@orangecheck/legal 0.7.29 → 0.7.30

package/dist/index.mjs

@@ -678,7 +678,7 @@ var privacy = {
   metaTitle: "Privacy Policy \u2014 OrangeCheck",
   metaDescription: "How OrangeCheck handles data and privacy. Non-custodial by design, minimal data collection, no account required, privacy-preserving analytics only.",
   effective: "2025-09-30",
-  updated: "2026-10-31",
+  updated: "2026-11-06",
   preamble: [
     {
       kind: "callout",
@@ -841,8 +841,8 @@ var privacy = {
               v: "only during a Google or GitHub sign-in: HttpOnly; SameSite=Lax; 10 minutes; deleted when the sign-in completes"
             },
             {
-              k: "oc_theme \xB7 oc_skin \xB7 oc_motion",
-              v: "your light/dark, appearance and reduced-motion choices (Domain=.ochk.io); not used to identify you"
+              k: "oc_theme \xB7 oc_skin \xB7 oc_motion \xB7 oc_logo",
+              v: "your light/dark, appearance, reduced-motion and logo choices (Domain=.ochk.io); not used to identify you. `oc_logo` is set only when you open a page with `?logo=` in its address, and is kept for a year; `?logo=classic` deletes it"
             }
           ]
         },
@@ -1209,7 +1209,7 @@ var privacy2 = {
   metaTitle: "Privacy Policy \u2014 ochk.app",
   metaDescription: "ochk.app privacy policy. No KYC, no PII required, and a full account of what orangecheck stores.",
   effective: "2026-05-15",
-  updated: "2026-11-03",
+  updated: "2026-11-06",
   preamble: [
     {
       kind: "callout",
@@ -1350,11 +1350,11 @@ var privacy2 = {
       blocks: [
         {
           kind: "para",
-          text: "On ochk.app, two cookies of its own, set for ochk.app alone. `__Host-oc_session` \u2014 a sign-in token bound to ochk.app (HttpOnly, Secure, SameSite=Lax); it cannot sign you in anywhere else. `__Host-oc_oauth` \u2014 kept for at most ten minutes while you sign in with Google or GitHub, then deleted. Your light/dark choice stays in your browser\u2019s local storage, not a cookie. Page analytics use orangecheck\u2019s own counter at insights.ochk.io: no cookie; a visit is counted by a hash salted daily, the salt is deleted after 48 hours, and your IP address and browser string are never stored."
+          text: "On ochk.app, up to three cookies of its own, set for ochk.app alone. `__Host-oc_session` \u2014 a sign-in token bound to ochk.app (HttpOnly, Secure, SameSite=Lax); it cannot sign you in anywhere else. `__Host-oc_oauth` \u2014 kept for at most ten minutes while you sign in with Google or GitHub, then deleted. `oc_logo` \u2014 which of our two logos you chose, set only when you open a page with `?logo=` in its address and kept for a year; `?logo=classic` deletes it. Your light/dark choice stays in your browser\u2019s local storage, not a cookie. Page analytics use orangecheck\u2019s own counter at insights.ochk.io: no cookie; a visit is counted by a hash salted daily, the salt is deleted after 48 hours, and your IP address and browser string are never stored."
         },
         {
           kind: "para",
-          text: "On me.ochk.io, four cookies. `oc_session` \u2014 the Ed25519-signed session token issued by ochk.io (HttpOnly, Secure, SameSite=None, Domain=.ochk.io). `oc_theme`, `oc_skin` and `oc_motion` \u2014 your dark/light, appearance and reduced-motion preferences (Domain=.ochk.io), not auth-bearing. No tracking cookies, no advertising IDs, no third-party pixels. Page analytics use [Plausible](https://plausible.io/privacy) \u2014 cookie-free, no PII, aggregate only."
+          text: "On me.ochk.io, five cookies. `oc_session` \u2014 the Ed25519-signed session token issued by ochk.io (HttpOnly, Secure, SameSite=None, Domain=.ochk.io). `oc_theme`, `oc_skin`, `oc_motion` and `oc_logo` \u2014 your dark/light, appearance, reduced-motion and logo preferences (Domain=.ochk.io), not auth-bearing. No tracking cookies, no advertising IDs, no third-party pixels. Page analytics use [Plausible](https://plausible.io/privacy) \u2014 cookie-free, no PII, aggregate only."
         }
       ]
     },
@@ -1639,7 +1639,7 @@ var privacy3 = {
   metaTitle: "Privacy Policy \u2014 OC Vault",
   metaDescription: "OC Vault privacy policy. End-to-end encrypted; OrangeCheck stores ciphertext only and cannot read your vault contents.",
   effective: "2026-05-15",
-  updated: "2026-10-31",
+  updated: "2026-11-06",
   preamble: [
     {
       kind: "callout",
@@ -1755,7 +1755,7 @@ var privacy3 = {
       blocks: [
         {
           kind: "para",
-          text: "No cookies of vault.ochk.io's own. The family sign-in cookie `oc_session` (set by ochk.io: HttpOnly; Secure; SameSite=None; Domain=.ochk.io; 30 days) and the appearance cookies `oc_theme`, `oc_skin` and `oc_motion` apply here. Your vault data lives in your browser's IndexedDB, under your account. Page analytics use [Plausible](https://plausible.io/privacy) \u2014 cookie-free, no PII, aggregate only. No advertising or tracking cookies."
+          text: "No cookies of vault.ochk.io's own. The family sign-in cookie `oc_session` (set by ochk.io: HttpOnly; Secure; SameSite=None; Domain=.ochk.io; 30 days) and the appearance cookies `oc_theme`, `oc_skin`, `oc_motion` and `oc_logo` (your logo choice, set only when you open a page with `?logo=` in its address) apply here. Your vault data lives in your browser's IndexedDB, under your account. Page analytics use [Plausible](https://plausible.io/privacy) \u2014 cookie-free, no PII, aggregate only. No advertising or tracking cookies."
         }
       ]
     },