@orangecheck/legal 0.7.22 → 0.7.28

package/dist/index.d.mts

@@ -72,7 +72,7 @@ interface SecurityDisclosureProps {
 declare function SecurityDisclosure({ securityContact, heading, }: SecurityDisclosureProps): react_jsx_runtime.JSX.Element;
 
 declare const LEGAL_SITES: Record<string, SiteContext>;
-declare const PROTOCOL_LINKED_SITES: readonly ["attest", "lock", "vote", "stamp", "agent", "pledge", "docs", "analytics"];
+declare const PROTOCOL_LINKED_SITES: readonly ["attest", "lock", "vote", "stamp", "agent", "pledge", "docs", "analytics", "chat", "cosign", "btc", "globe"];
 declare function getSiteContext(slug: string): SiteContext;
 declare function legalHref(siteSlug: string, kind: 'terms' | 'privacy' | 'security'): string;
 

package/dist/index.d.ts

@@ -72,7 +72,7 @@ interface SecurityDisclosureProps {
 declare function SecurityDisclosure({ securityContact, heading, }: SecurityDisclosureProps): react_jsx_runtime.JSX.Element;
 
 declare const LEGAL_SITES: Record<string, SiteContext>;
-declare const PROTOCOL_LINKED_SITES: readonly ["attest", "lock", "vote", "stamp", "agent", "pledge", "docs", "analytics"];
+declare const PROTOCOL_LINKED_SITES: readonly ["attest", "lock", "vote", "stamp", "agent", "pledge", "docs", "analytics", "chat", "cosign", "btc", "globe"];
 declare function getSiteContext(slug: string): SiteContext;
 declare function legalHref(siteSlug: string, kind: 'terms' | 'privacy' | 'security'): string;
 

package/dist/index.js

@@ -69,7 +69,11 @@ var PROTOCOL_LINKED_SITES = [
   "agent",
   "pledge",
   "docs",
-  "analytics"
+  "analytics",
+  "chat",
+  "cosign",
+  "btc",
+  "globe"
 ];
 function getSiteContext(slug) {
   const ctx = LEGAL_SITES[slug];
@@ -470,7 +474,7 @@ var privacyChanges = {
 };
 
 // src/content/protocol.ts
-var COMMERCIAL_SCOPE_NOTE = "These Terms govern the **non-custodial** OrangeCheck family: [ochk.io](https://ochk.io), including its documentation at [ochk.io/docs](https://ochk.io/docs), and the verb sites \u2014 OC Attest, OC Lock, OC Vote, OC Stamp, OC Agent, OC Pledge. The commercial products **ochk.app** and **vault.ochk.io** each publish their own Terms; these Terms do not govern your use of those products.";
+var COMMERCIAL_SCOPE_NOTE = "These Terms govern the **non-custodial** OrangeCheck family: [ochk.io](https://ochk.io), including its documentation at [ochk.io/docs](https://ochk.io/docs); the verb sites \u2014 OC Attest, OC Lock, OC Vote, OC Stamp, OC Agent, OC Pledge; and [chat.ochk.io](https://chat.ochk.io), [cosign.ochk.io](https://cosign.ochk.io), [btc.ochk.io](https://btc.ochk.io) and [globe.ochk.io](https://globe.ochk.io). The commercial products **ochk.app** and **vault.ochk.io** each publish their own Terms; these Terms do not govern your use of those products.";
 var terms = {
   kind: "terms",
   eyebrow: "terms",
@@ -479,7 +483,7 @@ var terms = {
   metaTitle: "Terms of Service \u2014 OrangeCheck",
   metaDescription: "The terms and conditions for using OrangeCheck. Non-custodial service provided as-is. You are responsible for your wallet and private keys.",
   effective: "2025-09-30",
-  updated: "2026-10-26",
+  updated: "2026-10-29",
   preamble: [
     {
       kind: "callout",
@@ -499,6 +503,10 @@ var terms = {
           kind: "para",
           text: "OrangeCheck is a family of **non-custodial** protocols and reference tools that let you create cryptographic proof-of-stake artifacts using Bitcoin message signatures (BIP-322), bind self-asserted handles to them, optionally publish them to decentralized Nostr relays, and discover and verify artifacts created by others."
