What Tillyard itself holds
In plain wordsTechnical detail
| Stored in | Details | Why | Kept for | Schedule row |
|---|---|---|---|---|
| members | email, name, name_key, school_id, student_status, status, status_reason | The account: who the member is, their school, and how they stand. | Until the account is erased; then the row is blanked. | Not listed yet |
| member_interests | interest_key | Interests the member picked. | Until changed or the account is erased. | Not listed yet |
| member_prefs | nod_from, tell_connections, notif_off, snooze_until, ui, tz | The member's own settings. | Until changed or the account is erased. | Not listed yet |
| settings | member_id, key, value_json | A member's own choices in a feature, such as where new Record items start. | Until changed or the account is erased. | Not listed yet |
| account_departed | email_hmac, standing | A keyed scramble of a closed account's address, so that leaving and returning does not undo a block or a removal. | 90 days, 24 months or 36 months by standing; then deleted. | Not listed yet |
| sessions | ua, ip_hash, agreed_set | Keeping a member signed in and showing their devices. | 180 days at most, or 60 days without a visit. | Not listed yet |
| passkeys | credential_id, public_key, label | Signing in without a password. | Until removed by the member or the account is erased. | Not listed yet |
| email_codes | email_hash, ip_hash | One-time codes. The address is kept only as a keyed hash. | One day after the code is used or expires. | Not listed yet |
| consents | key, version, surface, ref, given_at, withdrawn_at | A record of what the member agreed to and when. | For the life of the account and 24 months after it. | Not listed yet |
| notifications | kind, data | Notices shown to the member. | Until the account is erased. | Not listed yet |
| email_suppressed | mail_mac | A keyed scramble of an address whose owner asked never to be written to again, so that the request is honoured without keeping the address. | Until the person asks otherwise. | Not listed yet |
| bulletins | member_id, title, byline | Lines for the Morning Edition and the weekly sheets: a published paper, a table that is open. | Withdrawn when the item is hidden or the account is erased. | Not listed yet |
| connections | a, b | Who may message whom. | Until either member ends it or leaves. | Not listed yet |
| connection_reasons | a, b, reason | Each thing two members did together that connected them. | With the connection. | Not listed yet |
| blocks | blocker_id, blocked_id | Keeping two members apart at the request of one. | Until lifted. A block placed on a member outlives that member's account; the blocks a member placed go when they leave. | Not listed yet |
| mutes | a, b | Hiding one member from another. | Until lifted or either account is erased. | Not listed yet |
| circles | member_id, circle | Which rosters a member is on, so co-members count as people they share something with. | Until they leave the roster or the account is erased. | Not listed yet |
| pool | member_id, kinds, fields, paused | Whether the member has opted in to be offered other members' work to read. Nothing about how much they read is kept. | Until they leave the pool or the account is erased. | Not listed yet |
| record_items | title, facts, basis, visibility | What the member has done, for their Record. | Until withdrawn or the account is erased. | Not listed yet |
| credentials | member_id, title_key, source_ref | Titles granted by staff. | Kept, marked retired, when the holder leaves. | Not listed yet |
| perks | member_id, perk_key, detail | Marks of taking part, such as a founding number. | Until the account is erased. | Not listed yet |
| cases | subject_member_id, subject_id | Handling reports and holds. | Set by the retention schedule; longer under a legal hold. | Not listed yet |
| reports | reporter_member_id | Who reported what. | With the case. | Not listed yet |
| evidence_packets | snapshot_json | A copy of the reported item as it stood. | With the case; removed after it closes unless a legal hold applies. | Not listed yet |
| legal_holds | member_id, subject, reason | A register of what must be kept because the law or an open matter requires it. | Six years after release. | Not listed yet |
| screen_queue | text, member_id | Text waiting for a safety check that could not be done at once. | Minutes to hours; removed when checked. | Not listed yet |
| audit_log | actor_id, subject_id, detail_json | An unchangeable record of staff and system actions. | Kept. It holds ids and reasons, never member text or addresses. | Not listed yet |
| signup_refusals | email_hash | Not asking a refused address the same questions again straight away. | Until the refusal runs out. | Not listed yet |
| staff | email, name, own_member_id | Console accounts. | For the life of the staff agreement and the audit log. | Not listed yet |