@orangecheck/legal 0.7.23 → 0.7.29
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +8 -6
- package/dist/index.d.mts +2 -1
- package/dist/index.d.ts +2 -1
- package/dist/index.js +252 -54
- package/dist/index.js.map +1 -1
- package/dist/index.mjs +252 -54
- package/dist/index.mjs.map +1 -1
- package/package.json +1 -1
package/dist/index.js
CHANGED
|
@@ -9,6 +9,7 @@ var React__default = /*#__PURE__*/_interopDefault(React);
|
|
|
9
9
|
|
|
10
10
|
// src/constants.ts
|
|
11
11
|
var LEGAL_ENTITY = "OrangeCheck";
|
|
12
|
+
var BRAND = "OrangeCheck";
|
|
12
13
|
var LEGAL_ENTITY_LONG = "OrangeCheck (OCHK), an unincorporated project";
|
|
13
14
|
var ENTITY_PENDING = true;
|
|
14
15
|
var CONTACT_GENERAL = "contact@ochk.io";
|
|
@@ -17,6 +18,7 @@ var CONTACT_PRIVACY = "contact@ochk.io";
|
|
|
17
18
|
var GOVERNING_LAW_STATE = "Delaware, United States";
|
|
18
19
|
var ARBITRATION_SEAT = "Wilmington, Delaware, United States";
|
|
19
20
|
var GLOBAL_TOKENS = {
|
|
21
|
+
BRAND,
|
|
20
22
|
ENTITY: LEGAL_ENTITY,
|
|
21
23
|
ENTITY_LONG: LEGAL_ENTITY_LONG,
|
|
22
24
|
// For the clauses set in capitals, so the name does not break their case.
|
|
@@ -48,7 +50,9 @@ var LEGAL_SITES = {
|
|
|
48
50
|
productShort: "ochk.app",
|
|
49
51
|
contact: CONTACT_GENERAL,
|
|
50
52
|
securityContact: CONTACT_SECURITY,
|
|
51
|
-
selfHosted: true
|
|
53
|
+
selfHosted: true,
|
|
54
|
+
// ochk.app writes its brand lowercase, as its own pages do (lead ruling, 2026-11-03).
|
|
55
|
+
brand: "orangecheck"
|
|
52
56
|
},
|
|
53
57
|
vault: {
|
|
54
58
|
slug: "vault",
|
|
@@ -69,7 +73,11 @@ var PROTOCOL_LINKED_SITES = [
|
|
|
69
73
|
"agent",
|
|
70
74
|
"pledge",
|
|
71
75
|
"docs",
|
|
72
|
-
"analytics"
|
|
76
|
+
"analytics",
|
|
77
|
+
"chat",
|
|
78
|
+
"cosign",
|
|
79
|
+
"btc",
|
|
80
|
+
"globe"
|
|
73
81
|
];
|
|
74
82
|
function getSiteContext(slug) {
|
|
75
83
|
const ctx = LEGAL_SITES[slug];
|
|
@@ -151,7 +159,7 @@ var intellectualProperty = {
|
|
|
151
159
|
{ kind: "subhead", text: "[[ENTITY]]'s rights" },
|
|
152
160
|
{
|
|
153
161
|
kind: "para",
|
|
154
|
-
text: "The Service and its content (excluding user-generated content) are protected by copyright, trademark, patent, and other IP laws \u2014 including the
|
|
162
|
+
text: "The Service and its content (excluding user-generated content) are protected by copyright, trademark, patent, and other IP laws \u2014 including the [[BRAND]] name, logos, branding, site design, software, code, algorithms, and documentation."
|
|
155
163
|
},
|
|
156
164
|
{ kind: "subhead", text: "your license" },
|
|
157
165
|
{
|
|
@@ -166,7 +174,7 @@ var intellectualProperty = {
|
|
|
166
174
|
{ kind: "subhead", text: "open source" },
|
|
167
175
|
{
|
|
168
176
|
kind: "para",
|
|
169
|
-
text: "
|
|
177
|
+
text: "[[BRAND]] protocol specifications and the `@orangecheck/*` packages are released under open-source licenses (MIT unless stated otherwise). Those portions are governed by their own license terms; these Terms govern the hosted service."
|
|
170
178
|
}
|
|
171
179
|
]
|
|
172
180
|
};
|
|
@@ -450,7 +458,7 @@ var privacyTransfers = {
|
|
|
450
458
|
blocks: [
|
|
451
459
|
{
|
|
452
460
|
kind: "para",
|
|
453
|
-
text: "
|
|
461
|
+
text: "[[ENTITY]] is operated from the United States. If you access [[PRODUCT]] from elsewhere, your information may be transferred to, stored, and processed in the US or other countries where our service providers operate. For users in the EEA, UK, or Switzerland, we rely on appropriate safeguards for international transfers."
|
|
454
462
|
}
|
|
455
463
|
]
|
|
456
464
|
};
|
|
@@ -470,7 +478,7 @@ var privacyChanges = {
|
|
|
470
478
|
};
|
|
471
479
|
|
|
472
480
|
// src/content/protocol.ts
|
|
473
|
-
var COMMERCIAL_SCOPE_NOTE = "These Terms govern the **non-custodial** OrangeCheck family: [ochk.io](https://ochk.io), including its documentation at [ochk.io/docs](https://ochk.io/docs)
|
|
481
|
+
var COMMERCIAL_SCOPE_NOTE = "These Terms govern the **non-custodial** OrangeCheck family: [ochk.io](https://ochk.io), including its documentation at [ochk.io/docs](https://ochk.io/docs); the verb sites \u2014 OC Attest, OC Lock, OC Vote, OC Stamp, OC Agent, OC Pledge; and [chat.ochk.io](https://chat.ochk.io), [cosign.ochk.io](https://cosign.ochk.io), [btc.ochk.io](https://btc.ochk.io) and [globe.ochk.io](https://globe.ochk.io). The commercial products **ochk.app** and **vault.ochk.io** each publish their own Terms; these Terms do not govern your use of those products.";
|
|
474
482
|
var terms = {
|
|
475
483
|
kind: "terms",
|
|
476
484
|
eyebrow: "terms",
|
|
@@ -479,7 +487,7 @@ var terms = {
|
|
|
479
487
|
metaTitle: "Terms of Service \u2014 OrangeCheck",
|
|
480
488
|
metaDescription: "The terms and conditions for using OrangeCheck. Non-custodial service provided as-is. You are responsible for your wallet and private keys.",
|
|
481
489
|
effective: "2025-09-30",
|
|
482
|
-
updated: "2026-10-
|
|
490
|
+
updated: "2026-10-29",
|
|
483
491
|
preamble: [
|
|
484
492
|
{
|
|
485
493
|
kind: "callout",
|
|
@@ -499,6 +507,10 @@ var terms = {
|
|
|
499
507
|
kind: "para",
|
|
500
508
|
text: "OrangeCheck is a family of **non-custodial** protocols and reference tools that let you create cryptographic proof-of-stake artifacts using Bitcoin message signatures (BIP-322), bind self-asserted handles to them, optionally publish them to decentralized Nostr relays, and discover and verify artifacts created by others."
|
|
501
509
|
},
|
|
510
|
+
{
|
|
511
|
+
kind: "para",
|
|
512
|
+
text: "OrangeCheck also runs **chat.ochk.io**, an end-to-end-encrypted messenger; **cosign.ochk.io**, where builders post projects and others join or back them, with any payment going directly from one person to another; **btc.ochk.io**, a read-only Bitcoin market desk; and **globe.ochk.io**, a read-only view of the Bitcoin network."
