The application knows the matter. It does not know the visitor.

Privacy is enforced by removing identity fields and uncontrolled public input—not by asking people to trust a long policy.

0public identity tables

The production schema contains no public user, profile, email, telephone, address, GPS, message, public upload or social graph table.

Never requested publiclyNames, email, phone, age, precise location

Never accessed automaticallyGPS, camera, microphone, contacts or local files

Never embeddedAdvertising, third-party analytics, social pixels

Temporarily retainedMatter selections and blueprint results only

Automatically removedExpired capsules and their aggregate outcomes

Administrator accessA local access-key hash, not an identity profile

Administrator CSV importsExplicitly selected, structurally validated and never copied to application storage

Import privacy gateContact-like values are rejected before the transaction commits

Infrastructure limitation

Every website host receives network requests and may record access logs outside this application. RE:FORM does not write IP addresses to its database or application events. The deployment guide explains how to minimise or anonymise hosting logs where the provider offers that control.