/**
+ * Upload a locally-stored poster the cloud doesn't have yet — a poster set
+ * while offline, or one carried over when a local-only project was promoted.
+ * Best-effort and a no-op for local-only projects, so it is safe to fire on
+ * every project open.
+ */
+export async function pushPendingPoster(projectId: string): Promise<void> {
+    if (!(await isCloudSynced(projectId))) return;
+
+    const provider = await getStorageProvider();
+    const poster = await provider.getPoster(projectId);
+    if (!poster || !poster.pendingUpload) return;
+
+    try {
+        const { uploadPosterToCloud } = await import("./cloud-poster-sync");
+        await uploadPosterToCloud(projectId, poster.data, poster.mime);
+    } catch (e) {
+        console.warn("[posters] pending upload failed:", e);
+        return;
+    }
+
+    // Re-read before clearing the flag: the user may have picked another image
+    // while the upload was in flight, and that one still needs pushing.
+    const current = await provider.getPoster(projectId);
+    if (current && current.hash === poster.hash) {
+        await provider.putPoster({ ...current, pendingUpload: false });
+    }
+}
diff --git a/src/lib/posters/use-poster-url.ts b/src/lib/posters/use-poster-url.ts
new file mode 100644
index 00000000..57a08df1
--- /dev/null
+++ b/src/lib/posters/use-poster-url.ts
@@ -0,0 +1,59 @@
+"use client";
+
+/**
+ * Resolve a project's poster to an object URL for rendering.
+ *
+ * Reads the local-first {@link ./poster-store} rather than a signed cloud URL,
+ * so a local-only project shows its poster and a cloud project keeps showing
+ * one offline. Each consumer owns its URL (a poster appears once per screen, so
+ * there is nothing to share) and revokes it on unmount; a poster replaced by the
+ * user — or pulled in by a background revalidation — bumps the project's poster
+ * version, which re-runs the load.
+ */
+
+import { useCallback, useEffect, useState, useSyncExternalStore } from "react";
+import { getPosterVersion, loadPosterBlob, subscribeToPosters } from "./poster-store";
+
+/**
+ * Object URL for the project's poster, or null while loading / when it has none.
+ *
+ * `cloudSynced` is an optional hint for callers that already know the project is
+ * a cloud one (its membership payload says so) — it lets the poster load on a
+ * fresh device in the same pass that writes the project to the local cache.
+ */
+export function usePosterUrl(projectId: string | null | undefined, cloudSynced?: boolean): string | null {
+    const version = useSyncExternalStore(
+        subscribeToPosters,
+        useCallback(() => getPosterVersion(projectId), [projectId]),
+        () => 0,
+    );
+
+    // Tag the loaded URL with the project + poster version it belongs to, so a
+    // stale poster is never shown while a new one loads (and so the no-poster
+    // case resolves to null without a setState from the effect body).
+    const key = projectId ? `${projectId}:${version}:${cloudSynced}` : null;
+    const [loaded, setLoaded] = useState<{ key: string; url: string } | null>(null);
+
+    useEffect(() => {
+        if (!projectId) return;
+
+        const k = `${projectId}:${version}:${cloudSynced}`;
+        let active = true;
+        let created: string | null = null;
+
+        void loadPosterBlob(projectId, cloudSynced)
+            .then((blob) => {
+                if (!active || !blob) return;
+                created = URL.createObjectURL(blob);
+                setLoaded({ key: k, url: created });
+            })
+            .catch((e) => console.warn("[posters] failed to load poster:", e));
+
+        return () => {
+            active = false;
+            if (created) URL.revokeObjectURL(created);
+        };
+    }, [projectId, version, cloudSynced]);
+
+    return key && loaded?.key === key ? loaded.url : null;
+}
diff --git a/src/lib/s3.ts b/src/lib/s3.ts
index 766811db..2d03263b 100644
--- a/src/lib/s3.ts
+++ b/src/lib/s3.ts
@@ -20,9 +20,6 @@ const client = new S3Client({
     },
 });
 
-/** SigV4 caps presigned-URL validity at 7 days. */
-export const MAX_SIGNED_URL_TTL_SECONDS = 7 * 24 * 3600;
-
 export const getSignedDownloadUrl = async (name: string, expiresIn = 900): Promise<string | null> => {
     const params = {
         Bucket: env.S3_BUCKET,
@@ -38,23 +35,6 @@ export const getSignedDownloadUrl = async (name: string, expiresIn = 900): Promi
     }
 };
 
-export const upload = async (name: string, data: string): Promise<boolean> => {
-    const params = {
-        Bucket: env.S3_BUCKET,
-        Key: name,
-        Body: Buffer.from(data.substring("data:image/jpeg;base64,".length), "base64"),
-        ContentType: "image/jpeg",
-    };
-
-    try {
-        await client.send(new PutObjectCommand(params));
-        return true;
-    } catch (e) {
-        console.error("An error occurred while uploading object to S3: ", e);
-        return false;
-    }
-};
-
 export const destroy = async (name: string): Promise<boolean> => {
     const params = {
         Bucket: env.S3_BUCKET,
diff --git a/src/lib/utils/api-bodies.ts b/src/lib/utils/api-bodies.ts
index 8e46d2a1..8ddc60e8 100644
--- a/src/lib/utils/api-bodies.ts
+++ b/src/lib/utils/api-bodies.ts
@@ -16,7 +16,6 @@ export const CreateProjectBodySchema = z.object({
     title: z.string(),
     description: z.string().optional(),
     author: z.string().optional(),
-    poster: z.string().optional(),
 });
 export type CreateProjectBody = z.infer<typeof CreateProjectBodySchema>;
 
