# Data

Four sentences, and what they mean in practice.

1. **mximp does not keep your mail.** A message is processed and delivered; it is retained only while a task on it is open or while it is pinned as a test case.
2. **No customer content is ever used to train any model**, by mximp or by any provider mximp uses.
3. **A model reads a message only to write configuration**, only if you opted in to hosted teaching or used the try page, only inside Cloudflare; its output is verified rules, never stored values.
4. **Structural rules** (where a field sits, what it is labelled) may be shared across tenants unless a bucket says `no_share`; **nothing a document said ever crosses tenants.**

Third-party model use is opt-in. Rule sharing is opt-out.

## What is delivered

Every bucket has at least one destination; a bucket without one is a configuration error and its mail waits as *undelivered*. `set_tenant_policy` with `unrouted_destination` gives unrouted mail somewhere to go too. A delivery carries the whole message, so you always have the original:

| Destination | Carries |
|---|---|
| Webhook | the capture as JSON, and the original as a signed URL good for thirty minutes (`raw: url`, the default), or inline as base64 (`raw: inline`), or not at all (`raw: none`) |
| Email forward | the original as a `message/rfc822` attachment and the capture as JSON, once sending is onboarded |
| Hold | when policy opens a task, nothing leaves until it is resolved; the message is retained meanwhile |

Fetch the original during delivery if you want it: the message is deleted soon after.

## What is retained, and for how long

| Object | Retention |
|---|---|
| Raw message, sanitized text, hidden text, documents | until every destination has received it, then deleted within the hour. Kept while a live test case pins the message, or a task on it is open |
| Undelivered messages | until a destination receives them or you `delete_message` them; `list_captures` with `delivery=undelivered`; a cap and an age alarm per tenant |
| Capture field values | kept by default (small, and you asked for them); a bucket policy `store_captures: false` keeps only metadata |
| Metadata | who, when, which bucket, what became of it, which destination received it: kept |
| Events | metadata only: ids, actor, bucket, status, reason; never body text or field values |
| Test cases | the message and expected values, tenant-private, capped per bucket |
| Sandbox | nothing is delivered and everything is held; the whole tenant is deleted at expiry, 24 hours |

Deletion is real deletion from storage, logged as a `message.deleted` event with the reason. After it, `get_message` answers with metadata and `retention.retained: false`, `reprocess_message` refuses (`ingest_message` the original again instead), and a delivery's raw link answers 410.

A paid hold tier with 30 or 60 days of retention exists in the design for anyone who asks. Nobody has.