Skip to main content
InternalMarkdown

ADR 0012. Never Receive or Store Player Email, Name or Telephone

Status​

Accepted.

Resolves spec §33.1. Tightens the earlier "do not store email" product rule to no receipt into PlayerPal-controlled systems, not merely no persistence.

Context​

Operators will not adopt a loyalty network that becomes a second copy of their player PII. PlayerPal's privacy position is that it does not collect player email, name or telephone. Workforce identity (staff and partner admins) still needs business email for SSO and audit. Those are different populations.

Spec §29 asked whether "must not store email" meant no persistence or no receipt anywhere. §33 answers: infrastructure must never receive or store it.

Decision​

PlayerPal-controlled persistence, tokens, logs, traces, events and analytics must never contain player email, name or telephone number.

Prohibited claims are removed at the social/IAM boundary before they reach PlayerPal. Player OIDC clients request openid only. Automatic account linking by matching email is disabled.

If a social provider emits email regardless of scopes, product/legal/security must decide whether transient receipt plus immediate filtering complies. If PlayerPal may never receive email at all, that provider/configuration is not enabled.

Workforce business email is allowed only in the separate workforce identity domain (ADR 0018 portals, spec §7).

Email magic links and SMS OTP are excluded as player authentication methods.

Consequences​

  • Recovery cannot use email or SMS. Use passkeys, recovery codes, existing devices, or a later operator-assisted design (ADR 0028).
  • Account discovery cannot offer email/phone lookup (ADR 0019).
  • ADR 0010 must not be read as allowing an email-based richer profile.
  • Google on the local ZITADEL IdP uses openid only; Nest keeps iss + sub and drops IdP rawInformation before any PlayerPal write. Transient extra claims plus immediate drop is the local path; those claims must still never persist. If a future live capture shows PlayerPal logs, cookies, or DB receiving email, disable that IdP until the config changes.

Amendment​

ZITADEL User API create may require a synthetic verified placeholder email on the IAM side only. PlayerPal never persists it in DB, tokens, cookies, or logs (ADR 0024). Real player email/name/phone remain forbidden.