@@ -24,7 +23,6 @@ export const UpdateProjectBodySchema = z.object({
     title: z.string().optional(),
     description: z.string().optional(),
     author: z.string().optional(),
-    poster: z.string().optional(),
     characters: z.any().optional(),
 });
 export type UpdateProjectBody = z.infer<typeof UpdateProjectBodySchema>;
diff --git a/src/lib/utils/api-utils.ts b/src/lib/utils/api-utils.ts
index 51f9ff51..6d994209 100644
--- a/src/lib/utils/api-utils.ts
+++ b/src/lib/utils/api-utils.ts
@@ -58,6 +58,11 @@ export class ConflictError extends AppError {
         super(409, message);
     }
 }
+export class TooManyRequestsError extends AppError {
+    constructor(message = "Too many requests") {
+        super(429, message);
+    }
+}
 export class InternalServerError extends AppError {
     constructor(message = "Internal server error") {
         super(500, message);
diff --git a/src/lib/utils/hooks.ts b/src/lib/utils/hooks.ts
index 47b5ee77..ee103c73 100644
--- a/src/lib/utils/hooks.ts
+++ b/src/lib/utils/hooks.ts
@@ -2,7 +2,7 @@
 
 import useSWR, { useSWRConfig } from "swr";
 import { useCallback, useContext, useEffect, useMemo, useRef, useState } from "react";
-import { CookieUser, UserSettings } from "./types";
+import { CookieUser, DataExportState, UserSettings } from "./types";
 import { editUserSettings } from "./requests";
 import { readLocalSettings, writeLocalSettings, DEFAULT_LOCAL_SETTINGS } from "./local-settings";
 import { ProjectContext } from "@src/context/ProjectContext";
@@ -325,6 +325,20 @@ const useUser = () => {
     return { user, isLoading, mutate };
 };
 
+/**
+ * State of the user's GDPR data export, as the account settings render it.
+ *
+ * The zip is built in the background straight after the request, so poll while
+ * it is being prepared — the panel then flips to "ready" on its own instead of
+ * making the user reload to find out.
+ */
+const useDataExport = () => {
+    const { data, isLoading, mutate } = useSWR<DataExportState>("/api/users/export", {
+        refreshInterval: (latest) => (latest?.status === "PENDING" ? 5000 : 0),
+    });
+    return { dataExport: data, isLoading, mutate };
+};
+
 const useCookieUser = (redirect: boolean = false) => {
     const { data: user, isLoading, error } = useSWR<CookieUser>("/api/users/cookie");
     const [localUser, setLocalUser] = useState<CookieUser | undefined>(undefined);
@@ -454,7 +468,6 @@ const useCachedProjects = () => {
                     description: p.description,
                     author: p.author,
                     hasPoster: false,
-                    poster: null,
                     createdAt: p.createdAt,
                     updatedAt: p.updatedAt,
                 },
@@ -787,6 +800,7 @@ const useFormatTimestamp = () => {
 export {
     useDraggable,
     useUser,
+    useDataExport,
     useCookieUser,
     useSettings,
     useIsPro,
diff --git a/src/lib/utils/misc.ts b/src/lib/utils/misc.ts
index 7e85e277..87cafe83 100644
--- a/src/lib/utils/misc.ts
+++ b/src/lib/utils/misc.ts
@@ -34,7 +34,12 @@ export function hasExpired(date: Date | string | number, duration: number, unit:
     return now - dateMs > timeLimitMs;
 }
 
-export const cropImageBase64 = async (file: File, width: number, height: number) => {
+/**
+ * Re-encode a user-picked image to a `width`x`height` JPEG, scaled to fit on a
+ * white background. Returns the bytes as a Blob so callers can store them in
+ * IndexedDB and upload them as-is (no base64 round trip).
+ */
+export const cropImageToJpegBlob = async (file: File, width: number, height: number): Promise<Blob> => {
     const img = await createImageBitmap(file);
     const canvas = document.createElement("canvas");
     canvas.width = width;
@@ -42,16 +47,22 @@ export const cropImageBase64 = async (file: File, width: number, height: number)
 
     const ctx = canvas.getContext("2d");
     if (!ctx) {
-        return "data:,";
+        throw new Error("Canvas 2D context unavailable");
     }
 
     ctx.fillStyle = "white";
     ctx.fillRect(0, 0, width, height);
 
     const ratio = Math.min(width / img.width, height / img.height);
-    ctx?.drawImage(img, 0, 0, img.width * ratio, img.height * ratio);
-
-    return ctx.canvas.toDataURL("image/jpeg") || "data:,";
+    ctx.drawImage(img, 0, 0, img.width * ratio, img.height * ratio);
+    img.close();
+
+    return new Promise<Blob>((resolve, reject) => {
+        canvas.toBlob(
+            (blob) => (blob ? resolve(blob) : reject(new Error("Failed to encode image"))),
+            "image/jpeg",
+        );
+    });
 };
 
 export const _MS_PER_DAY = 1000 * 60 * 60 * 24;
diff --git a/src/lib/utils/requests.ts b/src/lib/utils/requests.ts
index e8c4dae6..be88e330 100644
--- a/src/lib/utils/requests.ts
+++ b/src/lib/utils/requests.ts
@@ -129,6 +129,10 @@ export const requestDataExport = () => {
     return request(`/api/users/export`, "POST");
 };
 
