@orangecheck/legal 0.7.20 → 0.7.22

package/dist/index.mjs

@@ -771,6 +771,10 @@ var privacy = {
             {
               k: "an OC Chat @handle claim",
               v: "your browser sends the claim's fingerprint (a SHA-256 hash) to the OpenTimestamps calendars at alice.btc.calendar.opentimestamps.org, bob.btc.calendar.opentimestamps.org and finney.calendar.eternitywall.com, and reads your address's coins and block headers from mempool.space; each of these sees your IP address and when you asked. We send them nothing about you ourselves."
+            },
+            {
+              k: "relay.ochk.io",
+              v: "the Nostr relay we run (strfry on Fly.io, in Frankfurt). Your browser connects to it to read and publish signed records; our sites also publish the same records to public relays run by others (see the Terms). It keeps each record it accepts until the same key replaces it with a newer version or the record's own expiry passes: records are public, copied each day to a public archive on GitHub (where earlier versions stay), and otherwise deleted only after a lawful takedown request, which does not remove the copies elsewhere. Each record is stored with the address of the connection it arrived on, which is our host's proxy, not yours, and is never served or archived. Our hosting provider (Fly.io) carries each connection to it and handles your IP address to do so, for its own short retention window; we keep no separate copy. Our host's connection logs for the relay can hold your IP address and connection times; they are kept for 7 days."
             }
           ]
         },
@@ -829,6 +833,10 @@ var privacy = {
               k: "request logs",
               v: "held by our hosting provider (Vercel) for its own short retention window; we keep no separate copy"
             },
+            {
+              k: "relay.ochk.io connections",
+              v: "handled by our hosting provider (Fly.io) for its own short retention window; its connection logs for the relay can hold your IP address and connection times for 7 days, and we keep no separate copy"
+            },
             {
               k: "sessions",
               v: "deleted when you sign out. A session that simply expires after 30 days is not yet deleted automatically."
@@ -888,7 +896,7 @@ var terms2 = {
   metaTitle: "Terms of Service \u2014 ochk.app",
   metaDescription: "Terms of service for ochk.app: a Bitcoin-backed identity that pays users in sats. OrangeCheck custody during bring-up, federation custody and self-custody graduation as the destination, no KYC.",
   effective: "2026-05-15",
-  updated: "2026-10-24",
+  updated: "2026-10-27",
   preamble: [
     {
       kind: "callout",
@@ -971,7 +979,7 @@ var terms2 = {
       blocks: [
         {
           kind: "para",
-          text: "ochk.app **does not perform Know-Your-Customer checks** and does not require your legal name, government ID, or physical address. Sybil resistance is achieved through protocol composition \u2014 BIP-322 sat-bond attestation, paid-action history, and integrator-defined gates \u2014 not identity verification. You must not use ochk.app to evade a KYC, AML, or sanctions obligation that applies to you elsewhere."
+          text: "ochk.app **does not perform Know-Your-Customer checks** and does not require your legal name, government ID, or physical address to sign in, use apps or get paid. Sybil resistance is achieved through protocol composition \u2014 BIP-322 sat-bond attestation, paid-action history, and integrator-defined gates \u2014 not identity verification. You must not use ochk.app to evade a KYC, AML, or sanctions obligation that applies to you elsewhere."
         }
       ]
     },
@@ -1053,7 +1061,7 @@ var privacy2 = {
   metaTitle: "Privacy Policy \u2014 ochk.app",
   metaDescription: "ochk.app privacy policy. No KYC, no PII required, and a full account of what OrangeCheck stores.",
   effective: "2026-05-15",
-  updated: "2026-10-26",
+  updated: "2026-10-27",
   preamble: [
     {
       kind: "callout",
@@ -1071,7 +1079,7 @@ var privacy2 = {
           items: [
             {
               k: "no kyc",
-              v: "ochk.app never collects your legal name, government ID, or physical address"
+              v: "ochk.app never collects your legal name, government ID, or physical address from people who sign in, use apps or get paid"
             },
             {
               k: "little pii at signup",
@@ -1129,6 +1137,10 @@ var privacy2 = {
               k: "site sign-ins",
               v: "which live sites you signed in to or shared data with through orangecheck, and when. A site can name you as the person who earned for an event only once this record exists. No site sees it, and it is erased with your account or with that site's project."
             },
+            {
+              k: "guardian applications",
+              v: "an application to run a guardian, made through ochk.app or by email to apply@ochk.io, holds your answers to the operator questionnaire, which asks, among other things, for a public handle, the name of the person or organisation that will run the guardian, its jurisdiction, a public contact channel, a key fingerprint and two references. Through ochk.app it can also hold an optional handle and email address that only the reviewer sees, for the decision. The questionnaire\u2019s handle, name, jurisdiction, contact channel and fingerprint are published in the federation charter, because guardians are named trust anchors. Nothing is checked against an ID, and nothing else is published."
+            },
             {
               k: "public anchors",
               v: "an OpenTimestamps proof over each envelope\u2019s hash, and a salted commitment to each envelope on Nostr. Public by design, and neither names you, the site or the amount. The envelope itself is served only to whoever holds its id. Drop manifests, which name no one, are published in full."
@@ -1239,7 +1251,7 @@ var privacy2 = {
       blocks: [
         {
           kind: "para",
-          text: "In [your settings](/me/settings) you can delete your account. A person reviews the request within 48 hours. Completing it erases your data on ochk.io, me.ochk.io, vault, chat and cosign and closes your sign-in, so signing in again starts a new account. Payment receipts are kept for accounting, and backups roll off within 30 days. We keep a record that your account was deleted, out of public view, so sessions you already had stop working and the deletion can be shown. Receipts and that record are kept under a keyed id, so the record by itself doesn't say whose account it was. Deleting does not pay out sats OrangeCheck holds for you: settle a non-zero balance first. If you run a guardian, you can delete only once your operator key holds no seat or hosted guardian, has finished any exit, created no federation that still exists, and is owed nothing. Charter signatures, incidents and amendment proposals the key signed stay public under the key, with what you wrote in them; exit records and machine reports stay visible to that federation's guardians and to us. Hashes anchored to Bitcoin and records published to Nostr cannot be deleted by anyone. me.ochk.io's own anchors name no one, but attestations, polls, pledges, stamps and a chat listing you published carry your Bitcoin address."
+          text: "In [your settings](/me/settings) you can delete your account. A person reviews the request within 48 hours. Completing it erases your data on ochk.io, me.ochk.io, vault, chat and cosign and closes your sign-in, so signing in again starts a new account. Payment receipts are kept for accounting. Backups roll off within 30 days, and copies cached by our CDN expire within a day. We keep a record that your account was deleted, out of public view, so sessions you already had stop working and the deletion can be shown. Receipts and that record are kept under a keyed id, so the record by itself doesn't say whose account it was. Deleting does not pay out sats OrangeCheck holds for you: settle a non-zero balance first. If you run a guardian, you can delete only once your operator key holds no seat or hosted guardian, has finished any exit, created no federation that still exists, and is owed nothing. Charter signatures, incidents and amendment proposals the key signed stay public under the key, with what you wrote in them; exit records and machine reports stay visible to that federation's guardians and to us. Hashes anchored to Bitcoin and records published to Nostr cannot be deleted by anyone. me.ochk.io's own anchors name no one, but attestations, polls, pledges, stamps and a chat listing you published carry your Bitcoin address."
         }
       ]
     },