Status: Proposed 2026-09-24
This is the contract behind the privacy promise. Any pull request that adds a personal field must add a row here first. Rows are grouped by the collection that holds them; the full schema is in the data model.
Visibility values: self (the member only), friends, organizer (of the event in question), grove (members of that Grove), public, admin (moderation only, never exported), nobody (stored, never read back except by the system).
Account
| Field | Purpose | Visibility | Retention |
|---|
email | Sign-in and magic links | nobody (used to send mail) | Until deletion |
passwordHash (argon2id) | Password sign-in, optional | nobody | Until deletion or password removal |
handle | The only name other members see | friends, grove, organizer, public (only on public posts) | Until deletion |
avatarKey | Optional picture | same as handle | Until deletion or removal |
homeArea | One of eleven SoCal regions, picked from a list | self, and as an aggregate count per Grove | Until deletion |
interests | Chosen tags, used by Ivy and for event suggestions | self, Ivy | Until deletion |
providers[] | Apple or Google subject ids for SSO | nobody | Until deletion |
discoverable | Whether friends can find you by handle (default off) | self | Until deletion |
publicPostsEnabled | Whether you can post publicly (default off) | self | Until deletion |
role | member or admin | nobody | Until deletion |
Not stored, ever: real name, phone number, birthdate, street address, device GPS, contacts, device identifiers beyond a push token.
Sessions and sign-in
| Field | Purpose | Visibility | Retention |
|---|
sessions.tokenHash | SHA-256 of the session token | nobody | 30 days sliding, or on logout |
sessions.client | ios, android, or web, so you can revoke a device | self | With the session |
magic_links.tokenHash | Single-use sign-in link | nobody | 15 minutes |
Social graph
| Field | Purpose | Visibility | Retention |
|---|
friendships | Who is friends with whom | the two members involved | Until either deletes the friendship or an account |
friend_invites.code | Invite codes shared in person | self | Expires, default 7 days |
grove_members | Membership and organizer role | self, organizers of that Grove; counts are public | Until leaving or deletion |
Activity
| Field | Purpose | Visibility | Retention |
|---|
event_rsvps | Going or interested | self, organizer of that event; counts are public | 30 days after the event ends |
posts, comments, reactions, saved_posts | The feed | per post: friends, grove, or public; comments follow the post | Until deletion |
place_reviews | Reviews and check-ins | public text; handle only if showHandle | Until deletion |
place_lists | Saved places | self unless isPublic | Until deletion |
action_log | Private impact journal | self | Until deletion |
messages (ciphertext) | Direct messages | participants | 90 days by default |
companion_conversations | Ivy chats | self | 24 hours unless pinned |
push_tokens | Device push address | nobody | 30 days after last use |
notification_preferences | What to send | self | Until deletion |
Server-side records that mention a member
| Record | What it holds | Retention |
|---|
| Access logs (pino) | Route, status, duration, a hash of the session id. Never email, token, coordinates, or bodies. | 14 days |
reports | Who reported what and why, for moderation | Until resolved plus 90 days |
| Aggregate stats | Counts only, no ids | Indefinite |
What third parties receive
| Party | What | Why |
|---|
| AWS SES | Your email address and the sign-in link | To deliver magic links and account mail |
| Apple, Google | Nothing from us. When you use SSO they tell us a subject id and, if you allow, an email. | SSO |
| Bunny Stream | Video files you upload, already stripped of metadata | Transcoding and playback |
| OpenFreeMap | Map tile requests from your device (no key, no cookies) | Map rendering |
| Anthropic | Your handle, your chosen interests, and the text of your Ivy conversation | Running the companion |
No party receives your email for advertising, your location, your friends, or your RSVPs.