@orangecheck/legal 0.7.2 → 0.7.4

package/dist/index.mjs

@@ -471,7 +471,7 @@ var terms = {
   metaTitle: "Terms of Service \u2014 OrangeCheck",
   metaDescription: "The terms and conditions for using OrangeCheck. Non-custodial service provided as-is. You are responsible for your wallet and private keys.",
   effective: "2025-09-30",
-  updated: "2026-05-15",
+  updated: "2026-10-08",
   preamble: [
     {
       kind: "callout",
@@ -550,7 +550,7 @@ var terms = {
       blocks: [
         {
           kind: "para",
-          text: "Most of the Service works without registration. An optional **Sign in with Bitcoin** flow opens a session keyed to a Bitcoin address you prove control of via BIP-322 \u2014 no password, no email. A session is a server-side row plus an `httpOnly + Secure + SameSite=Lax` cookie, revoked when you sign out or the cookie expires."
+          text: "Most of the Service works without registration. Optional sign-in proves one of: a Bitcoin address (a BIP-322 signature), an email inbox (a one-time code), or a Google or GitHub account. No password is ever created. A session is a server-side row plus an `HttpOnly; Secure; SameSite=None` cookie on `.ochk.io`, revoked when you sign out or the cookie expires."
         },
         {
           kind: "para",
@@ -656,7 +656,7 @@ var privacy = {
   metaTitle: "Privacy Policy \u2014 OrangeCheck",
   metaDescription: "How OrangeCheck handles data and privacy. Non-custodial by design, minimal data collection, no account required, privacy-preserving analytics only.",
   effective: "2025-09-30",
-  updated: "2026-05-15",
+  updated: "2026-10-08",
   preamble: [
     {
       kind: "callout",
@@ -682,7 +682,7 @@ var privacy = {
             },
             {
               k: "optional account",
-              v: "most of the Service needs no sign-in; the optional Sign in with Bitcoin flow is keyed to a public address \u2014 no email, no password"
+              v: "most of the Service needs no sign-in; optional sign-in uses a Bitcoin signature, an email code, or Google/GitHub \u2014 never a password"
             },
             {
               k: "transparency",
@@ -716,7 +716,34 @@ var privacy = {
         { kind: "subhead", text: "information you provide" },
         {
           kind: "para",
-          text: "**Bitcoin addresses and signatures** are processed client-side to generate a cryptographic proof; this data is public by design. **Identity bindings** you add are included in the signed message and are public. **Contact information** is collected only if you email us for support, solely to respond. **Sign-in sessions** store a minimal account row keyed by your verified Bitcoin address plus session rows with a random id, source IP, a user-agent hash, and timestamps \u2014 no password, no email."
+          text: "**Bitcoin addresses and signatures** are processed client-side to generate a cryptographic proof; this data is public by design. **Identity bindings** you add are included in the signed message and are public. **Messages you send us** \u2014 through the contact form or by email \u2014 reach our inbox through our email provider (Resend) and are kept only as long as we need them to reply."
+        },
+        { kind: "subhead", text: "if you sign in" },
+        {
+          kind: "bullets",
+          items: [
+            {
+              k: "account",
+              v: "an opaque `did:oc` identifier, an optional display name and Nostr npub, and when the account was created and last signed in"
+            },
+            {
+              k: "how you sign in",
+              v: "a Bitcoin address you prove with a signature (stored as is \u2014 it is public on-chain anyway); or, for an email code, Google or GitHub, the verified email address \u2014 encrypted at rest, plus a one-way hash of it so we can find your account"
+            },
+            {
+              k: "passkeys",
+              v: "for each passkey you register: its public key, a label, the transports it reported, and when it was added and last used"
+            },
+            {
+              k: "each session",
+              v: "a hash of the session token, the IP address and full user-agent string of the device that opened it, and timestamps"
+            },
+            {
+              k: "sign-in log",
+              v: "each sign-in and each identity you link or remove, with the IP address and user-agent at the time \u2014 kept for security"
+            },
+            { k: "never", v: "a password, a private key, or a seed phrase" }
+          ]
         },
         { kind: "subhead", text: "automatically collected" },
         {
@@ -728,9 +755,26 @@ var privacy = {
           ]
         },
         { kind: "subhead", text: "cookies & analytics" },
+        {
+          kind: "bullets",
+          items: [
+            {
+              k: "oc_session",
+              v: "your sign-in, set by ochk.io for every `*.ochk.io` site: HttpOnly; Secure; SameSite=None; Domain=.ochk.io; 30 days"
+            },
+            {
+              k: "oc_oauth_state",
+              v: "only during a Google or GitHub sign-in: HttpOnly; SameSite=Lax; 10 minutes; deleted when the sign-in completes"
+            },
+            {
+              k: "oc_theme \xB7 oc_skin \xB7 oc_motion",
+              v: "your light/dark, appearance and reduced-motion choices (Domain=.ochk.io); not used to identify you"
+            }
+          ]
+        },
         {
           kind: "para",
-          text: "Essential cookies are required for the Service to function; a preference cookie stores your theme. We use [Plausible Analytics](https://plausible.io/privacy) \u2014 cookie-free, no personal data, aggregate statistics only \u2014 alongside our own first-party, cookieless analytics (oc insights): no cookies, no cross-site identity, your IP address is hashed and immediately discarded (never stored), and Do-Not-Track / Global Privacy Control signals are honored. No advertising or tracking cookies."
