@orangecheck/legal 0.7.23 → 0.7.29
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +8 -6
- package/dist/index.d.mts +2 -1
- package/dist/index.d.ts +2 -1
- package/dist/index.js +252 -54
- package/dist/index.js.map +1 -1
- package/dist/index.mjs +252 -54
- package/dist/index.mjs.map +1 -1
- package/package.json +1 -1
package/dist/index.mjs
CHANGED
|
@@ -3,6 +3,7 @@ import { jsxs, jsx } from 'react/jsx-runtime';
|
|
|
3
3
|
|
|
4
4
|
// src/constants.ts
|
|
5
5
|
var LEGAL_ENTITY = "OrangeCheck";
|
|
6
|
+
var BRAND = "OrangeCheck";
|
|
6
7
|
var LEGAL_ENTITY_LONG = "OrangeCheck (OCHK), an unincorporated project";
|
|
7
8
|
var ENTITY_PENDING = true;
|
|
8
9
|
var CONTACT_GENERAL = "contact@ochk.io";
|
|
@@ -11,6 +12,7 @@ var CONTACT_PRIVACY = "contact@ochk.io";
|
|
|
11
12
|
var GOVERNING_LAW_STATE = "Delaware, United States";
|
|
12
13
|
var ARBITRATION_SEAT = "Wilmington, Delaware, United States";
|
|
13
14
|
var GLOBAL_TOKENS = {
|
|
15
|
+
BRAND,
|
|
14
16
|
ENTITY: LEGAL_ENTITY,
|
|
15
17
|
ENTITY_LONG: LEGAL_ENTITY_LONG,
|
|
16
18
|
// For the clauses set in capitals, so the name does not break their case.
|
|
@@ -42,7 +44,9 @@ var LEGAL_SITES = {
|
|
|
42
44
|
productShort: "ochk.app",
|
|
43
45
|
contact: CONTACT_GENERAL,
|
|
44
46
|
securityContact: CONTACT_SECURITY,
|
|
45
|
-
selfHosted: true
|
|
47
|
+
selfHosted: true,
|
|
48
|
+
// ochk.app writes its brand lowercase, as its own pages do (lead ruling, 2026-11-03).
|
|
49
|
+
brand: "orangecheck"
|
|
46
50
|
},
|
|
47
51
|
vault: {
|
|
48
52
|
slug: "vault",
|
|
@@ -63,7 +67,11 @@ var PROTOCOL_LINKED_SITES = [
|
|
|
63
67
|
"agent",
|
|
64
68
|
"pledge",
|
|
65
69
|
"docs",
|
|
66
|
-
"analytics"
|
|
70
|
+
"analytics",
|
|
71
|
+
"chat",
|
|
72
|
+
"cosign",
|
|
73
|
+
"btc",
|
|
74
|
+
"globe"
|
|
67
75
|
];
|
|
68
76
|
function getSiteContext(slug) {
|
|
69
77
|
const ctx = LEGAL_SITES[slug];
|
|
@@ -145,7 +153,7 @@ var intellectualProperty = {
|
|
|
145
153
|
{ kind: "subhead", text: "[[ENTITY]]'s rights" },
|
|
146
154
|
{
|
|
147
155
|
kind: "para",
|
|
148
|
-
text: "The Service and its content (excluding user-generated content) are protected by copyright, trademark, patent, and other IP laws \u2014 including the
|
|
156
|
+
text: "The Service and its content (excluding user-generated content) are protected by copyright, trademark, patent, and other IP laws \u2014 including the [[BRAND]] name, logos, branding, site design, software, code, algorithms, and documentation."
|
|
149
157
|
},
|
|
150
158
|
{ kind: "subhead", text: "your license" },
|
|
151
159
|
{
|
|
@@ -160,7 +168,7 @@ var intellectualProperty = {
|
|
|
160
168
|
{ kind: "subhead", text: "open source" },
|
|
161
169
|
{
|
|
162
170
|
kind: "para",
|
|
163
|
-
text: "
|
|
171
|
+
text: "[[BRAND]] protocol specifications and the `@orangecheck/*` packages are released under open-source licenses (MIT unless stated otherwise). Those portions are governed by their own license terms; these Terms govern the hosted service."
|
|
164
172
|
}
|
|
165
173
|
]
|
|
166
174
|
};
|
|
@@ -444,7 +452,7 @@ var privacyTransfers = {
|
|
|
444
452
|
blocks: [
|
|
445
453
|
{
|
|
446
454
|
kind: "para",
|
|
447
|
-
text: "
|
|
455
|
+
text: "[[ENTITY]] is operated from the United States. If you access [[PRODUCT]] from elsewhere, your information may be transferred to, stored, and processed in the US or other countries where our service providers operate. For users in the EEA, UK, or Switzerland, we rely on appropriate safeguards for international transfers."
|
|
448
456
|
}
|
|
449
457
|
]
|
|
450
458
|
};
|
|
@@ -464,7 +472,7 @@ var privacyChanges = {
|
|
|
464
472
|
};
|
|
465
473
|
|
|
466
474
|
// src/content/protocol.ts
|
|
467
|
-
var COMMERCIAL_SCOPE_NOTE = "These Terms govern the **non-custodial** OrangeCheck family: [ochk.io](https://ochk.io), including its documentation at [ochk.io/docs](https://ochk.io/docs)
|
|
475
|
+
var COMMERCIAL_SCOPE_NOTE = "These Terms govern the **non-custodial** OrangeCheck family: [ochk.io](https://ochk.io), including its documentation at [ochk.io/docs](https://ochk.io/docs); the verb sites \u2014 OC Attest, OC Lock, OC Vote, OC Stamp, OC Agent, OC Pledge; and [chat.ochk.io](https://chat.ochk.io), [cosign.ochk.io](https://cosign.ochk.io), [btc.ochk.io](https://btc.ochk.io) and [globe.ochk.io](https://globe.ochk.io). The commercial products **ochk.app** and **vault.ochk.io** each publish their own Terms; these Terms do not govern your use of those products.";
|
|
468
476
|
var terms = {
|
|
469
477
|
kind: "terms",
|
|
470
478
|
eyebrow: "terms",
|
|
@@ -473,7 +481,7 @@ var terms = {
|
|
|
473
481
|
metaTitle: "Terms of Service \u2014 OrangeCheck",
|
|
474
482
|
metaDescription: "The terms and conditions for using OrangeCheck. Non-custodial service provided as-is. You are responsible for your wallet and private keys.",
|
|
475
483
|
effective: "2025-09-30",
|
|
476
|
-
updated: "2026-10-
|
|
484
|
+
updated: "2026-10-29",
|
|
477
485
|
preamble: [
|
|
478
486
|
{
|
|
479
487
|
kind: "callout",
|
|
@@ -493,6 +501,10 @@ var terms = {
|
|
|
493
501
|
kind: "para",
|
|
494
502
|
text: "OrangeCheck is a family of **non-custodial** protocols and reference tools that let you create cryptographic proof-of-stake artifacts using Bitcoin message signatures (BIP-322), bind self-asserted handles to them, optionally publish them to decentralized Nostr relays, and discover and verify artifacts created by others."
|
|
495
503
|
},
|
|
504
|
+
{
|
|
505
|
+
kind: "para",
|
|
506
|
+
text: "OrangeCheck also runs **chat.ochk.io**, an end-to-end-encrypted messenger; **cosign.ochk.io**, where builders post projects and others join or back them, with any payment going directly from one person to another; **btc.ochk.io**, a read-only Bitcoin market desk; and **globe.ochk.io**, a read-only view of the Bitcoin network."
