@orangecheck/legal 0.7.18 → 0.7.20

package/dist/index.js

@@ -479,7 +479,7 @@ var terms = {
   metaTitle: "Terms of Service \u2014 OrangeCheck",
   metaDescription: "The terms and conditions for using OrangeCheck. Non-custodial service provided as-is. You are responsible for your wallet and private keys.",
   effective: "2025-09-30",
-  updated: "2026-10-20",
+  updated: "2026-10-26",
   preamble: [
     {
       kind: "callout",
@@ -580,6 +580,10 @@ var terms = {
               k: "blockchain data",
               v: "verification relies on third-party APIs (mempool.space, Esplora, or your own node). we do not guarantee accuracy or availability."
             },
+            {
+              k: "opentimestamps calendars",
+              v: "when you claim an OC Chat @handle, your browser sends the claim's fingerprint (a SHA-256 hash) to the OpenTimestamps calendars at alice.btc.calendar.opentimestamps.org, bob.btc.calendar.opentimestamps.org and finney.calendar.eternitywall.com, and reads your address's coins and block headers from mempool.space; each of these sees your IP address and when you asked."
+            },
             {
               k: "nostr network",
               v: "decentralized relays operated by third parties. published data is replicated outside our control and may persist indefinitely."
@@ -664,7 +668,7 @@ var privacy = {
   metaTitle: "Privacy Policy \u2014 OrangeCheck",
   metaDescription: "How OrangeCheck handles data and privacy. Non-custodial by design, minimal data collection, no account required, privacy-preserving analytics only.",
   effective: "2025-09-30",
-  updated: "2026-10-20",
+  updated: "2026-10-26",
   preamble: [
     {
       kind: "callout",
@@ -744,11 +748,11 @@ var privacy = {
             },
             {
               k: "each session",
-              v: "a hash of the session token, the IP address and full user-agent string of the device that opened it, and timestamps"
+              v: "a hash of the session token, the full user-agent string of the device that opened it, and timestamps"
             },
             {
               k: "sign-in log",
-              v: "each sign-in and each identity you link or remove, with the IP address and user-agent at the time \u2014 kept for security"
+              v: "each sign-in and each identity you link or remove, with the IP address and user-agent at the time \u2014 kept for security; the IP address is cleared after 90 days"
             },
             {
               k: "when you first sign in",
@@ -766,6 +770,16 @@ var privacy = {
             { k: "pages visited", v: "aggregate, to improve the Service" }
           ]
         },
+        { kind: "subhead", text: "sent from your browser to others" },
+        {
+          kind: "bullets",
+          items: [
+            {
+              k: "an OC Chat @handle claim",
+              v: "your browser sends the claim's fingerprint (a SHA-256 hash) to the OpenTimestamps calendars at alice.btc.calendar.opentimestamps.org, bob.btc.calendar.opentimestamps.org and finney.calendar.eternitywall.com, and reads your address's coins and block headers from mempool.space; each of these sees your IP address and when you asked. We send them nothing about you ourselves."
+            }
+          ]
+        },
         { kind: "subhead", text: "cookies & analytics" },
         {
           kind: "bullets",
@@ -825,6 +839,10 @@ var privacy = {
               k: "sessions",
               v: "deleted when you sign out. A session that simply expires after 30 days is not yet deleted automatically."
             },
+            {
+              k: "IP addresses in the sign-in log",
+              v: "cleared after 90 days; the entries themselves stay until your account is deleted"
+            },
             {
               k: "account, sign-in identities, passkeys and sign-in log",
               v: "deleted when your account-deletion request completes; file one in your account settings, or ask at [[PRIVACY_CONTACT]]"
@@ -1041,7 +1059,7 @@ var privacy2 = {
   metaTitle: "Privacy Policy \u2014 ochk.app",
   metaDescription: "ochk.app privacy policy. No KYC, no PII required, and a full account of what OrangeCheck stores.",
   effective: "2026-05-15",
-  updated: "2026-10-24",
+  updated: "2026-10-26",
   preamble: [
     {
       kind: "callout",
@@ -1099,7 +1117,11 @@ var privacy2 = {
             },
             {
               k: "session record",
-              v: "a hash of the session token, the account id, the IP address and user-agent of the device that opened it, and timestamps. The token itself lives only in your browser."
+              v: "a hash of the session token, the account id, the user-agent of the device that opened it, and timestamps. The token itself lives only in your browser."
+            },
+            {
+              k: "sign-in log",
+              v: "each sign-in and each identity you link or remove, with the IP address and user-agent at the time, kept for security; the IP address is cleared after 90 days."
             },
             {
               k: "event envelopes",
@@ -1109,6 +1131,10 @@ var privacy2 = {
               k: "custody-state envelopes",
               v: "a record of each federation \u21C4 self-custody transition (graduation), surfaced on your own identity timeline."
             },
+            {
+              k: "site sign-ins",
+              v: "which live sites you signed in to or shared data with through orangecheck, and when. A site can name you as the person who earned for an event only once this record exists. No site sees it, and it is erased with your account or with that site's project."
+            },
             {
               k: "public anchors",
               v: "an OpenTimestamps proof over each envelope\u2019s hash, and a salted commitment to each envelope on Nostr. Public by design, and neither names you, the site or the amount. The envelope itself is served only to whoever holds its id. Drop manifests, which name no one, are published in full."
@@ -1127,7 +1153,7 @@ var privacy2 = {
         },
         {
           kind: "para",
-          text: "Integrators never receive your event history with other sites, your wallet balance, your connected-sites list, or any cross-integrator data, regardless of scopes granted."
+          text: "Integrators never receive your event history with other sites, your wallet balance, your site sign-ins, or any cross-integrator data, regardless of scopes granted."
         }
       ]
     },
@@ -1190,9 +1216,13 @@ var privacy2 = {
               k: "session records",
               v: "retained until the session is revoked or expires"
             },
+            {
+              k: "IP addresses in the sign-in log",
+              v: "cleared after 90 days; the entries themselves stay until your account is deleted"
+            },
             {
               k: "account row",
-              v: "deleted, with your sign-in identities, passkeys and sessions, when your account-deletion request completes; anchored and published data cannot be deleted by anyone"
+              v: "deleted, with your sign-in identities, passkeys, sessions and sign-in log, when your account-deletion request completes; anchored and published data cannot be deleted by anyone"
             }
           ]
         }