> ## Documentation Index
> Fetch the complete documentation index at: https://docs.batchrelay.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Event privacy

> Understand what shared event payloads expose and how authorized purchaser context differs.

Shared event payloads contain typed lifecycle facts and opaque resource
references. They exclude person names, contact details, child records, raw form
answers, authentication identifiers, image URLs, and arbitrary provider or
request payloads. Resource display names in supported catalog and order
summaries describe the purchased resource, not the child or purchaser.

Form response events report submission and change metadata. A change can name
a field without publishing its authored answer. Event and photo assignment
updates use opaque references. `actorkind` describes the actor category and
does not identify the transaction purchaser.

A `buyer_ref` permits correlation within the intended Studio or guest
transaction scope. It exposes no global guardian ID or Clerk ID. Names and
email are available only through the separately permissioned
[purchaser context endpoint](/events/purchaser-context.md). The universal event
ledger stays unchanged when an integration opts in.

The shipping topic has a narrow exception for known carrier, service level,
tracking number, and tracking URL facts. Other events do not acquire shipping
fields. Recipient and address details remain excluded.

A missing event capability prevents delivery of that topic. It does not turn
the frozen shared event into a different payload. Guardian connection topics
require their own explicit capability and privacy opt-in; that grant does not
authorize purchaser details.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.