|
|
507
|
+
},
|
|
496
508
|
{ kind: "subhead", text: "what orangecheck does not" },
|
|
497
509
|
{
|
|
498
510
|
kind: "bullets",
|
|
@@ -578,6 +590,10 @@ var terms = {
|
|
|
578
590
|
k: "opentimestamps calendars",
|
|
579
591
|
v: "when you claim an OC Chat @handle, your browser sends the claim's fingerprint (a SHA-256 hash) to the OpenTimestamps calendars at alice.btc.calendar.opentimestamps.org, bob.btc.calendar.opentimestamps.org and finney.calendar.eternitywall.com, and reads your address's coins and block headers from mempool.space; each of these sees your IP address and when you asked."
|
|
580
592
|
},
|
|
593
|
+
{
|
|
594
|
+
k: "payments between people",
|
|
595
|
+
v: "postage on chat.ochk.io, and backing, zaps and bounties on cosign.ochk.io, are Lightning payments you make directly to the other person's wallet. OrangeCheck never holds them, cannot reverse them, and is not a party to them."
|
|
596
|
+
},
|
|
581
597
|
{
|
|
582
598
|
k: "nostr network",
|
|
583
599
|
v: "decentralized relays operated by third parties. published data is replicated outside our control and may persist indefinitely."
|
|
@@ -605,7 +621,7 @@ var terms = {
|
|
|
605
621
|
blocks: [
|
|
606
622
|
{
|
|
607
623
|
kind: "para",
|
|
608
|
-
text: "The protocol sites
|
|
624
|
+
text: "The protocol sites, the documentation, cosign.ochk.io, btc.ochk.io and globe.ochk.io are free to use, and so is chat.ochk.io. chat.ochk.io also lists an optional paid plan, Personal: when its checkout is open, you pay the price shown before you pay, in advance, for a fixed period, and it does not renew on its own. You are responsible for Bitcoin network fees on any transactions you initiate and for your own ISP and wallet-provider costs. Other paid functionality, if introduced, will be announced with advance notice; the commercial products **ochk.app** and **vault.ochk.io** carry their own pricing and Terms."
|
|
609
625
|
}
|
|
610
626
|
]
|
|
611
627
|
},
|
|
@@ -622,7 +638,7 @@ var terms = {
|
|
|
622
638
|
{ kind: "subhead", text: "not financial, legal, or compliance advice" },
|
|
623
639
|
{
|
|
624
640
|
kind: "para",
|
|
625
|
-
text: "Nothing OrangeCheck provides \u2014 artifacts, metrics, scores, identity bindings, or other output \u2014 is financial, investment, legal, tax, KYC, AML, sanctions, or regulatory-compliance advice. Obtain independent professional advice before relying on the Service for any decision."
|
|
641
|
+
text: "Nothing OrangeCheck provides \u2014 artifacts, metrics, scores, identity bindings, btc.ochk.io's market data, charts and written market commentary (some of it written by an AI model), or other output \u2014 is financial, investment, legal, tax, KYC, AML, sanctions, or regulatory-compliance advice. Obtain independent professional advice before relying on the Service for any decision."
|
|
626
642
|
},
|
|
627
643
|
{ kind: "subhead", text: "regulatory status \xB7 not a money services business" },
|
|
628
644
|
{
|
|
@@ -662,11 +678,24 @@ var privacy = {
|
|
|
662
678
|
metaTitle: "Privacy Policy \u2014 OrangeCheck",
|
|
663
679
|
metaDescription: "How OrangeCheck handles data and privacy. Non-custodial by design, minimal data collection, no account required, privacy-preserving analytics only.",
|
|
664
680
|
effective: "2025-09-30",
|
|
665
|
-
updated: "2026-10-
|
|
681
|
+
updated: "2026-10-31",
|
|
666
682
|
preamble: [
|
|
667
683
|
{
|
|
668
684
|
kind: "callout",
|
|
669
|
-
text: "
|
|
685
|
+
text: "**What changed, 8 to 31 October 2026.** We corrected this policy where it did not say what is kept or who sees it. Newest first; the [changelog](https://github.com/orangecheck/oc-packages/blob/main/legal/CHANGELOG.md) lists every change."
|
|
686
|
+
},
|
|
687
|
+
{
|
|
688
|
+
kind: "bullets",
|
|
689
|
+
items: [
|
|
690
|
+
{ k: "31 October", v: "the owner consoles, analytics.ochk.io and vault.ochk.io's, show every email address masked, refuse an email as a search or action subject, and show a whole address only after a written reason is recorded." },
|
|
691
|
+
{ k: "29 October", v: "an account also keeps its Google or GitHub id, the roster id that links accounts signed in from one browser, the site you signed up through, a coin that backs it (its address, outpoint and amount, and the message you signed), and OC Chat device vouches and revocations, which are also published to Nostr relays. relay.ochk.io keeps each record with a pseudonym of the sender's IP address, replaced each UTC day, and never the address itself. Our operators' first-sign-in email names only your did:oc and the kind of sign-in. The policy says what chat, cosign, btc and globe keep, who completes a deletion, and what stays." },
|
|
692
|
+
{ k: "26 October", v: "a session row keeps no IP address, and the sign-in log keeps it for 90 days. relay.ochk.io is named, and our host's connection logs for it hold your IP address and connection times for 7 days. Claiming an OC Chat handle sends its fingerprint to three OpenTimestamps calendars and reads mempool.space, and each sees your IP address." },
|
|
693
|
+
{ k: "8 and 9 October", v: "the email is stored, encrypted. Each session and the sign-in log keep the full user-agent. Our operators get an email when a new account first signs in." }
|
|
694
|
+
]
|
|
695
|
+
},
|
|
696
|
+
{
|
|
697
|
+
kind: "callout",
|
|
698
|
+
text: "This policy covers the **non-custodial** OrangeCheck family \u2014 [ochk.io](https://ochk.io), including its documentation at [ochk.io/docs](https://ochk.io/docs), the six verb sites, and [chat.ochk.io](https://chat.ochk.io), [cosign.ochk.io](https://cosign.ochk.io), [btc.ochk.io](https://btc.ochk.io) and [globe.ochk.io](https://globe.ochk.io). The commercial products ochk.app and vault.ochk.io publish their own privacy policies covering the additional data their products handle."