+          text: "A browser tab may also keep its own copy of a sign-in token in session storage, cleared when the tab closes. We use [Plausible Analytics](https://plausible.io/privacy) \u2014 cookie-free, no personal data, aggregate statistics only \u2014 alongside our own first-party, cookieless analytics (oc insights): no cookies, no cross-site identity, your IP address is hashed and immediately discarded (never stored), and Do-Not-Track / Global Privacy Control signals are honored. No advertising or tracking cookies."
         }
       ]
     },
@@ -752,7 +796,7 @@ var privacy = {
     {
       id: "retention",
       heading: "data retention",
-      hint: "90d logs \xB7 permanent public artifacts",
+      hint: "no automatic deletion yet \xB7 permanent public artifacts",
       blocks: [
         {
           kind: "bullets",
@@ -762,12 +806,16 @@ var privacy = {
               v: "permanent and publicly shareable; data published to Nostr cannot be deleted by OrangeCheck"
             },
             {
-              k: "technical logs",
-              v: "server logs retained 90 days for security and debugging, then auto-deleted"
+              k: "request logs",
+              v: "held by our hosting provider (Vercel) for its own short retention window; we keep no separate copy"
             },
             {
-              k: "session rows",
-              v: "live up to 30 days (cookie max-age) or until revoked; idle accounts with no session activity for 24 months are deleted automatically"
+              k: "sessions",
+              v: "deleted when you sign out. A session that simply expires after 30 days is not yet deleted automatically."
+            },
+            {
+              k: "account, sign-in identities, passkeys and sign-in log",
+              v: "kept until you ask us to delete them at [[PRIVACY_CONTACT]]; there is no automatic deletion yet"
             },
             {
               k: "support emails",
@@ -816,7 +864,7 @@ var terms2 = {
   metaTitle: "Terms of Service \u2014 me.ochk.io",
   metaDescription: "Terms of service for me.ochk.io: a Bitcoin-backed identity that pays users in sats. OrangeCheck custody during bring-up, federation custody and self-custody graduation as the destination, no KYC.",
   effective: "2026-05-15",
-  updated: "2026-05-15",
+  updated: "2026-10-09",
   preamble: [
     {
       kind: "callout",
@@ -963,7 +1011,7 @@ var terms2 = {
       blocks: [
         {
           kind: "para",
-          text: "**Your right:** stop using me.ochk.io at any time; you may delete your identity from `/me/settings`. **Our right:** suspend or terminate access with or without cause, including for abuse or legal risk. Deleting your identity does not settle a balance OrangeCheck owes you, and during bring-up there is no sweep to self-custody to run first \u2014 no federation is bound. If your balance is above zero, bind a payout destination and instruct a cash-out before you delete, or contact us. Anchored events on Bitcoin and Nostr-published envelopes are immutable and cannot be deleted by OrangeCheck. The disclaimer, liability, indemnification, governing-law, and dispute provisions survive."
+          text: "**Your right:** stop using me.ochk.io at any time; you may delete your identity from `/me/settings`. **Our right:** suspend or terminate access with or without cause, including for abuse or legal risk. Deleting your identity does not settle a balance OrangeCheck owes you, and during bring-up there is no sweep to self-custody to run first \u2014 no federation is bound. If your balance is above zero, bind a payout destination and instruct a cash-out before you delete, or contact us. Hashes anchored to Bitcoin and commitments published to Nostr are immutable and cannot be deleted by OrangeCheck; neither names you. The disclaimer, liability, indemnification, governing-law, and dispute provisions survive."
