Data-handling statement — draft

Implementation draft; final owner text, host region, contact inbox and assisted-source/provider handling facts remain pending. Fidrail itself resolves public repository metadata without credentials and does not fetch/store repository source archives. An authorized operator uses Mapper’s separate existing manual route; this does not authorize automatic analysis or target execution.

Stored categories and copies

• PostgreSQL: identity/workspace, canonical public repository and commit, requests/questions/scope/reasons/events, immutable report JSON, responses/feedback, inquiries and actual access/operator/delivery/deletion records.
• Private artifact storage: validated original report imports, every superseded/staged/failed upload. Local private storage is labelled as such; live R2 remains unverified until configured.
• Queue payloads reference IDs, not copied report text or recipient addresses. SMTP sends only a minimal event template; it currently contains no workspace link or report content.
• Manual owned DB/artifact backups and evidence exports are separate copies and remain within the retention/deletion inventory.

Retention

Inquiries/staging and access/delivery: 30 days. Completed content: 30 days from terminal completion/latest correction; active requests until resolved. Content-free audit/deletion records and pseudonymous stale-identity guard: 90 days. Minimum content-free acknowledgement proof-use tracking remains while an older upload attempt is still tracked, then follows normal audit expiry. Manual backups: maximum 7 days with operator-run recorded expiry, not an automatic schedule.

Deletion behavior

Delete retained data removes the selected repository’s requests, all report versions and artifacts, responses, feedback, reasons/scope and related delivery/access details. Single-report deletion removes every version and associated response/feedback while the parent request may remain. Deleting a request expands to its reports. Account deletion revokes access, removes raw identity/memberships/sessions and workspace content, purges verified linked inquiries, and retains only the disclosed temporary pseudonymous stale-token guard and content-free deletion receipts.

An in-flight upload cannot be declared deleted merely because DELETE or HEAD returns success/404. Late success removes its own object; uncertain remote settlement remains pending. Backups are purged/expired and deletion records applied before a restore serves data. Unknown or unexpired copies prevent a physical-completion claim. Immediate access revocation and physical completion are reported separately.

Unverified live integrations

Live email-code sign-in, Turnstile, R2 permissions, SMTP inbox delivery/domain authentication and authenticated public ingress require actual post-deployment verification. Technical hosting alone does not establish them or final policy approval. Local signed-identity/storage/email fixtures do not verify those services.