|
|
670
699
|
}
|
|
671
700
|
],
|
|
672
701
|
sections: [
|
|
@@ -734,7 +763,7 @@ var privacy = {
|
|
|
734
763
|
},
|
|
735
764
|
{
|
|
736
765
|
k: "how you sign in",
|
|
737
|
-
v: "a Bitcoin address you prove with a signature (stored as is \u2014 it is public on-chain anyway); or, for an email code, Google or GitHub, the verified email address \u2014 encrypted at rest, plus a one-way hash of it so we can find your account"
|
|
766
|
+
v: "a Bitcoin address you prove with a signature (stored as is \u2014 it is public on-chain anyway); or, for an email code, Google or GitHub, the verified email address \u2014 encrypted at rest, plus a one-way hash of it so we can find your account. For Google or GitHub we also store that provider's id for your account, unencrypted, so a changed email still reaches the same account"
|
|
738
767
|
},
|
|
739
768
|
{
|
|
740
769
|
k: "passkeys",
|
|
@@ -748,13 +777,34 @@ var privacy = {
|
|
|
748
777
|
k: "sign-in log",
|
|
749
778
|
v: "each sign-in and each identity you link or remove, with the IP address and user-agent at the time \u2014 kept for security; the IP address is cleared after 90 days"
|
|
750
779
|
},
|
|
780
|
+
{
|
|
781
|
+
k: "accounts in one browser",
|
|
782
|
+
v: "sessions opened in the same browser share a roster id, so we can tell which of your accounts were signed in from it; and which of our sites you first signed up through"
|
|
783
|
+
},
|
|
784
|
+
{
|
|
785
|
+
k: "a coin backing your account",
|
|
786
|
+
v: "if you back your account with a coin: its address, outpoint and amount, the backing message you signed, and when we last found it unspent, or saw it released or spent. We read the coin from mempool.space. Earlier backings stay with your account. Sites you sign in to get only amount and age floors and a number that differs from site to site (all *.ochk.io sites share one), never the coin"
|
|
787
|
+
},
|
|
788
|
+
{
|
|
789
|
+
k: "OC Chat devices",
|
|
790
|
+
v: "for each chat.ochk.io device we vouch for: its device and Nostr public keys, when we vouched, and the sign-in that asked; for a device you revoke, the signed revocation, which we also publish to Nostr relays"
|
|
791
|
+
},
|
|
792
|
+
{
|
|
793
|
+
k: "btc.ochk.io alerts",
|
|
794
|
+
v: "the market thresholds you save on btc.ochk.io (up to 25), stored with your account"
|
|
795
|
+
},
|
|
751
796
|
{
|
|
752
797
|
k: "when you first sign in",
|
|
753
|
-
v: "OrangeCheck\u2019s operators get an email, sent through our email provider (Resend), naming your `did:oc` and the
|
|
798
|
+
v: "OrangeCheck\u2019s operators get an email, sent through our email provider (Resend), naming your `did:oc` and the kind of sign-in you used (a Bitcoin wallet, an email code, Google or GitHub). Notices sent up to and including 29 October 2026 (UTC) also named the identity itself: your Bitcoin address or your email address"
|
|
754
799
|
},
|
|
755
800
|
{ k: "never", v: "a password, a private key, or a seed phrase" }
|
|
756
801
|
]
|
|
757
802
|
},
|
|
803
|
+
{ kind: "subhead", text: "who at OrangeCheck can see it" },
|
|
804
|
+
{
|
|
805
|
+
kind: "para",
|
|
806
|
+
text: "OrangeCheck's operators can see your account in owner-only consoles: analytics.ochk.io and, for a vault account, vault.ochk.io's. Their account lists show each email address masked: the first character of the part before the @ when that part has three or more characters, and none of it otherwise. Their account searches and actions refuse an email address: an account is found by email only through a lookup. Revealing one address, or looking up one account, asks for a written reason, which is recorded before your email address is shown. A lookup's record has its details about you cleared after 90 days; the reason stays."
|
|
807
|
+
},
|
|
758
808
|
{ kind: "subhead", text: "automatically collected" },
|
|
759
809
|
{
|
|
760
810
|
kind: "bullets",
|
|
@@ -774,7 +824,7 @@ var privacy = {
|
|
|
774
824
|
},
|
|
775
825
|
{
|
|
776
826
|
k: "relay.ochk.io",
|
|
777
|
-
v: "the Nostr relay we run (strfry on Fly.io, in Frankfurt). Your browser connects to it to read and publish signed records; our sites also publish the same records to public relays run by others (see the Terms). It keeps each record it accepts until the same key replaces it with a newer version or the record's own expiry passes: records are public, copied each day to a public archive on GitHub (where earlier versions stay), and otherwise deleted only after a lawful takedown request, which does not remove the copies elsewhere. Each record is stored with
|
|
827
|
+
v: "the Nostr relay we run (strfry on Fly.io, in Frankfurt). Your browser connects to it to read and publish signed records; our sites also publish the same records to public relays run by others (see the Terms). It keeps each record it accepts until the same key replaces it with a newer version or the record's own expiry passes: records are public, copied each day to a public archive on GitHub (where earlier versions stay), and otherwise deleted only after a lawful takedown request, which does not remove the copies elsewhere. Each record is stored with a pseudonym of the IP address it came from, made with a key that is kept only in memory and replaced each UTC day, so the relay can limit how much one source writes; your IP address itself is never stored, and the pseudonym is never served or archived. Our hosting provider (Fly.io) carries each connection to it and handles your IP address to do so, for its own short retention window; we keep no separate copy. Our host's connection logs for the relay can hold your IP address and connection times; they are kept for 7 days."
|
|
778
828
|
}
|
|
779
829
|
]
|
|
780
830
|
},
|
|
@@ -802,6 +852,95 @@ var privacy = {
|
|
|
802
852
|
}
|
|
803
853
|
]
|
|
804
854
|
},
|
|
855
|
+
{
|
|
856
|
+
id: "chat-cosign-btc-globe",
|
|
857
|
+
heading: "chat, cosign, btc and globe",
|
|
858
|
+
hint: "what each of these sites keeps",
|
|
859
|
+
blocks: [
|
|
860
|
+
{ kind: "subhead", text: "chat.ochk.io" },
|
|
861
|
+
{
|
|
862
|
+
kind: "bullets",
|
|
863
|
+
items: [
|
|
864
|
+
{
|
|
865
|
+
k: "messages",
|
|
866
|
+
v: "end-to-end encrypted. Our server holds a message only as ciphertext, under a per-conversation id that names neither person, until the recipient picks it up: for up to 14 days, or 365 days on the Personal plan. A delivered message is deleted 24 hours after the recipient confirms it. We cannot read message content"
|
|
867
|
+
},
|
|
868
|
+
{
|
|
869
|
+
k: "on your device",
|
|
870
|
+
v: "your messages, contacts and settings are kept in your browser. Lock this device with a passphrase to encrypt your device key and messages there"
|
|
871
|
+
},
|
|
872
|
+
{
|
|
873
|
+
k: "sending limits",
|
|
874
|
+
v: "a count of messages sent per hour, under a keyed id made from your account, dropped after a day. chat.ochk.io stores no IP address"
|
|
875
|
+
},
|
|
876
|
+
{
|
|
877
|
+
k: "the Personal plan",
|
|
878
|
+
v: "if you buy it: your account id, the plan, when you paid and until when, the amount and the invoice id. The invoice our payment processor (BTCPay) holds says what was sold, not who bought it"
|
|
879
|
+
},
|
|
880
|
+
{
|
|
881
|
+
k: "published to Nostr",
|
|
882
|
+
v: "your device records, public channel posts (which are not encrypted), and a directory listing if you choose to be listed are public and stay on the relays. Direct messages travel encrypted"
|
|
883
|
+
},
|
|
884
|
+
{
|
|
885
|
+
k: "sent from your browser",
|
|
886
|
+
v: "chain data from mempool.space and blockstream.info, the drand network for messages that open at a future block, the OpenTimestamps calendars named above for a handle claim, and the Nostr relays you use; each sees your IP address"
|
|
887
|
+
},
|
|
888
|
+
{
|
|
889
|
+
k: "analytics",
|
|
890
|
+
v: "none"
|
|
891
|
+
},
|
|
892
|
+
{
|
|
893
|
+
k: "deletion",
|
|
894
|
+
v: "deleting your account deletes chat.ochk.io's other records of you; Personal plan payment records stay for accounting under a keyed id, not your account id. Messages waiting for pickup expire on their own, and what is on Nostr relays stays"
|
|
895
|
+
}
|
|
896
|
+
]
|
|
897
|
+
},
|
|
898
|
+
{ kind: "subhead", text: "cosign.ochk.io" },
|
|
899
|
+
{
|
|
900
|
+
kind: "bullets",
|
|
901
|
+
items: [
|
|
902
|
+
{
|
|
903
|
+
k: "what you post",
|
|
904
|
+
v: "your profile, projects, updates, cosigns and vouches are public on cosign.ochk.io"
|
|
905
|
+
},
|
|
906
|
+
{
|
|
907
|
+
k: "messages",
|
|
908
|
+
v: "**not end-to-end encrypted.** They are stored on our servers, and OrangeCheck's operators can read them"
|
|
909
|
+
},
|
|
910
|
+
{
|
|
911
|
+
k: "reports and notifications",
|
|
912
|
+
v: "a report you file keeps you as its reporter, the subject and your reason. Notifications are shown in the app only; a read one is deleted after 30 days and any after 90"
|
|
913
|
+
},
|
|
914
|
+
{
|
|
915
|
+
k: "payments between people",
|
|
916
|
+
v: "we record each Lightning payment for display (amount, time, status and the receiving Lightning address); the money goes directly between people and cosign never holds it"
|
|
917
|
+
},
|
|
918
|
+
{
|
|
919
|
+
k: "abuse limits",
|
|
920
|
+
v: "counts of writes per account, per IP address and per network, under keyed ids, dropped after 2 days; and your account's counts for the last ten minutes, kept with your account. No IP address is stored"
|
|
921
|
+
},
|
|
922
|
+
{
|
|
923
|
+
k: "deletion",
|
|
924
|
+
v: "deleting your account deletes your profile, projects and the rest, except that your messages in conversations with other people, the reports you filed, and payment records stay, with your account taken off them"
|
|
925
|
+
}
|
|
926
|
+
]
|
|
927
|
+
},
|
|
928
|
+
{ kind: "subhead", text: "btc.ochk.io" },
|
|
929
|
+
{
|
|
930
|
+
kind: "para",
|
|
931
|
+
text: "btc.ochk.io keeps only the alert thresholds you save, with your account, and deletes them when your account is deleted. Its planner and paper desk stay in your browser. Its market commentary is written each hour by an AI model provider (Anthropic) from market data and the web searches it runs; nothing about you is sent."