         }
       ]
     },
@@ -981,7 +1029,7 @@ var privacy2 = {
   metaTitle: "Privacy Policy \u2014 me.ochk.io",
   metaDescription: "me.ochk.io privacy policy. No KYC, no PII required, per-integrator scoped identity, and a full account of what OrangeCheck stores.",
   effective: "2026-05-15",
-  updated: "2026-05-15",
+  updated: "2026-10-09",
   preamble: [
     {
       kind: "callout",
@@ -1002,8 +1050,8 @@ var privacy2 = {
               v: "me.ochk.io never collects your legal name, government ID, or physical address"
             },
             {
-              k: "no pii at signup",
-              v: "you sign up with a Bitcoin signature or an email/phone one-time code \u2014 your choice"
+              k: "little pii at signup",
+              v: "a Bitcoin signature needs no personal data; an email code, Google or GitHub sign-in stores your email address, encrypted"
             },
             {
               k: "scoped identity",
@@ -1039,7 +1087,7 @@ var privacy2 = {
             },
             {
               k: "session record",
-              v: "the session JWT id, account id, and issue/revoke timestamps. The session token itself lives only as a cookie in your browser."
+              v: "a hash of the session token, the account id, the IP address and user-agent of the device that opened it, and timestamps. The token itself lives only in your browser."
             },
             {
               k: "event envelopes",
@@ -1051,7 +1099,7 @@ var privacy2 = {
             },
             {
               k: "public anchors",
-              v: "OpenTimestamps proofs and Nostr-published event roots \u2014 public by design, verifiable against Bitcoin without OrangeCheck online"
+              v: "an OpenTimestamps proof over each envelope\u2019s hash, and a salted commitment to each envelope on Nostr. Public by design, and neither names you, the site or the amount. The envelope itself is served only to whoever holds its id. Drop manifests, which name no one, are published in full."
             }
           ]
         }
@@ -1088,7 +1136,7 @@ var privacy2 = {
       blocks: [
         {
           kind: "para",
-          text: "Two cookies. `oc_session` \u2014 the Ed25519-signed session token issued by ochk.io (HttpOnly, Secure, SameSite=Lax, Domain=.ochk.io). `oc_theme` \u2014 your dark/light preference, not auth-bearing. No tracking cookies, no advertising IDs, no third-party pixels. Page analytics use [Plausible](https://plausible.io/privacy) \u2014 cookie-free, no PII, aggregate only."
+          text: "Four cookies. `oc_session` \u2014 the Ed25519-signed session token issued by ochk.io (HttpOnly, Secure, SameSite=None, Domain=.ochk.io). `oc_theme`, `oc_skin` and `oc_motion` \u2014 your dark/light, appearance and reduced-motion preferences (Domain=.ochk.io), not auth-bearing. No tracking cookies, no advertising IDs, no third-party pixels. Page analytics use [Plausible](https://plausible.io/privacy) \u2014 cookie-free, no PII, aggregate only."
         }
       ]
     },
@@ -1116,11 +1164,11 @@ var privacy2 = {
           items: [
             {
               k: "event & rebind envelopes",
-              v: "retained as the canonical earnings and custody-state record; anchored copies on Bitcoin and Nostr are immutable"
+              v: "retained as the canonical earnings and custody-state record; their hashes on Bitcoin and commitments on Nostr are immutable"
             },
             {
-              k: "technical logs",
-              v: "retained 90 days for security and debugging, then auto-deleted"
+              k: "request logs",
+              v: "held by our hosting provider (Vercel) for its own short retention window; we keep no separate copy"
             },
             {
               k: "session records",
@@ -1151,7 +1199,7 @@ var privacy2 = {
       blocks: [
         {
           kind: "para",
-          text: "From `/me/settings \u2192 advanced \u2192 delete` you can permanently revoke your OrangeCheck identity. Deleting does not pay out sats OrangeCheck owes you, and there is no sweep to self-custody to run first: no federation is bound during bring-up. Settle a non-zero balance before you delete. OrangeCheck deletes the operational records it holds about you; events already anchored to Bitcoin headers or published to Nostr are immutable public records of fee flows and cannot be deleted by anyone."
