Privacy

Classify collected fields, apply export redaction, and keep the generated privacy ledger truthful. Use when adding properties, changing RedactionPolicy, or touching export/privacy UI.

hoangsonww 2775737 1.2 KB Updated

File contents

Privacy

Local-first. Nothing leaves the device unless the user exports. No account, no telemetry.

Classification

Level Meaning
public Safe to share (OS version)
local Mildly identifying, kept on device
sensitive Identifies the user or environment (SSID, repo path)
restricted Never collected, or always stripped on export

RedactionPolicy.none still redacts restricted. standard (default) redacts sensitive+. strict redacts local+.

Redaction is a copy. Snapshot.redacted must not mutate the stored snapshot.

Checks

  • New fields have a classification on the descriptor.
  • PrivacyLedger.neverCollected stays a design commitment; do not silently delete lines.
  • Export paths (SnapshotService.exportSnapshot/Diff/Report) apply a policy.
  • Tests: Tests/Domain/PrivacyAndRedactionTests.swift and redaction invariants.

Read Documentation/adr/0007-privacy-classification.md and Documentation/Privacy.md.

hoangsonww/diffuse-native-apps/tree/main/.agents/skills/privacy commit 2775737edd

Frequently asked questions

npx skillmds@latest add hoangsonww/privacy