|
|
932
|
+
},
|
|
933
|
+
{ kind: "subhead", text: "globe.ochk.io" },
|
|
934
|
+
{
|
|
935
|
+
kind: "para",
|
|
936
|
+
text: "globe.ochk.io stores nothing about you. Your browser fetches live network data directly from mempool.space, which sees your IP address."
|
|
937
|
+
},
|
|
938
|
+
{
|
|
939
|
+
kind: "para",
|
|
940
|
+
text: "cosign.ochk.io, btc.ochk.io and globe.ochk.io use the cookie-free analytics described below."
|
|
941
|
+
}
|
|
942
|
+
]
|
|
943
|
+
},
|
|
805
944
|
{
|
|
806
945
|
id: "how-we-use",
|
|
807
946
|
heading: "how we use information",
|
|
@@ -820,7 +959,7 @@ var privacy = {
|
|
|
820
959
|
{
|
|
821
960
|
id: "retention",
|
|
822
961
|
heading: "data retention",
|
|
823
|
-
hint: "
|
|
962
|
+
hint: "scheduled and on-write deletion \xB7 permanent public artifacts",
|
|
824
963
|
blocks: [
|
|
825
964
|
{
|
|
826
965
|
kind: "bullets",
|
|
@@ -839,15 +978,19 @@ var privacy = {
|
|
|
839
978
|
},
|
|
840
979
|
{
|
|
841
980
|
k: "sessions",
|
|
842
|
-
v: "deleted when you sign out
|
|
981
|
+
v: "deleted when you sign out; a session that expires after 30 days is deleted the next time anyone signs in"
|
|
843
982
|
},
|
|
844
983
|
{
|
|
845
984
|
k: "IP addresses in the sign-in log",
|
|
846
985
|
v: "cleared after 90 days; the entries themselves stay until your account is deleted"
|
|
847
986
|
},
|
|
848
987
|
{
|
|
849
|
-
k: "
|
|
850
|
-
v: "deleted when
|
|
988
|
+
k: "email sign-in codes",
|
|
989
|
+
v: "the code itself is never stored and expires after 10 minutes; the record that lets it be used once is deleted when it is spent, or with the next code anyone asks for after it expires; per-address and per-network send counts, kept as keyed hashes, are dropped after a day"
|
|
990
|
+
},
|
|
991
|
+
{
|
|
992
|
+
k: "account, sign-in identities, passkeys, sign-in log, coin backings, OC Chat device records and btc.ochk.io alerts",
|
|
993
|
+
v: "deleted when your account-deletion request completes. File one in [your account on ochk.app](https://ochk.app/me/account), or ask at [[PRIVACY_CONTACT]]. A person completes the request, and we aim to do that within 48 hours. Nothing is erased while a blocker remains: sats you are owed or payouts still pending on ochk.app, live guardian-operator duties, developer projects or an OC Connect app you own, or a vault team you own that still has other members. What stays: the email our operators received when you first signed in, which names your `did:oc` and the kind of sign-in you used, and, if it was sent up to and including 29 October 2026 (UTC), the identity itself; a revocation already published to Nostr relays, and anything else you published there or anchored to Bitcoin; a marker under a hash of your account id that refuses your old sessions until they would have expired, about 30 days; and, if a site made an account for you, a hashed record of it, so that site is told the account was deleted instead of making a new one"
|
|
851
994
|
},
|
|
852
995
|
{
|
|
853
996
|
k: "support emails",
|
|
@@ -887,16 +1030,16 @@ var privacy = {
|
|
|
887
1030
|
var protocolProfile = { terms, privacy };
|
|
888
1031
|
|
|
889
1032
|
// src/content/me.ts
|
|
890
|
-
var COMMERCIAL_NOTE = "**ochk.app is a commercial product operated by
|
|
1033
|
+
var COMMERCIAL_NOTE = "**ochk.app is a commercial product operated by orangecheck.** It is distinct from the non-custodial orangecheck protocol sites; the Terms at [ochk.io/terms](https://ochk.io/terms) do not govern ochk.app. These Terms do. Its API is served at me.ochk.io, from the same accounts and records: these Terms govern the Service at either address, and \u201Cochk.app\u201D in them means both.";
|
|
891
1034
|
var terms2 = {
|
|
892
1035
|
kind: "terms",
|
|
893
1036
|
eyebrow: "terms",
|
|
894
1037
|
title: "Terms of service",
|
|
895
|
-
description: "The terms governing your use of ochk.app and its API at me.ochk.io \u2014 a Bitcoin-backed identity that
|
|
1038
|
+
description: "The terms governing your use of ochk.app and its API at me.ochk.io \u2014 a Bitcoin-backed identity that will pay you in sats. orangecheck holds what you earn during bring-up and will pay it to a Lightning wallet you choose. No KYC.",
|
|
896
1039
|
metaTitle: "Terms of Service \u2014 ochk.app",
|
|
897
|
-
metaDescription: "Terms of service for ochk.app: a Bitcoin-backed identity that
|
|
1040
|
+
metaDescription: "Terms of service for ochk.app: a Bitcoin-backed identity that will pay users in sats. orangecheck holds what users earn during bring-up and will pay it to a Lightning wallet they choose. No KYC.",
|
|
898
1041
|
effective: "2026-05-15",
|
|
899
|
-
updated: "2026-
|
|
1042
|
+
updated: "2026-11-03",
|
|
900
1043
|
preamble: [
|
|
901
1044
|
{
|
|
902
1045
|
kind: "callout",
|
|
@@ -913,26 +1056,26 @@ var terms2 = {
|
|
|
913
1056
|
blocks: [
|
|
914
1057
|
{
|
|
915
1058
|
kind: "para",
|
|
916
|
-
text: 'ochk.app is an identity you use to sign in across participating sites ("integrators"). When an integrator records a billable event for an action you authorize, a share of the fee
|
|
1059
|
+
text: 'ochk.app is an identity you use to sign in across participating sites ("integrators"). When an integrator records a billable event for an action you authorize, a share of the fee will flow back to you in sats. Your identity works across the orangecheck family. Every paid event on your account has a receipt, signed by us, and anyone holding one and the public key we publish can check its signature offline, without asking us; a receipt sent to Bitcoin for a timestamp also checks against Bitcoin once it is anchored. If you back your account, it is tied to bitcoin you hold, and that bitcoin stays in your wallet.'
