@orangecheck/legal 0.6.0 → 0.7.0

package/dist/index.js

@@ -818,9 +818,9 @@ var terms2 = {
   kind: "terms",
   eyebrow: "terms",
   title: "Terms of service",
-  description: "The terms governing your use of me.ochk.io \u2014 a Bitcoin-backed identity that pays you in sats. Federation-custodied by default, self-custody graduation, no KYC.",
+  description: "The terms governing your use of me.ochk.io \u2014 a Bitcoin-backed identity that pays you in sats. OrangeCheck-custodied during bring-up, federation custody and self-custody graduation as the destination, no KYC.",
   metaTitle: "Terms of Service \u2014 me.ochk.io",
-  metaDescription: "Terms of service for me.ochk.io: a Bitcoin-backed identity that pays users in sats. Federation custody, graduation to self-custody, no KYC.",
+  metaDescription: "Terms of service for me.ochk.io: a Bitcoin-backed identity that pays users in sats. OrangeCheck custody during bring-up, federation custody and self-custody graduation as the destination, no KYC.",
   effective: "2026-05-15",
   updated: "2026-05-15",
   preamble: [
@@ -843,7 +843,7 @@ var terms2 = {
         },
         {
           kind: "para",
-          text: "me.ochk.io is **not a bank, exchange, broker, or wallet provider.** It is an identity and reputation service with an attached cashback mechanism. OrangeCheck does not hold your funds \u2014 see section on custody below."
+          text: "me.ochk.io is **not a bank, exchange, broker, or wallet provider.** It is an identity and reputation service with an attached cashback mechanism. **During bring-up OrangeCheck operates every role in that mechanism, including custody of the balance it pays you.** That is a stage, not the design \u2014 see the custody section below for what holds today and what replaces it."
         }
       ]
     },
@@ -957,7 +957,7 @@ var terms2 = {
         { kind: "subhead", text: "regulatory status" },
         {
           kind: "stub",
-          text: "me.ochk.io facilitates cashback that is custodied and disbursed by independent Fedimint federations; OrangeCheck does not itself custody, transmit, or take possession of user funds. The full regulatory analysis of this arrangement \u2014 including OrangeCheck\u2019s position under the U.S. Bank Secrecy Act money-transmission rules, the FATF Recommendations, the EU MiCA Regulation, and applicable U.S. state money-transmitter regimes, and the corresponding licensing posture \u2014 is being prepared and will be published before general availability. This section will be completed following review by counsel."
+          text: "me.ochk.io is designed so that cashback is custodied and disbursed by independent Fedimint federations. **Those federations do not exist yet. During bring-up OrangeCheck itself custodies and transmits the funds it pays to email-identity users**, because it is operating every role in the system in order to prove it works before third parties take any of them. Self-custody (BIP-322) users are unaffected: OrangeCheck never holds their keys or their funds. The full regulatory analysis of both the bring-up posture and the designed end state \u2014 including OrangeCheck\u2019s position under the U.S. Bank Secrecy Act money-transmission rules, the FATF Recommendations, the EU MiCA Regulation, and applicable U.S. state money-transmitter regimes, and the corresponding licensing posture \u2014 is being prepared and will be published before general availability. This section will be completed following review by counsel."
         }
       ]
     },
@@ -977,7 +977,7 @@ var terms2 = {
     disputeResolution,
     miscellaneous
   ],
-  summary: "summary: an identity that pays you in sats. orangecheck holds no keys and no funds. money, custody, fee, and regulatory terms are being finalized \u2014 see the marked sections."
+  summary: "summary: an identity that pays you in sats. if you sign in with your own bitcoin wallet, orangecheck holds no keys and no funds. if you sign in with email, orangecheck holds the paying key during bring-up, until independent federations take it over. money, custody, fee, and regulatory terms are being finalized \u2014 see the marked sections."
