Privacy bulkhead record-level rules
Some fields never cross the glass.
The register may be useful while every live value remains Unknown. It may never make a person, message, possession, path, or location easier to identify.
Privacy classes exactly three
Classification precedes inspection.
aggregate-windowAggregate window
Only an already-aggregated server window may enter the public record; no raw event or identifier accompanies it.
Definition may publish; measurements still unavailable.
suppressed-breakdownSuppressed breakdown
A category breakdown may publish only after a documented cohort rule; otherwise the whole window reads unavailable.
Definition may publish; measurements still unavailable.
never-collectNever collect
This field is prohibited and never enters the public pipeline, even in a small, delayed, or aggregated form.
No record may publish.
Rejected anywhere including nested keys
The dry side of the glass
usernameThe whole object fails closed when this field appears.uuidThe whole object fails closed when this field appears.ipAddressThe whole object fails closed when this field appears.coordinatesThe whole object fails closed when this field appears.chatThe whole object fails closed when this field appears.privateMessageThe whole object fails closed when this field appears.inventoryThe whole object fails closed when this field appears.trajectoryThe whole object fails closed when this field appears.
Local inspection no transfer
The browser is the boundary.
- Local
- No uploadThe inspector parses JSON in this browser and sends no request.
- Ephemeral
- No storageInput is not written to cookies, local storage, analytics, or an account.
- Bounded
- Exact schemaMissing, extra, unknown, and identifying fields fail with a specific explanation.
- Honest
- No live claimOnly
recordType: "example"is accepted; measurements remain Unknown.
Measurement status dated 2026-07-18
No live feed is connected.
No cohort threshold, delay window, differencing defense, or safe measured result is claimed here. Those facts would need attributable review before any measured record could replace the visible Unknown state.
The hard never-collect boundary is already operative in this reference: exact coordinates, trajectories, identities, chat, private messages, and inventories are rejected rather than “safely” approximated.