Agent WranglersEmail privacy Required
Keep email logs lean
Log what you need to run and debug email, without full message bodies, and delete it on a set schedule.
How to do it
Log the message ID, template, time, status and recipient domain. Leave out bodies, sign-in links and reset tokens. Hash or shorten full addresses where you can. Delete sent messages and delivery logs after a fixed period, such as 30 days, and say so in the privacy policy. Keep personal data out of all logs, as in logs without personal data, and follow log retention.
How to check
Search the logs for a test recipient's full address, the message body and a reset link. None of them appears, and records older than the set period are gone.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers email playbook: https://agentwranglers.se/playbook/email/email-privacy/lean-email-logs.