 };
 var privacy2 = {
   kind: "privacy",
@@ -1499,283 +1499,11 @@ var privacy3 = {
 };
 var vaultProfile = { terms: terms3, privacy: privacy3 };
 
-// src/content/fleet.ts
-var COMMERCIAL_NOTE3 = "**OrangeCheck Fleet is a commercial product operated by OrangeCheck**, available at fleet.ochk.io. It is distinct from the non-custodial OrangeCheck protocol sites. Where an Enterprise customer has executed a separate Master Services Agreement, that agreement controls; otherwise these Terms govern.";
-var terms4 = {
-  kind: "terms",
-  eyebrow: "terms",
-  title: "Terms of service",
-  description: "The terms governing use of OrangeCheck Fleet \u2014 enterprise managed infrastructure for OC Agent and OC Pledge. No custody of customer keys or funds.",
-  metaTitle: "Terms of Service \u2014 OrangeCheck Fleet",
-  metaDescription: "Terms of service for OrangeCheck Fleet (fleet.ochk.io): enterprise managed infrastructure for OC Agent and OC Pledge. No custody of keys or funds.",
-  effective: "2026-05-15",
-  updated: "2026-05-15",
-  preamble: [
-    {
-      kind: "callout",
-      emphatic: true,
-      text: "By accessing or using OrangeCheck Fleet, you agree to be bound by these Terms on behalf of yourself and any organization you represent. If you do not agree, do not use the Service. These Terms contain a binding-arbitration, class-action, and jury-trial waiver and important limitations on liability."
-    },
-    { kind: "callout", text: COMMERCIAL_NOTE3 }
-  ],
-  sections: [
-    {
-      id: "overview",
-      heading: "overview",
-      hint: "what fleet is",
-      blocks: [
-        {
-          kind: "para",
-          text: "OrangeCheck Fleet is managed infrastructure for organizations deploying AI agents under the OC Agent and OC Pledge protocols. Fleet issues, scopes, and revokes agent delegations, records action receipts, and produces auditable evidence bundles."
-        },
-        {
-          kind: "para",
-          text: "Fleet holds **no customer private keys, no customer funds, and no custodial wallet of any kind.** Signing happens in the customer\u2019s wallet; bonded reputation stake is an attestation of unspent funds, never escrow. Fleet operates no token or points balance."
-        }
-      ]
-    },
-    {
-      id: "accounts",
-      heading: "accounts & operators",
-      blocks: [
-        {
-          kind: "para",
-          text: "A customer account is operated by one or more authorized individuals. You are responsible for the acts and omissions of everyone you authorize, for keeping credentials secure, and for ensuring the individuals you authorize have authority to bind your organization."
-        }
-      ]
-    },
-    {
-      id: "plans-billing",
-      heading: "plans, billing & payment",
-      hint: "stripe + lightning",
-      blocks: [
-        {
-          kind: "para",
-          text: "Fleet offers a free Community tier and paid Pro and Enterprise tiers. Paid tiers are billed in either Bitcoin (Lightning) or US dollars (card / ACH via Stripe, our payment processor)."
-        },
-        {
-          kind: "stub",
-          text: "The full commercial terms \u2014 current pricing, what each tier includes, the billing cycle, overage rates and metering, taxes, renewal and cancellation behavior, and the refund policy \u2014 are being finalized for publication. Current pricing is shown on /pricing. Card and ACH payments are processed by Stripe under Stripe\u2019s own terms. This section will be completed following review by counsel."
-        }
-      ]
-    },
-    {
-      id: "service-levels",
-      heading: "service levels",
-      hint: "uptime \xB7 support response",
-      blocks: [
-        {
-          kind: "stub",
-          text: "Fleet\u2019s service-level commitments \u2014 target uptime, the support-response times by tier, the measurement methodology, exclusions, and any service credits \u2014 are being finalized and will be published as a referenced Service Level Agreement. Until then, support-response targets are described on /pricing. This section will be completed following review by counsel."
-        }
-      ]
-    },
-    {
-      id: "customer-data",
-      heading: "customer data",
-      blocks: [
-        {
-          kind: "para",
-          text: "Fleet holds operator account metadata (email, billing address, plan tier), the public Bitcoin addresses you bind agents to, OC Agent action envelopes, OpenTimestamps proofs, and operational logs (90-day retention). Fleet does **not** hold raw action inputs beyond hashes unless you opt in. Processing of personal data is described in the [Privacy Policy](/privacy)."