         },
+        {
+          kind: "para",
+          text: "OrangeCheck also runs **chat.ochk.io**, an end-to-end-encrypted messenger; **cosign.ochk.io**, where builders post projects and others join or back them, with any payment going directly from one person to another; **btc.ochk.io**, a read-only Bitcoin market desk; and **globe.ochk.io**, a read-only view of the Bitcoin network."
+        },
         { kind: "subhead", text: "what orangecheck does not" },
         {
           kind: "bullets",
@@ -584,6 +592,10 @@ var terms = {
               k: "opentimestamps calendars",
               v: "when you claim an OC Chat @handle, your browser sends the claim's fingerprint (a SHA-256 hash) to the OpenTimestamps calendars at alice.btc.calendar.opentimestamps.org, bob.btc.calendar.opentimestamps.org and finney.calendar.eternitywall.com, and reads your address's coins and block headers from mempool.space; each of these sees your IP address and when you asked."
             },
+            {
+              k: "payments between people",
+              v: "postage on chat.ochk.io, and backing, zaps and bounties on cosign.ochk.io, are Lightning payments you make directly to the other person's wallet. OrangeCheck never holds them, cannot reverse them, and is not a party to them."
+            },
             {
               k: "nostr network",
               v: "decentralized relays operated by third parties. published data is replicated outside our control and may persist indefinitely."
@@ -611,7 +623,7 @@ var terms = {
       blocks: [
         {
           kind: "para",
-          text: "The protocol sites and documentation are free to use. You are responsible for Bitcoin network fees on any transactions you initiate and for your own ISP and wallet-provider costs. Paid functionality, if introduced, will be announced with advance notice; the commercial products **ochk.app** and **vault.ochk.io** carry their own pricing and Terms."
+          text: "The protocol sites, the documentation, cosign.ochk.io, btc.ochk.io and globe.ochk.io are free to use, and so is chat.ochk.io. chat.ochk.io also lists an optional paid plan, Personal: when its checkout is open, you pay the price shown before you pay, in advance, for a fixed period, and it does not renew on its own. You are responsible for Bitcoin network fees on any transactions you initiate and for your own ISP and wallet-provider costs. Other paid functionality, if introduced, will be announced with advance notice; the commercial products **ochk.app** and **vault.ochk.io** carry their own pricing and Terms."
         }
       ]
     },
@@ -628,7 +640,7 @@ var terms = {
         { kind: "subhead", text: "not financial, legal, or compliance advice" },
         {
           kind: "para",
-          text: "Nothing OrangeCheck provides \u2014 artifacts, metrics, scores, identity bindings, or other output \u2014 is financial, investment, legal, tax, KYC, AML, sanctions, or regulatory-compliance advice. Obtain independent professional advice before relying on the Service for any decision."
+          text: "Nothing OrangeCheck provides \u2014 artifacts, metrics, scores, identity bindings, btc.ochk.io's market data, charts and written market commentary (some of it written by an AI model), or other output \u2014 is financial, investment, legal, tax, KYC, AML, sanctions, or regulatory-compliance advice. Obtain independent professional advice before relying on the Service for any decision."
         },
         { kind: "subhead", text: "regulatory status \xB7 not a money services business" },
         {
@@ -668,11 +680,24 @@ var privacy = {
   metaTitle: "Privacy Policy \u2014 OrangeCheck",
   metaDescription: "How OrangeCheck handles data and privacy. Non-custodial by design, minimal data collection, no account required, privacy-preserving analytics only.",
   effective: "2025-09-30",
-  updated: "2026-10-26",
+  updated: "2026-10-31",
   preamble: [
     {
       kind: "callout",
-      text: "This policy covers the **non-custodial** OrangeCheck family \u2014 [ochk.io](https://ochk.io), including its documentation at [ochk.io/docs](https://ochk.io/docs), and the six verb sites. The commercial products ochk.app and vault.ochk.io publish their own privacy policies covering the additional data their products handle."
+      text: "**What changed, 8 to 31 October 2026.** We corrected this policy where it did not say what is kept or who sees it. Newest first; the [changelog](https://github.com/orangecheck/oc-packages/blob/main/legal/CHANGELOG.md) lists every change."
