TITIP-011 Privacy and data deletion
Status Accepted
Version 0.1
Stage 0 — Authority

Purpose

State what Titip collects, why, how long it is kept, and how deletion works. This is the product rule. Counsel still has to review it before public launch (plans/production-readiness.md).

Decisions

  1. Collect the minimum that the trust model needs: owner identity for the account, contact channels for people the owner named, guidance the owner chose to store, and evidence of checks and releases.
  2. Do not collect secrets. Do not collect a death-registry record in the prototype or alpha. Do not use recipient data for marketing.
  3. Purpose limitation: trusted-contact channels are for escalation notices. Recipient channels are for release notices after approval. They must not be reused for newsletters.
  4. The owner must be able to delete a vault, an asset, a contact, or the whole account from the product, not only by emailing support.
  5. Vault deletion destroys content ciphertext and the data encryption keys that wrapped it. Backups must expire within the backup window in policies/retention.md. Until infrastructure can enforce that window, real customer data must not be stored (prototype uses demo data).
  6. Account deletion:
    • revokes sessions and unused recipient tokens
    • deletes vault ciphertext
    • removes contact channels from active notification lists
    • retains minimized audit events (ids, types, timestamps, policy versions) for the audit retention period
    • must not retain instruction text in logs, analytics, or AI traces
  7. AI traces, when AI exists, follow TITIP-012: no training on owner vault text for a shared model; deletion includes provider-side deletion where the provider supports it, or AI is not enabled.
  8. Data residency for production is an explicit infrastructure decision before launch. Prototype must assume a single region and must not replicate customer-like data to a second region “for convenience”.
  9. Trusted contacts and recipients must be told, at invitation or disclosure, that their name and channel are stored because the owner named them, and how to reject or ask for removal.

Lawful basis and legal copy

Privacy policy and terms are launch artefacts. This spec does not pretend to be those documents. Public pages must distinguish informational guidance from legal advice, and must link the canonical “what not to store” list.

Children

The daughter in the demo is a recipient under a hold rule, not an account holder. The prototype must not create accounts for minors. A vault held until age 18 stores guidance for later release; it does not require the child’s credentials now.

Acceptance