|
|
513
|
+
},
|
|
502
514
|
{ kind: "subhead", text: "what orangecheck does not" },
|
|
503
515
|
{
|
|
504
516
|
kind: "bullets",
|
|
@@ -584,6 +596,10 @@ var terms = {
|
|
|
584
596
|
k: "opentimestamps calendars",
|
|
585
597
|
v: "when you claim an OC Chat @handle, your browser sends the claim's fingerprint (a SHA-256 hash) to the OpenTimestamps calendars at alice.btc.calendar.opentimestamps.org, bob.btc.calendar.opentimestamps.org and finney.calendar.eternitywall.com, and reads your address's coins and block headers from mempool.space; each of these sees your IP address and when you asked."
|
|
586
598
|
},
|
|
599
|
+
{
|
|
600
|
+
k: "payments between people",
|
|
601
|
+
v: "postage on chat.ochk.io, and backing, zaps and bounties on cosign.ochk.io, are Lightning payments you make directly to the other person's wallet. OrangeCheck never holds them, cannot reverse them, and is not a party to them."
|
|
602
|
+
},
|
|
587
603
|
{
|
|
588
604
|
k: "nostr network",
|
|
589
605
|
v: "decentralized relays operated by third parties. published data is replicated outside our control and may persist indefinitely."
|
|
@@ -611,7 +627,7 @@ var terms = {
|
|
|
611
627
|
blocks: [
|
|
612
628
|
{
|
|
613
629
|
kind: "para",
|
|
614
|
-
text: "The protocol sites
|
|
630
|
+
text: "The protocol sites, the documentation, cosign.ochk.io, btc.ochk.io and globe.ochk.io are free to use, and so is chat.ochk.io. chat.ochk.io also lists an optional paid plan, Personal: when its checkout is open, you pay the price shown before you pay, in advance, for a fixed period, and it does not renew on its own. You are responsible for Bitcoin network fees on any transactions you initiate and for your own ISP and wallet-provider costs. Other paid functionality, if introduced, will be announced with advance notice; the commercial products **ochk.app** and **vault.ochk.io** carry their own pricing and Terms."
|
|
615
631
|
}
|
|
616
632
|
]
|
|
617
633
|
},
|
|
@@ -628,7 +644,7 @@ var terms = {
|
|
|
628
644
|
{ kind: "subhead", text: "not financial, legal, or compliance advice" },
|
|
629
645
|
{
|
|
630
646
|
kind: "para",
|
|
631
|
-
text: "Nothing OrangeCheck provides \u2014 artifacts, metrics, scores, identity bindings, or other output \u2014 is financial, investment, legal, tax, KYC, AML, sanctions, or regulatory-compliance advice. Obtain independent professional advice before relying on the Service for any decision."
|
|
647
|
+
text: "Nothing OrangeCheck provides \u2014 artifacts, metrics, scores, identity bindings, btc.ochk.io's market data, charts and written market commentary (some of it written by an AI model), or other output \u2014 is financial, investment, legal, tax, KYC, AML, sanctions, or regulatory-compliance advice. Obtain independent professional advice before relying on the Service for any decision."
|
|
632
648
|
},
|
|
633
649
|
{ kind: "subhead", text: "regulatory status \xB7 not a money services business" },
|
|
634
650
|
{
|
|
@@ -668,11 +684,24 @@ var privacy = {
|
|
|
668
684
|
metaTitle: "Privacy Policy \u2014 OrangeCheck",
|
|
669
685
|
metaDescription: "How OrangeCheck handles data and privacy. Non-custodial by design, minimal data collection, no account required, privacy-preserving analytics only.",
|
|
670
686
|
effective: "2025-09-30",
|
|
671
|
-
updated: "2026-10-
|
|
687
|
+
updated: "2026-10-31",
|
|
672
688
|
preamble: [
|
|
673
689
|
{
|
|
674
690
|
kind: "callout",
|
|
675
|
-
text: "
|
|
691
|
+
text: "**What changed, 8 to 31 October 2026.** We corrected this policy where it did not say what is kept or who sees it. Newest first; the [changelog](https://github.com/orangecheck/oc-packages/blob/main/legal/CHANGELOG.md) lists every change."
|
|
692
|
+
},
|
|
693
|
+
{
|
|
694
|
+
kind: "bullets",
|
|
695
|
+
items: [
|
|
696
|
+
{ k: "31 October", v: "the owner consoles, analytics.ochk.io and vault.ochk.io's, show every email address masked, refuse an email as a search or action subject, and show a whole address only after a written reason is recorded." },
|
|
697
|
+
{ k: "29 October", v: "an account also keeps its Google or GitHub id, the roster id that links accounts signed in from one browser, the site you signed up through, a coin that backs it (its address, outpoint and amount, and the message you signed), and OC Chat device vouches and revocations, which are also published to Nostr relays. relay.ochk.io keeps each record with a pseudonym of the sender's IP address, replaced each UTC day, and never the address itself. Our operators' first-sign-in email names only your did:oc and the kind of sign-in. The policy says what chat, cosign, btc and globe keep, who completes a deletion, and what stays." },
|
|
698
|
+
{ k: "26 October", v: "a session row keeps no IP address, and the sign-in log keeps it for 90 days. relay.ochk.io is named, and our host's connection logs for it hold your IP address and connection times for 7 days. Claiming an OC Chat handle sends its fingerprint to three OpenTimestamps calendars and reads mempool.space, and each sees your IP address." },
|
|
699
|
+
{ k: "8 and 9 October", v: "the email is stored, encrypted. Each session and the sign-in log keep the full user-agent. Our operators get an email when a new account first signs in." }
|
|
700
|
+
]
|
|
701
|
+
},
|
|
702
|
+
{
|
|
703
|
+
kind: "callout",
|
|
704
|
+
text: "This policy covers the **non-custodial** OrangeCheck family \u2014 [ochk.io](https://ochk.io), including its documentation at [ochk.io/docs](https://ochk.io/docs), the six verb sites, and [chat.ochk.io](https://chat.ochk.io), [cosign.ochk.io](https://cosign.ochk.io), [btc.ochk.io](https://btc.ochk.io) and [globe.ochk.io](https://globe.ochk.io). The commercial products ochk.app and vault.ochk.io publish their own privacy policies covering the additional data their products handle."
