# PRIVATE RECORDING RETENTION: default off; never commit a real encryption key.
RAW_AUDIO_COLLECTION_ENABLED=false
# Must be the research protocol's approved maximum number of days (1..3650).
# Empty intentionally: an operator/research-controller decision is required.
RAW_AUDIO_RETENTION_DAYS=
# Base64-encoded, cryptographically random 32-byte AES-GCM key in HF Secrets.
# Back up this key privately; changing it prevents decryption of older payloads.
RAW_AUDIO_ENCRYPTION_KEY=

# COLLECTION_DB_PATH must already point to persistent, private storage.
# Live central collection path: /data/purepolyglot/collection-v2.sqlite3
# Audio ciphertext is stored in this DB, NOT a public dataset/audio directory.
# Each browser needs a current speech receipt, a separate private-recording
# receipt, and a server-recorded game-session/own-voice confirmation before upload.
# Completed microphone clips then upload automatically (no individual Save prompt).
# Game changes, backgrounding/minimizing, pagehide and reload clear client permission.
# Session DELETE is best effort on exit; server expiry is capped at 12 hours.
# Uploads recheck the bound session both before streaming and before commit.
# 8 MiB per recording; 128 MiB active ciphertext quota per participant.
# Shared-device Bridge recording retention is excluded.
# Default public research receipt's raw_audio_consent remains false on purpose:
# it is NOT a substitute for the supplementary private-recording receipt.
# The running API sweeps expiry every minute even after this feature is disabled.
# A stopped Space cannot run its sweeper; run purge_expired before reopening it.
# Withdrawal nulls active ciphertext/nonce in the same database transaction.
# Backup/public-copy erasure is NOT automatically attested. Restores must replay
# withdrawal records and expiry cleanup before restored data is made accessible.
# Raw audio is never public, placed on-chain/IPFS, or used for model training
# under this optional recording permission. Further purposes need separate review.