What Safety holds
In plain wordsTechnical detail
| Stored in | Details | Why | Kept for | Schedule row |
|---|---|---|---|---|
| safety_report_x | category, reason_key, detail, verdict | Deciding a case and weighing reports. | With the case: 12 months after it closes with no action; 24 after a notice, mute, suspension or withdrawn item; 36 after an account is removed. | Not listed yet |
| safety_case_x | category, weight, clusters, outcome | Where a case stands and what the rules worked out. | With the case: 12 months after it closes with no action; 24 after a notice, mute, suspension or withdrawn item; 36 after an account is removed. | Not listed yet |
| safety_packets | body, sha256, net | Fixed evidence of what was reported, and a scrambled network address of whoever filed it. | With the case: 12 months after it closes with no action; 24 after a notice, mute, suspension or withdrawn item; 36 after an account is removed. The network details are dropped after 90 days. | Not listed yet |
| safety_requests | locator, body, statements, signature, contact, contact_hmac, net_hmac | Proving a removal request, a copyright notice or a dispute was valid, and answering it. | Intimate-image requests: 5 years after the ticket closes. Copyright: 3 years. Disputes and visitor reports: 24 months. Contact details are erased sooner on request; the network hash after 30 days. | Not listed yet |
| safety_actions | action, guideline, reason, until, appeal_by, seen_at | Decisions and their history. | With the case: 12 months after it closes with no action; 24 after a notice, mute, suspension or withdrawn item; 36 after an account is removed. | Not listed yet |
| safety_strikes | kind, state, active_until | What a decision counts for, and until when. | With the case. A strike counts for 12 months. | Not listed yet |
| safety_appeals | new_info, state, reply_key | Second looks. | With the case: 12 months after it closes with no action; 24 after a notice, mute, suspension or withdrawn item; 36 after an account is removed. | Not listed yet |
| safety_checklists | steps, external_ref, external_at, preserve_until | The steps taken in a child-safety, age, threat or legal matter. | At least 1 year from the outside report, then with the case; longer only under a legal hold. | Not listed yet |
| safety_age_checks | state, status_answer, explain, asked_at, answered_at | The record of an age re-check. No date of birth is kept. | 36 months. | Not listed yet |
| safety_reporters | filed, upheld, rejected, rejected_at, urgent_rejected_at, age_pause_at | Weighing reports. | While the account exists. | Not listed yet |
| safety_legal_requests | kind, sender, received_at, steps | Legal process received. | 6 years after it closes. | Not listed yet |
| safety_evasion | key_hmac | Noticing the return of a removed member. A keyed hash of name and school that only ever flags. | 24 months. | Not listed yet |
| safety_payment_log | kind, amount_cents, happened_on, outcome, stripe_ref, note | Refunds and bank disputes, by ticket. No card data and no payer name. | 7 years. | Not listed yet |
| auth_holds | rule, scope, state, detail_json, raised_at, expires_at, ended_at, appeal_at | Pausing part of an account for a short fixed time when its activity looks like abuse, while a person looks. The rule that tripped, the counts and times, and what a person did. No message text. | 90 days after the hold ends. | Not listed yet |
| auth_hold_events | kind, at, detail_json | What happened to a hold: raised, repeated, extended, released, run out, sent to moderation. No message text. | With the hold: 90 days after it ends. | Not listed yet |
| auth_signals | kind, tag, at | The small events the hold rules count: a rate limit that refused, a link a new account tried to send. A kind of event and the name of the limit, never what was written. | 48 hours. | Not listed yet |