TPA-RFC-12: expand on confidential issues

This is just a guess, I am not actually sure how to handle this.

But hopefully, this will...

Closes: team#40354

policy/tpa-rfc-2-support.md

@@ -73,7 +73,15 @@ in doubt, just file the issue with as much details as you can.
 
 You can also mark an issue as confidential, in which case only members
 of the team (and the larger "tpo" organisation on GitLab) will be able
-to read it.
+to read it. It is up to the submitter to decide whether an issue
+should be marked as confidential, but TPA might also mark tickets as
+confidential if they feel the information contained should not be
+public.
+
+As a rule of thumb, privately identifiable information like IP
+addresses, addresses, or email addresses should not be
+public. Information relevant only to `tor-internal` should also be
+handled only in confidential tickets.
 
 [GitLab]: https://gitlab.torproject.org/tpo/tpa/team/
 [direct link to a new ticket form]: https://gitlab.torproject.org/tpo/tpa/team/-/issues/new