@orangecheck/legal 0.7.29 → 0.7.31

package/dist/index.mjs

@@ -678,7 +678,7 @@ var privacy = {
   metaTitle: "Privacy Policy \u2014 OrangeCheck",
   metaDescription: "How OrangeCheck handles data and privacy. Non-custodial by design, minimal data collection, no account required, privacy-preserving analytics only.",
   effective: "2025-09-30",
-  updated: "2026-10-31",
+  updated: "2026-11-06",
   preamble: [
     {
       kind: "callout",
@@ -841,8 +841,8 @@ var privacy = {
               v: "only during a Google or GitHub sign-in: HttpOnly; SameSite=Lax; 10 minutes; deleted when the sign-in completes"
             },
             {
-              k: "oc_theme \xB7 oc_skin \xB7 oc_motion",
-              v: "your light/dark, appearance and reduced-motion choices (Domain=.ochk.io); not used to identify you"
+              k: "oc_theme \xB7 oc_skin \xB7 oc_motion \xB7 oc_logo",
+              v: "your light/dark, appearance, reduced-motion and logo choices (Domain=.ochk.io); not used to identify you. `oc_logo` is set only when you open a page with `?logo=` in its address, and is kept for a year; `?logo=classic` deletes it"
             }
           ]
         },
@@ -1191,7 +1191,7 @@ var terms2 = {
       blocks: [
         {
           kind: "para",
-          text: "**Your right:** stop using ochk.app at any time; you may delete your identity in [your settings](/me/settings). **Our right:** suspend or terminate access with or without cause, including for abuse or legal risk. Deleting your identity does not settle a balance orangecheck owes you. If your balance is above zero, bind a payout destination and instruct a cash-out before you delete, or contact us. Hashes anchored to Bitcoin and commitments published to Nostr are immutable and cannot be deleted by orangecheck; neither names you. The disclaimer, liability, indemnification, governing-law, and dispute provisions survive."
+          text: "**Your right:** stop using ochk.app at any time; you may delete your identity in [your settings](/me/account#delete). **Our right:** suspend or terminate access with or without cause, including for abuse or legal risk. Deleting your identity does not settle a balance orangecheck owes you. If your balance is above zero, bind a payout destination and instruct a cash-out before you delete, or contact us. Hashes anchored to Bitcoin and commitments published to Nostr are immutable and cannot be deleted by orangecheck; neither names you. The disclaimer, liability, indemnification, governing-law, and dispute provisions survive."
         }
       ]
     },
@@ -1209,7 +1209,7 @@ var privacy2 = {
   metaTitle: "Privacy Policy \u2014 ochk.app",
   metaDescription: "ochk.app privacy policy. No KYC, no PII required, and a full account of what orangecheck stores.",
   effective: "2026-05-15",
-  updated: "2026-11-03",
+  updated: "2026-11-06",
   preamble: [
     {
       kind: "callout",
@@ -1231,7 +1231,7 @@ var privacy2 = {
     },
     {
       kind: "callout",
-      text: "This policy covers the Service at both of its addresses, ochk.app and its API at me.ochk.io: one account, one store of records, one operator; \u201Cochk.app\u201D below means both. Its product is identity that will pay you; its privacy posture is what makes it distinct from Sign in with Google. For a side-by-side comparison you can falsify, see [the privacy comparison](/privacy-compare)."
+      text: "This policy covers the Service at both of its addresses, ochk.app and its API at me.ochk.io: one account, one store of records, one operator; \u201Cochk.app\u201D below means both. Its product is identity that will pay you; its privacy posture is what makes it distinct from Sign in with Google. For a side-by-side comparison you can falsify, see [the privacy comparison](/trust#privacy)."
     }
   ],
   sections: [
@@ -1350,11 +1350,11 @@ var privacy2 = {
       blocks: [
         {
           kind: "para",
-          text: "On ochk.app, two cookies of its own, set for ochk.app alone. `__Host-oc_session` \u2014 a sign-in token bound to ochk.app (HttpOnly, Secure, SameSite=Lax); it cannot sign you in anywhere else. `__Host-oc_oauth` \u2014 kept for at most ten minutes while you sign in with Google or GitHub, then deleted. Your light/dark choice stays in your browser\u2019s local storage, not a cookie. Page analytics use orangecheck\u2019s own counter at insights.ochk.io: no cookie; a visit is counted by a hash salted daily, the salt is deleted after 48 hours, and your IP address and browser string are never stored."