+    },
+    {
+      kind: "bullets",
+      items: [
+        { k: "31 October", v: "the owner consoles, analytics.ochk.io and vault.ochk.io's, show every email address masked, refuse an email as a search or action subject, and show a whole address only after a written reason is recorded." },
+        { k: "29 October", v: "an account also keeps its Google or GitHub id, the roster id that links accounts signed in from one browser, the site you signed up through, a coin that backs it (its address, outpoint and amount, and the message you signed), and OC Chat device vouches and revocations, which are also published to Nostr relays. relay.ochk.io keeps each record with a pseudonym of the sender's IP address, replaced each UTC day, and never the address itself. Our operators' first-sign-in email names only your did:oc and the kind of sign-in. The policy says what chat, cosign, btc and globe keep, who completes a deletion, and what stays." },
+        { k: "26 October", v: "a session row keeps no IP address, and the sign-in log keeps it for 90 days. relay.ochk.io is named, and our host's connection logs for it hold your IP address and connection times for 7 days. Claiming an OC Chat handle sends its fingerprint to three OpenTimestamps calendars and reads mempool.space, and each sees your IP address." },
+        { k: "8 and 9 October", v: "the email is stored, encrypted. Each session and the sign-in log keep the full user-agent. Our operators get an email when a new account first signs in." }
+      ]
+    },
+    {
+      kind: "callout",
+      text: "This policy covers the **non-custodial** OrangeCheck family \u2014 [ochk.io](https://ochk.io), including its documentation at [ochk.io/docs](https://ochk.io/docs), the six verb sites, and [chat.ochk.io](https://chat.ochk.io), [cosign.ochk.io](https://cosign.ochk.io), [btc.ochk.io](https://btc.ochk.io) and [globe.ochk.io](https://globe.ochk.io). The commercial products ochk.app and vault.ochk.io publish their own privacy policies covering the additional data their products handle."
     }
   ],
   sections: [
@@ -740,7 +765,7 @@ var privacy = {
             },
             {
               k: "how you sign in",
-              v: "a Bitcoin address you prove with a signature (stored as is \u2014 it is public on-chain anyway); or, for an email code, Google or GitHub, the verified email address \u2014 encrypted at rest, plus a one-way hash of it so we can find your account"
+              v: "a Bitcoin address you prove with a signature (stored as is \u2014 it is public on-chain anyway); or, for an email code, Google or GitHub, the verified email address \u2014 encrypted at rest, plus a one-way hash of it so we can find your account. For Google or GitHub we also store that provider's id for your account, unencrypted, so a changed email still reaches the same account"
             },
             {
               k: "passkeys",
@@ -754,13 +779,34 @@ var privacy = {
               k: "sign-in log",
               v: "each sign-in and each identity you link or remove, with the IP address and user-agent at the time \u2014 kept for security; the IP address is cleared after 90 days"
             },
+            {
+              k: "accounts in one browser",
+              v: "sessions opened in the same browser share a roster id, so we can tell which of your accounts were signed in from it; and which of our sites you first signed up through"
+            },
+            {
+              k: "a coin backing your account",
+              v: "if you back your account with a coin: its address, outpoint and amount, the backing message you signed, and when we last found it unspent, or saw it released or spent. We read the coin from mempool.space. Earlier backings stay with your account. Sites you sign in to get only amount and age floors and a number that differs from site to site (all *.ochk.io sites share one), never the coin"
+            },
+            {
+              k: "OC Chat devices",
+              v: "for each chat.ochk.io device we vouch for: its device and Nostr public keys, when we vouched, and the sign-in that asked; for a device you revoke, the signed revocation, which we also publish to Nostr relays"
+            },
+            {
+              k: "btc.ochk.io alerts",
+              v: "the market thresholds you save on btc.ochk.io (up to 25), stored with your account"
+            },
             {
               k: "when you first sign in",
-              v: "OrangeCheck\u2019s operators get an email, sent through our email provider (Resend), naming your `did:oc` and the identity you signed in with: your Bitcoin address or your email address"
+              v: "OrangeCheck\u2019s operators get an email, sent through our email provider (Resend), naming your `did:oc` and the kind of sign-in you used (a Bitcoin wallet, an email code, Google or GitHub). Notices sent up to and including 29 October 2026 (UTC) also named the identity itself: your Bitcoin address or your email address"
             },
             { k: "never", v: "a password, a private key, or a seed phrase" }
           ]
         },
+        { kind: "subhead", text: "who at OrangeCheck can see it" },
+        {
+          kind: "para",
+          text: "OrangeCheck's operators can see your account in owner-only consoles: analytics.ochk.io and, for a vault account, vault.ochk.io's. Their account lists show each email address masked: the first character of the part before the @ when that part has three or more characters, and none of it otherwise. Their account searches and actions refuse an email address: an account is found by email only through a lookup. Revealing one address, or looking up one account, asks for a written reason, which is recorded before your email address is shown. A lookup's record has its details about you cleared after 90 days; the reason stays."