|
|
917
1060
|
},
|
|
918
1061
|
{
|
|
919
1062
|
kind: "para",
|
|
920
|
-
text: "ochk.app is **not a bank, exchange, broker, or wallet provider.** It is an identity and reputation service with an attached cashback mechanism. **During bring-up
|
|
1063
|
+
text: "ochk.app is **not a bank, exchange, broker, or wallet provider.** It is an identity and reputation service with an attached cashback mechanism. **During bring-up orangecheck operates every role in that mechanism, including custody of the balance it will pay you.** That is a stage, not the design \u2014 see the custody section below for what holds today."
|
|
921
1064
|
}
|
|
922
1065
|
]
|
|
923
1066
|
},
|
|
924
1067
|
{
|
|
925
1068
|
id: "accounts",
|
|
926
1069
|
heading: "accounts & identity",
|
|
927
|
-
hint: "
|
|
1070
|
+
hint: "four ways to sign in",
|
|
928
1071
|
blocks: [
|
|
929
1072
|
{
|
|
930
1073
|
kind: "para",
|
|
931
|
-
text: "You may create an identity
|
|
1074
|
+
text: "You may create an identity four ways: with **email** (a one-time code), **Google**, **GitHub**, or **a Bitcoin wallet** (you sign with BIP-322 \u2014 full self-custody of your signing key). With email, Google or GitHub you hold no key of your own, so orangecheck holds your signing key. However you sign in, during bring-up orangecheck holds the cashback you accrue; see custody below. Each way produces a stable, opaque `did:oc` identifier. No password is ever stored."
|
|
932
1075
|
},
|
|
933
1076
|
{
|
|
934
1077
|
kind: "para",
|
|
935
|
-
text: "You are responsible for the security of the wallet, device, email account, or recovery mnemonic associated with your identity. Anyone with your keys or recovery factor can act as you.
|
|
1078
|
+
text: "You are responsible for the security of the wallet, device, email account, or recovery mnemonic associated with your identity. Anyone with your keys or recovery factor can act as you. orangecheck cannot recover an account, reverse a sign-in, or restore a lost key or mnemonic."
|
|
936
1079
|
}
|
|
937
1080
|
]
|
|
938
1081
|
},
|
|
@@ -944,22 +1087,22 @@ var terms2 = {
|
|
|
944
1087
|
blocks: [
|
|
945
1088
|
{
|
|
946
1089
|
kind: "stub",
|
|
947
|
-
text: "The economics of earning sats on ochk.app \u2014 how billable events generate cashback, the fee split between you, the integrating site, federation operators, and
|
|
1090
|
+
text: "The economics of earning sats on ochk.app \u2014 how billable events generate cashback, the fee split between you, the integrating site, federation operators, and orangecheck, the timing of credits, and the conditions under which earnings may be withheld, delayed, clawed back, or reversed (including for suspected abuse or wash-trading) \u2014 are being finalized for publication before general availability. Until then, earning behavior is governed by the published abuse limits in the section below and the descriptions on [how it works](/how) and [the earn page](/earn). This section will be completed following review by counsel."
|
|
948
1091
|
}
|
|
949
1092
|
]
|
|
950
1093
|
},
|
|
951
1094
|
{
|
|
952
1095
|
id: "custody",
|
|
953
|
-
heading: "custody &
|
|
954
|
-
hint: "orangecheck-held during bring-up \xB7
|
|
1096
|
+
heading: "custody & payouts",
|
|
1097
|
+
hint: "orangecheck-held during bring-up \xB7 paid out to a wallet you choose",
|
|
955
1098
|
blocks: [
|
|
956
1099
|
{
|
|
957
1100
|
kind: "para",
|
|
958
|
-
text: "Custody depends on how you sign in, and the honest answer differs today from the design.\n\n**If you sign in with BIP-322, you hold your own keys.** They never leave your device.
|
|
1101
|
+
text: "Custody depends on how you sign in, and the honest answer differs today from the design.\n\n**If you sign in with BIP-322, you hold your own keys.** They never leave your device. orangecheck verifies signatures and relays envelopes; it cannot move the funds in your wallet. That is true now and does not change.\n\n**What you earn is a different matter.** Cashback you accrue is a balance orangecheck owes you until it is paid out to the destination you bind. During bring-up orangecheck holds those sats for every user, however they sign in.\n\n**If you sign in with email, Google or GitHub, orangecheck currently holds the key that will pay you.** The design is a Fedimint federation: independent guardians hold the bitcoin under a threshold scheme, and orangecheck\u2019s executor holds your claim on it, as ecash, until it is paid out to a Lightning wallet you choose. That federation does not exist yet: there are no independent guardians today, and during bring-up the signing key for the paying rail is operated by orangecheck. So during this period orangecheck is a custodian, of the signing keys of people who sign in with email, Google or GitHub and of every user\u2019s accrued cashback, and the party that will move the money once payouts open.\n\nWe state that plainly rather than describing the destination as though it were the present. **The live status of the paying rail \u2014 which posture is in force, what bounds it, and what has actually settled \u2014 is published on [the custody page](/custody) and machine-readable at `/api/federations`.** Those surfaces are computed from the system rather than written by hand, so they cannot drift from this document the way a fixed sentence would."
|
|
959
1102
|
},
|
|
960
1103
|
{
|
|
961
1104
|
kind: "stub",
|
|
962
|
-
text: "The complete custody disclosure \u2014 the federation threshold model and its failure modes, what each guardian can and cannot do, the durability of your balance if a federation or
|
|
1105
|
+
text: "The complete custody disclosure \u2014 the federation threshold model and its failure modes, what each guardian can and cannot do, the durability of your balance if a federation or orangecheck ceases operations, and the allocation of risk between you, the federation, and orangecheck \u2014 is being finalized for publication before general availability. The honest current-state engineering account is published on the [security page](/security). This section will be completed following review by counsel."
|
|
963
1106
|
}
|
|
964
1107
|
]
|
|
965
1108
|
},
|
|
@@ -970,6 +1113,11 @@ var terms2 = {
|
|
|
970
1113
|
{
|
|
971
1114
|
kind: "stub",
|
|
972
1115
|
text: "Platform fees, payout mechanics and minimums, supported payout rails, currency-conversion handling, and the allocation of tax-reporting and tax-payment responsibility for sats you receive are being finalized for publication before general availability. You are advised that cashback received may be taxable income in your jurisdiction and that you are responsible for your own tax compliance. This section will be completed following review by counsel."
|
|
1116
|
+
},
|
|
1117
|
+
{ kind: "subhead", text: "when a payout is held" },
|
|
1118
|
+
{
|
|
1119
|
+
kind: "para",
|
|
1120
|
+
text: "We hold a payout, and do not send it, when an earlier attempt to send it may already have gone through; while payouts are paused by a halt, a federation migration or a payout ceiling, or are not yet open to you; while the node that pays cannot cover everything owed, or its fee limit is unknown; for 24 hours after you change your payout destination; when your payout destination is no longer valid; or when our records disagree about what is owed. A paused or limited payout goes out on its own once the pause, ceiling, shortfall or 24 hours have passed; setting a new destination clears a destination hold; and a disagreement clears when we correct the record. A payout whose earlier attempt may have gone through is never retried on its own: we check the payment node, then either mark it paid with the payment's proof or release it to be sent again. A hold does not cancel what you are owed."
|
|
973
1121
|
}
|
|
974
1122
|
]
|
|
975
1123
|
},
|
|
@@ -1009,7 +1157,7 @@ var terms2 = {
|
|
|
1009
1157
|
blocks: [
|
|
1010
1158
|
{
|
|
1011
1159
|
kind: "para",
|
|
1012
|
-
text: "Sites that integrate ochk.app through its API at me.ochk.io get their own subject id for the events they report, and your Bitcoin address, email or attestation tier only if you grant that scope. Signing in gives every site the same orangecheck id (did:oc), so sites that compare ids can tell it is you. Integrators independently decide whether and how to trust your identity, including whether to admit, gate, or reject you.