|
|
676
705
|
}
|
|
677
706
|
],
|
|
678
707
|
sections: [
|
|
@@ -740,7 +769,7 @@ var privacy = {
|
|
|
740
769
|
},
|
|
741
770
|
{
|
|
742
771
|
k: "how you sign in",
|
|
743
|
-
v: "a Bitcoin address you prove with a signature (stored as is \u2014 it is public on-chain anyway); or, for an email code, Google or GitHub, the verified email address \u2014 encrypted at rest, plus a one-way hash of it so we can find your account"
|
|
772
|
+
v: "a Bitcoin address you prove with a signature (stored as is \u2014 it is public on-chain anyway); or, for an email code, Google or GitHub, the verified email address \u2014 encrypted at rest, plus a one-way hash of it so we can find your account. For Google or GitHub we also store that provider's id for your account, unencrypted, so a changed email still reaches the same account"
|
|
744
773
|
},
|
|
745
774
|
{
|
|
746
775
|
k: "passkeys",
|
|
@@ -754,13 +783,34 @@ var privacy = {
|
|
|
754
783
|
k: "sign-in log",
|
|
755
784
|
v: "each sign-in and each identity you link or remove, with the IP address and user-agent at the time \u2014 kept for security; the IP address is cleared after 90 days"
|
|
756
785
|
},
|
|
786
|
+
{
|
|
787
|
+
k: "accounts in one browser",
|
|
788
|
+
v: "sessions opened in the same browser share a roster id, so we can tell which of your accounts were signed in from it; and which of our sites you first signed up through"
|
|
789
|
+
},
|
|
790
|
+
{
|
|
791
|
+
k: "a coin backing your account",
|
|
792
|
+
v: "if you back your account with a coin: its address, outpoint and amount, the backing message you signed, and when we last found it unspent, or saw it released or spent. We read the coin from mempool.space. Earlier backings stay with your account. Sites you sign in to get only amount and age floors and a number that differs from site to site (all *.ochk.io sites share one), never the coin"
|
|
793
|
+
},
|
|
794
|
+
{
|
|
795
|
+
k: "OC Chat devices",
|
|
796
|
+
v: "for each chat.ochk.io device we vouch for: its device and Nostr public keys, when we vouched, and the sign-in that asked; for a device you revoke, the signed revocation, which we also publish to Nostr relays"
|
|
797
|
+
},
|
|
798
|
+
{
|
|
799
|
+
k: "btc.ochk.io alerts",
|
|
800
|
+
v: "the market thresholds you save on btc.ochk.io (up to 25), stored with your account"
|
|
801
|
+
},
|
|
757
802
|
{
|
|
758
803
|
k: "when you first sign in",
|
|
759
|
-
v: "OrangeCheck\u2019s operators get an email, sent through our email provider (Resend), naming your `did:oc` and the
|
|
804
|
+
v: "OrangeCheck\u2019s operators get an email, sent through our email provider (Resend), naming your `did:oc` and the kind of sign-in you used (a Bitcoin wallet, an email code, Google or GitHub). Notices sent up to and including 29 October 2026 (UTC) also named the identity itself: your Bitcoin address or your email address"
|
|
760
805
|
},
|
|
761
806
|
{ k: "never", v: "a password, a private key, or a seed phrase" }
|
|
762
807
|
]
|
|
763
808
|
},
|
|
809
|
+
{ kind: "subhead", text: "who at OrangeCheck can see it" },
|
|
810
|
+
{
|
|
811
|
+
kind: "para",
|
|
812
|
+
text: "OrangeCheck's operators can see your account in owner-only consoles: analytics.ochk.io and, for a vault account, vault.ochk.io's. Their account lists show each email address masked: the first character of the part before the @ when that part has three or more characters, and none of it otherwise. Their account searches and actions refuse an email address: an account is found by email only through a lookup. Revealing one address, or looking up one account, asks for a written reason, which is recorded before your email address is shown. A lookup's record has its details about you cleared after 90 days; the reason stays."
|
|
813
|
+
},
|
|
764
814
|
{ kind: "subhead", text: "automatically collected" },
|
|
765
815
|
{
|
|
766
816
|
kind: "bullets",
|
|
@@ -780,7 +830,7 @@ var privacy = {
|
|
|
780
830
|
},
|
|
781
831
|
{
|
|
782
832
|
k: "relay.ochk.io",
|
|
783
|
-
v: "the Nostr relay we run (strfry on Fly.io, in Frankfurt). Your browser connects to it to read and publish signed records; our sites also publish the same records to public relays run by others (see the Terms). It keeps each record it accepts until the same key replaces it with a newer version or the record's own expiry passes: records are public, copied each day to a public archive on GitHub (where earlier versions stay), and otherwise deleted only after a lawful takedown request, which does not remove the copies elsewhere. Each record is stored with
|
|
833
|
+
v: "the Nostr relay we run (strfry on Fly.io, in Frankfurt). Your browser connects to it to read and publish signed records; our sites also publish the same records to public relays run by others (see the Terms). It keeps each record it accepts until the same key replaces it with a newer version or the record's own expiry passes: records are public, copied each day to a public archive on GitHub (where earlier versions stay), and otherwise deleted only after a lawful takedown request, which does not remove the copies elsewhere. Each record is stored with a pseudonym of the IP address it came from, made with a key that is kept only in memory and replaced each UTC day, so the relay can limit how much one source writes; your IP address itself is never stored, and the pseudonym is never served or archived. Our hosting provider (Fly.io) carries each connection to it and handles your IP address to do so, for its own short retention window; we keep no separate copy. Our host's connection logs for the relay can hold your IP address and connection times; they are kept for 7 days."
|
|
784
834
|
}
|
|
785
835
|
]
|
|
786
836
|
},
|
|
@@ -808,6 +858,95 @@ var privacy = {
|
|
|
808
858
|
}
|
|
809
859
|
]
|
|
810
860
|
},
|
|
861
|
+
{
|
|
862
|
+
id: "chat-cosign-btc-globe",
|
|
863
|
+
heading: "chat, cosign, btc and globe",
|
|
864
|
+
hint: "what each of these sites keeps",
|
|
865
|
+
blocks: [
|
|
866
|
+
{ kind: "subhead", text: "chat.ochk.io" },
|
|
867
|
+
{
|
|
868
|
+
kind: "bullets",
|
|
869
|
+
items: [
|
|
870
|
+
{
|
|
871
|
+
k: "messages",
|
|
872
|
+
v: "end-to-end encrypted. Our server holds a message only as ciphertext, under a per-conversation id that names neither person, until the recipient picks it up: for up to 14 days, or 365 days on the Personal plan. A delivered message is deleted 24 hours after the recipient confirms it. We cannot read message content"
|
|
873
|
+
},
|
|
874
|
+
{
|
|
875
|
+
k: "on your device",
|
|
876
|
+
v: "your messages, contacts and settings are kept in your browser. Lock this device with a passphrase to encrypt your device key and messages there"
|
|
877
|
+
},
|
|
878
|
+
{
|
|
879
|
+
k: "sending limits",
|
|
880
|
+
v: "a count of messages sent per hour, under a keyed id made from your account, dropped after a day. chat.ochk.io stores no IP address"
|
|
881
|
+
},
|
|
882
|
+
{
|
|
883
|
+
k: "the Personal plan",
|
|
884
|
+
v: "if you buy it: your account id, the plan, when you paid and until when, the amount and the invoice id. The invoice our payment processor (BTCPay) holds says what was sold, not who bought it"
|
|
885
|
+
},
|
|
886
|
+
{
|
|
887
|
+
k: "published to Nostr",
|
|
888
|
+
v: "your device records, public channel posts (which are not encrypted), and a directory listing if you choose to be listed are public and stay on the relays. Direct messages travel encrypted"
|
|
889
|
+
},
|
|
890
|
+
{
|
|
891
|
+
k: "sent from your browser",
|
|
892
|
+
v: "chain data from mempool.space and blockstream.info, the drand network for messages that open at a future block, the OpenTimestamps calendars named above for a handle claim, and the Nostr relays you use; each sees your IP address"
|
|
893
|
+
},
|
|
894
|
+
{
|
|
895
|
+
k: "analytics",
|
|
896
|
+
v: "none"
|
|
897
|
+
},
|
|
898
|
+
{
|
|
899
|
+
k: "deletion",
|
|
900
|
+
v: "deleting your account deletes chat.ochk.io's other records of you; Personal plan payment records stay for accounting under a keyed id, not your account id. Messages waiting for pickup expire on their own, and what is on Nostr relays stays"
|
|
901
|
+
}
|
|
902
|
+
]
|
|
903
|
+
},
|
|
904
|
+
{ kind: "subhead", text: "cosign.ochk.io" },
|
|
905
|
+
{
|
|
906
|
+
kind: "bullets",
|
|
907
|
+
items: [
|
|
908
|
+
{
|
|
909
|
+
k: "what you post",
|
|
910
|
+
v: "your profile, projects, updates, cosigns and vouches are public on cosign.ochk.io"
|
|
911
|
+
},
|
|
912
|
+
{
|
|
913
|
+
k: "messages",
|
|
914
|
+
v: "**not end-to-end encrypted.** They are stored on our servers, and OrangeCheck's operators can read them"
|
|
915
|
+
},
|
|
916
|
+
{
|
|
917
|
+
k: "reports and notifications",
|
|
918
|
+
v: "a report you file keeps you as its reporter, the subject and your reason. Notifications are shown in the app only; a read one is deleted after 30 days and any after 90"
|
|
919
|
+
},
|
|
920
|
+
{
|
|
921
|
+
k: "payments between people",
|
|
922
|
+
v: "we record each Lightning payment for display (amount, time, status and the receiving Lightning address); the money goes directly between people and cosign never holds it"
|
|
923
|
+
},
|
|
924
|
+
{
|
|
925
|
+
k: "abuse limits",
|
|
926
|
+
v: "counts of writes per account, per IP address and per network, under keyed ids, dropped after 2 days; and your account's counts for the last ten minutes, kept with your account. No IP address is stored"
|
|
927
|
+
},
|
|
928
|
+
{
|
|
929
|
+
k: "deletion",
|
|
930
|
+
v: "deleting your account deletes your profile, projects and the rest, except that your messages in conversations with other people, the reports you filed, and payment records stay, with your account taken off them"
|
|
931
|
+
}
|
|
932
|
+
]
|
|
933
|
+
},
|
|
934
|
+
{ kind: "subhead", text: "btc.ochk.io" },
|
|
935
|
+
{
|
|
936
|
+
kind: "para",
|
|
937
|
+
text: "btc.ochk.io keeps only the alert thresholds you save, with your account, and deletes them when your account is deleted. Its planner and paper desk stay in your browser. Its market commentary is written each hour by an AI model provider (Anthropic) from market data and the web searches it runs; nothing about you is sent."
