{
  "format": "pigeon/droppings/could-give/v1",
  "version": 1,
  "in_force_from": "2026-10-22",
  "approved_by": "owner 2026-10-24",
  "reason": "First version, the same table as pigeonmessage.io's law enforcement guidelines, version 1.0.",
  "rows": [
    {"category": "content", "asked": "Message content (text, photos, files)", "could": "Only encrypted data we can't decrypt, and only while it's still stored. A message is deleted from our servers once the recipient's device confirms it has it. We hold no keys: they stay on users' devices.", "planned": false, "sources": ["T02", "T07", "T25"]},
    {"category": "social_graph", "asked": "Who talks to whom", "could": "Nothing. A stored message carries no account, sender, recipient or group, and the mailbox addresses it's stored under change over time and aren't derived from anyone's keys.", "planned": false, "sources": ["T08", "T09"]},
    {"category": "contacts", "asked": "Contact lists and address books", "could": "Nothing. They stay on the device.", "planned": false, "sources": []},
    {"category": "group_membership", "asked": "Group names, members or sizes", "could": "Nothing. Groups exist only on members' devices.", "planned": false, "sources": ["T08"]},
    {"category": "subscriber", "asked": "Name, phone number, email, payment details", "could": "Nothing. We don't ask for them. An account is a set of public keys.", "planned": false, "sources": []},
    {"category": "handle", "asked": "Handle (Pigeon name) to account", "could": "Which account's public key a handle points to. Anyone can look that up.", "planned": true, "sources": []},
    {"category": "ip_logs", "asked": "IP addresses and connection times", "could": "Currently none from the past: our servers don't record visitors' IP addresses. Our hosting provider's own network records are outside our control. A court can order a provider to start recording; if one did, we'd say so here when the law allowed.", "planned": false, "sources": ["T05", "T36"]},
    {"category": "timing", "asked": "Timing and size of stored data", "could": "For messages still waiting on a server: the order they arrived and their size band, not linked to any account.", "planned": false, "sources": ["T21", "T36"]},
    {"category": "media", "asked": "Files and photos", "could": "Encrypted pieces we can't decrypt, if identified by their exact identifiers, until they expire. We can't search for “a user's files”.", "planned": false, "sources": ["T22", "T79"]},
    {"category": "abuse_reports", "asked": "Abuse reports", "could": "A report someone chose to send us: the messages they selected, the sender's account key and device, and the report's arrival time and IP address.", "planned": false, "sources": []},
    {"category": "invites", "asked": "Invite codes", "could": "That an account is registered for the alpha. We keep no record of who invited whom.", "planned": true, "sources": []},
    {"category": "lookups", "asked": "Name lookups", "could": "Nothing from the past: the directory is designed to keep no lookup log.", "planned": true, "sources": ["T27"]},
    {"category": "payments", "asked": "Payments", "could": "No payment record linked to an account: payment proofs are anonymous.", "planned": true, "sources": []},
    {"category": "keys", "asked": "Seed phrases, device keys, passwords", "could": "Nothing. We don't receive them; they stay on users' devices.", "planned": false, "sources": []}
  ],
  "actions": [
    {"category": "preserve", "asked": "Preserve data", "could": "Preserve what we hold that the request identifies. Preservation can't capture what we don't hold, and messages are deleted once delivered."},
    {"category": "remove", "asked": "Remove a file", "could": "Remove the exact upload named, and nothing else."},
    {"category": "prospective_logging", "asked": "Record data from now on", "could": "Nothing from the past. An order like this asks us to start holding something we don't hold today."},
    {"category": "assistance", "asked": "Change the software or the service", "could": "Not data. We'd consider every lawful way to challenge a demand like this."}
  ],
  "footnotes": [
    "The messages themselves are on people's devices. Whoever holds an unlocked device can read them; Pigeon can't unlock a device or help anyone else to.",
    "“Planned” means the feature isn't running yet; its row describes how it is designed.",
    "This table changes only with a change to Pigeon's code, which is public, and a new version here. Every entry points at the version in force when it was received."
  ]
}