|
|
1160
|
+
text: "Sites that integrate ochk.app through its API at me.ochk.io get their own subject id for the events they report, and your Bitcoin address, email or attestation tier only if you grant that scope. Signing in gives every site the same orangecheck id (did:oc), so sites that compare ids can tell it is you. Integrators independently decide whether and how to trust your identity, including whether to admit, gate, or reject you. orangecheck is not a party to, and accepts no liability for, an integrator\u2019s decisions or an integrator\u2019s own terms, pricing, or conduct."
|
|
1013
1161
|
}
|
|
1014
1162
|
]
|
|
1015
1163
|
},
|
|
@@ -1026,12 +1174,12 @@ var terms2 = {
|
|
|
1026
1174
|
},
|
|
1027
1175
|
{
|
|
1028
1176
|
kind: "para",
|
|
1029
|
-
text: "Nothing ochk.app provides is financial, investment, legal, or tax advice. ochk.app does not guarantee any level of earnings; cashback depends on integrator activity outside
|
|
1177
|
+
text: "Nothing ochk.app provides is financial, investment, legal, or tax advice. ochk.app does not guarantee any level of earnings; cashback depends on integrator activity outside orangecheck\u2019s control."
|
|
1030
1178
|
},
|
|
1031
1179
|
{ kind: "subhead", text: "regulatory status" },
|
|
1032
1180
|
{
|
|
1033
1181
|
kind: "stub",
|
|
1034
|
-
text: "ochk.app is designed so that cashback
|
|
1182
|
+
text: "ochk.app is designed so that independent Fedimint federations hold the bitcoin behind the cashback, while orangecheck\u2019s executor holds each person\u2019s claim on it and pays it out. **Those federations do not exist yet. During bring-up orangecheck itself custodies the cashback every user earns, and will be the one that transmits it**, because it is operating every role in the system in order to prove it works before third parties take any of them. Self-custody (BIP-322) users keep their own keys, which orangecheck never holds; the cashback they accrue is held by orangecheck until it is paid out, as it is for every user. The full regulatory analysis of both the bring-up posture and the designed end state \u2014 including orangecheck\u2019s position under the U.S. Bank Secrecy Act money-transmission rules, the FATF Recommendations, the EU MiCA Regulation, and applicable U.S. state money-transmitter regimes, and the corresponding licensing posture \u2014 is being prepared and will be published before general availability. This section will be completed following review by counsel."
|
|
1035
1183
|
}
|
|
1036
1184
|
]
|
|
1037
1185
|
},
|
|
@@ -1043,7 +1191,7 @@ var terms2 = {
|
|
|
1043
1191
|
blocks: [
|
|
1044
1192
|
{
|
|
1045
1193
|
kind: "para",
|
|
1046
|
-
text: "**Your right:** stop using ochk.app at any time; you may delete your identity in [your settings](/me/settings). **Our right:** suspend or terminate access with or without cause, including for abuse or legal risk. Deleting your identity does not settle a balance
|
|
1194
|
+
text: "**Your right:** stop using ochk.app at any time; you may delete your identity in [your settings](/me/settings). **Our right:** suspend or terminate access with or without cause, including for abuse or legal risk. Deleting your identity does not settle a balance orangecheck owes you. If your balance is above zero, bind a payout destination and instruct a cash-out before you delete, or contact us. Hashes anchored to Bitcoin and commitments published to Nostr are immutable and cannot be deleted by orangecheck; neither names you. The disclaimer, liability, indemnification, governing-law, and dispute provisions survive."
|
|
1047
1195
|
}
|
|
1048
1196
|
]
|
|
1049
1197
|
},
|
|
@@ -1051,21 +1199,39 @@ var terms2 = {
|
|
|
1051
1199
|
disputeResolution,
|
|
1052
1200
|
miscellaneous
|
|
1053
1201
|
],
|
|
1054
|
-
summary: "summary: an identity that
|
|
1202
|
+
summary: "summary: an identity that will pay you in sats. if you sign in with your own bitcoin wallet, you keep your keys; if you sign in with email, google or github, orangecheck holds the key that will pay you. either way, during bring-up orangecheck holds what you have earned until it is paid out. money, custody, fee, and regulatory terms are being finalized \u2014 see the marked sections."
|
|
1055
1203
|
};
|
|
1056
1204
|
var privacy2 = {
|
|
1057
1205
|
kind: "privacy",
|
|
1058
1206
|
eyebrow: "privacy",
|
|
1059
1207
|
title: "Privacy policy",
|
|
1060
|
-
description: "How ochk.app and its API at me.ochk.io handle your data: no KYC, no PII required, and a documented, falsifiable account of every record
|
|
1208
|
+
description: "How ochk.app and its API at me.ochk.io handle your data: no KYC, no PII required, and a documented, falsifiable account of every record orangecheck stores.",
|
|
1061
1209
|
metaTitle: "Privacy Policy \u2014 ochk.app",
|
|
1062
|
-
metaDescription: "ochk.app privacy policy. No KYC, no PII required, and a full account of what
|
|
1210
|
+
metaDescription: "ochk.app privacy policy. No KYC, no PII required, and a full account of what orangecheck stores.",
|
|
1063
1211
|
effective: "2026-05-15",
|
|
1064
|
-
updated: "2026-
|
|
1212
|
+
updated: "2026-11-03",
|
|
1065
1213
|
preamble: [
|
|
1066
1214
|
{
|
|
1067
1215
|
kind: "callout",
|
|
1068
|
-
text: "
|
|
1216
|
+
text: "**What changed, 8 to 31 October 2026.** We corrected this policy where it did not say what is kept or who sees it. Newest first; the [changelog](https://github.com/orangecheck/oc-packages/blob/main/legal/CHANGELOG.md) lists every change."
|
|
1217
|
+
},
|
|
1218
|
+
{
|
|
1219
|
+
kind: "bullets",
|
|
1220
|
+
items: [
|
|
1221
|
+
{ k: "29 October", v: "the contact form sends your email address, an optional name, the topic and your message to our inbox through our email provider (Resend)." },
|
|
1222
|
+
{ k: "27 and 28 October", v: "a guardian application holds the questionnaire's answers, and the charter publishes its handle, name, jurisdiction, contact channel and fingerprint. The policy says which records a deletion keeps, and that cached copies expire within a day." },
|
|
1223
|
+
{ k: "26 October", v: "a session record keeps no IP address, and the sign-in log keeps it for 90 days." },
|
|
1224
|
+
{ k: "25 October", v: "me.ochk.io records which sites you sign in to or share data with, and when. No site sees that record." },
|
|
1225
|
+
{ k: "24 October", v: "signing in gives every site the same did:oc." },
|
|
1226
|
+
{ k: "23 October", v: "an account a site makes for you through orangecheck Connect keeps a hash of the site's id for you, a keyed hash of your email if the site sent one, when it was made, whether you agreed to earn, and what it earned." },
|
|
1227
|
+
{ k: "19 October", v: "ochk.app is the Service, and me.ochk.io is its API." },
|
|
1228
|
+
{ k: "15 October", v: "ochk.app's own cookies are listed: __Host-oc_session, and __Host-oc_oauth for at most ten minutes during a Google or GitHub sign-in." },
|
|
1229
|
+
{ k: "8 October", v: "a session record keeps your user-agent, and an email is personal data." }
|
|
1230
|
+
]
|
|
1231
|
+
},
|
|
1232
|
+
{
|
|
1233
|
+
kind: "callout",
|
|
1234
|
+
text: "This policy covers the Service at both of its addresses, ochk.app and its API at me.ochk.io: one account, one store of records, one operator; \u201Cochk.app\u201D below means both. Its product is identity that will pay you; its privacy posture is what makes it distinct from Sign in with Google. For a side-by-side comparison you can falsify, see [the privacy comparison](/privacy-compare)."