|
|
938
|
+
},
|
|
939
|
+
{ kind: "subhead", text: "globe.ochk.io" },
|
|
940
|
+
{
|
|
941
|
+
kind: "para",
|
|
942
|
+
text: "globe.ochk.io stores nothing about you. Your browser fetches live network data directly from mempool.space, which sees your IP address."
|
|
943
|
+
},
|
|
944
|
+
{
|
|
945
|
+
kind: "para",
|
|
946
|
+
text: "cosign.ochk.io, btc.ochk.io and globe.ochk.io use the cookie-free analytics described below."
|
|
947
|
+
}
|
|
948
|
+
]
|
|
949
|
+
},
|
|
811
950
|
{
|
|
812
951
|
id: "how-we-use",
|
|
813
952
|
heading: "how we use information",
|
|
@@ -826,7 +965,7 @@ var privacy = {
|
|
|
826
965
|
{
|
|
827
966
|
id: "retention",
|
|
828
967
|
heading: "data retention",
|
|
829
|
-
hint: "
|
|
968
|
+
hint: "scheduled and on-write deletion \xB7 permanent public artifacts",
|
|
830
969
|
blocks: [
|
|
831
970
|
{
|
|
832
971
|
kind: "bullets",
|
|
@@ -845,15 +984,19 @@ var privacy = {
|
|
|
845
984
|
},
|
|
846
985
|
{
|
|
847
986
|
k: "sessions",
|
|
848
|
-
v: "deleted when you sign out
|
|
987
|
+
v: "deleted when you sign out; a session that expires after 30 days is deleted the next time anyone signs in"
|
|
849
988
|
},
|
|
850
989
|
{
|
|
851
990
|
k: "IP addresses in the sign-in log",
|
|
852
991
|
v: "cleared after 90 days; the entries themselves stay until your account is deleted"
|
|
853
992
|
},
|
|
854
993
|
{
|
|
855
|
-
k: "
|
|
856
|
-
v: "deleted when
|
|
994
|
+
k: "email sign-in codes",
|
|
995
|
+
v: "the code itself is never stored and expires after 10 minutes; the record that lets it be used once is deleted when it is spent, or with the next code anyone asks for after it expires; per-address and per-network send counts, kept as keyed hashes, are dropped after a day"
|
|
996
|
+
},
|
|
997
|
+
{
|
|
998
|
+
k: "account, sign-in identities, passkeys, sign-in log, coin backings, OC Chat device records and btc.ochk.io alerts",
|
|
999
|
+
v: "deleted when your account-deletion request completes. File one in [your account on ochk.app](https://ochk.app/me/account), or ask at [[PRIVACY_CONTACT]]. A person completes the request, and we aim to do that within 48 hours. Nothing is erased while a blocker remains: sats you are owed or payouts still pending on ochk.app, live guardian-operator duties, developer projects or an OC Connect app you own, or a vault team you own that still has other members. What stays: the email our operators received when you first signed in, which names your `did:oc` and the kind of sign-in you used, and, if it was sent up to and including 29 October 2026 (UTC), the identity itself; a revocation already published to Nostr relays, and anything else you published there or anchored to Bitcoin; a marker under a hash of your account id that refuses your old sessions until they would have expired, about 30 days; and, if a site made an account for you, a hashed record of it, so that site is told the account was deleted instead of making a new one"
|
|
857
1000
|
},
|
|
858
1001
|
{
|
|
859
1002
|
k: "support emails",
|
|
@@ -893,16 +1036,16 @@ var privacy = {
|
|
|
893
1036
|
var protocolProfile = { terms, privacy };
|
|
894
1037
|
|
|
895
1038
|
// src/content/me.ts
|
|
896
|
-
var COMMERCIAL_NOTE = "**ochk.app is a commercial product operated by
|
|
1039
|
+
var COMMERCIAL_NOTE = "**ochk.app is a commercial product operated by orangecheck.** It is distinct from the non-custodial orangecheck protocol sites; the Terms at [ochk.io/terms](https://ochk.io/terms) do not govern ochk.app. These Terms do. Its API is served at me.ochk.io, from the same accounts and records: these Terms govern the Service at either address, and \u201Cochk.app\u201D in them means both.";
|
|
897
1040
|
var terms2 = {
|
|
898
1041
|
kind: "terms",
|
|
899
1042
|
eyebrow: "terms",
|
|
900
1043
|
title: "Terms of service",
|
|
901
|
-
description: "The terms governing your use of ochk.app and its API at me.ochk.io \u2014 a Bitcoin-backed identity that
|
|
1044
|
+
description: "The terms governing your use of ochk.app and its API at me.ochk.io \u2014 a Bitcoin-backed identity that will pay you in sats. orangecheck holds what you earn during bring-up and will pay it to a Lightning wallet you choose. No KYC.",
|
|
902
1045
|
metaTitle: "Terms of Service \u2014 ochk.app",
|
|
903
|
-
metaDescription: "Terms of service for ochk.app: a Bitcoin-backed identity that
|
|
1046
|
+
metaDescription: "Terms of service for ochk.app: a Bitcoin-backed identity that will pay users in sats. orangecheck holds what users earn during bring-up and will pay it to a Lightning wallet they choose. No KYC.",
|
|
904
1047
|
effective: "2026-05-15",
|
|
905
|
-
updated: "2026-
|
|
1048
|
+
updated: "2026-11-03",
|
|
906
1049
|
preamble: [
|
|
907
1050
|
{
|
|
908
1051
|
kind: "callout",
|
|
@@ -919,26 +1062,26 @@ var terms2 = {
|
|
|
919
1062
|
blocks: [
|
|
920
1063
|
{
|
|
921
1064
|
kind: "para",
|
|
922
|
-
text: 'ochk.app is an identity you use to sign in across participating sites ("integrators"). When an integrator records a billable event for an action you authorize, a share of the fee
|
|
1065
|
+
text: 'ochk.app is an identity you use to sign in across participating sites ("integrators"). When an integrator records a billable event for an action you authorize, a share of the fee will flow back to you in sats. Your identity works across the orangecheck family. Every paid event on your account has a receipt, signed by us, and anyone holding one and the public key we publish can check its signature offline, without asking us; a receipt sent to Bitcoin for a timestamp also checks against Bitcoin once it is anchored. If you back your account, it is tied to bitcoin you hold, and that bitcoin stays in your wallet.'
