How to clear the list on View Sent Form

[LN]

Can you describe in greater detail what your role is and what you're trying to do? If you're the form designer, you should be able to choose what information to include in the form instance name as described in the documentation. In particular, the documentation states the following:

A sent form's instance_name is maintained after it is deleted. This makes it possible to confirm what work has been completed even if submissions are configured to delete after send. However, it does mean sensitive data should be avoided in instance_name.

@wroos

have a final question (e.g. acknowledgement type) in the form to anonymise the data (names etc.) and the instance_name, before finalisation/send.

This is a really great suggestion if you want to both have a meaningful instance name for any drafts saved and make sure that sensitive data does not remain on the device.

It would not address the desire to have a meaningful submission name on Central. If that's the need you have it would be helpful to understand your workflow and how you're using instance name on Central in greater detail.

@gessel

it has become fairly standard for even lower-tech adversaries to employ phone forensic devices and extract all data from a phone for later analysis

Does this mean that your data collectors are using devices that do not auto lock? Or maybe older Android devices or ones by untrusted companies? If your devices auto lock and run Android 10 or greater, they should also be encrypted and therefore virtually impossible to get any data from without the device pin/biometrics.

@gessel

It would seem that if encrypted forms are used, metadata should also be expunged by default.

Which metadata are you concerned about? Do you consider e.g. the count of submissions made per form to be sensitive? In general, I expect that folks using submission encryption would either leave instance name blank or set it to something generic (e.g. "Sent").

ODK tends to give users a lot of power and responsibility. That helps make it a very flexible platform but it does mean that form/project designers need to do more cost/benefit analysis than if ODK prescribed more of a set workflow.

@gessel

This is obviously an insanely dangerous data leak

@gessel

It is clearly a bug and a dangerous one

Consider describing your use case in detail so the core team has expanded context to design against (see @BartRoelandt2's example at Assessing the quality of Natura2000 habitats and monitoring of management of the same habitats). In general, please consider that ODK is produced by people and that the kind of language used here is not a great way to motivate us to help solve your problem.