DATA-001C1 — Pause optional My Account phone collection during privacy review #178

Outcome

Pause new optional phone-number collection on the signed-in My Account profile while MPRC performs the private incident, purpose, access, retention, and deployed-state review owned by #110, #112, and #113.

This is precautionary source containment. Current main denies anonymous/cross-user member-profile reads in source and tests, and the public email account-registration form has no phone field. The live Firebase Rules/Functions/App Check revision remains unproven, and the separate public Google membership form does require phone and emergency-contact numbers. Spam timing alone does not prove which system, if any, disclosed a number.

Invariant

After this change, the account page and its service do not offer or send a new phone number. A signed-in user may still edit their name. Existing stored phone values are preserved byte-for-byte and are not newly queried, exported, deleted, backfilled, or migrated by this issue; the existing owner-profile document read remains document-level.

Allowed transitions

• Existing profile + name edit -> only fullName and updatedAt change.
• Existing profile + unchanged phone -> phone remains unchanged.
• Direct self-service attempt to add or replace a non-empty phone -> Rules deny.

Failure cases

• Anonymous and cross-user profile reads/listing remain denied.
• A browser client cannot reintroduce phone collection by bypassing the UI.
• A failed save remains generic and leaves membership/payment state unchanged.
• No production record, provider Console, or real phone number is used in testing.

Scope

• Remove the Phone display and Phone edit control from My Account.
• Add short plain-language notice that phone collection is paused and existing data is not changed by this update.
• Make the account service validate/write name only.
• Narrow self-service Rules so non-empty phone mutations are denied while existing values can remain untouched.
• Add synthetic UI/service/Rules tests for the containment and retained authorization denials.
• Update the account workflow/system map and officer procedure.

Potential owned paths:

• src/pages/account/Account.tsx
• src/pages/account/Account.test.tsx
• src/services/account/accountService.ts
• src/services/account/accountService.test.ts
• src/types/member.ts
• firestore.rules
• tests/firestore-rules/members.test.js
• SYSTEM_DESIGN.md
• docs/officers/EVENTS_SHOP_MEMBERS.md
• docs/officers/SYSTEM_MAPS.md

Explicitly out of scope

• Existing-data deletion, backfill, export, inventory, or notification decisions (DATA-001B — Inventory personal data and approve a minimization/retention matrix #110/OPS-SEC-001 — Establish private security/privacy reporting and rehearse incident response #112/BACKEND-001 — Audit the Firebase cutover and approve legacy data disposition #113).
• Firebase Auth-derived user.phoneNumber and signup/recovery Functions.
• Google Forms/Sites/Sheets sharing or response access.
• Admin roster projection/capabilities (MEMBERS-ROSTER-001 — Add officer-only member roster view and safe CSV export #116).
• Event-registration, shop, Stripe, WhatsApp, Strava, Sentry, or Analytics phone fields.
• Workflow/deployment/provider configuration and every path claimed by TEST-001A2 — Reject sensitive emitted test artifacts and require the scrubber gate #177.
• Root SECURITY.md, GITHUB_ISSUES.md, GITHUB_ISSUE_SLICES.md, IMPLEMENTATION_PLAN.md, OPERATIONS_RUNBOOK.md, OFFICER_START_HERE.md, and docs/officers/PUBLISH_AND_CHECK.md.

Acceptance criteria

• My Account has no phone value, phone input, tel autocomplete, or phone state.
• Name-only edits send no phone field and preserve a generic failure path.
• Source Rules deny new/replacement non-empty phone writes and continue denying anonymous/cross-user/list access.
• Existing profile phone data is not deleted, migrated, exported, logged, or copied into fixtures.
• Focused frontend/service tests and the full frontend suite pass with synthetic data.
• Focused Rules tests and the full Rules suite pass in the emulator.
• Diagnostic production build passes without regenerating public/sitemap.xml.
• Diff review covers authorization, PII/logging, backward compatibility, and production fallback.

Migration and rollback

No data migration. Existing documents remain compatible. Rollback is a reviewed source revert or safe roll-forward; do not restore phone collection until #110 approves its purpose/disclosure/retention and #113/#133/#136 prove the intended protected deployment and access boundary.

Officer impact: Officers should stop directing members to store phone numbers in My Account; membership-form and provider handling remain a separate private review.

Officer documentation: docs/officers/EVENTS_SHOP_MEMBERS.md, docs/officers/SYSTEM_MAPS.md

Deployment evidence: Source/tests/merge, website publication, runmprc.com revision, Firebase Rules deployment, provider configuration, and production behavior must be recorded separately. This issue performs no provider or production-data action.