-        },
-        {
-          kind: "stub",
-          text: "Enterprise customers that process personal data through Fleet may require a Data Processing Agreement. A standard DPA, including the sub-processor list and the international-transfer mechanism, is being finalized and will be made available to Enterprise customers. This section will be completed following review by counsel."
-        }
-      ]
-    },
-    acceptableUse,
-    intellectualProperty,
-    {
-      id: "enterprise-msa",
-      heading: "enterprise agreements",
-      blocks: [
-        {
-          kind: "stub",
-          text: "Enterprise-tier customers may execute a Master Services Agreement that supplements or supersedes these Terms \u2014 covering negotiated SLAs, the DPA, security commitments, self-hosting, indemnities, and liability terms specific to the engagement. The standard MSA template is being finalized. Where an executed MSA exists, it controls over any conflicting provision of these Terms. This section will be completed following review by counsel."
-        }
-      ]
-    },
-    {
-      id: "confidentiality",
-      heading: "confidentiality",
-      blocks: [
-        {
-          kind: "para",
-          text: "Each party may receive non-public information of the other. The receiving party will use it only to perform under these Terms, protect it with at least reasonable care, and not disclose it except to personnel and contractors bound by comparable obligations. This does not apply to information that is public, independently developed, or rightfully received from a third party."
-        }
-      ]
-    },
-    {
-      id: "disclaimers",
-      heading: "disclaimers & warranties",
-      hint: "as-is \xB7 compliance posture",
-      blocks: [
-        {
-          kind: "callout",
-          emphatic: true,
-          text: 'EXCEPT AS EXPRESSLY STATED IN AN EXECUTED MASTER SERVICES AGREEMENT, THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE", WITH ALL FAULTS AND WITHOUT WARRANTY OF ANY KIND. TO THE MAXIMUM EXTENT PERMITTED BY LAW, ORANGECHECK DISCLAIMS ALL WARRANTIES, EXPRESS, IMPLIED, AND STATUTORY \u2014 INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, AND ACCURACY.'
-        },
-        {
-          kind: "para",
-          text: 'Any compliance certification described as "in progress" (including SOC 2) is a statement of intent, not a warranty, until completed and the report issued. Fleet does not provide legal, financial, or regulatory-compliance advice.'
-        }
-      ]
-    },
-    limitationOfLiability,
-    indemnification,
-    eligibility,
-    {
-      id: "termination",
-      heading: "termination",
-      blocks: [
-        {
-          kind: "para",
-          text: "**Your right:** stop using Fleet and cancel a paid plan as described in the billing terms. **Our right:** suspend or terminate access for non-payment, breach, or legal or security risk. On termination you may export your action envelopes and audit bundles, which verify offline independently of Fleet. The confidentiality, disclaimer, liability, indemnification, governing-law, and dispute provisions survive."
-        }
-      ]
-    },
-    changesToTerms,
-    disputeResolution,
-    miscellaneous
-  ],
-  summary: "summary: managed agent infrastructure with no custody of customer keys or funds. billing, sla, dpa, and the enterprise msa are being finalized \u2014 see the marked sections."
-};
-var privacy4 = {
-  kind: "privacy",
-  eyebrow: "privacy",
-  title: "Privacy policy",
-  description: "How OrangeCheck Fleet handles personal data \u2014 operator account information and the metadata required to run managed agent infrastructure. No customer keys, no customer funds.",
-  metaTitle: "Privacy Policy \u2014 OrangeCheck Fleet",
-  metaDescription: "OrangeCheck Fleet privacy policy. Operator account data and orchestration metadata only; no customer keys, no customer funds, no raw action inputs.",
-  effective: "2026-05-15",
-  updated: "2026-05-15",
-  preamble: [
-    {
-      kind: "callout",
-      text: "This policy covers personal data OrangeCheck processes as a **controller** for the Fleet account relationship \u2014 operator and billing information. Where Fleet processes personal data **on a customer\u2019s behalf** as a processor, the customer\u2019s Data Processing Agreement governs that processing."