|
|
1069
1235
|
}
|
|
1070
1236
|
],
|
|
1071
1237
|
sections: [
|
|
@@ -1108,7 +1274,7 @@ var privacy2 = {
|
|
|
1108
1274
|
blocks: [
|
|
1109
1275
|
{
|
|
1110
1276
|
kind: "para",
|
|
1111
|
-
text: "The list below is what an auditor would find in
|
|
1277
|
+
text: "The list below is what an auditor would find in orangecheck\u2019s production infrastructure. Every item is metadata; none of it lets orangecheck sign on your behalf."
|
|
1112
1278
|
},
|
|
1113
1279
|
{
|
|
1114
1280
|
kind: "bullets",
|
|
@@ -1131,7 +1297,7 @@ var privacy2 = {
|
|
|
1131
1297
|
},
|
|
1132
1298
|
{
|
|
1133
1299
|
k: "custody-state envelopes",
|
|
1134
|
-
v: "a record of each
|
|
1300
|
+
v: "a record of each change in how your account is custodied, kept on your own identity timeline. None is made while the system is in testing."
|
|
1135
1301
|
},
|
|
1136
1302
|
{
|
|
1137
1303
|
k: "site sign-ins",
|
|
@@ -1141,6 +1307,10 @@ var privacy2 = {
|
|
|
1141
1307
|
k: "guardian applications",
|
|
1142
1308
|
v: "an application to run a guardian, made through ochk.app or by email to apply@ochk.io, holds your answers to the operator questionnaire, which asks, among other things, for a public handle, the name of the person or organisation that will run the guardian, its jurisdiction, a public contact channel, a key fingerprint and two references. Through ochk.app it can also hold an optional handle and email address that only the reviewer sees, for the decision. The questionnaire\u2019s handle, name, jurisdiction, contact channel and fingerprint are published in the federation charter, because guardians are named trust anchors. Nothing is checked against an ID, and nothing else is published."
|
|
1143
1309
|
},
|
|
1310
|
+
{
|
|
1311
|
+
k: "messages you send us",
|
|
1312
|
+
v: "the contact form at ochk.app/contact sends your email address, an optional name, the topic you pick and your message to our inbox through our email provider (Resend). They are kept only as long as we need them to reply"
|
|
1313
|
+
},
|
|
1144
1314
|
{
|
|
1145
1315
|
k: "public anchors",
|
|
1146
1316
|
v: "an OpenTimestamps proof over each envelope\u2019s hash, and a salted commitment to each envelope on Nostr. Public by design, and neither names you, the site or the amount. The envelope itself is served only to whoever holds its id. Drop manifests, which name no one, are published in full."
|
|
@@ -1170,7 +1340,7 @@ var privacy2 = {
|
|
|
1170
1340
|
blocks: [
|
|
1171
1341
|
{
|
|
1172
1342
|
kind: "para",
|
|
1173
|
-
text: "
|
|
1343
|
+
text: "orangecheck\u2019s billing engine necessarily knows which user earned which cashback across integrating sites \u2014 that join is how the right wallet is credited. Today that linkage exists in plain storage on me.ochk.io infrastructure; orangecheck commits, as a **policy** matter enforced by access controls and audit logging, not to build cross-site behavioural profiles. A per-integrator blinded-identifier design that removes the linkage architecturally is active research and not yet shipped. We disclose this honestly rather than overclaim."
|
|
1174
1344
|
}
|
|
1175
1345
|
]
|
|
1176
1346
|
},
|
|
@@ -1197,7 +1367,7 @@ var privacy2 = {
|
|
|
1197
1367
|
items: [
|
|
1198
1368
|
"Route cashback to the correct identity and wallet",
|
|
1199
1369
|
"Detect and prevent sybil farming, wash-trading, and abuse",
|
|
1200
|
-
"Operate sign-in and verification across the
|
|
1370
|
+
"Operate sign-in and verification across the orangecheck family",
|
|
1201
1371
|
"Fix bugs, improve the Service, and respond to support requests"
|
|
1202
1372
|
]
|
|
1203
1373
|
}
|
|
@@ -1251,7 +1421,7 @@ var privacy2 = {
|
|
|
1251
1421
|
blocks: [
|
|
1252
1422
|
{
|
|
1253
1423
|
kind: "para",
|
|
1254
|
-
text: "In [your settings](/me/settings) you can delete your account. A person completes the request, and we aim to do that within 48 hours: an alert tells us when one has waited a day. Completing it closes your sign-in, so signing in again starts a new account, and erases your data on ochk.io, me.ochk.io, vault, chat and cosign, except a few records. Payment records keep their amounts and times for accounting, and our audit log and your deletion request stay, without the reason you gave. We keep a record that your account was deleted, out of public view, so sessions you already had stop working and the deletion can be shown. Each keeps your account only as a keyed id, or not at all, so the record by itself doesn't say whose account it was. On cosign, your messages in conversations with other people and the reports you filed stay, with your account taken off them. Backups roll off within 30 days, and copies cached by our CDN expire within a day. Deleting does not pay out sats
|
|
1424
|
+
text: "In [your settings](/me/settings) you can delete your account. A person completes the request, and we aim to do that within 48 hours: an alert tells us when one has waited a day. Completing it closes your sign-in, so signing in again starts a new account, and erases your data on ochk.io, me.ochk.io, vault, chat and cosign, except a few records. Payment records keep their amounts and times for accounting, and our audit log and your deletion request stay, without the reason you gave. We keep a record that your account was deleted, out of public view, so sessions you already had stop working and the deletion can be shown. Each keeps your account only as a keyed id, or not at all, so the record by itself doesn't say whose account it was. On cosign, your messages in conversations with other people and the reports you filed stay, with your account taken off them. Backups roll off within 30 days, and copies cached by our CDN expire within a day. Deleting does not pay out sats orangecheck holds for you: settle a non-zero balance first. If you run a guardian, you can delete only once your operator key holds no seat or hosted guardian, has finished any exit, created no federation that still exists, and is owed nothing. Charter signatures, incidents and amendment proposals the key signed stay public under the key, with what you wrote in them; exit records and machine reports stay visible to that federation's guardians and to us. Hashes anchored to Bitcoin and records published to Nostr cannot be deleted by anyone. me.ochk.io's own anchors name no one, but attestations, polls, pledges, stamps and a chat listing you published carry your Bitcoin address."
|
|
1255
1425
|
}
|
|
1256
1426
|
]
|
|
1257
1427
|
},
|
|
@@ -1261,11 +1431,11 @@ var privacy2 = {
|
|
|
1261
1431
|
blocks: [
|
|
1262
1432
|
{
|
|
1263
1433
|
kind: "para",
|
|
1264
|
-
text: "A site that signs you in its own way can use
|
|
1434
|
+
text: "A site that signs you in its own way can use orangecheck Connect to make an orangecheck account for you. For that account orangecheck keeps a hash of the id the site gave you, never the id; a keyed hash of your email address if the site sent one, never the address; when the account was made; whether the site said you agreed to earn with it; and what it earned, if the site pays. It keeps no sign-in times, because the account has no sign-in of its own. Until you agree, through the site or by claiming it, the account is for sign-in only and earns nothing."