+export const downloadDataExport = (id: string) => {
+    return request(`/api/users/export/download?id=${encodeURIComponent(id)}`, "GET");
+};
+
 /* Auth */
 
 export const requestMagicLink = (body: RequestMagicLinkBody) => {
diff --git a/src/lib/utils/save-file.ts b/src/lib/utils/save-file.ts
new file mode 100644
index 00000000..5f3d45e8
--- /dev/null
+++ b/src/lib/utils/save-file.ts
@@ -0,0 +1,91 @@
+/**
+ * Hand a blob to the user as a file.
+ *
+ * The three environments the app ships in each save differently, and the iOS
+ * one is genuinely surprising, so every caller goes through here rather than
+ * rediscovering it: the browser downloads, Tauri desktop opens a save dialog and
+ * reveals the result, and Tauri iOS has to stage the bytes before it can ask.
+ */
+
+import FileSaver from "file-saver";
+import { isTauri } from "@tauri-apps/api/core";
+
+import { isIOS } from "../utils/platform";
+
+/** How the native save dialog labels and filters the file being written. */
+export type SaveFileFilter = {
+    /** Human-readable format name shown in the dialog, e.g. "Final Draft". */
+    label: string;
+    /** Suffix, lower-case and without the dot, e.g. "fdx". */
+    extension: string;
+};
+
+/**
+ * iOS has no "choose a path, then write to it" dialog. `UIDocumentPicker` in
+ * `.exportToService` mode only moves an *existing* file to a location the
+ * user picks, so tauri-plugin-dialog's `save()` fakes the cross-platform
+ * shape: it creates a placeholder at `<Documents>/<fileName>`, hands that to
+ * the picker, and returns where the user put it.
+ *
+ * The copy therefore happens when the user confirms — before we ever get the
+ * path back. Writing after `save()` resolves, the way desktop does, exports
+ * the empty placeholder and leaves a 0-byte file: the destination URL is
+ * outside our sandbox, so the later write lands nowhere the user can see.
+ *
+ * So stage the real bytes at exactly the path the plugin will use and let
+ * the picker export those. It only creates the placeholder
+ * (`if !fileManager.fileExists`) when nothing is there, so a pre-written file
+ * survives — this hooks that, rather than fighting it.
+ *
+ * The staged copy is left behind on purpose. The app declares neither
+ * `UIFileSharingEnabled` nor `LSSupportsOpeningDocumentsInPlace`, so
+ * `<Documents>` is invisible to the user, one file per name at most; and
+ * deleting it would race the picker's copy for cloud destinations.
+ */
+async function saveIOS(blob: Blob, fileName: string, filter: SaveFileFilter): Promise<void> {
+    const { save } = await import("@tauri-apps/plugin-dialog");
+    const { writeFile, BaseDirectory } = await import("@tauri-apps/plugin-fs");
+
+    // The plugin derives its staging path with `PathBuf::file_name()`, which
+    // would drop everything before a separator in the name and stage under a
+    // name we never wrote. Keep the two in lockstep.
+    const staged = fileName.replace(/[\\/:*?"<>|]/g, "-");
+
+    const buffer = new Uint8Array(await blob.arrayBuffer());
+    await writeFile(staged, buffer, { baseDir: BaseDirectory.Document });
+
+    // Resolves to the chosen destination, or null if cancelled. Either way the
+    // save is already done — there is nothing left for us to write.
+    await save({
+        defaultPath: staged,
+        filters: [{ name: filter.label, extensions: [filter.extension] }],
+    });
+}
+
+async function saveDesktop(blob: Blob, fileName: string, filter: SaveFileFilter): Promise<void> {
+    const { save } = await import("@tauri-apps/plugin-dialog");
+    const { writeFile } = await import("@tauri-apps/plugin-fs");
+    const { revealItemInDir } = await import("@tauri-apps/plugin-opener");
+
+    const filePath = await save({
+        defaultPath: fileName,
+        filters: [{ name: filter.label, extensions: [filter.extension] }],
+    });
+
+    if (!filePath) return;
+
+    const buffer = new Uint8Array(await blob.arrayBuffer());
+    await writeFile(filePath, buffer);
+    await revealItemInDir(filePath);
+}
+
+/** Write `blob` to wherever this platform puts user-saved files. */
+export async function saveBlob(blob: Blob, fileName: string, filter: SaveFileFilter): Promise<void> {
+    if (isTauri() && isIOS()) {
+        await saveIOS(blob, fileName, filter);
+    } else if (isTauri()) {
+        await saveDesktop(blob, fileName, filter);
+    } else {
+        FileSaver.saveAs(blob, fileName);
+    }
+}
diff --git a/src/lib/utils/storage-limits.ts b/src/lib/utils/storage-limits.ts
index 1ac5e89d..e524b6fb 100644
--- a/src/lib/utils/storage-limits.ts
+++ b/src/lib/utils/storage-limits.ts
@@ -13,6 +13,13 @@ export const USER_STORAGE_QUOTA_BYTES = 5 * 1024 ** 3; // 5 GB
 /** Hard cap on a single uploaded asset, to bound individual requests. */
 export const MAX_ASSET_SIZE_BYTES = 50 * 1024 ** 2; // 50 MB
 