+        },
         { kind: "subhead", text: "automatically collected" },
         {
           kind: "bullets",
@@ -780,7 +826,7 @@ var privacy = {
             },
             {
               k: "relay.ochk.io",
-              v: "the Nostr relay we run (strfry on Fly.io, in Frankfurt). Your browser connects to it to read and publish signed records; our sites also publish the same records to public relays run by others (see the Terms). It keeps each record it accepts until the same key replaces it with a newer version or the record's own expiry passes: records are public, copied each day to a public archive on GitHub (where earlier versions stay), and otherwise deleted only after a lawful takedown request, which does not remove the copies elsewhere. Each record is stored with the address of the connection it arrived on, which is our host's proxy, not yours, and is never served or archived. Our hosting provider (Fly.io) carries each connection to it and handles your IP address to do so, for its own short retention window; we keep no separate copy. Our host's connection logs for the relay can hold your IP address and connection times; they are kept for 7 days."
+              v: "the Nostr relay we run (strfry on Fly.io, in Frankfurt). Your browser connects to it to read and publish signed records; our sites also publish the same records to public relays run by others (see the Terms). It keeps each record it accepts until the same key replaces it with a newer version or the record's own expiry passes: records are public, copied each day to a public archive on GitHub (where earlier versions stay), and otherwise deleted only after a lawful takedown request, which does not remove the copies elsewhere. Each record is stored with a pseudonym of the IP address it came from, made with a key that is kept only in memory and replaced each UTC day, so the relay can limit how much one source writes; your IP address itself is never stored, and the pseudonym is never served or archived. Our hosting provider (Fly.io) carries each connection to it and handles your IP address to do so, for its own short retention window; we keep no separate copy. Our host's connection logs for the relay can hold your IP address and connection times; they are kept for 7 days."
             }
           ]
         },
@@ -808,6 +854,95 @@ var privacy = {
         }
       ]
     },
+    {
+      id: "chat-cosign-btc-globe",
+      heading: "chat, cosign, btc and globe",
+      hint: "what each of these sites keeps",
+      blocks: [
+        { kind: "subhead", text: "chat.ochk.io" },
+        {
+          kind: "bullets",
+          items: [
+            {
+              k: "messages",
+              v: "end-to-end encrypted. Our server holds a message only as ciphertext, under a per-conversation id that names neither person, until the recipient picks it up: for up to 14 days, or 365 days on the Personal plan. A delivered message is deleted 24 hours after the recipient confirms it. We cannot read message content"
+            },
+            {
+              k: "on your device",
+              v: "your messages, contacts and settings are kept in your browser. Lock this device with a passphrase to encrypt your device key and messages there"
+            },
+            {
+              k: "sending limits",
+              v: "a count of messages sent per hour, under a keyed id made from your account, dropped after a day. chat.ochk.io stores no IP address"
+            },
+            {
+              k: "the Personal plan",
+              v: "if you buy it: your account id, the plan, when you paid and until when, the amount and the invoice id. The invoice our payment processor (BTCPay) holds says what was sold, not who bought it"
+            },
+            {
+              k: "published to Nostr",
+              v: "your device records, public channel posts (which are not encrypted), and a directory listing if you choose to be listed are public and stay on the relays. Direct messages travel encrypted"
+            },
+            {
+              k: "sent from your browser",
+              v: "chain data from mempool.space and blockstream.info, the drand network for messages that open at a future block, the OpenTimestamps calendars named above for a handle claim, and the Nostr relays you use; each sees your IP address"
+            },
+            {
+              k: "analytics",
+              v: "none"
+            },
+            {
+              k: "deletion",
+              v: "deleting your account deletes chat.ochk.io's other records of you; Personal plan payment records stay for accounting under a keyed id, not your account id. Messages waiting for pickup expire on their own, and what is on Nostr relays stays"
+            }
+          ]
+        },
+        { kind: "subhead", text: "cosign.ochk.io" },
+        {
+          kind: "bullets",
+          items: [
+            {
+              k: "what you post",
+              v: "your profile, projects, updates, cosigns and vouches are public on cosign.ochk.io"
+            },
+            {
+              k: "messages",
+              v: "**not end-to-end encrypted.** They are stored on our servers, and OrangeCheck's operators can read them"
+            },
+            {
+              k: "reports and notifications",
+              v: "a report you file keeps you as its reporter, the subject and your reason. Notifications are shown in the app only; a read one is deleted after 30 days and any after 90"
