Evidence Retention
Document Vault support and release QA evidence must stay privacy-safe. Evidence can help diagnose defects, prove release gates, or answer App Review questions, but it must not become a copy of a user's vault.
Collection rules
Evidence collection is minimum necessary and redacted by default. Do not send vault content, document images, generated PDFs, OCR text, translation text, filenames, folders, tags, packet contents, identity documents, financial documents, medical documents, PINs, passwords, OAuth tokens, one-time codes, account identifiers, provider object ids, local paths, receipts, transaction ids, purchase tokens, or billing records unless a narrowly scoped investigation genuinely requires a redacted sample.
Storage rules
Support should prefer text summaries that name the validated behavior over raw screenshots or logs. Private evidence must not be pasted into commits, GitHub issues, release notes, public documentation, or public support threads.
Retention rules
Routine support triage evidence should be deleted within 30 days after the request is resolved unless a user asks for earlier deletion or an active legal/security hold applies. Release QA evidence for App Store, TestFlight, paid subscription, privacy-label, sync, Phase 1, or accessibility gates should be kept only until the related release decision, App Review cycle, or rollback window is closed, then deleted or replaced with a redacted summary within 180 days.
Escalation
Escalate before accepting or retaining anything that may contain vault content, government identity material, payment data, medical data, unredacted account identifiers, secrets, or provider logs. If evidence may indicate a security or privacy incident, stop routine sharing and follow incident support.