|
|
923
1066
|
},
|
|
924
1067
|
{
|
|
925
1068
|
kind: "para",
|
|
926
|
-
text: "ochk.app is **not a bank, exchange, broker, or wallet provider.** It is an identity and reputation service with an attached cashback mechanism. **During bring-up
|
|
1069
|
+
text: "ochk.app is **not a bank, exchange, broker, or wallet provider.** It is an identity and reputation service with an attached cashback mechanism. **During bring-up orangecheck operates every role in that mechanism, including custody of the balance it will pay you.** That is a stage, not the design \u2014 see the custody section below for what holds today."
|
|
927
1070
|
}
|
|
928
1071
|
]
|
|
929
1072
|
},
|
|
930
1073
|
{
|
|
931
1074
|
id: "accounts",
|
|
932
1075
|
heading: "accounts & identity",
|
|
933
|
-
hint: "
|
|
1076
|
+
hint: "four ways to sign in",
|
|
934
1077
|
blocks: [
|
|
935
1078
|
{
|
|
936
1079
|
kind: "para",
|
|
937
|
-
text: "You may create an identity
|
|
1080
|
+
text: "You may create an identity four ways: with **email** (a one-time code), **Google**, **GitHub**, or **a Bitcoin wallet** (you sign with BIP-322 \u2014 full self-custody of your signing key). With email, Google or GitHub you hold no key of your own, so orangecheck holds your signing key. However you sign in, during bring-up orangecheck holds the cashback you accrue; see custody below. Each way produces a stable, opaque `did:oc` identifier. No password is ever stored."
|
|
938
1081
|
},
|
|
939
1082
|
{
|
|
940
1083
|
kind: "para",
|
|
941
|
-
text: "You are responsible for the security of the wallet, device, email account, or recovery mnemonic associated with your identity. Anyone with your keys or recovery factor can act as you.
|
|
1084
|
+
text: "You are responsible for the security of the wallet, device, email account, or recovery mnemonic associated with your identity. Anyone with your keys or recovery factor can act as you. orangecheck cannot recover an account, reverse a sign-in, or restore a lost key or mnemonic."
|
|
942
1085
|
}
|
|
943
1086
|
]
|
|
944
1087
|
},
|
|
@@ -950,22 +1093,22 @@ var terms2 = {
|
|
|
950
1093
|
blocks: [
|
|
951
1094
|
{
|
|
952
1095
|
kind: "stub",
|
|
953
|
-
text: "The economics of earning sats on ochk.app \u2014 how billable events generate cashback, the fee split between you, the integrating site, federation operators, and
|
|
1096
|
+
text: "The economics of earning sats on ochk.app \u2014 how billable events generate cashback, the fee split between you, the integrating site, federation operators, and orangecheck, the timing of credits, and the conditions under which earnings may be withheld, delayed, clawed back, or reversed (including for suspected abuse or wash-trading) \u2014 are being finalized for publication before general availability. Until then, earning behavior is governed by the published abuse limits in the section below and the descriptions on [how it works](/how) and [the earn page](/earn). This section will be completed following review by counsel."
|
|
954
1097
|
}
|
|
955
1098
|
]
|
|
956
1099
|
},
|
|
957
1100
|
{
|
|
958
1101
|
id: "custody",
|
|
959
|
-
heading: "custody &
|
|
960
|
-
hint: "orangecheck-held during bring-up \xB7
|
|
1102
|
+
heading: "custody & payouts",
|
|
1103
|
+
hint: "orangecheck-held during bring-up \xB7 paid out to a wallet you choose",
|
|
961
1104
|
blocks: [
|
|
962
1105
|
{
|
|
963
1106
|
kind: "para",
|
|
964
|
-
text: "Custody depends on how you sign in, and the honest answer differs today from the design.\n\n**If you sign in with BIP-322, you hold your own keys.** They never leave your device.
|
|
1107
|
+
text: "Custody depends on how you sign in, and the honest answer differs today from the design.\n\n**If you sign in with BIP-322, you hold your own keys.** They never leave your device. orangecheck verifies signatures and relays envelopes; it cannot move the funds in your wallet. That is true now and does not change.\n\n**What you earn is a different matter.** Cashback you accrue is a balance orangecheck owes you until it is paid out to the destination you bind. During bring-up orangecheck holds those sats for every user, however they sign in.\n\n**If you sign in with email, Google or GitHub, orangecheck currently holds the key that will pay you.** The design is a Fedimint federation: independent guardians hold the bitcoin under a threshold scheme, and orangecheck\u2019s executor holds your claim on it, as ecash, until it is paid out to a Lightning wallet you choose. That federation does not exist yet: there are no independent guardians today, and during bring-up the signing key for the paying rail is operated by orangecheck. So during this period orangecheck is a custodian, of the signing keys of people who sign in with email, Google or GitHub and of every user\u2019s accrued cashback, and the party that will move the money once payouts open.\n\nWe state that plainly rather than describing the destination as though it were the present. **The live status of the paying rail \u2014 which posture is in force, what bounds it, and what has actually settled \u2014 is published on [the custody page](/custody) and machine-readable at `/api/federations`.** Those surfaces are computed from the system rather than written by hand, so they cannot drift from this document the way a fixed sentence would."
|
|
965
1108
|
},
|
|
966
1109
|
{
|
|
967
1110
|
kind: "stub",
|
|
968
|
-
text: "The complete custody disclosure \u2014 the federation threshold model and its failure modes, what each guardian can and cannot do, the durability of your balance if a federation or
|
|
1111
|
+
text: "The complete custody disclosure \u2014 the federation threshold model and its failure modes, what each guardian can and cannot do, the durability of your balance if a federation or orangecheck ceases operations, and the allocation of risk between you, the federation, and orangecheck \u2014 is being finalized for publication before general availability. The honest current-state engineering account is published on the [security page](/security). This section will be completed following review by counsel."
|
|
969
1112
|
}
|
|
970
1113
|
]
|
|
971
1114
|
},
|
|
@@ -976,6 +1119,11 @@ var terms2 = {
|
|
|
976
1119
|
{
|
|
977
1120
|
kind: "stub",
|
|
978
1121
|
text: "Platform fees, payout mechanics and minimums, supported payout rails, currency-conversion handling, and the allocation of tax-reporting and tax-payment responsibility for sats you receive are being finalized for publication before general availability. You are advised that cashback received may be taxable income in your jurisdiction and that you are responsible for your own tax compliance. This section will be completed following review by counsel."
|
|
1122
|
+
},
|
|
1123
|
+
{ kind: "subhead", text: "when a payout is held" },
|
|
1124
|
+
{
|
|
1125
|
+
kind: "para",
|
|
1126
|
+
text: "We hold a payout, and do not send it, when an earlier attempt to send it may already have gone through; while payouts are paused by a halt, a federation migration or a payout ceiling, or are not yet open to you; while the node that pays cannot cover everything owed, or its fee limit is unknown; for 24 hours after you change your payout destination; when your payout destination is no longer valid; or when our records disagree about what is owed. A paused or limited payout goes out on its own once the pause, ceiling, shortfall or 24 hours have passed; setting a new destination clears a destination hold; and a disagreement clears when we correct the record. A payout whose earlier attempt may have gone through is never retried on its own: we check the payment node, then either mark it paid with the payment's proof or release it to be sent again. A hold does not cancel what you are owed."
|
|
979
1127
|
}
|
|
980
1128
|
]
|
|
981
1129
|
},
|
|
@@ -1015,7 +1163,7 @@ var terms2 = {
|
|
|
1015
1163
|
blocks: [
|
|
1016
1164
|
{
|
|
1017
1165
|
kind: "para",
|
|
1018
|
-
text: "Sites that integrate ochk.app through its API at me.ochk.io get their own subject id for the events they report, and your Bitcoin address, email or attestation tier only if you grant that scope. Signing in gives every site the same orangecheck id (did:oc), so sites that compare ids can tell it is you. Integrators independently decide whether and how to trust your identity, including whether to admit, gate, or reject you.