+            },
+            {
+              k: "payments between people",
+              v: "we record each Lightning payment for display (amount, time, status and the receiving Lightning address); the money goes directly between people and cosign never holds it"
+            },
+            {
+              k: "abuse limits",
+              v: "counts of writes per account, per IP address and per network, under keyed ids, dropped after 2 days; and your account's counts for the last ten minutes, kept with your account. No IP address is stored"
+            },
+            {
+              k: "deletion",
+              v: "deleting your account deletes your profile, projects and the rest, except that your messages in conversations with other people, the reports you filed, and payment records stay, with your account taken off them"
+            }
+          ]
+        },
+        { kind: "subhead", text: "btc.ochk.io" },
+        {
+          kind: "para",
+          text: "btc.ochk.io keeps only the alert thresholds you save, with your account, and deletes them when your account is deleted. Its planner and paper desk stay in your browser. Its market commentary is written each hour by an AI model provider (Anthropic) from market data and the web searches it runs; nothing about you is sent."
+        },
+        { kind: "subhead", text: "globe.ochk.io" },
+        {
+          kind: "para",
+          text: "globe.ochk.io stores nothing about you. Your browser fetches live network data directly from mempool.space, which sees your IP address."
+        },
+        {
+          kind: "para",
+          text: "cosign.ochk.io, btc.ochk.io and globe.ochk.io use the cookie-free analytics described below."
+        }
+      ]
+    },
     {
       id: "how-we-use",
       heading: "how we use information",
@@ -826,7 +961,7 @@ var privacy = {
     {
       id: "retention",
       heading: "data retention",
-      hint: "no automatic deletion yet \xB7 permanent public artifacts",
+      hint: "scheduled and on-write deletion \xB7 permanent public artifacts",
       blocks: [
         {
           kind: "bullets",
@@ -845,15 +980,19 @@ var privacy = {
             },
             {
               k: "sessions",
-              v: "deleted when you sign out. A session that simply expires after 30 days is not yet deleted automatically."
+              v: "deleted when you sign out; a session that expires after 30 days is deleted the next time anyone signs in"
             },
             {
               k: "IP addresses in the sign-in log",
               v: "cleared after 90 days; the entries themselves stay until your account is deleted"
             },
             {
-              k: "account, sign-in identities, passkeys and sign-in log",
-              v: "deleted when your account-deletion request completes; file one in your account settings, or ask at [[PRIVACY_CONTACT]]"
+              k: "email sign-in codes",
+              v: "the code itself is never stored and expires after 10 minutes; the record that lets it be used once is deleted when it is spent, or with the next code anyone asks for after it expires; per-address and per-network send counts, kept as keyed hashes, are dropped after a day"
+            },
+            {
+              k: "account, sign-in identities, passkeys, sign-in log, coin backings, OC Chat device records and btc.ochk.io alerts",
+              v: "deleted when your account-deletion request completes. File one in [your account on ochk.app](https://ochk.app/me/account), or ask at [[PRIVACY_CONTACT]]. A person completes the request, and we aim to do that within 48 hours. Nothing is erased while a blocker remains: sats you are owed or payouts still pending on ochk.app, live guardian-operator duties, developer projects or an OC Connect app you own, or a vault team you own that still has other members. What stays: the email our operators received when you first signed in, which names your `did:oc` and the kind of sign-in you used, and, if it was sent up to and including 29 October 2026 (UTC), the identity itself; a revocation already published to Nostr relays, and anything else you published there or anchored to Bitcoin; a marker under a hash of your account id that refuses your old sessions until they would have expired, about 30 days; and, if a site made an account for you, a hashed record of it, so that site is told the account was deleted instead of making a new one"
             },
             {
               k: "support emails",
@@ -902,7 +1041,7 @@ var terms2 = {
   metaTitle: "Terms of Service \u2014 ochk.app",
   metaDescription: "Terms of service for ochk.app: a Bitcoin-backed identity that pays users in sats. OrangeCheck custody during bring-up, federation custody and self-custody graduation as the destination, no KYC.",
   effective: "2026-05-15",
-  updated: "2026-10-27",
+  updated: "2026-10-29",
   preamble: [
     {
       kind: "callout",
@@ -976,6 +1115,11 @@ var terms2 = {
         {
           kind: "stub",
           text: "Platform fees, payout mechanics and minimums, supported payout rails, currency-conversion handling, and the allocation of tax-reporting and tax-payment responsibility for sats you receive are being finalized for publication before general availability. You are advised that cashback received may be taxable income in your jurisdiction and that you are responsible for your own tax compliance. This section will be completed following review by counsel."