+/**
+ * Hard cap on a project poster upload. Posters are re-encoded client-side to a
+ * 600x900 JPEG, so this only bounds a malformed or hostile request. They are one
+ * small object per project and are not metered against the owner's quota.
+ */
+export const MAX_POSTER_SIZE_BYTES = 4 * 1024 ** 2; // 4 MB
+
 /**
  * Grace window before a cloud orphan is eligible for GC. Protects an asset a
  * collaborator just added whose referencing card hasn't yet synced to the client
diff --git a/src/lib/utils/types.ts b/src/lib/utils/types.ts
index 7422f98e..65ac5f4f 100644
--- a/src/lib/utils/types.ts
+++ b/src/lib/utils/types.ts
@@ -32,6 +32,22 @@ export type ProjectUpdate = {
     hasPoster?: boolean;
 };
 
+/**
+ * What the account settings show about the user's GDPR data export.
+ *
+ * `NONE` covers "never asked" and "the last attempt failed" alike — both leave
+ * the user with nothing to download and nothing to wait for.
+ */
+export type DataExportState = {
+    /** Id to download, present only while `status` is READY. */
+    id: string | null;
+    status: "NONE" | "PENDING" | "READY" | "EXPIRED";
+    /** When the READY archive stops being downloadable (ISO). */
+    expiresAt: string | null;
+    /** When a new export may be requested (ISO), or null if one may be now. */
+    canRequestAt: string | null;
+};
+
 /* User Settings */
 export interface UserSettings {
     keybinds: Record<string, string>;
diff --git a/src/server/repository/data-export-repository.ts b/src/server/repository/data-export-repository.ts
index 9bf95ac6..009e4650 100644
--- a/src/server/repository/data-export-repository.ts
+++ b/src/server/repository/data-export-repository.ts
@@ -6,13 +6,54 @@ export class DataExportRepository {
         return prisma.dataExport.create({ data: { userId } });
     }
 
-    /** The user's PENDING export created after `since`, if any (duplicate-request guard). */
-    findActivePending(userId: string, since: Date) {
+    findById(id: string) {
+        return prisma.dataExport.findUnique({ where: { id } });
+    }
+
+    /** The user's newest export created after `since` that still counts against
+     *  the cooldown. FAILED rows do not, so a failed run can be retried at once. */
+    findLatestSince(userId: string, since: Date) {
         return prisma.dataExport.findFirst({
-            where: { userId, status: DataExportStatus.PENDING, createdAt: { gte: since } },
+            where: {
+                userId,
+                status: { not: DataExportStatus.FAILED },
+                createdAt: { gte: since },
+            },
+            orderBy: { createdAt: "desc" },
         });
     }
 
+    /** The user's most recent export whatever its outcome (drives the UI state). */
+    findLatest(userId: string) {
+        return prisma.dataExport.findFirst({ where: { userId }, orderBy: { createdAt: "desc" } });
+    }
+
+    /** The newest export that can still be downloaded right now. */
+    findLatestDownloadable(userId: string, now: Date) {
+        return prisma.dataExport.findFirst({
+            where: {
+                userId,
+                status: DataExportStatus.COMPLETED,
+                key: { not: null },
+                expiresAt: { gt: now },
+            },
+            orderBy: { createdAt: "desc" },
+        });
+    }
+
+    /** Exports whose download link has lapsed — their zip is dead weight in R2. */
+    findExpired(userId: string, before: Date) {
+        return prisma.dataExport.findMany({
+            where: { userId, key: { not: null }, expiresAt: { lt: before } },
+            select: { id: true, key: true },
+        });
+    }
+
+    /** Forget the keys of exports whose zips have just been reclaimed. */
+    clearKeys(ids: string[]) {
+        return prisma.dataExport.updateMany({ where: { id: { in: ids } }, data: { key: null } });
+    }
+
     /** Mark PENDING rows older than `before` FAILED — leftovers of a crashed
      *  server that would otherwise block the user's next request forever. */
     failStalePending(userId: string, before: Date) {
diff --git a/src/server/repository/project-repository.ts b/src/server/repository/project-repository.ts
index cb6333b3..375d1dea 100644
--- a/src/server/repository/project-repository.ts
+++ b/src/server/repository/project-repository.ts
@@ -2,7 +2,6 @@ import { ProjectCreation, ProjectUpdate } from "../../lib/utils/types";
 import { Prisma, ProjectRole } from "../../generated/client/client";
 import prisma from "../db";
 
-import * as S3 from "@src/lib/s3";
 import { ConflictError } from "@src/lib/utils/api-utils";
 
 const projectMembershipSelect = {
@@ -44,37 +43,19 @@ type RawProject = Prisma.ProjectGetPayload<{
     select: typeof projectMembershipSelect.project.select;
 }>;
 