|
|
1166
|
+
text: "Sites that integrate ochk.app through its API at me.ochk.io get their own subject id for the events they report, and your Bitcoin address, email or attestation tier only if you grant that scope. Signing in gives every site the same orangecheck id (did:oc), so sites that compare ids can tell it is you. Integrators independently decide whether and how to trust your identity, including whether to admit, gate, or reject you. orangecheck is not a party to, and accepts no liability for, an integrator\u2019s decisions or an integrator\u2019s own terms, pricing, or conduct."
|
|
1019
1167
|
}
|
|
1020
1168
|
]
|
|
1021
1169
|
},
|
|
@@ -1032,12 +1180,12 @@ var terms2 = {
|
|
|
1032
1180
|
},
|
|
1033
1181
|
{
|
|
1034
1182
|
kind: "para",
|
|
1035
|
-
text: "Nothing ochk.app provides is financial, investment, legal, or tax advice. ochk.app does not guarantee any level of earnings; cashback depends on integrator activity outside
|
|
1183
|
+
text: "Nothing ochk.app provides is financial, investment, legal, or tax advice. ochk.app does not guarantee any level of earnings; cashback depends on integrator activity outside orangecheck\u2019s control."
|
|
1036
1184
|
},
|
|
1037
1185
|
{ kind: "subhead", text: "regulatory status" },
|
|
1038
1186
|
{
|
|
1039
1187
|
kind: "stub",
|
|
1040
|
-
text: "ochk.app is designed so that cashback
|
|
1188
|
+
text: "ochk.app is designed so that independent Fedimint federations hold the bitcoin behind the cashback, while orangecheck\u2019s executor holds each person\u2019s claim on it and pays it out. **Those federations do not exist yet. During bring-up orangecheck itself custodies the cashback every user earns, and will be the one that transmits it**, because it is operating every role in the system in order to prove it works before third parties take any of them. Self-custody (BIP-322) users keep their own keys, which orangecheck never holds; the cashback they accrue is held by orangecheck until it is paid out, as it is for every user. The full regulatory analysis of both the bring-up posture and the designed end state \u2014 including orangecheck\u2019s position under the U.S. Bank Secrecy Act money-transmission rules, the FATF Recommendations, the EU MiCA Regulation, and applicable U.S. state money-transmitter regimes, and the corresponding licensing posture \u2014 is being prepared and will be published before general availability. This section will be completed following review by counsel."
|
|
1041
1189
|
}
|
|
1042
1190
|
]
|
|
1043
1191
|
},
|
|
@@ -1049,7 +1197,7 @@ var terms2 = {
|
|
|
1049
1197
|
blocks: [
|
|
1050
1198
|
{
|
|
1051
1199
|
kind: "para",
|
|
1052
|
-
text: "**Your right:** stop using ochk.app at any time; you may delete your identity in [your settings](/me/settings). **Our right:** suspend or terminate access with or without cause, including for abuse or legal risk. Deleting your identity does not settle a balance
|
|
1200
|
+
text: "**Your right:** stop using ochk.app at any time; you may delete your identity in [your settings](/me/settings). **Our right:** suspend or terminate access with or without cause, including for abuse or legal risk. Deleting your identity does not settle a balance orangecheck owes you. If your balance is above zero, bind a payout destination and instruct a cash-out before you delete, or contact us. Hashes anchored to Bitcoin and commitments published to Nostr are immutable and cannot be deleted by orangecheck; neither names you. The disclaimer, liability, indemnification, governing-law, and dispute provisions survive."
|
|
1053
1201
|
}
|
|
1054
1202
|
]
|
|
1055
1203
|
},
|
|
@@ -1057,21 +1205,39 @@ var terms2 = {
|
|
|
1057
1205
|
disputeResolution,
|
|
1058
1206
|
miscellaneous
|
|
1059
1207
|
],
|
|
1060
|
-
summary: "summary: an identity that
|
|
1208
|
+
summary: "summary: an identity that will pay you in sats. if you sign in with your own bitcoin wallet, you keep your keys; if you sign in with email, google or github, orangecheck holds the key that will pay you. either way, during bring-up orangecheck holds what you have earned until it is paid out. money, custody, fee, and regulatory terms are being finalized \u2014 see the marked sections."
|
|
1061
1209
|
};
|
|
1062
1210
|
var privacy2 = {
|
|
1063
1211
|
kind: "privacy",
|
|
1064
1212
|
eyebrow: "privacy",
|
|
1065
1213
|
title: "Privacy policy",
|
|
1066
|
-
description: "How ochk.app and its API at me.ochk.io handle your data: no KYC, no PII required, and a documented, falsifiable account of every record
|
|
1214
|
+
description: "How ochk.app and its API at me.ochk.io handle your data: no KYC, no PII required, and a documented, falsifiable account of every record orangecheck stores.",
|
|
1067
1215
|
metaTitle: "Privacy Policy \u2014 ochk.app",
|
|
1068
|
-
metaDescription: "ochk.app privacy policy. No KYC, no PII required, and a full account of what
|
|
1216
|
+
metaDescription: "ochk.app privacy policy. No KYC, no PII required, and a full account of what orangecheck stores.",
|
|
1069
1217
|
effective: "2026-05-15",
|
|
1070
|
-
updated: "2026-
|
|
1218
|
+
updated: "2026-11-03",
|
|
1071
1219
|
preamble: [
|
|
1072
1220
|
{
|
|
1073
1221
|
kind: "callout",
|
|
1074
|
-
text: "
|
|
1222
|
+
text: "**What changed, 8 to 31 October 2026.** We corrected this policy where it did not say what is kept or who sees it. Newest first; the [changelog](https://github.com/orangecheck/oc-packages/blob/main/legal/CHANGELOG.md) lists every change."
|
|
1223
|
+
},
|
|
1224
|
+
{
|
|
1225
|
+
kind: "bullets",
|
|
1226
|
+
items: [
|
|
1227
|
+
{ k: "29 October", v: "the contact form sends your email address, an optional name, the topic and your message to our inbox through our email provider (Resend)." },
|
|
1228
|
+
{ k: "27 and 28 October", v: "a guardian application holds the questionnaire's answers, and the charter publishes its handle, name, jurisdiction, contact channel and fingerprint. The policy says which records a deletion keeps, and that cached copies expire within a day." },
|
|
1229
|
+
{ k: "26 October", v: "a session record keeps no IP address, and the sign-in log keeps it for 90 days." },
|
|
1230
|
+
{ k: "25 October", v: "me.ochk.io records which sites you sign in to or share data with, and when. No site sees that record." },
|
|
1231
|
+
{ k: "24 October", v: "signing in gives every site the same did:oc." },
|
|
1232
|
+
{ k: "23 October", v: "an account a site makes for you through orangecheck Connect keeps a hash of the site's id for you, a keyed hash of your email if the site sent one, when it was made, whether you agreed to earn, and what it earned." },
|
|
1233
|
+
{ k: "19 October", v: "ochk.app is the Service, and me.ochk.io is its API." },
|
|
1234
|
+
{ k: "15 October", v: "ochk.app's own cookies are listed: __Host-oc_session, and __Host-oc_oauth for at most ten minutes during a Google or GitHub sign-in." },
|
|
1235
|
+
{ k: "8 October", v: "a session record keeps your user-agent, and an email is personal data." }
|
|
1236
|
+
]
|
|
1237
|
+
},
|
|
1238
|
+
{
|
|
1239
|
+
kind: "callout",
|
|
1240
|
+
text: "This policy covers the Service at both of its addresses, ochk.app and its API at me.ochk.io: one account, one store of records, one operator; \u201Cochk.app\u201D below means both. Its product is identity that will pay you; its privacy posture is what makes it distinct from Sign in with Google. For a side-by-side comparison you can falsify, see [the privacy comparison](/privacy-compare)."