-    }
-  ],
-  sections: [
-    {
-      id: "what-we-collect",
-      heading: "information we collect",
-      blocks: [
-        {
-          kind: "bullets",
-          items: [
-            {
-              k: "operator account data",
-              v: "the email address and name of authorized operators"
-            },
-            {
-              k: "billing information",
-              v: "billing address and plan tier; card and ACH details are collected and held by Stripe, our payment processor, not by OrangeCheck"
-            },
-            {
-              k: "orchestration metadata",
-              v: "public Bitcoin addresses you bind agents to, OC Agent action envelopes, and OpenTimestamps proofs"
-            },
-            {
-              k: "operational logs",
-              v: "request and SLA-accounting logs sufficient for abuse response, retained 90 days"
-            }
-          ]
-        },
-        {
-          kind: "para",
-          text: "Fleet does not collect customer private keys, customer funds, or raw action inputs beyond hashes (unless a customer opts in)."
-        }
-      ]
-    },
-    {
-      id: "how-we-use",
-      heading: "how we use information",
-      blocks: [
-        {
-          kind: "bullets",
-          items: [
-            "Provision and operate managed agent infrastructure",
-            "Bill paid plans and account for service levels",
-            "Detect and respond to abuse and security incidents",
-            "Provide support and communicate service notices"
-          ]
-        }
-      ]
-    },
-    {
-      id: "sub-processors",
-      heading: "sub-processors",
-      blocks: [
-        {
-          kind: "para",
-          text: "Fleet relies on a small set of sub-processors \u2014 including a payment processor (Stripe) and hosting and infrastructure providers."
-        },
-        {
-          kind: "stub",
-          text: "The complete, current sub-processor list \u2014 each provider, its role, and its processing location \u2014 together with the mechanism for advance notice of changes is being finalized and will be published and referenced from the Data Processing Agreement. This section will be completed following review by counsel."
-        }
-      ]
-    },
-    {
-      id: "cookies",
-      heading: "cookies & analytics",
-      blocks: [
-        {
-          kind: "para",
-          text: "Essential cookies for authentication and a theme preference. Page analytics use [Plausible](https://plausible.io/privacy) \u2014 cookie-free, no PII, aggregate only \u2014 alongside our own first-party, cookieless analytics (oc insights): no cookies, no cross-site identity, IP hashed and immediately discarded, and Do-Not-Track / Global Privacy Control honored. No advertising or tracking cookies."
-        }
-      ]
-    },
-    {
-      id: "retention",
-      heading: "data retention",
-      blocks: [
-        {
-          kind: "bullets",
-          items: [
-            {
-              k: "operational logs",
-              v: "retained 90 days, then auto-deleted"
-            },
-            {
-              k: "account & billing records",
-              v: "retained for the life of the account and as required for accounting, tax, and audit obligations"
-            },
-            {
-              k: "action envelopes",
-              v: "retained for the life of the account; exportable by the customer at any time"
-            }
-          ]
-        }
-      ]
-    },
-    {
-      id: "data-security",
-      heading: "data security",
-      blocks: [
-        {
-          kind: "para",
-          text: "HTTPS in transit, access controls on production data, and a bounded blast radius by design \u2014 Fleet structurally cannot hold customer keys or funds. A SOC 2 examination is in progress; until the report is issued it is a statement of intent, not a warranty. We use reasonable measures but do not warrant security; see the [Terms of Service](/terms). We notify affected customers and any competent authority of a personal-data breach as required by applicable law."
-        }
-      ]
-    },
-    privacyRights,
-    privacyTransfers,
-    privacyRegional,
-    privacyChildren,
-    privacyChanges
-  ],
-  summary: "summary: operator and billing data plus orchestration metadata; no customer keys, no customer funds. card payments are held by stripe. dpa and sub-processor list are being finalized."
-};
-var fleetProfile = { terms: terms4, privacy: privacy4 };
-
 // src/content/index.ts
 var PROFILES = {
   protocol: protocolProfile,
   me: meProfile,
-  vault: vaultProfile,
-  fleet: fleetProfile
+  vault: vaultProfile
 };
 
 // src/build.ts