-type RawMembership = {
-    role: ProjectRole;
-    project: RawProject;
-};
+/**
+ * Project metadata as the client sees it. The poster image itself is *not* part
+ * of this payload: it is fetched (and cached offline) through
+ * `/projects/[projectId]/poster`, so `hasPoster` is only a hint that one exists.
+ */
+export type Project = RawProject;
 
-export type Project = Omit<RawProject, "poster"> & {
-    poster: string | null;
-};
 export interface ProjectMembershipPayload {
     role: ProjectRole;
     project: Project;
 }
 
 export class ProjectRepository {
-    private async hydrateMembership(membership: RawMembership): Promise<ProjectMembershipPayload> {
-        let posterUrl: string | null = null;
-
-        if (membership.project.hasPoster) {
-            const key = `poster-${membership.project.id}`;
-            posterUrl = await S3.getSignedDownloadUrl(key);
-        }
-
-        return {
-            ...membership,
-            project: {
-                ...membership.project,
-                poster: posterUrl,
-            },
-        };
-    }
-
     async fetchProjectMemberships(userId: string) {
         const user = await prisma.user.findUnique({
             where: { id: userId },
@@ -92,7 +73,7 @@ export class ProjectRepository {
 
         if (!user) return [];
 
-        return Promise.all(user.projects.map((m) => this.hydrateMembership(m)));
+        return user.projects;
     }
 
     async fetchProjectMembership(projectId: string, userId: string) {
@@ -106,9 +87,7 @@ export class ProjectRepository {
             select: projectMembershipSelect,
         });
 
-        if (!membership) return null;
-
-        return this.hydrateMembership(membership);
+        return membership;
     }
 
     fetchProjectTitle(projectId: string) {
diff --git a/src/server/service/gdpr-export-service.ts b/src/server/service/gdpr-export-service.ts
index 632c1321..bdbf3c57 100644
--- a/src/server/service/gdpr-export-service.ts
+++ b/src/server/service/gdpr-export-service.ts
@@ -2,8 +2,7 @@
  * GDPR data-access export.
  *
  * Bundles the personal data the database actually links to a user — account
- * info/settings and project memberships — into a zip on R2 and mails them a
- * signed download link, valid 7 days (the SigV4 maximum):
+ * info/settings and project memberships — into a zip on R2:
  *
  *   user.json        — account info + settings
  *   memberships.json — every project membership with its role
@@ -12,6 +11,13 @@
  * to users in the database — it belongs to the project — so there is nothing
  * per-project to bundle.
  *
+ * The archive is downloaded from the account settings, which read
+ * `getDataExportState` and hit `/users/export/download` with the session — the
+ * bytes never leave the server behind anything but a logged-in request. The
+ * email that follows is a notification only: it carries no link to the data, so
+ * it is worthless to anyone who intercepts it, and it lets the account holder
+ * notice an export they did not ask for.
+ *
  * fflate's async `zip` compresses in a worker thread and the job runs after
  * the response (`after`), so requests never block the event loop.
  */
@@ -22,15 +28,21 @@ import * as S3 from "@src/lib/s3";
 import * as ProjectService from "@src/server/service/project-service";
 import * as UserService from "@src/server/service/user-service";
 import { sendDataExportEmail } from "@src/lib/mail/mail";
-import { ConflictError } from "@src/lib/utils/api-utils";
+import { ConflictError, NotFoundError, TooManyRequestsError } from "@src/lib/utils/api-utils";
 import { logger } from "@src/lib/utils/logger";
+import { DataExportStatus } from "@src/generated/client/client";
+import type { DataExportState } from "@src/lib/utils/types";
 import { DataExportRepository } from "../repository/data-export-repository";
 
 const repository = new DataExportRepository();
 
-const EXPORT_LINK_TTL_SECONDS = S3.MAX_SIGNED_URL_TTL_SECONDS; // 7 days
+/** How long a completed export stays downloadable. */
+const EXPORT_LINK_TTL_MS = 7 * 24 * 60 * 60 * 1000;
 /** A PENDING row older than this is a crash leftover, not a running job. */
 const PENDING_STALE_MS = 60 * 60 * 1000;
+/** One export per user per hour: bundling and mailing is not free, and a second
+ *  request minutes after the first only ever produces the same zip again. */
+const EXPORT_COOLDOWN_MS = 60 * 60 * 1000;
 
 const zipAsync = (data: Zippable): Promise<Uint8Array> =>
     new Promise((resolve, reject) => {
@@ -39,19 +51,93 @@ const zipAsync = (data: Zippable): Promise<Uint8Array> =>
 
 /**
  * Validate and record a new export request. Throws ConflictError while a
- * recent request is still building. Returns the export id for `runDataExport`.
+ * request is still building and TooManyRequestsError while the cooldown of the
+ * last one has not lapsed. Returns the export id for `runDataExport`.
  */
 export async function beginDataExport(userId: string): Promise<string> {
-    const staleBefore = new Date(Date.now() - PENDING_STALE_MS);
-    await repository.failStalePending(userId, staleBefore);
+    const now = Date.now();
+    await repository.failStalePending(userId, new Date(now - PENDING_STALE_MS));
 
