Public does not mean limitless.

Implemented rule

Data minimization

• Normal buyer views omit residential addresses, telephone numbers, email addresses, and unrelated personal details.
• Source-withheld fields are not reconstructed from unrelated sources.
• Serving projections minimize personal fields and public routes do not expose future private logbook uploads.
• Sensitive fields are not intentionally placed in analytics or routine logs.

Current architecture

Payments and access

Paid report access is designed to use Stripe-hosted Checkout, signature-verified webhooks, idempotent purchase records, and signed report-access tokens. Checkout remains disabled where configuration is incomplete.

Not final legal text

Before production authorization

Qualified counsel must review retention, data-subject requests, source licenses, analytics, processor disclosures, cookies, payment policy, and any future uploaded records. Contact and jurisdiction details are intentionally not invented here.