Skip to main content
Shared event payloads contain typed lifecycle facts and opaque resource references. They exclude person names, contact details, child records, raw form answers, authentication identifiers, image URLs, and arbitrary provider or request payloads. Resource display names in supported catalog and order summaries describe the purchased resource, not the child or purchaser. Form response events report submission and change metadata. A change can name a field without publishing its authored answer. Event and photo assignment updates use opaque references. actorkind describes the actor category and does not identify the transaction purchaser. A buyer_ref permits correlation within the intended Studio or guest transaction scope. It exposes no global guardian ID or Clerk ID. Names and email are available only through the separately permissioned purchaser context endpoint. The universal event ledger stays unchanged when an integration opts in. The shipping topic has a narrow exception for known carrier, service level, tracking number, and tracking URL facts. Other events do not acquire shipping fields. Recipient and address details remain excluded. A missing event capability prevents delivery of that topic. It does not turn the frozen shared event into a different payload. Guardian connection topics require their own explicit capability and privacy opt-in; that grant does not authorize purchaser details.