@orangecheck/legal 0.7.16 → 0.7.18

package/dist/index.mjs

@@ -870,7 +870,7 @@ var terms2 = {
   metaTitle: "Terms of Service \u2014 ochk.app",
   metaDescription: "Terms of service for ochk.app: a Bitcoin-backed identity that pays users in sats. OrangeCheck custody during bring-up, federation custody and self-custody graduation as the destination, no KYC.",
   effective: "2026-05-15",
-  updated: "2026-10-19",
+  updated: "2026-10-24",
   preamble: [
     {
       kind: "callout",
@@ -983,7 +983,7 @@ var terms2 = {
       blocks: [
         {
           kind: "para",
-          text: "Sites that integrate ochk.app through its API at me.ochk.io receive a **per-integrator scoped identifier** for you, not your master identity \u2014 they cannot correlate you across sites unless you explicitly grant a scope. Integrators independently decide whether and how to trust your identity, including whether to admit, gate, or reject you. OrangeCheck is not a party to, and accepts no liability for, an integrator\u2019s decisions or an integrator\u2019s own terms, pricing, or conduct."
+          text: "Sites that integrate ochk.app through its API at me.ochk.io get their own subject id for the events they report, and your Bitcoin address, email or attestation tier only if you grant that scope. Signing in gives every site the same orangecheck id (did:oc), so sites that compare ids can tell it is you. Integrators independently decide whether and how to trust your identity, including whether to admit, gate, or reject you. OrangeCheck is not a party to, and accepts no liability for, an integrator\u2019s decisions or an integrator\u2019s own terms, pricing, or conduct."
         }
       ]
     },
@@ -1031,11 +1031,11 @@ var privacy2 = {
   kind: "privacy",
   eyebrow: "privacy",
   title: "Privacy policy",
-  description: "How ochk.app and its API at me.ochk.io handle your data: no KYC, no PII required, a per-integrator scoped identity, and a documented, falsifiable account of every record OrangeCheck stores.",
+  description: "How ochk.app and its API at me.ochk.io handle your data: no KYC, no PII required, and a documented, falsifiable account of every record OrangeCheck stores.",
   metaTitle: "Privacy Policy \u2014 ochk.app",
-  metaDescription: "ochk.app privacy policy. No KYC, no PII required, per-integrator scoped identity, and a full account of what OrangeCheck stores.",
+  metaDescription: "ochk.app privacy policy. No KYC, no PII required, and a full account of what OrangeCheck stores.",
   effective: "2026-05-15",
-  updated: "2026-10-19",
+  updated: "2026-10-24",
   preamble: [
     {
       kind: "callout",
@@ -1046,7 +1046,7 @@ var privacy2 = {
     {
       id: "at-a-glance",
       heading: "at a glance",
-      hint: "no kyc \xB7 no pii \xB7 scoped identity",
+      hint: "no kyc \xB7 no pii \xB7 what sites get",
       blocks: [
         {
           kind: "bullets",
@@ -1060,8 +1060,8 @@ var privacy2 = {
               v: "a Bitcoin signature needs no personal data; an email code, Google or GitHub sign-in stores your email address, encrypted"
             },
             {
-              k: "scoped identity",
-              v: "integrating sites receive a per-site identifier, not your master identity; they cannot correlate you across sites"
+              k: "what sites get",
+              v: "each site gets its own subject id for events, but signing in gives every site the same orangecheck id (did:oc), so sites that compare ids can tell it is you"
             },
             {
               k: "no advertising",
@@ -1113,11 +1113,11 @@ var privacy2 = {
     },
     {
       id: "scoped-identity",
-      heading: "per-integrator identity & scopes",
+      heading: "what sites get, and scopes",
       blocks: [
         {
           kind: "para",
-          text: "Each integrating site receives a deterministic **scoped subject** derived from your master identity and that site\u2019s project key. Scoped subjects are stable per-site (the integrator recognizes a returning user) but unlinkable across sites (two integrators cannot collude to correlate you). An integrator only ever receives your master Bitcoin address, email, or attestation tier if you **explicitly grant that scope** for that site \u2014 each scope is opt-in, per-site, and revocable at any time from your account."
+          text: "Each site gets its own subject id for events: a **scoped subject**, derived from your account and that site\u2019s project key, so the site recognizes you when you return. But signing in gives every site the same orangecheck id (did:oc), so sites that compare ids can tell it is you. An integrator only ever receives your master Bitcoin address, email, or attestation tier if you **explicitly grant that scope** for that site \u2014 each scope is opt-in, per-site, and revocable at any time from your account."
         },
         {
           kind: "para",
@@ -1209,7 +1209,7 @@ var privacy2 = {
       blocks: [
         {
           kind: "para",
-          text: "In [your settings](/me/settings) you can delete your account. A person reviews the request within 48 hours. Completing it erases your data on ochk.io, me.ochk.io, vault, chat and cosign and closes your sign-in, so signing in again starts a new account. Payment receipts are kept for accounting under an id that no longer leads to you, and backups roll off within 30 days. We keep a record that your account was deleted, under its id and out of public view, so sessions you already had stop working and the deletion can be shown. Deleting does not pay out sats OrangeCheck holds for you: settle a non-zero balance first. If you run a guardian, you can delete only once your operator key holds no seat or hosted guardian, has finished any exit, created no federation that still exists, and is owed nothing. Charter signatures, incidents and amendment proposals the key signed stay public under the key, with what you wrote in them; exit records and machine reports stay visible to that federation's guardians and to us. Hashes anchored to Bitcoin and records published to Nostr cannot be deleted by anyone. me.ochk.io's own anchors name no one, but attestations, polls, pledges, stamps and a chat listing you published carry your Bitcoin address."
+          text: "In [your settings](/me/settings) you can delete your account. A person reviews the request within 48 hours. Completing it erases your data on ochk.io, me.ochk.io, vault, chat and cosign and closes your sign-in, so signing in again starts a new account. Payment receipts are kept for accounting, and backups roll off within 30 days. We keep a record that your account was deleted, out of public view, so sessions you already had stop working and the deletion can be shown. Receipts and that record are kept under a keyed id, so the record by itself doesn't say whose account it was. Deleting does not pay out sats OrangeCheck holds for you: settle a non-zero balance first. If you run a guardian, you can delete only once your operator key holds no seat or hosted guardian, has finished any exit, created no federation that still exists, and is owed nothing. Charter signatures, incidents and amendment proposals the key signed stay public under the key, with what you wrote in them; exit records and machine reports stay visible to that federation's guardians and to us. Hashes anchored to Bitcoin and records published to Nostr cannot be deleted by anyone. me.ochk.io's own anchors name no one, but attestations, polls, pledges, stamps and a chat listing you published carry your Bitcoin address."
         }
       ]
     },
@@ -1232,7 +1232,7 @@ var privacy2 = {
     privacyChildren,
     privacyChanges
   ],
-  summary: "summary: no kyc, no pii required, a per-integrator scoped identity, and a documented account of every record orangecheck stores."
+  summary: "summary: no kyc, no pii required, and a documented account of every record orangecheck stores."
 };
 var meProfile = { terms: terms2, privacy: privacy2 };