@orangecheck/legal 0.3.0 → 0.5.0

package/dist/index.mjs

@@ -885,7 +885,7 @@ var terms2 = {
       blocks: [
         {
           kind: "para",
-          text: "me.ochk.io is **non-custodial with respect to OrangeCheck**: OrangeCheck holds no private keys and no federation key shares, and cannot move your funds. BIP-322 users hold their own wallet. For email-OTP users, a Fedimint **federation** \u2014 run by independent guardian operators, never OrangeCheck \u2014 holds funds under a threshold scheme. You may **graduate** to full self-custody at any time."
+          text: "Custody depends on how you sign in, and the honest answer differs today from the design.\n\n**If you sign in with BIP-322, you hold your own keys.** They never leave your device. OrangeCheck verifies signatures and relays envelopes; it cannot move your funds. That is true now and does not change.\n\n**If you sign in with email, OrangeCheck currently holds the key that pays you.** The design is that a Fedimint federation \u2014 run by independent guardian operators, not OrangeCheck \u2014 holds funds under a threshold scheme, and you may **graduate** to full self-custody at any time. That federation does not exist yet: there are no independent guardians today, and during bring-up the signing key for the paying rail is operated by OrangeCheck. So for email users, during this period, OrangeCheck is a custodian and the party that moves the money.\n\nWe state that plainly rather than describing the destination as though it were the present. **The live status of the paying rail \u2014 which posture is in force, what bounds it, and what has actually settled \u2014 is published at [/custody](/custody) and machine-readable at `/api/federations`.** Those surfaces are computed from the system rather than written by hand, so they cannot drift from this document the way a fixed sentence would."
         },
         {
           kind: "stub",
@@ -1397,6 +1397,10 @@ var privacy3 = {
               k: "encrypted blobs",
               v: "opaque ciphertext keyed to your identity address \u2014 OrangeCheck cannot decrypt it"
             },
+            {
+              k: "per-item metadata",
+              v: 'one row per stored item, carrying its opaque envelope id and a last-updated timestamp. That means we CAN see how many items you store and when each last changed \u2014 the count is what enforces the per-account item ceiling in the service limits, and the timestamp is what lets a second device know which items to re-sync. We cannot see what any item is: not its contents, not its name, not its type. This entry previously appeared on the "what we cannot see" list, which was wrong.'
+            },
             {
               k: "access tokens",
               v: "for developer / CLI / CI access: an SHA-256 hash of each token, an optional label, the granted scope (read or read-write), creation / last-used / optional expiry timestamps. We never store the token itself \u2014 only its hash."
@@ -1418,7 +1422,6 @@ var privacy3 = {
           items: [
             "The contents of any vault item",
             "The names, titles, or types of your items",
-            "How many items you store or how often you use them",
             "Your vault key or any recovery material",
             "Your access tokens (only the SHA-256 hash is stored)",
             "Which sites the browser extension autofilled on \u2014 origin matching happens locally in your browser"