+        },
+        { kind: "subhead", text: "when a payout is held" },
+        {
+          kind: "para",
+          text: "We hold a payout, and do not send it, when an earlier attempt to send it may already have gone through; while payouts are paused by a halt, a federation migration or a payout ceiling, or are not yet open to you; while the node that pays cannot cover everything owed, or its fee limit is unknown; for 24 hours after you change your payout destination; when your payout destination is no longer valid; or when our records disagree about what is owed. A paused or limited payout goes out on its own once the pause, ceiling, shortfall or 24 hours have passed; setting a new destination clears a destination hold; and a disagreement clears when we correct the record. A payout whose earlier attempt may have gone through is never retried on its own: we check the payment node, then either mark it paid with the payment's proof or release it to be sent again. A hold does not cancel what you are owed."
         }
       ]
     },
@@ -1067,8 +1211,26 @@ var privacy2 = {
   metaTitle: "Privacy Policy \u2014 ochk.app",
   metaDescription: "ochk.app privacy policy. No KYC, no PII required, and a full account of what OrangeCheck stores.",
   effective: "2026-05-15",
-  updated: "2026-10-27",
+  updated: "2026-10-31",
   preamble: [
+    {
+      kind: "callout",
+      text: "**What changed, 8 to 31 October 2026.** We corrected this policy where it did not say what is kept or who sees it. Newest first; the [changelog](https://github.com/orangecheck/oc-packages/blob/main/legal/CHANGELOG.md) lists every change."
+    },
+    {
+      kind: "bullets",
+      items: [
+        { k: "29 October", v: "the contact form sends your email address, an optional name, the topic and your message to our inbox through our email provider (Resend)." },
+        { k: "27 and 28 October", v: "a guardian application holds the questionnaire's answers, and the charter publishes its handle, name, jurisdiction, contact channel and fingerprint. The policy says which records a deletion keeps, and that cached copies expire within a day." },
+        { k: "26 October", v: "a session record keeps no IP address, and the sign-in log keeps it for 90 days." },
+        { k: "25 October", v: "me.ochk.io records which sites you sign in to or share data with, and when. No site sees that record." },
+        { k: "24 October", v: "signing in gives every site the same did:oc." },
+        { k: "23 October", v: "an account a site makes for you through OrangeCheck Connect keeps a hash of the site's id for you, a keyed hash of your email if the site sent one, when it was made, whether you agreed to earn, and what it earned." },
+        { k: "19 October", v: "ochk.app is the Service, and me.ochk.io is its API." },
+        { k: "15 October", v: "ochk.app's own cookies are listed: __Host-oc_session, and __Host-oc_oauth for at most ten minutes during a Google or GitHub sign-in." },
+        { k: "8 October", v: "a session record keeps your user-agent, and an email is personal data." }
+      ]
+    },
     {
       kind: "callout",
       text: "This policy covers the Service at both of its addresses, ochk.app and its API at me.ochk.io: one account, one store of records, one operator; \u201Cochk.app\u201D below means both. Its product is identity that pays you; its privacy posture is what makes it distinct from Sign in with Google. For a side-by-side comparison you can falsify, see [the privacy comparison](/privacy-compare)."