-    const active = await repository.findActivePending(userId, staleBefore);
-    if (active) throw new ConflictError("A data export is already being prepared");
+    const recent = await repository.findLatestSince(userId, new Date(now - EXPORT_COOLDOWN_MS));
+    if (recent) {
+        if (recent.status === DataExportStatus.PENDING)
+            throw new ConflictError("A data export is already being prepared");
+        throw new TooManyRequestsError("A data export was requested less than an hour ago");
+    }
 
     const row = await repository.createPending(userId);
     return row.id;
 }
 
+/** Resolve what the settings panel should show, without mutating anything. */
+export async function getDataExportState(userId: string): Promise<DataExportState> {
+    const now = Date.now();
+    const [latest, downloadable] = await Promise.all([
+        repository.findLatest(userId),
+        repository.findLatestDownloadable(userId, new Date(now)),
+    ]);
+
+    // A PENDING row past the stale cutoff is a crash leftover. `beginDataExport`
+    // fails it on the next request; a read must not show it as still running.
+    const isPreparing =
+        latest?.status === DataExportStatus.PENDING &&
+        latest.createdAt.getTime() > now - PENDING_STALE_MS;
+
+    // Mirrors the guard in `beginDataExport` so the button and the API agree on
+    // when a request is allowed. Safe because a stale PENDING is necessarily
+    // older than the cooldown too (PENDING_STALE_MS === EXPORT_COOLDOWN_MS).
+    const blocking = latest && latest.status !== DataExportStatus.FAILED ? latest : null;
+    const cooldownEnd = blocking ? blocking.createdAt.getTime() + EXPORT_COOLDOWN_MS : 0;
+
+    const status: DataExportState["status"] = isPreparing
+        ? "PENDING"
+        : downloadable
+          ? "READY"
+          : latest?.status === DataExportStatus.COMPLETED
+            ? "EXPIRED"
+            : "NONE";
+
+    return {
+        id: downloadable?.id ?? null,
+        status,
+        expiresAt: downloadable?.expiresAt?.toISOString() ?? null,
+        canRequestAt: cooldownEnd > now ? new Date(cooldownEnd).toISOString() : null,
+    };
+}
+
+/**
+ * Read a completed export on behalf of the signed-in caller. Everything that
+ * makes the archive unavailable — someone else's export, an id that does not
+ * exist, a run that never completed, a lapsed link — answers with the same 404,
+ * so the endpoint never confirms an export id to whoever is holding the link.
+ */
+export async function getExportArchive(
+    exportId: string,
+    userId: string,
+): Promise<{ bytes: Uint8Array; filename: string }> {
+    const record = await repository.findById(exportId);
+    const unavailable = new NotFoundError("This data export is no longer available");
+
+    if (!record || record.userId !== userId) throw unavailable;
+    if (record.status !== DataExportStatus.COMPLETED || !record.key) throw unavailable;
+    if (record.expiresAt && record.expiresAt.getTime() < Date.now()) throw unavailable;
+
+    const bytes = await S3.getObjectBytes(record.key);
+    if (!bytes) throw unavailable;
+
+    return { bytes, filename: record.key.split("/").pop() ?? "scriptio-data-export.zip" };
+}
+
+/** Delete the R2 objects of exports whose download link has already lapsed. */
+async function purgeExpiredExports(userId: string): Promise<void> {
+    const expired = await repository.findExpired(userId, new Date());
+    const keys = expired.map((e) => e.key).filter((key): key is string => !!key);
+    if (!keys.length) return;
+
+    await S3.destroyMany(keys);
+    await repository.clearKeys(expired.map((e) => e.id));
+}
+
 /**
  * Build the zip, upload it and email the link. Runs in the background after
  * the request already returned — never throws, records FAILED instead.
@@ -62,9 +148,9 @@ export async function runDataExport(exportId: string, userId: string): Promise<v
         if (!user) throw new Error("User no longer exists");
         const memberships = await ProjectService.getMembershipsWithProject(userId);
 
-        // Only the newest export link should stay valid; this also reclaims the
-        // previous zip instead of waiting out its 7 days.
-        await S3.destroyPrefix(`gdpr-exports/${userId}/`);
+        // Reclaim the zips of lapsed exports only. Wiping the whole prefix would
+        // break the links of earlier emails that are still within their 7 days.
+        await purgeExpiredExports(userId);
 
         const timestamp = new Date().toISOString().replace(/[:.]/g, "-");
         const key = `gdpr-exports/${userId}/scriptio-data-export-${timestamp}.zip`;
@@ -91,12 +177,9 @@ export async function runDataExport(exportId: string, userId: string): Promise<v
         const uploaded = await S3.putObject(key, archive, "application/zip");
         if (!uploaded) throw new Error("Failed to upload the export zip");
 
