For a Next.js App Router application using the Node.js runtime on the Hobby plan, with no Log Drains, tracing rules, integrations, or application APM SDK, what is the documented collection/redaction behavior for an OAuth form_post callback?

The application does not log request values or raw exceptions. The authorization response arrives in a form-encoded POST body, followed by an encrypted, short-lived HttpOnly cookie and a fixed redirect. We understand this does not establish platform-level non-collection.

1. Are incoming POST bodies, Cookie headers, or outgoing Set-Cookie headers collected by default in runtime/access logs, firewall/security events, tracing, or platform error diagnostics?
2. Does the answer cover requests rejected before the application handler (for example invalid headers or request-size limits), and runtime failures after response headers have started?
3. If any of these values are collected, which documented controls exclude or redact them before storage or export, are those controls available on Hobby, and which collection layers do they cover?

Please distinguish customer-visible/exported logs from internal platform diagnostics and link to the applicable documentation or a maintained field/redaction specification. We are not requesting access to internal logs and will not provide real authorization codes, cookies, or credentials in this discussion.