diff --git a/.gitignore b/.gitignore
index 6155015..3239d65 100644
--- a/.gitignore
+++ b/.gitignore
@@ -23,6 +23,13 @@ Thumbs.db
 # Generated calibration inputs
 data/synthid_corpus/refs/
 
+# Real user uploads pulled from DO Spaces by the private raiw-app retention
+# checks (see raiw-app/.claude/rules/spaces-retention.md). Customer data has
+# no place in this public repository's history. Until 2026-09-07 the only
+# thing keeping 157k of these files out of a commit was an untracked
+# .gitignore inside the directory, which a fresh clone would not have.
+data/spaces/
+
 # Reference materials
 _refs/
 
diff --git a/CLAUDE.md b/CLAUDE.md
index 8dfd525..cc898ea 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -47,7 +47,7 @@ Research and current constraints are routed through [`docs/index.md`](docs/index
 
 ## Data safety
 
-Follow [`data/README.md`](data/README.md) for public fixture, calibration, oracle, and evaluation layout. Store each tracked binary once and keep generated evaluation outputs outside the repository.
+Follow [`data/README.md`](data/README.md) for public fixture, calibration, oracle, and evaluation layout. Real customer uploads never enter this repository: the private `raiw-app` retention checks materialize them under `data/spaces/`, which is gitignored here for that reason, and nothing under it may be committed, quoted, or turned into a fixture. Store each tracked binary once and keep generated evaluation outputs outside the repository.
 
 ## Rules and conventions