Release privacy: reconcile project-operated review demo and collection disclosures #325

Scope: client disclosures, with a separate review-service boundary

This is not an audit of every user's Plex/Jellyfin/Emby server, nor a claim that the normal client uploads meaningful diagnostic logs to the developer. There is one Labstream client app; the optional project-operated reviewer/demo server is a distinct destination the user selects, not a separate demo app.

Three paths must remain distinct:

1. Ordinary client diagnostics: bounded on-device events/files and OS-delivered diagnostic summaries. Source inspection found no automatic developer-upload path in the reviewed diagnostics/reporting code. Normal selected-server authentication, browse and playback/progress traffic is not diagnostic upload.
2. Explicit support sharing: copy/local export alone is not developer receipt. Opening the GitHub prefill URL transmits included fields to GitHub; submitting an issue or using a share destination is a separate user action. Redaction does not make every report non-personal or automatically exempt from disclosure.
3. Project-operated review/demo service: when selected, its operator receives normal service requests and may retain operational records. Its operational retention verification belongs to App Review: provision an isolated dedicated Jellyfin demo environment #280; this ticket must ensure policy/account answers accurately reflect the verified service behavior and remaining uncertainty.

Verified client-source findings

Rechecked at f1a6a5e0 (PR #327 head):

• AppDiagnostics is off by default, keeps a 300-event ring, writes redacted local unified/file logs and exports at most 80 recent events in a report.
• DiagnosticFileLogSink uses app-support storage with one active file and up to three rotated archives, nominally 1 MB each. Count/size bounds are not a time-based deletion guarantee.
• MetricKitDiagnostics stores bounded summaries locally for optional reports; tvOS uses an empty provider.
• FeedbackSheet and Settings expose affirmative GitHub/copy/share/export actions; GitHub prefill may include the report under its URL-length cap. No automatic network sender was identified in the reviewed diagnostics implementation/call sites.

This is source-level evidence, not packet-capture proof, a promise about Apple OS services, third-party server logging, or a final App Store privacy certification.

Acceptance by boundary

Client and wording (this issue)

• Inspect local diagnostic sinks and outbound report handoffs; separate normal media-server protocol traffic from developer telemetry.
• Review/merge PR docs: reconcile demo-service privacy and collection disclosures #329's correction of absolute no-developer-backend/media-hosting claims, preserving the ordinary-client versus optional-demo distinction.
• Resolve applicable support-data disclosure using all Apple optional-disclosure conditions and the owner's actual purposes/handling. The in-app submitting-account identity condition is not established; do not infer exemption from user initiation alone.
• Reconcile policy, manifest and proposed data/purpose/linkage answers against the exact candidate and approved review-service findings. No account edits without explicit approval; Privacy manifest: declare production systemUptime API use #326 required-reason APIs are separate.

Review-service evidence dependency (owned by #280)

• Link verified auth/activity expiry, centralized/edge retention, backup coverage and operator-access findings from App Review: provision an isolated dedicated Jellyfin demo environment #280. Unknown retention must remain unknown; an honest disclosure need not invent a fixed deletion period.

Current delivery

Merged PR #329 (181b9431, reviewed source ece31016) corrects wording and records a read-only service audit/proposed disclosure mapping; CI passed. It does not close this issue or change infrastructure, app behavior, manifests or App Store Connect answers. The previous Data Not Collected account answer is historical, not newly certified.

References: #92, #280, Apple App Privacy Details.