-        const url = await S3.getSignedDownloadUrl(key, EXPORT_LINK_TTL_SECONDS);
-        if (!url) throw new Error("Failed to sign the export download URL");
-
-        const expiresAt = new Date(Date.now() + EXPORT_LINK_TTL_SECONDS * 1000);
+        const expiresAt = new Date(Date.now() + EXPORT_LINK_TTL_MS);
         await repository.markCompleted(exportId, key, expiresAt);
-        await sendDataExportEmail(user.email, url);
+        await sendDataExportEmail(user.email);
         logger.info("[DataExport] Export completed", { userId, exportId, key });
     } catch (e) {
         logger.error("[DataExport] Export failed", { userId, exportId, error: e });
diff --git a/src/server/service/project-teardown-service.ts b/src/server/service/project-teardown-service.ts
index 38e15b8a..d64adb52 100644
--- a/src/server/service/project-teardown-service.ts
+++ b/src/server/service/project-teardown-service.ts
@@ -21,9 +21,9 @@ export async function destroyProjectCompletely(projectId: string): Promise<void>
     await S3.destroyPrefix(`assets/${projectId}/`);
 
     // The poster lives outside that folder, under its own key. Deleted
-    // unconditionally: S3 deletes are idempotent, and `hasPoster` is not
-    // trustworthy enough to gate on (any PATCH without a poster resets the
-    // flag to false while the object stays in the bucket).
+    // unconditionally: S3 deletes are idempotent, and a `hasPoster` that drifted
+    // false (older builds reset it on any project edit) would otherwise leave
+    // the object behind forever.
     await S3.destroy(`poster-${projectId}`);
 
