# ADR 0012. Never Receive or Store Player Email, Name or Telephone

## Status
Accepted.

Resolves spec §33.1. Tightens the earlier "do not store email" product rule
to **no receipt** into PlayerPal-controlled systems, not merely no persistence.

## Context
Operators will not adopt a loyalty network that becomes a second copy of their
player PII. PlayerPal's privacy position is that it does not collect player
email, name or telephone. Workforce identity (staff and partner admins) still
needs business email for SSO and audit. Those are different populations.

Spec §29 asked whether "must not store email" meant no persistence or no
receipt anywhere. §33 answers: infrastructure must never receive or store it.

## Decision
PlayerPal-controlled persistence, tokens, logs, traces, events and analytics
must never contain player email, name or telephone number.

Prohibited claims are removed at the social/IAM boundary before they reach
PlayerPal. Player OIDC clients request `openid` only. Automatic account
linking by matching email is disabled.

If a social provider emits email regardless of scopes, product/legal/security
must decide whether transient receipt plus immediate filtering complies. If
PlayerPal may never receive email at all, that provider/configuration is not
enabled.

Workforce business email is allowed only in the separate workforce identity
domain (ADR 0018 portals, spec §7).

Email magic links and SMS OTP are excluded as player authentication methods.

## Consequences
- Recovery cannot use email or SMS. Use passkeys, recovery codes, existing
  devices, or a later operator-assisted design ([ADR 0028](0028-v1-recovery-without-operator-assist.md)).
- Account discovery cannot offer email/phone lookup (ADR 0019).
- [ADR 0010](0010-linking-unifies-no-separate-claim.md) must not be read as
  allowing an email-based richer profile.
- Google on the local ZITADEL IdP uses `openid` only; Nest keeps `iss` +
  `sub` and drops IdP `rawInformation` before any PlayerPal write. Transient
  extra claims plus immediate drop is the local path; those claims must still
  never persist. If a future live capture shows PlayerPal logs, cookies, or
  DB receiving email, disable that IdP until the config changes.

## Amendment
ZITADEL User API create may require a **synthetic verified placeholder email**
on the IAM side only. PlayerPal never persists it in DB, tokens, cookies, or
logs ([ADR 0024](0024-nest-owned-portal-auth.md)). Real player email/name/phone
remain forbidden.