Skip to Content
ModulesRequestsSnapshotting PII

Snapshotting PII

The moment a request is marked done (mark done on its row), the recipient’s name is removed — not hidden, removed. No snapshot of it is kept anywhere, including the audit log. This is intentional: the recipient is often a child, and once the gift is handed over there is no reason to keep their name.

Who this is for: anyone reviewing completed requests + compliance reviewers.

What’s kept

  • Request status, dates, shipping method, items and notes.
  • The recipient’s age and gender, and a coarse location — city, state and ZIP — for reporting.
  • The requestor (the person who asked) and their contact details: marking a request done does not change them. The requester’s email and phone stay encrypted at rest, as they always are.
  • The audit log’s record of who marked it done and when. Audit entries are stored with personal details redacted, so the log never held the recipient’s name to begin with.

What’s redacted

When the request is marked done:

  • Recipient name → shown as [redacted] in the list.
  • Every occurrence of that name in the original email or note the request was made from → [redacted].
  • The delivery address → cut down to city, state and ZIP (the street goes).

There is no way to recover the name. Redaction is destructive and one-way: completing a request sets recipient_name to NULL and rewrites every occurrence of it inside the stored raw_input to [redacted]. No copy is kept, so no role and no capability can reveal it — and flipping the request back to not-complete does not bring it back either.

If you will need the name for a follow-up next year, record it somewhere that is not the request before you mark it done.

Why

  • Limits the surface area if a CartonCrew account is compromised.
  • Honors the implicit consent model: a requester didn’t sign up for permanent surveillance, only for the help they asked for.
  • Keeps the history useful: the request, its items and its dates are all still there for reporting — only the child’s identity is gone.

What you’ll see

Common issues

  • “I need the name back.” It is gone, for everyone. See above — plan for that before completing the request.
  • A requester asks to be forgotten — open Requests → Requesters, open the person and click Delete. That removes the requester record; their past requests keep the requestor name typed on them, so delete or edit those requests too. There is no single “forget this person” control.

Last updated: 2026-06-01 · Applies to: CartonCrew v1.56+

Managing requestersCampaign link & codes