That’s a real good case for the application website not storing it (which is in the CA law being proposed)