Privacy Audit

Find out what personal data a system holds and what happens to it: where each class enters, every place it is copied, who receives it, how long it stays, and whether a deletion ever reaches the copies. The primary database is rarely the problem; the problem is the cache, the search index, the analytics event, the error report and the nightly export that nobody counted.

Read-only: it reports a data map, ranked findings and a verdict, and never edits code, config or data. Works from source, schemas, migrations, infrastructure config and client code; a live system is not needed, and a check that would need one is named rather than run.

Jurisdiction-neutral. The tracks below follow principles that most data-protection regimes share — collect what a purpose needs, keep it no longer than that, tell the person and let them see, correct and remove it, protect it in proportion to its harm. A regime (the EU's GDPR, California's CCPA, Brazil's LGPD) is named only as an example of where a principle comes from. This audit is not legal advice: it states what the code does, and whether that is lawful for a given product, market and legal basis is a question for counsel. No finding says "non-compliant", and no report estimates fines.

Reference files (load the one you need):

• references/data-classes.md — the data classes and their weights, the combinations that raise a class, where personal data hides beyond the schema, and the evidence each inventory row carries. Read it before Track 1.
• references/stores-and-deletion.md — the store catalogue, retention thresholds, the deletion-propagation walk, rights mechanics, consent gating and the blast-radius line. Read it before Track 2 and keep it open through Track 7.

When to Activate

• A privacy review, a data-protection or GDPR/CCPA readiness check, a data inventory or data map
• "Where does our users' personal data actually go?"
• Before launching in a new region or market, or before a due-diligence or vendor questionnaire
• After adding an analytics, advertising, session-replay or error-tracking SDK, or a new third-party integration
• After adding a feature that collects a new kind of personal data (location, health, payments, minors)