|
|
1075
1241
|
}
|
|
1076
1242
|
],
|
|
1077
1243
|
sections: [
|
|
@@ -1114,7 +1280,7 @@ var privacy2 = {
|
|
|
1114
1280
|
blocks: [
|
|
1115
1281
|
{
|
|
1116
1282
|
kind: "para",
|
|
1117
|
-
text: "The list below is what an auditor would find in
|
|
1283
|
+
text: "The list below is what an auditor would find in orangecheck\u2019s production infrastructure. Every item is metadata; none of it lets orangecheck sign on your behalf."
|
|
1118
1284
|
},
|
|
1119
1285
|
{
|
|
1120
1286
|
kind: "bullets",
|
|
@@ -1137,7 +1303,7 @@ var privacy2 = {
|
|
|
1137
1303
|
},
|
|
1138
1304
|
{
|
|
1139
1305
|
k: "custody-state envelopes",
|
|
1140
|
-
v: "a record of each
|
|
1306
|
+
v: "a record of each change in how your account is custodied, kept on your own identity timeline. None is made while the system is in testing."
|
|
1141
1307
|
},
|
|
1142
1308
|
{
|
|
1143
1309
|
k: "site sign-ins",
|
|
@@ -1147,6 +1313,10 @@ var privacy2 = {
|
|
|
1147
1313
|
k: "guardian applications",
|
|
1148
1314
|
v: "an application to run a guardian, made through ochk.app or by email to apply@ochk.io, holds your answers to the operator questionnaire, which asks, among other things, for a public handle, the name of the person or organisation that will run the guardian, its jurisdiction, a public contact channel, a key fingerprint and two references. Through ochk.app it can also hold an optional handle and email address that only the reviewer sees, for the decision. The questionnaire\u2019s handle, name, jurisdiction, contact channel and fingerprint are published in the federation charter, because guardians are named trust anchors. Nothing is checked against an ID, and nothing else is published."
|
|
1149
1315
|
},
|
|
1316
|
+
{
|
|
1317
|
+
k: "messages you send us",
|
|
1318
|
+
v: "the contact form at ochk.app/contact sends your email address, an optional name, the topic you pick and your message to our inbox through our email provider (Resend). They are kept only as long as we need them to reply"
|
|
1319
|
+
},
|
|
1150
1320
|
{
|
|
1151
1321
|
k: "public anchors",
|
|
1152
1322
|
v: "an OpenTimestamps proof over each envelope\u2019s hash, and a salted commitment to each envelope on Nostr. Public by design, and neither names you, the site or the amount. The envelope itself is served only to whoever holds its id. Drop manifests, which name no one, are published in full."
|
|
@@ -1176,7 +1346,7 @@ var privacy2 = {
|
|
|
1176
1346
|
blocks: [
|
|
1177
1347
|
{
|
|
1178
1348
|
kind: "para",
|
|
1179
|
-
text: "
|
|
1349
|
+
text: "orangecheck\u2019s billing engine necessarily knows which user earned which cashback across integrating sites \u2014 that join is how the right wallet is credited. Today that linkage exists in plain storage on me.ochk.io infrastructure; orangecheck commits, as a **policy** matter enforced by access controls and audit logging, not to build cross-site behavioural profiles. A per-integrator blinded-identifier design that removes the linkage architecturally is active research and not yet shipped. We disclose this honestly rather than overclaim."
|
|
1180
1350
|
}
|
|
1181
1351
|
]
|
|
1182
1352
|
},
|
|
@@ -1203,7 +1373,7 @@ var privacy2 = {
|
|
|
1203
1373
|
items: [
|
|
1204
1374
|
"Route cashback to the correct identity and wallet",
|
|
1205
1375
|
"Detect and prevent sybil farming, wash-trading, and abuse",
|
|
1206
|
-
"Operate sign-in and verification across the
|
|
1376
|
+
"Operate sign-in and verification across the orangecheck family",
|
|
1207
1377
|
"Fix bugs, improve the Service, and respond to support requests"
|
|
1208
1378
|
]
|
|
1209
1379
|
}
|
|
@@ -1257,7 +1427,7 @@ var privacy2 = {
|
|
|
1257
1427
|
blocks: [
|
|
1258
1428
|
{
|
|
1259
1429
|
kind: "para",
|
|
1260
|
-
text: "In [your settings](/me/settings) you can delete your account. A person completes the request, and we aim to do that within 48 hours: an alert tells us when one has waited a day. Completing it closes your sign-in, so signing in again starts a new account, and erases your data on ochk.io, me.ochk.io, vault, chat and cosign, except a few records. Payment records keep their amounts and times for accounting, and our audit log and your deletion request stay, without the reason you gave. We keep a record that your account was deleted, out of public view, so sessions you already had stop working and the deletion can be shown. Each keeps your account only as a keyed id, or not at all, so the record by itself doesn't say whose account it was. On cosign, your messages in conversations with other people and the reports you filed stay, with your account taken off them. Backups roll off within 30 days, and copies cached by our CDN expire within a day. Deleting does not pay out sats
|
|
1430
|
+
text: "In [your settings](/me/settings) you can delete your account. A person completes the request, and we aim to do that within 48 hours: an alert tells us when one has waited a day. Completing it closes your sign-in, so signing in again starts a new account, and erases your data on ochk.io, me.ochk.io, vault, chat and cosign, except a few records. Payment records keep their amounts and times for accounting, and our audit log and your deletion request stay, without the reason you gave. We keep a record that your account was deleted, out of public view, so sessions you already had stop working and the deletion can be shown. Each keeps your account only as a keyed id, or not at all, so the record by itself doesn't say whose account it was. On cosign, your messages in conversations with other people and the reports you filed stay, with your account taken off them. Backups roll off within 30 days, and copies cached by our CDN expire within a day. Deleting does not pay out sats orangecheck holds for you: settle a non-zero balance first. If you run a guardian, you can delete only once your operator key holds no seat or hosted guardian, has finished any exit, created no federation that still exists, and is owed nothing. Charter signatures, incidents and amendment proposals the key signed stay public under the key, with what you wrote in them; exit records and machine reports stay visible to that federation's guardians and to us. Hashes anchored to Bitcoin and records published to Nostr cannot be deleted by anyone. me.ochk.io's own anchors name no one, but attestations, polls, pledges, stamps and a chat listing you published carry your Bitcoin address."
|
|
1261
1431
|
}
|
|
1262
1432
|
]
|
|
1263
1433
|
},
|
|
@@ -1267,11 +1437,11 @@ var privacy2 = {
|
|
|
1267
1437
|
blocks: [
|
|
1268
1438
|
{
|
|
1269
1439
|
kind: "para",
|
|
1270
|
-
text: "A site that signs you in its own way can use
|
|
1440
|
+
text: "A site that signs you in its own way can use orangecheck Connect to make an orangecheck account for you. For that account orangecheck keeps a hash of the id the site gave you, never the id; a keyed hash of your email address if the site sent one, never the address; when the account was made; whether the site said you agreed to earn with it; and what it earned, if the site pays. It keeps no sign-in times, because the account has no sign-in of its own. Until you agree, through the site or by claiming it, the account is for sign-in only and earns nothing."
