Privacy
Local-first. Nothing leaves the device unless the user exports. No account, no telemetry.
Classification
| Level | Meaning |
|---|---|
public |
Safe to share (OS version) |
local |
Mildly identifying, kept on device |
sensitive |
Identifies the user or environment (SSID, repo path) |
restricted |
Never collected, or always stripped on export |
RedactionPolicy.none still redacts restricted. standard (default) redacts sensitive+. strict redacts local+.
Redaction is a copy. Snapshot.redacted must not mutate the stored snapshot.
Checks
- New fields have a classification on the descriptor.
PrivacyLedger.neverCollectedstays a design commitment; do not silently delete lines.- Export paths (
SnapshotService.exportSnapshot/Diff/Report) apply a policy. - Tests:
Tests/Domain/PrivacyAndRedactionTests.swiftand redaction invariants.
Read Documentation/adr/0007-privacy-classification.md and Documentation/Privacy.md.