Idk what the current status is but last I checked they literally keep addresses and names in a Totally Secure ™ government database and just like hash (or some other “one way” crypto encoding) them when distributing subsets to researchers. Have they actually changed that policy of direct retention?