The working A prototype: use its controls to test the build question.
Determine which data a product truly needs and what can be removed.
RN conceived the question, structured the evidence boundaries, designed the experience, implemented the prototype and documented its limits.
This independent prototype demonstrates an approach; it is not a deployed client system, professional advice or proof of real-world outcomes.
Work through the controls with a situation of your own rather than the sample values. The tool responds to what you put in, so the useful output comes from real input, and everything is processed in your browser as you go. Any sample content you find already loaded is there to show the shape of a filled-in state, and you can clear it and start again at any point.
The build overview sets out the question, the purpose, the role and the evidence status in one place, and the public record behind it states what changed, what another person can reuse and what supports the system. If you want to judge how far this build should be trusted, the record is the page to read, not this one.
BUILD 024-A
Privacy & Data Minimization Engine
Make every synthetic field earn collection, retention, derivation, and disclosure before it enters a system.
OVER-COLLECTING
5 collected · 0 excluded
DAT-01 / necessary
Service reply address
- Purpose
- PUR-REPLY: Return the requested service decision
- Necessity basis
- A reply cannot be delivered without one destination
- Evidence
- TEST-024-01 no-address delivery counterfactual
- Counterfactual
- Without a destination, the service cannot return its decision.
- Permission
- not-required
- Retention
- 30 days · Synthetic response-close schedule
- Deletion
- Thirty days after the response closes · Queue verified account-record deletion
- Redaction
- Mask in reviewer exports
- Owner
- Service data steward
DAT-02 / sensitive
Application evidence
- Purpose
- PUR-ELIGIBILITY: Evaluate the requested service application
- Necessity basis
- Named evidence is required for this synthetic eligibility review
- Evidence
- REQ-024-02 synthetic eligibility evidence rule
- Counterfactual
- Removing all evidence prevents this fixture from evaluating eligibility.
- Permission
- granted · PUR-ELIGIBILITY
- Retention
- 90 days · Synthetic appeal-window schedule
- Deletion
- Ninety days after final disposition · Delete primary record and expire indexed replicas
- Redaction
- Remove direct identifiers before analytics
- Owner
- Eligibility data steward
DAT-03 / optional
Marketing interests
- Purpose
- PUR-MARKETING: Personalize future promotional messages
- Necessity basis
- Not provided
- Evidence
- No evidence reference
- Counterfactual
- Not tested
- Permission
- withdrawn · PUR-MARKETING
- Retention
- 365 days ·
- Deletion
- When promotional permission is withdrawn · Delete marketing profile and downstream audience membership
- Redaction
- Exclude from operational export
- Owner
- Marketing data steward
DAT-04 / derived
Inferred vulnerability score
- Purpose
- PUR-PRIORITY: Prioritize applications for review
- Necessity basis
- The synthetic queue requires a documented priority order
- Evidence
- TEST-024-04 manual-queue comparison
- Counterfactual
- Without this score the fixture uses manual chronological review.
- Permission
- granted · PUR-PRIORITY
- Retention
- 90 days · Matches the synthetic source-record schedule
- Deletion
- When the underlying application is deleted · Recompute indexes, then delete score and cached copies
- Redaction
- Do not disclose outside authorized review
- Owner
- Review operations steward
DAT-05 / prohibited
Unrelated household browsing history
- Purpose
- PUR-GENERALIZED: Improve generalized prediction
- Necessity basis
- Not provided
- Evidence
- No evidence reference
- Counterfactual
- Not tested
- Permission
- withdrawn
- Retention
- Not bounded
- Deletion
- No complete deletion plan
- Redaction
- Do not collect
- Owner
- Privacy data steward
Unresolved rules
- DAT-03: optional data is still collected; permission does not establish necessity.
- DAT-03: document the basis for the retention period.
- DAT-05: prohibited data must not be collected.
- DAT-05: set a positive whole-day retention limit.
- DAT-05: document the basis for the retention period.
- DAT-05: specify both deletion trigger and deletion method.
Boundary: A passed deterministic control check is not proof of necessity, lawful processing, effective deletion, or compliance. Everything runs client-locally; use no real personal data.