Privacy & Retention

• FlagForge stores player UUIDs and last-known names, never IP addresses, chat, signs, books, or inventory contents unrelated to a finding — only the numeric/contextual evidence needed to explain that specific finding.
• Retention (storage.yml): detailed evidence defaults to 14 days, aggregate player/check statistics to 90 days, both enforced by a scheduled async purge task that never blocks the main thread.
• Manual purge: /ff purge player <name> confirm deletes every stored finding for one player; /ff purge before <ISO-8601-timestamp> confirm deletes everything older than a date. Both require the exact literal confirm argument as a deliberate two-step safeguard, and both are audit-logged.
• Every mutating staff action (reload, exempt, enforcement toggle, purge, check toggle) is recorded in an append-only audit log with who/what/when/outcome.
• Coarse location (block coordinates, not exact) is what staff-facing surfaces (Discord embeds, /ff finding) display when a finding carries a position — see QualityContext.location.