Add privacy-safe product analytics

Establish an idempotent analytics pipeline and internal decision dashboard while keeping event metadata allowlisted and account deletion enforceable.
2026-08-20 15:20:01 +08:00
parent 231c5040a5
commit 4b465e0e5e
38 changed files with 4275 additions and 80 deletions
@@ -4,6 +4,9 @@
 - Apple email and avatar data are not requested or stored.
 - Deleting an account removes its session, profile, referral, grant, and mutable
  account records in the same local transaction before Apple revocation is retried.
+- Product analytics installations linked to the account and all of their events
+  are deleted by database cascade. The service stores only the digest of a
+  random installation UUID and never stores user content in analytics events.
 - Pseudonymous immutable credit-ledger entries, StoreKit transaction audit data,
  and time-limited anti-abuse tombstones remain after deletion where required to
  prevent replay, preserve financial integrity, and stop repeated trial abuse.