@orangecheck/legal 0.7.19 → 0.7.20

package/dist/index.mjs

@@ -473,7 +473,7 @@ var terms = {
   metaTitle: "Terms of Service \u2014 OrangeCheck",
   metaDescription: "The terms and conditions for using OrangeCheck. Non-custodial service provided as-is. You are responsible for your wallet and private keys.",
   effective: "2025-09-30",
-  updated: "2026-10-20",
+  updated: "2026-10-26",
   preamble: [
     {
       kind: "callout",
@@ -574,6 +574,10 @@ var terms = {
               k: "blockchain data",
               v: "verification relies on third-party APIs (mempool.space, Esplora, or your own node). we do not guarantee accuracy or availability."
             },
+            {
+              k: "opentimestamps calendars",
+              v: "when you claim an OC Chat @handle, your browser sends the claim's fingerprint (a SHA-256 hash) to the OpenTimestamps calendars at alice.btc.calendar.opentimestamps.org, bob.btc.calendar.opentimestamps.org and finney.calendar.eternitywall.com, and reads your address's coins and block headers from mempool.space; each of these sees your IP address and when you asked."
+            },
             {
               k: "nostr network",
               v: "decentralized relays operated by third parties. published data is replicated outside our control and may persist indefinitely."
@@ -658,7 +662,7 @@ var privacy = {
   metaTitle: "Privacy Policy \u2014 OrangeCheck",
   metaDescription: "How OrangeCheck handles data and privacy. Non-custodial by design, minimal data collection, no account required, privacy-preserving analytics only.",
   effective: "2025-09-30",
-  updated: "2026-10-20",
+  updated: "2026-10-26",
   preamble: [
     {
       kind: "callout",
@@ -738,11 +742,11 @@ var privacy = {
             },
             {
               k: "each session",
-              v: "a hash of the session token, the IP address and full user-agent string of the device that opened it, and timestamps"
+              v: "a hash of the session token, the full user-agent string of the device that opened it, and timestamps"
             },
             {
               k: "sign-in log",
-              v: "each sign-in and each identity you link or remove, with the IP address and user-agent at the time \u2014 kept for security"
+              v: "each sign-in and each identity you link or remove, with the IP address and user-agent at the time \u2014 kept for security; the IP address is cleared after 90 days"
             },
             {
               k: "when you first sign in",
@@ -760,6 +764,16 @@ var privacy = {
             { k: "pages visited", v: "aggregate, to improve the Service" }
           ]
         },
+        { kind: "subhead", text: "sent from your browser to others" },
+        {
+          kind: "bullets",
+          items: [
+            {
+              k: "an OC Chat @handle claim",
+              v: "your browser sends the claim's fingerprint (a SHA-256 hash) to the OpenTimestamps calendars at alice.btc.calendar.opentimestamps.org, bob.btc.calendar.opentimestamps.org and finney.calendar.eternitywall.com, and reads your address's coins and block headers from mempool.space; each of these sees your IP address and when you asked. We send them nothing about you ourselves."
+            }
+          ]
+        },
         { kind: "subhead", text: "cookies & analytics" },
         {
           kind: "bullets",
@@ -819,6 +833,10 @@ var privacy = {
               k: "sessions",
               v: "deleted when you sign out. A session that simply expires after 30 days is not yet deleted automatically."
             },
+            {
+              k: "IP addresses in the sign-in log",
+              v: "cleared after 90 days; the entries themselves stay until your account is deleted"
+            },
             {
               k: "account, sign-in identities, passkeys and sign-in log",
               v: "deleted when your account-deletion request completes; file one in your account settings, or ask at [[PRIVACY_CONTACT]]"
@@ -1035,7 +1053,7 @@ var privacy2 = {
   metaTitle: "Privacy Policy \u2014 ochk.app",
   metaDescription: "ochk.app privacy policy. No KYC, no PII required, and a full account of what OrangeCheck stores.",
   effective: "2026-05-15",
-  updated: "2026-10-25",
+  updated: "2026-10-26",
   preamble: [
     {
       kind: "callout",
@@ -1093,7 +1111,11 @@ var privacy2 = {
             },
             {
               k: "session record",
-              v: "a hash of the session token, the account id, the IP address and user-agent of the device that opened it, and timestamps. The token itself lives only in your browser."
+              v: "a hash of the session token, the account id, the user-agent of the device that opened it, and timestamps. The token itself lives only in your browser."
+            },
+            {
+              k: "sign-in log",
+              v: "each sign-in and each identity you link or remove, with the IP address and user-agent at the time, kept for security; the IP address is cleared after 90 days."
             },
             {
               k: "event envelopes",
@@ -1188,9 +1210,13 @@ var privacy2 = {
               k: "session records",
               v: "retained until the session is revoked or expires"
             },
+            {
+              k: "IP addresses in the sign-in log",
+              v: "cleared after 90 days; the entries themselves stay until your account is deleted"
+            },
             {
               k: "account row",
-              v: "deleted, with your sign-in identities, passkeys and sessions, when your account-deletion request completes; anchored and published data cannot be deleted by anyone"
+              v: "deleted, with your sign-in identities, passkeys, sessions and sign-in log, when your account-deletion request completes; anchored and published data cannot be deleted by anyone"
             }
           ]
         }