|
|
1271
1441
|
},
|
|
1272
1442
|
{
|
|
1273
1443
|
kind: "para",
|
|
1274
|
-
text: "You can claim it on ochk.app with a link the site gives you, or with an email address the site verified and you hold. It then becomes part of your own account, and deleting your account deletes it. The site can delete it too, for example when you close your account with that site, unless it holds earnings: those stay yours until you claim them. After a deletion
|
|
1444
|
+
text: "You can claim it on ochk.app with a link the site gives you, or with an email address the site verified and you hold. It then becomes part of your own account, and deleting your account deletes it. The site can delete it too, for example when you close your account with that site, unless it holds earnings: those stay yours until you claim them. After a deletion orangecheck keeps only a hash of the id the site gave you, with the site's app id, so the site cannot quietly make the account again; it can only when you agree again."
|
|
1275
1445
|
}
|
|
1276
1446
|
]
|
|
1277
1447
|
},
|
|
@@ -1475,7 +1645,21 @@ var privacy3 = {
|
|
|
1475
1645
|
metaTitle: "Privacy Policy \u2014 OC Vault",
|
|
1476
1646
|
metaDescription: "OC Vault privacy policy. End-to-end encrypted; OrangeCheck stores ciphertext only and cannot read your vault contents.",
|
|
1477
1647
|
effective: "2026-05-15",
|
|
1478
|
-
updated: "2026-10-
|
|
1648
|
+
updated: "2026-10-31",
|
|
1649
|
+
preamble: [
|
|
1650
|
+
{
|
|
1651
|
+
kind: "callout",
|
|
1652
|
+
text: "**What changed, 8 to 31 October 2026.** We corrected this policy where it did not say what is kept or who sees it. Newest first; the [changelog](https://github.com/orangecheck/oc-packages/blob/main/legal/CHANGELOG.md) lists every change."
|
|
1653
|
+
},
|
|
1654
|
+
{
|
|
1655
|
+
kind: "bullets",
|
|
1656
|
+
items: [
|
|
1657
|
+
{ k: "31 October", v: "an emailed team invite keeps the invitee's address on the invite and shows it to the team's managers, the email goes through our email provider (Resend), and its link carries the team key only sealed under a one-time code." },
|
|
1658
|
+
{ k: "29 October", v: "the browser extension is described. Deleting your account removes the sealed vault key and the rest of your vault data, keeps payment records under a keyed id, and is refused while you own a team that still has other members." },
|
|
1659
|
+
{ k: "8 October", v: "your vault is filed under your did:oc, and the vault key is stored on our server, sealed under your passphrase and your recovery code." }
|
|
1660
|
+
]
|
|
1661
|
+
}
|
|
1662
|
+
],
|
|
1479
1663
|
sections: [
|
|
1480
1664
|
{
|
|
1481
1665
|
id: "principles",
|
|
@@ -1507,6 +1691,10 @@ var privacy3 = {
|
|
|
1507
1691
|
k: "team email (optional)",
|
|
1508
1692
|
v: "if you choose to show teammates an email address in a team vault, that address"
|
|
1509
1693
|
},
|
|
1694
|
+
{
|
|
1695
|
+
k: "emailed team invite",
|
|
1696
|
+
v: "if a team manager emails you an invite: your email address, which is kept on the invite and shown to the team's managers, and sent with the invite link through our email provider (Resend). The link carries the team key only sealed under a one-time code the manager gives you themselves; OrangeCheck never sees the code or the key. The invite is deleted when a manager revokes it, with the team, or when the account that sent or claimed it is deleted"
|
|
1697
|
+
},
|
|
1510
1698
|
{
|
|
1511
1699
|
k: "payment records",
|
|
1512
1700
|
v: "for paid tiers: the BTCPay invoice id, sats paid, tier, and entitlement expiry. No card number, no billing address"
|
|
@@ -1553,12 +1741,12 @@ var privacy3 = {
|
|
|
1553
1741
|
blocks: [
|
|
1554
1742
|
{
|
|
1555
1743
|
kind: "para",
|
|
1556
|
-
text: "The same encrypted vault is reachable from the web app and
|
|
1744
|
+
text: "The same encrypted vault is reachable from the web app, the browser extension, and the CLI and SDK. The zero-knowledge guarantee \u2014 that OrangeCheck only ever holds ciphertext \u2014 applies to all of them."
|
|
1557
1745
|
},
|
|
1558
|
-
{ kind: "subhead", text: "browser extension (not
|
|
1746
|
+
{ kind: "subhead", text: "browser extension (not in a store yet)" },
|
|
1559
1747
|
{
|
|
1560
1748
|
kind: "para",
|
|
1561
|
-
text: "
|
|
1749
|
+
text: "The OC Vault browser extension is built for Chrome and Firefox but is not yet in either browser's store; its source is public at [github.com/orangecheck/oc-vault-extension](https://github.com/orangecheck/oc-vault-extension), and you can build and load it yourself. It fetches the same encrypted blobs the web app does, may cache them **as ciphertext** in extension storage, and decrypts in its service worker only after you unlock it. The vault key lives in memory and a RAM-only `storage.session` slot and is never written to disk in the clear; if you turn on passkey unlock, it is also stored sealed to your passkey. The content script that offers autofill receives only **one entry's username and password at fill time**; it never receives the vault key or the entry index. The extension talks only to vault.ochk.io, and to ochk.io for sign-in: no analytics, no telemetry, no remote code."
|
|
1562
1750
|
},
|
|
1563
1751
|
{ kind: "subhead", text: "developer platform \u2014 access tokens, CLI, SDK, GitHub Action" },
|
|
1564
1752
|
{
|
|
@@ -1590,11 +1778,15 @@ var privacy3 = {
|
|
|
1590
1778
|
},
|
|
1591
1779
|
{
|
|
1592
1780
|
k: "sealed vault key",
|
|
1593
|
-
v: "kept so a new device can unlock; deleting the cloud copy does not remove it
|
|
1781
|
+
v: "kept so a new device can unlock; deleting the cloud copy does not remove it, and deleting your account does"
|
|
1594
1782
|
},
|
|
1595
1783
|
{
|
|
1596
1784
|
k: "payment records",
|
|
1597
|
-
v: "retained as required for accounting and entitlement verification"
|
|
1785
|
+
v: "retained as required for accounting and entitlement verification; when your account is deleted they stay under a keyed id, not your account id"
|
|
1786
|
+
},
|
|
1787
|
+
{
|
|
1788
|
+
k: "deleting your account",
|
|
1789
|
+
v: "removes your encrypted blobs, devices and grants, sealed vault key, access tokens, one-time shares, the teams you own alone, and your seats and invites in other teams. It is refused while you own a team that still has other members"
|
|
1598
1790
|
},
|
|
1599
1791
|
{
|
|
1600
1792
|
k: "request logs",
|
|
@@ -1677,8 +1869,14 @@ function fillSpec(spec, tokens) {
|
|
|
1677
1869
|
function buildDoc(siteSlug, kind) {
|
|
1678
1870
|
const ctx = getSiteContext(siteSlug);
|
|
1679
1871
|
const spec = PROFILES[ctx.profile][kind];
|
|
1872
|
+
const brand = ctx.brand ?? BRAND;
|
|
1873
|
+
const entity = ctx.brand ? ctx.brand : LEGAL_ENTITY;
|
|
1680
1874
|
const tokens = {
|
|
1681
1875
|
...GLOBAL_TOKENS,
|
|
1876
|
+
BRAND: brand,
|
|
1877
|
+
ENTITY: entity,
|
|
1878
|
+
ENTITY_LONG: LEGAL_ENTITY_LONG.replace(LEGAL_ENTITY, entity),
|
|
1879
|
+
ENTITY_UPPER: entity.toUpperCase(),
|
|
1682
1880
|
PRODUCT: ctx.product,
|
|
1683
1881
|
PRODUCT_SHORT: ctx.productShort,
|
|
1684
1882
|
HOST: ctx.host,
|