ADR-005: Photos live at most 72 hours; the database holds metadata only
Who is this for
Section titled “Who is this for”Developers, operators and the owner — read this before storing anything derived from a guest’s photo.
- Selfies, face crops, sheets, anchors and debug images are files with a lifetime of at most 72 hours.
- The database never stores an image — only a file path, statuses, timestamps and the pack name.
- Status: accepted. Treated as a legal requirement, not a feature.
Context
Section titled “Context”The product processes face photos of event guests. Keeping them longer than needed creates legal exposure and leak risk for the organiser and for the team. The retention promise is also printed on the landing page and in the bot’s consent text.
Decision
Section titled “Decision”PHOTO_TTL_HOURSdefaults to 72. A value outside 1–72 is a start-up error (bot/config.py).- A cleanup loop in the bot process runs at start and then every hour and removes expired files
(
bot/services/storage.py,bot/main.py). The loop subtracts its own interval from the limit, so a file never outlives it. - The appearance passport is cleared from the job row when the job ends; the same loop clears any that were missed.
- Uploaded photos are re-encoded, which drops EXIF data such as location and device model
(
bot/api.py). - Photos are not included in backups.
Alternatives considered
Section titled “Alternatives considered”| Alternative | Why not |
|---|---|
| Delete everything the moment the pack is sent | A failed job could not be retried, and support at the station needs the photo for a while. |
| Keep photos for quality research | Not covered by the consent text. |
Consequences
Section titled “Consequences”- A failed job can be retried from the admin panel only while the selfie still exists.
- Debugging a bad pack is possible for three days at most.
- Cleanup runs only while the bot service runs — a stopped service stops deletion. See Backups & data lifecycle.
Evidence
Section titled “Evidence”Where to go next
Section titled “Where to go next”Last verified: 2026-11-13 against ai-sticker-pack@b715418 and ai-stickers-landing@e350ff5.