For the first four months we logged filenames. Not contents — never contents — but names, sizes and the route taken, because that is what you want at three in the morning when a conversion is failing and you cannot reproduce it. Then we read our own privacy page and noticed we were describing a system we had not built.
What a filename gives away
More than you would think. Redundancy-consultation-final.docx. Scan-biopsy-results.pdf. Offer-letter-candidate-3.pdf. We were holding a quiet inventory of other people’s worst weeks, in a database, for debugging convenience.
What we replaced them with
- A random job id, which is what appears in any error we surface to you.
- The route taken, as format pairs with no reference to any particular file.
- Duration and outcome, as numbers.
- Nothing else. No name, no size histogram, no fingerprint.
What it cost
Real debugging comfort. Twice in six months we have had a failure we could not reproduce and could not investigate, and both times we shrugged and shipped a defensive fix rather than a targeted one. That is the honest cost, and it is smaller than the thing we were trading it for.
If a log would embarrass the person who generated it, it is not telemetry. It is a liability.
Files are deleted within the hour. Now the record of them is deleted at the moment the job ends, which is the only deletion schedule that needs no explaining.