     // Cascades ProjectMember, ProjectInvitation and ProjectAsset rows.
diff --git a/src/tests/migrations/store-migration-runner.test.ts b/src/tests/migrations/store-migration-runner.test.ts
index cf428de4..52651db6 100644
--- a/src/tests/migrations/store-migration-runner.test.ts
+++ b/src/tests/migrations/store-migration-runner.test.ts
@@ -75,6 +75,7 @@ describe("runStoreMigrations", () => {
                 STORE_NAMES.DICTIONARIES,
                 STORE_NAMES.MIGRATION_BACKUPS,
                 STORE_NAMES.ASSETS,
+                STORE_NAMES.POSTERS,
             ].sort(),
         );
         db.close();
diff --git a/src/tests/posters/posters.test.ts b/src/tests/posters/posters.test.ts
new file mode 100644
index 00000000..9e253122
--- /dev/null
+++ b/src/tests/posters/posters.test.ts
@@ -0,0 +1,210 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+import {
+    loadPosterBlob,
+    pushPendingPoster,
+    revalidatePoster,
+    savePosterFromFile,
+} from "@src/lib/posters/poster-store";
+import {
+    createCachedProjectWithId,
+    deleteCachedProject,
+    markCachedProjectAsSynced,
+} from "@src/lib/persistence/storage-provider/local-persistence";
+import { getStorageProvider } from "@src/lib/persistence/storage-provider/storage-provider";
+
+const pid = () => `poster-test-${Math.random().toString(36).slice(2)}`;
+
+/** A real, decodable JPEG so `savePosterFromFile`'s re-encode path runs for real. */
+async function makeImageFile(fill: string): Promise<File> {
+    const canvas = document.createElement("canvas");
+    canvas.width = 40;
+    canvas.height = 60;
+    const ctx = canvas.getContext("2d")!;
+    ctx.fillStyle = fill;
+    ctx.fillRect(0, 0, canvas.width, canvas.height);
+    const blob = await new Promise<Blob>((resolve) => canvas.toBlob((b) => resolve(b!), "image/jpeg"));
+    return new File([blob], "poster.jpg", { type: "image/jpeg" });
+}
+
+/** Stub `fetch` with a canned poster response, and report what was requested. */
+function stubFetch(impl: (url: string, init?: RequestInit) => Promise<Response>) {
+    const spy = vi.fn((input: RequestInfo, init?: RequestInit) =>
+        impl(typeof input === "string" ? input : input.url, init),
+    );
+    vi.stubGlobal("fetch", spy);
+    return spy;
+}
+
+const ok = async () => new Response(null, { status: 200 });
+const offline = async () => {
+    throw new TypeError("Failed to fetch");
+};
+
+afterEach(() => {
+    vi.unstubAllGlobals();
+});
+
+describe("posters on a local-only project", () => {
+    it("stores and reads back a poster without ever touching the network", async () => {
+        const id = pid();
+        await createCachedProjectWithId(id, "local", undefined, false);
+        const spy = stubFetch(ok);
+
+        await savePosterFromFile(id, await makeImageFile("#c00"));
+
+        const blob = await loadPosterBlob(id);
+        expect(blob).not.toBeNull();
+        expect(blob!.size).toBeGreaterThan(0);
+        expect(blob!.type).toBe("image/jpeg");
+        expect(spy).not.toHaveBeenCalled();
+
+        await deleteCachedProject(id);
+    });
+
+    it("uploads the poster it already had once the project is promoted to the cloud", async () => {
+        const id = pid();
+        await createCachedProjectWithId(id, "local", undefined, false);
+        await savePosterFromFile(id, await makeImageFile("#0c0"));
+
+        const provider = await getStorageProvider();
+        expect((await provider.getPoster(id))?.pendingUpload).toBe(true);
+
+        // Promotion flips the cached entry to synced, then pushes what's local.
+        await markCachedProjectAsSynced(id);
+        const spy = stubFetch(ok);
+        await pushPendingPoster(id);
+
+        expect(spy).toHaveBeenCalledTimes(1);
+        const [url, init] = spy.mock.calls[0];
+        expect(url).toContain(`/api/projects/${id}/poster`);
+        expect(init?.method).toBe("PUT");
+        expect((await provider.getPoster(id))?.pendingUpload).toBe(false);
+
+        await deleteCachedProject(id);
+    });
+
+    it("drops the poster when the project is deleted", async () => {
+        const id = pid();
+        await createCachedProjectWithId(id, "local", undefined, false);
+        await savePosterFromFile(id, await makeImageFile("#00c"));
+
+        await deleteCachedProject(id);
+
+        const provider = await getStorageProvider();
+        expect(await provider.getPoster(id)).toBeNull();
+    });
+
+    it("carries the poster to the new id when a cloud project is migrated to local", async () => {
+        const oldId = pid();
+        const newId = pid();
+        await createCachedProjectWithId(oldId, "cloud", undefined, true);
+        stubFetch(ok);
+        await savePosterFromFile(oldId, await makeImageFile("#cc0"));
+
+        const provider = await getStorageProvider();
+        await provider.copyPoster(oldId, newId);
+
+        const copied = await provider.getPoster(newId);
+        expect(copied?.hash).toBe((await provider.getPoster(oldId))!.hash);
+
+        await deleteCachedProject(oldId);
+        await deleteCachedProject(newId);
+    });
+});
+
+describe("posters on a cloud-synced project", () => {
+    it("pulls the poster from the cloud on a local cache miss, then serves it locally", async () => {
+        const id = pid();
+        await createCachedProjectWithId(id, "cloud", undefined, true);
+
+        const bytes = await (await makeImageFile("#0cc")).arrayBuffer();
+        const spy = stubFetch(
+            async () =>
+                new Response(bytes, { status: 200, headers: { "Content-Type": "image/jpeg" } }),
+        );
+
+        const blob = await loadPosterBlob(id);
+        expect(blob?.size).toBe(bytes.byteLength);
+        expect(spy).toHaveBeenCalledTimes(1);
+
+        // Cached now: the second read is local, which is what works offline.
+        const offlineSpy = stubFetch(offline);
+        expect((await loadPosterBlob(id))?.size).toBe(bytes.byteLength);
+        expect(offlineSpy).not.toHaveBeenCalled();
+
+        await deleteCachedProject(id);
+    });
+
+    it("loads the poster on a fresh device, before the project reaches the local cache", async () => {
+        const id = pid(); // listed by the API, not yet written to IndexedDB
+        const bytes = await (await makeImageFile("#333")).arrayBuffer();
+        const spy = stubFetch(
+            async () =>
+                new Response(bytes, { status: 200, headers: { "Content-Type": "image/jpeg" } }),
+        );
+
+        // Without the membership hint an uncached project is assumed local-only,
+        // so no request fires for it.
+        expect(await loadPosterBlob(id)).toBeNull();
+        expect(spy).not.toHaveBeenCalled();
+
+        expect((await loadPosterBlob(id, true))?.size).toBe(bytes.byteLength);
+        expect(spy).toHaveBeenCalledTimes(1);
+
+        await (await getStorageProvider()).deletePoster(id);
+    });
+
+    it("keeps a poster set while offline and pushes it on the next open", async () => {
+        const id = pid();
+        await createCachedProjectWithId(id, "cloud", undefined, true);
+
+        stubFetch(offline);
+        await savePosterFromFile(id, await makeImageFile("#c0c"));
+
+        const provider = await getStorageProvider();
+        const pending = await provider.getPoster(id);
+        expect(pending?.pendingUpload).toBe(true);
+        // Still rendered from the local copy despite the failed upload.
+        expect((await loadPosterBlob(id))?.size).toBeGreaterThan(0);
+
+        const spy = stubFetch(ok);
+        await pushPendingPoster(id);
+
+        expect(spy).toHaveBeenCalledTimes(1);
+        expect((await provider.getPoster(id))?.pendingUpload).toBe(false);
+
+        await deleteCachedProject(id);
+    });
+
+    it("never lets the stale cloud copy overwrite a poster still waiting to upload", async () => {
+        const id = pid();
+        await createCachedProjectWithId(id, "cloud", undefined, true);
+
+        // What a previous session left behind: local bytes that never reached R2.
+        const provider = await getStorageProvider();
+        const mine = await (await makeImageFile("#111")).arrayBuffer();
+        await provider.putPoster({
+            projectId: id,
+            mime: "image/jpeg",
+            data: mine,
+            hash: "local-hash",
+            pendingUpload: true,
+            updatedAt: Date.now(),
+        });
+
+        // Revalidating now would pull the older cloud bytes — it must not run.
+        const stale = await (await makeImageFile("#eee")).arrayBuffer();
+        const spy = stubFetch(
+            async () =>
+                new Response(stale, { status: 200, headers: { "Content-Type": "image/jpeg" } }),
+        );
+        expect((await loadPosterBlob(id))?.size).toBe(mine.byteLength);
+        await revalidatePoster(id);
+
+        expect(spy).not.toHaveBeenCalled();
+        expect((await provider.getPoster(id))?.hash).toBe("local-hash");
+
+        await deleteCachedProject(id);
+    });
+});