AI HUB DATA CONTRACT v1

PUBLIC: catalog metadata, approved package files, aggregate stars/downloads, approved public handles, approved community content.
MODERATION-ONLY: pending title, summary, public source URL, requested public handle, status timestamps, opaque actor hash.
NOT COLLECTED BY APPLICATION: email, legal name, phone, raw IP, browser fingerprint, payment instrument, private repository credentials.
DEVICE COOKIE: random UUID, HttpOnly, Secure, SameSite=Lax; server stores SHA-256 hash only.
RETENTION: moderation records are retained only while operationally necessary; deletion workflow is required before account features launch.