+          text: "From `/me/settings \u2192 advanced \u2192 delete` you can permanently revoke your OrangeCheck identity. Deleting does not pay out sats OrangeCheck owes you, and there is no sweep to self-custody to run first: no federation is bound during bring-up. Settle a non-zero balance before you delete. OrangeCheck deletes the operational records it holds about you; hashes already anchored to Bitcoin and commitments published to Nostr are immutable and cannot be deleted by anyone; neither names you."
         }
       ]
     },
@@ -1174,7 +1222,7 @@ var terms3 = {
   metaTitle: "Terms of Service \u2014 OC Vault",
   metaDescription: "Terms of service for OC Vault (vault.ochk.io): an end-to-end-encrypted secrets vault. Client-side encryption, on-chain Bitcoin payment, no fund custody.",
   effective: "2026-05-15",
-  updated: "2026-05-15",
+  updated: "2026-10-08",
   preamble: [
     {
       kind: "callout",
@@ -1191,7 +1239,7 @@ var terms3 = {
       blocks: [
         {
           kind: "para",
-          text: "OC Vault stores passwords, one-time-password seeds, API keys, notes, and small files. Every item is **encrypted client-side** in your browser under a vault key that never leaves your control. When you sync to the cloud, OrangeCheck stores an opaque encrypted blob \u2014 **OrangeCheck cannot read your vault contents, item names, or item types.**"
+          text: "OC Vault stores passwords, one-time-password seeds, API keys, notes, and small files. Every item is **encrypted client-side** in your browser under a vault key that only your passphrase or recovery code unlocks; we store that key only in sealed form. When you sync to the cloud, OrangeCheck stores an opaque encrypted blob \u2014 **OrangeCheck cannot read your vault contents, item names, or item types.**"
         },
         {
           kind: "para",
@@ -1205,7 +1253,7 @@ var terms3 = {
       blocks: [
         {
           kind: "para",
-          text: "Your identity is a Bitcoin address you prove control of via BIP-322. No email or password is required. You are responsible for the security of the wallet you sign with and of the vault key that encrypts your data."
+          text: "You sign in with your OrangeCheck account: a Bitcoin address you prove via BIP-322, an email one-time code, or Google/GitHub. Your entries are encrypted under a vault key that your vault passphrase (or recovery code) unlocks; signing in does not decrypt anything. You are responsible for keeping that passphrase and recovery code safe."
         }
       ]
     },
@@ -1277,7 +1325,7 @@ var terms3 = {
       blocks: [
         {
           kind: "para",
-          text: "The portable export feature is always free and works offline with [`@orangecheck/vault-core`](https://www.npmjs.com/package/@orangecheck/vault-core) \u2014 even if OC Vault is discontinued, you retain a self-decryptable copy of your data. That guarantee does not depend on any paid tier."
+          text: "The encrypted backup (settings \u2192 encrypted backup) is free on every tier. It writes one file holding your vault key and every entry, sealed under a passphrase you choose (scrypt, then AES-256-GCM), so it restores on any device and stays decryptable with standard, open primitives if OC Vault is discontinued. The plain export holds entries without the key and is readable only where your vault key already is."
         },
         {
           kind: "stub",
@@ -1355,7 +1403,7 @@ var privacy3 = {
   metaTitle: "Privacy Policy \u2014 OC Vault",
   metaDescription: "OC Vault privacy policy. End-to-end encrypted; OrangeCheck stores ciphertext only and cannot read your vault contents.",
   effective: "2026-05-15",
-  updated: "2026-05-15",
+  updated: "2026-10-08",
   sections: [
     {
       id: "principles",
@@ -1376,8 +1424,16 @@ var privacy3 = {
           kind: "bullets",
           items: [
             {
-              k: "identity address",
-              v: "the Bitcoin address you sign in with \u2014 public on-chain already; no email, no name"
+              k: "account id",
+              v: "the opaque did:oc of the OrangeCheck account you sign in with; your vault is filed under it"
+            },
+            {
+              k: "sealed vault key",
+              v: "your vault key, encrypted under your passphrase and under your recovery code, so a new device can unlock; OrangeCheck cannot open it without one of them"
+            },
+            {
+              k: "team email (optional)",
+              v: "if you choose to show teammates an email address in a team vault, that address"
             },
             {
               k: "payment records",
@@ -1385,7 +1441,7 @@ var privacy3 = {
             },
             {
               k: "encrypted blobs",
-              v: "opaque ciphertext keyed to your identity address \u2014 OrangeCheck cannot decrypt it"
+              v: "opaque ciphertext filed under your account id \u2014 OrangeCheck cannot decrypt it"
             },
             {
               k: "per-item metadata",
@@ -1412,9 +1468,8 @@ var privacy3 = {
           items: [
             "The contents of any vault item",
             "The names, titles, or types of your items",
-            "Your vault key or any recovery material",
-            "Your access tokens (only the SHA-256 hash is stored)",
-            "Which sites the browser extension autofilled on \u2014 origin matching happens locally in your browser"
+            "Your vault key in usable form, your passphrase, or your recovery code \u2014 we hold the key only sealed under them",
+            "Your access tokens (only the SHA-256 hash is stored)"
           ]
         }
       ]
@@ -1426,12 +1481,12 @@ var privacy3 = {
       blocks: [
         {
           kind: "para",
-          text: "The same encrypted vault is reachable from three surfaces. The zero-knowledge guarantee \u2014 that OrangeCheck only ever holds ciphertext \u2014 applies to all of them."