@@ -1101,7 +1263,7 @@ var privacy2 = {
             },
             {
               k: "deletable",
-              v: "you can delete your account in your settings: your data is erased and your sign-in closes"
+              v: "you can delete your account in your settings: your sign-in closes and your data is erased, except the few records named under identity & account deletion"
             }
           ]
         }
@@ -1147,6 +1309,10 @@ var privacy2 = {
               k: "guardian applications",
               v: "an application to run a guardian, made through ochk.app or by email to apply@ochk.io, holds your answers to the operator questionnaire, which asks, among other things, for a public handle, the name of the person or organisation that will run the guardian, its jurisdiction, a public contact channel, a key fingerprint and two references. Through ochk.app it can also hold an optional handle and email address that only the reviewer sees, for the decision. The questionnaire\u2019s handle, name, jurisdiction, contact channel and fingerprint are published in the federation charter, because guardians are named trust anchors. Nothing is checked against an ID, and nothing else is published."
             },
+            {
+              k: "messages you send us",
+              v: "the contact form at ochk.app/contact sends your email address, an optional name, the topic you pick and your message to our inbox through our email provider (Resend). They are kept only as long as we need them to reply"
+            },
             {
               k: "public anchors",
               v: "an OpenTimestamps proof over each envelope\u2019s hash, and a salted commitment to each envelope on Nostr. Public by design, and neither names you, the site or the amount. The envelope itself is served only to whoever holds its id. Drop manifests, which name no one, are published in full."
@@ -1257,7 +1423,7 @@ var privacy2 = {
       blocks: [
         {
           kind: "para",
-          text: "In [your settings](/me/settings) you can delete your account. A person reviews the request within 48 hours. Completing it erases your data on ochk.io, me.ochk.io, vault, chat and cosign and closes your sign-in, so signing in again starts a new account. Payment receipts are kept for accounting. Backups roll off within 30 days, and copies cached by our CDN expire within a day. We keep a record that your account was deleted, out of public view, so sessions you already had stop working and the deletion can be shown. Receipts and that record are kept under a keyed id, so the record by itself doesn't say whose account it was. Deleting does not pay out sats OrangeCheck holds for you: settle a non-zero balance first. If you run a guardian, you can delete only once your operator key holds no seat or hosted guardian, has finished any exit, created no federation that still exists, and is owed nothing. Charter signatures, incidents and amendment proposals the key signed stay public under the key, with what you wrote in them; exit records and machine reports stay visible to that federation's guardians and to us. Hashes anchored to Bitcoin and records published to Nostr cannot be deleted by anyone. me.ochk.io's own anchors name no one, but attestations, polls, pledges, stamps and a chat listing you published carry your Bitcoin address."
+          text: "In [your settings](/me/settings) you can delete your account. A person completes the request, and we aim to do that within 48 hours: an alert tells us when one has waited a day. Completing it closes your sign-in, so signing in again starts a new account, and erases your data on ochk.io, me.ochk.io, vault, chat and cosign, except a few records. Payment records keep their amounts and times for accounting, and our audit log and your deletion request stay, without the reason you gave. We keep a record that your account was deleted, out of public view, so sessions you already had stop working and the deletion can be shown. Each keeps your account only as a keyed id, or not at all, so the record by itself doesn't say whose account it was. On cosign, your messages in conversations with other people and the reports you filed stay, with your account taken off them. Backups roll off within 30 days, and copies cached by our CDN expire within a day. Deleting does not pay out sats OrangeCheck holds for you: settle a non-zero balance first. If you run a guardian, you can delete only once your operator key holds no seat or hosted guardian, has finished any exit, created no federation that still exists, and is owed nothing. Charter signatures, incidents and amendment proposals the key signed stay public under the key, with what you wrote in them; exit records and machine reports stay visible to that federation's guardians and to us. Hashes anchored to Bitcoin and records published to Nostr cannot be deleted by anyone. me.ochk.io's own anchors name no one, but attestations, polls, pledges, stamps and a chat listing you published carry your Bitcoin address."
         }
       ]
     },
@@ -1475,7 +1641,21 @@ var privacy3 = {
   metaTitle: "Privacy Policy \u2014 OC Vault",
   metaDescription: "OC Vault privacy policy. End-to-end encrypted; OrangeCheck stores ciphertext only and cannot read your vault contents.",
   effective: "2026-05-15",
-  updated: "2026-10-08",
+  updated: "2026-10-31",
+  preamble: [
+    {
+      kind: "callout",
+      text: "**What changed, 8 to 31 October 2026.** We corrected this policy where it did not say what is kept or who sees it. Newest first; the [changelog](https://github.com/orangecheck/oc-packages/blob/main/legal/CHANGELOG.md) lists every change."
