{"schemaVersion":1,"policyId":"project42-learner-data","policyVersion":"2026-07-25","effectiveDate":"2026-07-25","accountBackedRecords":"planned","currentStorageNotice":"Project 42 currently keeps learner progress in this browser. Account-backed cross-device records are not enabled yet.","identity":{"protocol":"openid-connect-authorization-code-pkce","authoritativeKey":"issuer-subject","emailIsAuthoritative":false,"automaticEmailMerge":false,"stableSubjectRequired":true},"adapters":{"hostedRecordStore":"sites-d1","referenceRecordStore":"postgresql","identity":"openid-connect","identityRequirement":"The configured provider must expose a stable issuer and subject; email is display/contact data only."},"tenancy":{"installationOrTenantRequired":true,"denyCrossTenantByDefault":true,"scopeEveryCommandAndQuery":true},"profile":{"requiredFields":["learnerId","tenantId","lifecycleState","createdAt","updatedAt"],"optionalFields":["displayName","locale","timeZone","reducedMotion","highContrast"],"prohibitedFields":["password","governmentIdentifier","dateOfBirth","advertisingProfile"]},"lifecycle":{"states":["created","active","suspended","recovery-pending","deletion-requested","deleted"],"transitions":[{"from":"created","to":"active","actor":"learner","condition":"Required service consent is recorded and identity binding succeeds."},{"from":"created","to":"deletion-requested","actor":"learner","condition":"The learner abandons account creation and requests removal."},{"from":"active","to":"suspended","actor":"administrator","condition":"A documented safety or account-integrity reason is recorded."},{"from":"active","to":"recovery-pending","actor":"learner","condition":"The learner begins an identity recovery flow."},{"from":"active","to":"deletion-requested","actor":"learner","condition":"The learner confirms the deletion scope and consequences."},{"from":"suspended","to":"active","actor":"administrator","condition":"The documented suspension reason is resolved."},{"from":"suspended","to":"recovery-pending","actor":"learner","condition":"The learner begins an identity recovery flow."},{"from":"suspended","to":"deletion-requested","actor":"learner","condition":"Deletion remains available while the account is suspended."},{"from":"recovery-pending","to":"active","actor":"system","condition":"The configured identity provider completes recovery."},{"from":"recovery-pending","to":"suspended","actor":"administrator","condition":"Recovery cannot be verified without unsafe disclosure."},{"from":"recovery-pending","to":"deletion-requested","actor":"learner","condition":"The learner requests deletion instead of continuing recovery."},{"from":"deletion-requested","to":"active","actor":"learner","condition":"The request is cancelled inside the cancellation window."},{"from":"deletion-requested","to":"deleted","actor":"system","condition":"Active stores are erased and adapter receipts are verified."}]},"consent":{"recordFields":["purpose","policyVersion","decision","decidedAt"],"purposes":[{"id":"learning-record","required":true,"description":"Store profile, enrollment, progress, attempts, scores, badges, and transcript records.","withdrawalEffect":"Starts account deletion because the service cannot operate without it."},{"id":"product-improvement","required":false,"description":"Use minimized, non-transcript events to improve the learning experience.","withdrawalEffect":"Stops future optional product-improvement events."},{"id":"learning-reminders","required":false,"description":"Send learner-requested progress and review reminders.","withdrawalEffect":"Stops future reminders without deleting the learning record."}]},"retention":{"classes":[{"id":"active-account","records":["profile","consent","enrollment","learning-events","attempts","badges"],"trigger":"account-active","retainDays":null,"disposition":"Retain while the learner keeps the account active."},{"id":"inactive-account","records":["profile","consent","enrollment","learning-events","attempts","badges"],"trigger":"account-inactive","retainDays":730,"disposition":"Notify before expiry, then run the verified deletion workflow."},{"id":"privileged-audit","records":["privileged-access-events","export-events","deletion-events"],"trigger":"record-created","retainDays":365,"disposition":"Delete event detail after the audit window."},{"id":"support-diagnostics","records":["support-case-diagnostics"],"trigger":"record-created","retainDays":30,"disposition":"Delete diagnostic detail and retain only a non-sensitive case outcome."},{"id":"deletion-receipt","records":["deletion-receipt"],"trigger":"request-completed","retainDays":90,"disposition":"Delete the receipt after the dispute window."}]},"export":{"formats":["project42-portable-json","transcript-csv"],"recentAuthenticationMinutes":15,"delivery":"single-response-download","publicObjectUrlAllowed":false,"auditEventRequired":true},"deletion":{"cancellationWindowDays":7,"activeStoreCompletionDays":7,"backupExpiryDays":35,"restoreTimeDeletionReplay":true,"receiptRetainDays":90,"auditEventRequired":true},"recovery":{"recoveryPointHours":24,"recoveryTimeHours":8,"restoreTestCadenceDays":90,"deletionReplayRequired":true},"authorization":{"denyByDefault":true,"privilegedActionsAudited":true,"grants":[{"role":"learner","permissions":["profile:read:self","profile:update:self","consent:manage:self","transcript:read:self","transcript:export:self","deletion:request:self"],"boundary":"Only the authenticated learner's own record in the current tenant."},{"role":"support","permissions":["learner-summary:read:tenant"],"boundary":"Read-only minimized summary for an active support case in the assigned tenant."},{"role":"content-editor","permissions":["content:manage"],"boundary":"Curriculum content only; no learner-data access."},{"role":"administrator","permissions":["learner-summary:read:tenant","account:suspend:tenant","account:recover:tenant","deletion:process:tenant","badge:correct:tenant"],"boundary":"Explicit privileged role, current tenant only, with immutable audit events."},{"role":"system","permissions":["projection:rebuild:tenant","deletion:replay:tenant"],"boundary":"Named service operation in one tenant with auditable execution context."}]}}