+          text: "The same encrypted vault is reachable from the web app and from the CLI and SDK; a browser extension is planned. The zero-knowledge guarantee \u2014 that OrangeCheck only ever holds ciphertext \u2014 applies to all of them."
         },
-        { kind: "subhead", text: "browser extension (OC Vault for Chromium / Firefox)" },
+        { kind: "subhead", text: "browser extension (not released yet)" },
         {
           kind: "para",
-          text: "The extension fetches the same encrypted blobs the web app does, caches them **as ciphertext** in browser-extension storage, and decrypts in the service worker only after you enter your passphrase. The vault key lives in memory and a RAM-only `storage.session` slot \u2014 it is never written to disk. The content script that offers autofill receives **one entry's field values at fill time** and nothing else; it never receives the vault key or the entry index. The extension talks only to your own `vault.ochk.io` account: no analytics, no telemetry, no remote code."
+          text: "There is no OC Vault browser extension yet. When one ships, it is designed to work this way: the extension fetches the same encrypted blobs the web app does, caches them **as ciphertext** in browser-extension storage, and decrypts in the service worker only after you enter your passphrase. The vault key lives in memory and a RAM-only `storage.session` slot \u2014 it is never written to disk. The content script that offers autofill receives **one entry's field values at fill time** and nothing else; it never receives the vault key or the entry index. The extension talks only to your own `vault.ochk.io` account: no analytics, no telemetry, no remote code."
         },
         { kind: "subhead", text: "developer platform \u2014 access tokens, CLI, SDK, GitHub Action" },
         {
@@ -1446,7 +1501,7 @@ var privacy3 = {
       blocks: [
         {
           kind: "para",
-          text: "Essential cookies only, plus a theme preference. Page analytics use [Plausible](https://plausible.io/privacy) \u2014 cookie-free, no PII, aggregate only. No advertising or tracking cookies."
+          text: "No cookies of vault.ochk.io's own. The family sign-in cookie `oc_session` (set by ochk.io: HttpOnly; Secure; SameSite=None; Domain=.ochk.io; 30 days) and the appearance cookies `oc_theme`, `oc_skin` and `oc_motion` apply here. Your vault data lives in your browser's IndexedDB, under your account. Page analytics use [Plausible](https://plausible.io/privacy) \u2014 cookie-free, no PII, aggregate only. No advertising or tracking cookies."
         }
       ]
     },
@@ -1459,15 +1514,19 @@ var privacy3 = {
           items: [
             {
               k: "encrypted blobs",
-              v: "retained while your account is active; deleted on account deletion"
+              v: "kept while your account is active; you can delete the whole cloud copy at any time from settings"
+            },
+            {
+              k: "sealed vault key",
+              v: "kept so a new device can unlock; deleting the cloud copy does not remove it \u2014 ask us at [[PRIVACY_CONTACT]] and we will"
             },
             {
               k: "payment records",
               v: "retained as required for accounting and entitlement verification"
             },
             {
-              k: "technical logs",
-              v: "retained 90 days, then auto-deleted"
+              k: "request logs",
+              v: "held by our hosting provider (Vercel) for its own short retention window; rate-limit counters keyed by IP expire with their window"
             }
           ]
         }