+    },
+    {
+      kind: "bullets",
+      items: [
+        { k: "31 October", v: "an emailed team invite keeps the invitee's address on the invite and shows it to the team's managers, the email goes through our email provider (Resend), and its link carries the team key only sealed under a one-time code." },
+        { k: "29 October", v: "the browser extension is described. Deleting your account removes the sealed vault key and the rest of your vault data, keeps payment records under a keyed id, and is refused while you own a team that still has other members." },
+        { k: "8 October", v: "your vault is filed under your did:oc, and the vault key is stored on our server, sealed under your passphrase and your recovery code." }
+      ]
+    }
+  ],
   sections: [
     {
       id: "principles",
@@ -1507,6 +1687,10 @@ var privacy3 = {
               k: "team email (optional)",
               v: "if you choose to show teammates an email address in a team vault, that address"
             },
+            {
+              k: "emailed team invite",
+              v: "if a team manager emails you an invite: your email address, which is kept on the invite and shown to the team's managers, and sent with the invite link through our email provider (Resend). The link carries the team key only sealed under a one-time code the manager gives you themselves; OrangeCheck never sees the code or the key. The invite is deleted when a manager revokes it, with the team, or when the account that sent or claimed it is deleted"
+            },
             {
               k: "payment records",
               v: "for paid tiers: the BTCPay invoice id, sats paid, tier, and entitlement expiry. No card number, no billing address"
@@ -1553,12 +1737,12 @@ var privacy3 = {
       blocks: [
         {
           kind: "para",
-          text: "The same encrypted vault is reachable from the web app and from the CLI and SDK; a browser extension is planned. The zero-knowledge guarantee \u2014 that OrangeCheck only ever holds ciphertext \u2014 applies to all of them."
+          text: "The same encrypted vault is reachable from the web app, the browser extension, and the CLI and SDK. The zero-knowledge guarantee \u2014 that OrangeCheck only ever holds ciphertext \u2014 applies to all of them."
         },
-        { kind: "subhead", text: "browser extension (not released yet)" },
+        { kind: "subhead", text: "browser extension (not in a store yet)" },
         {
           kind: "para",
-          text: "There is no OC Vault browser extension yet. When one ships, it is designed to work this way: the extension fetches the same encrypted blobs the web app does, caches them **as ciphertext** in browser-extension storage, and decrypts in the service worker only after you enter your passphrase. The vault key lives in memory and a RAM-only `storage.session` slot \u2014 it is never written to disk. The content script that offers autofill receives **one entry's field values at fill time** and nothing else; it never receives the vault key or the entry index. The extension talks only to your own `vault.ochk.io` account: no analytics, no telemetry, no remote code."
+          text: "The OC Vault browser extension is built for Chrome and Firefox but is not yet in either browser's store; its source is public at [github.com/orangecheck/oc-vault-extension](https://github.com/orangecheck/oc-vault-extension), and you can build and load it yourself. It fetches the same encrypted blobs the web app does, may cache them **as ciphertext** in extension storage, and decrypts in its service worker only after you unlock it. The vault key lives in memory and a RAM-only `storage.session` slot and is never written to disk in the clear; if you turn on passkey unlock, it is also stored sealed to your passkey. The content script that offers autofill receives only **one entry's username and password at fill time**; it never receives the vault key or the entry index. The extension talks only to vault.ochk.io, and to ochk.io for sign-in: no analytics, no telemetry, no remote code."
         },
         { kind: "subhead", text: "developer platform \u2014 access tokens, CLI, SDK, GitHub Action" },
         {
@@ -1590,11 +1774,15 @@ var privacy3 = {
             },
             {
               k: "sealed vault key",
-              v: "kept so a new device can unlock; deleting the cloud copy does not remove it \u2014 ask us at [[PRIVACY_CONTACT]] and we will"
+              v: "kept so a new device can unlock; deleting the cloud copy does not remove it, and deleting your account does"
             },
             {
               k: "payment records",
-              v: "retained as required for accounting and entitlement verification"
+              v: "retained as required for accounting and entitlement verification; when your account is deleted they stay under a keyed id, not your account id"
+            },
+            {
+              k: "deleting your account",
+              v: "removes your encrypted blobs, devices and grants, sealed vault key, access tokens, one-time shares, the teams you own alone, and your seats and invites in other teams. It is refused while you own a team that still has other members"
             },
             {
               k: "request logs",