Account records store an email, a username, a password hash, a date of birth, and a country. Passwords are never stored in plaintext.
Legal
Privacy
Personal data is explained in plain language before restricted features collect anything more sensitive.
Login attempts keep a hash of the email and a hash of the IP address. Verification documents, when that phase exists, stay in private storage and out of public APIs.
Public profile fields will be an explicit allow-list. A profile is not published by default.