Retain server logs containing the IP address of all requests to this server no more than 90 days.
Retain the IP addresses associated with registered users and their posts no more than 5 years.
I’m pretty sure that the first of these refers to nginx and rails logs that are rotated in the container.
I’m not quite sure what “IP addresses associated with registered users and their posts” means, but I don’t see any evidence that these get removed from the database. Is this a promise to delete the registration IP after some time? Or is it about users and post, so it would refer only to something in the posts record (I dont’ see anything there?)