|
|
1265
1435
|
},
|
|
1266
1436
|
{
|
|
1267
1437
|
kind: "para",
|
|
1268
|
-
text: "You can claim it on ochk.app with a link the site gives you, or with an email address the site verified and you hold. It then becomes part of your own account, and deleting your account deletes it. The site can delete it too, for example when you close your account with that site, unless it holds earnings: those stay yours until you claim them. After a deletion
|
|
1438
|
+
text: "You can claim it on ochk.app with a link the site gives you, or with an email address the site verified and you hold. It then becomes part of your own account, and deleting your account deletes it. The site can delete it too, for example when you close your account with that site, unless it holds earnings: those stay yours until you claim them. After a deletion orangecheck keeps only a hash of the id the site gave you, with the site's app id, so the site cannot quietly make the account again; it can only when you agree again."
|
|
1269
1439
|
}
|
|
1270
1440
|
]
|
|
1271
1441
|
},
|
|
@@ -1469,7 +1639,21 @@ var privacy3 = {
|
|
|
1469
1639
|
metaTitle: "Privacy Policy \u2014 OC Vault",
|
|
1470
1640
|
metaDescription: "OC Vault privacy policy. End-to-end encrypted; OrangeCheck stores ciphertext only and cannot read your vault contents.",
|
|
1471
1641
|
effective: "2026-05-15",
|
|
1472
|
-
updated: "2026-10-
|
|
1642
|
+
updated: "2026-10-31",
|
|
1643
|
+
preamble: [
|
|
1644
|
+
{
|
|
1645
|
+
kind: "callout",
|
|
1646
|
+
text: "**What changed, 8 to 31 October 2026.** We corrected this policy where it did not say what is kept or who sees it. Newest first; the [changelog](https://github.com/orangecheck/oc-packages/blob/main/legal/CHANGELOG.md) lists every change."
|
|
1647
|
+
},
|
|
1648
|
+
{
|
|
1649
|
+
kind: "bullets",
|
|
1650
|
+
items: [
|
|
1651
|
+
{ k: "31 October", v: "an emailed team invite keeps the invitee's address on the invite and shows it to the team's managers, the email goes through our email provider (Resend), and its link carries the team key only sealed under a one-time code." },
|
|
1652
|
+
{ k: "29 October", v: "the browser extension is described. Deleting your account removes the sealed vault key and the rest of your vault data, keeps payment records under a keyed id, and is refused while you own a team that still has other members." },
|
|
1653
|
+
{ k: "8 October", v: "your vault is filed under your did:oc, and the vault key is stored on our server, sealed under your passphrase and your recovery code." }
|
|
1654
|
+
]
|
|
1655
|
+
}
|
|
1656
|
+
],
|
|
1473
1657
|
sections: [
|
|
1474
1658
|
{
|
|
1475
1659
|
id: "principles",
|
|
@@ -1501,6 +1685,10 @@ var privacy3 = {
|
|
|
1501
1685
|
k: "team email (optional)",
|
|
1502
1686
|
v: "if you choose to show teammates an email address in a team vault, that address"
|
|
1503
1687
|
},
|
|
1688
|
+
{
|
|
1689
|
+
k: "emailed team invite",
|
|
1690
|
+
v: "if a team manager emails you an invite: your email address, which is kept on the invite and shown to the team's managers, and sent with the invite link through our email provider (Resend). The link carries the team key only sealed under a one-time code the manager gives you themselves; OrangeCheck never sees the code or the key. The invite is deleted when a manager revokes it, with the team, or when the account that sent or claimed it is deleted"
|
|
1691
|
+
},
|
|
1504
1692
|
{
|
|
1505
1693
|
k: "payment records",
|
|
1506
1694
|
v: "for paid tiers: the BTCPay invoice id, sats paid, tier, and entitlement expiry. No card number, no billing address"
|
|
@@ -1547,12 +1735,12 @@ var privacy3 = {
|
|
|
1547
1735
|
blocks: [
|
|
1548
1736
|
{
|
|
1549
1737
|
kind: "para",
|
|
1550
|
-
text: "The same encrypted vault is reachable from the web app and
|
|
1738
|
+
text: "The same encrypted vault is reachable from the web app, the browser extension, and the CLI and SDK. The zero-knowledge guarantee \u2014 that OrangeCheck only ever holds ciphertext \u2014 applies to all of them."
|
|
1551
1739
|
},
|
|
1552
|
-
{ kind: "subhead", text: "browser extension (not
|
|
1740
|
+
{ kind: "subhead", text: "browser extension (not in a store yet)" },
|
|
1553
1741
|
{
|
|
1554
1742
|
kind: "para",
|
|
1555
|
-
text: "
|
|
1743
|
+
text: "The OC Vault browser extension is built for Chrome and Firefox but is not yet in either browser's store; its source is public at [github.com/orangecheck/oc-vault-extension](https://github.com/orangecheck/oc-vault-extension), and you can build and load it yourself. It fetches the same encrypted blobs the web app does, may cache them **as ciphertext** in extension storage, and decrypts in its service worker only after you unlock it. The vault key lives in memory and a RAM-only `storage.session` slot and is never written to disk in the clear; if you turn on passkey unlock, it is also stored sealed to your passkey. The content script that offers autofill receives only **one entry's username and password at fill time**; it never receives the vault key or the entry index. The extension talks only to vault.ochk.io, and to ochk.io for sign-in: no analytics, no telemetry, no remote code."
|
|
1556
1744
|
},
|
|
1557
1745
|
{ kind: "subhead", text: "developer platform \u2014 access tokens, CLI, SDK, GitHub Action" },
|
|
1558
1746
|
{
|
|
@@ -1584,11 +1772,15 @@ var privacy3 = {
|
|
|
1584
1772
|
},
|
|
1585
1773
|
{
|
|
1586
1774
|
k: "sealed vault key",
|
|
1587
|
-
v: "kept so a new device can unlock; deleting the cloud copy does not remove it
|
|
1775
|
+
v: "kept so a new device can unlock; deleting the cloud copy does not remove it, and deleting your account does"
|
|
1588
1776
|
},
|
|
1589
1777
|
{
|
|
1590
1778
|
k: "payment records",
|
|
1591
|
-
v: "retained as required for accounting and entitlement verification"
|
|
1779
|
+
v: "retained as required for accounting and entitlement verification; when your account is deleted they stay under a keyed id, not your account id"
|
|
1780
|
+
},
|
|
1781
|
+
{
|
|
1782
|
+
k: "deleting your account",
|
|
1783
|
+
v: "removes your encrypted blobs, devices and grants, sealed vault key, access tokens, one-time shares, the teams you own alone, and your seats and invites in other teams. It is refused while you own a team that still has other members"
|
|
1592
1784
|
},
|
|
1593
1785
|
{
|
|
1594
1786
|
k: "request logs",
|
|
@@ -1671,8 +1863,14 @@ function fillSpec(spec, tokens) {
|
|
|
1671
1863
|
function buildDoc(siteSlug, kind) {
|
|
1672
1864
|
const ctx = getSiteContext(siteSlug);
|
|
1673
1865
|
const spec = PROFILES[ctx.profile][kind];
|
|
1866
|
+
const brand = ctx.brand ?? BRAND;
|
|
1867
|
+
const entity = ctx.brand ? ctx.brand : LEGAL_ENTITY;
|
|
1674
1868
|
const tokens = {
|
|
1675
1869
|
...GLOBAL_TOKENS,
|
|
1870
|
+
BRAND: brand,
|
|
1871
|
+
ENTITY: entity,
|
|
1872
|
+
ENTITY_LONG: LEGAL_ENTITY_LONG.replace(LEGAL_ENTITY, entity),
|
|
1873
|
+
ENTITY_UPPER: entity.toUpperCase(),
|
|
1676
1874
|
PRODUCT: ctx.product,
|
|
1677
1875
|
PRODUCT_SHORT: ctx.productShort,
|
|
1678
1876
|
HOST: ctx.host,
|