A funnel needs to know whether onboarding completed, chat started, or a feature failed. It does not need the message text that accompanied those actions.
If generic event payloads accept arbitrary objects, conversation content can leak into analytics through convenience logging. The safer design allowlists event names and small metadata such as companion key, platform class, and success state.
What was actually going wrong
One flexible logging helper made technical telemetry and user conversation data look interchangeable.
What I tried
- Redacting message text after sending the event
- Hashing full chat content for analytics
- Using console logs as the only privacy boundary
Analytics events use fixed schemas with no content field, while diagnostic exports independently sanitize technical metadata.
Why it worked
Sensitive text cannot be included accidentally when the event contract has nowhere to put it.
Data minimization is strongest when enforced by shape.
Where EACI uses this today
Main funnels measure feature use separately from companion conversations.
This journal covers real engineering on EACI Companion / The Veil. Companions include Caelum, Chad, Natalia, Atreus, Luna, Roxy, and Cael. Journal articles stay family-safe in content. See Privacy and Ethics.