+          text: "On ochk.app, up to three cookies of its own, set for ochk.app alone. `__Host-oc_session` \u2014 a sign-in token bound to ochk.app (HttpOnly, Secure, SameSite=Lax); it cannot sign you in anywhere else. `__Host-oc_oauth` \u2014 kept for at most ten minutes while you sign in with Google or GitHub, then deleted. `oc_logo` \u2014 which of our two logos you chose, set only when you open a page with `?logo=` in its address and kept for a year; `?logo=classic` deletes it. Your light/dark choice stays in your browser\u2019s local storage, not a cookie. Page analytics use orangecheck\u2019s own counter at insights.ochk.io: no cookie; a visit is counted by a hash salted daily, the salt is deleted after 48 hours, and your IP address and browser string are never stored."
         },
         {
           kind: "para",
-          text: "On me.ochk.io, four cookies. `oc_session` \u2014 the Ed25519-signed session token issued by ochk.io (HttpOnly, Secure, SameSite=None, Domain=.ochk.io). `oc_theme`, `oc_skin` and `oc_motion` \u2014 your dark/light, appearance and reduced-motion preferences (Domain=.ochk.io), not auth-bearing. No tracking cookies, no advertising IDs, no third-party pixels. Page analytics use [Plausible](https://plausible.io/privacy) \u2014 cookie-free, no PII, aggregate only."
+          text: "On me.ochk.io, five cookies. `oc_session` \u2014 the Ed25519-signed session token issued by ochk.io (HttpOnly, Secure, SameSite=None, Domain=.ochk.io). `oc_theme`, `oc_skin`, `oc_motion` and `oc_logo` \u2014 your dark/light, appearance, reduced-motion and logo preferences (Domain=.ochk.io), not auth-bearing. No tracking cookies, no advertising IDs, no third-party pixels. Page analytics use [Plausible](https://plausible.io/privacy) \u2014 cookie-free, no PII, aggregate only."
         }
       ]
     },
@@ -1421,7 +1421,7 @@ var privacy2 = {
       blocks: [
         {
           kind: "para",
-          text: "In [your settings](/me/settings) you can delete your account. A person completes the request, and we aim to do that within 48 hours: an alert tells us when one has waited a day. Completing it closes your sign-in, so signing in again starts a new account, and erases your data on ochk.io, me.ochk.io, vault, chat and cosign, except a few records. Payment records keep their amounts and times for accounting, and our audit log and your deletion request stay, without the reason you gave. We keep a record that your account was deleted, out of public view, so sessions you already had stop working and the deletion can be shown. Each keeps your account only as a keyed id, or not at all, so the record by itself doesn't say whose account it was. On cosign, your messages in conversations with other people and the reports you filed stay, with your account taken off them. Backups roll off within 30 days, and copies cached by our CDN expire within a day. Deleting does not pay out sats orangecheck holds for you: settle a non-zero balance first. If you run a guardian, you can delete only once your operator key holds no seat or hosted guardian, has finished any exit, created no federation that still exists, and is owed nothing. Charter signatures, incidents and amendment proposals the key signed stay public under the key, with what you wrote in them; exit records and machine reports stay visible to that federation's guardians and to us. Hashes anchored to Bitcoin and records published to Nostr cannot be deleted by anyone. me.ochk.io's own anchors name no one, but attestations, polls, pledges, stamps and a chat listing you published carry your Bitcoin address."
+          text: "In [your settings](/me/account#delete) you can delete your account. A person completes the request, and we aim to do that within 48 hours: an alert tells us when one has waited a day. Completing it closes your sign-in, so signing in again starts a new account, and erases your data on ochk.io, me.ochk.io, vault, chat and cosign, except a few records. Payment records keep their amounts and times for accounting, and our audit log and your deletion request stay, without the reason you gave. We keep a record that your account was deleted, out of public view, so sessions you already had stop working and the deletion can be shown. Each keeps your account only as a keyed id, or not at all, so the record by itself doesn't say whose account it was. On cosign, your messages in conversations with other people and the reports you filed stay, with your account taken off them. Backups roll off within 30 days, and copies cached by our CDN expire within a day. Deleting does not pay out sats orangecheck holds for you: settle a non-zero balance first. If you run a guardian, you can delete only once your operator key holds no seat or hosted guardian, has finished any exit, created no federation that still exists, and is owed nothing. Charter signatures, incidents and amendment proposals the key signed stay public under the key, with what you wrote in them; exit records and machine reports stay visible to that federation's guardians and to us. Hashes anchored to Bitcoin and records published to Nostr cannot be deleted by anyone. me.ochk.io's own anchors name no one, but attestations, polls, pledges, stamps and a chat listing you published carry your Bitcoin address."
         }
       ]
     },
@@ -1639,7 +1639,7 @@ var privacy3 = {
   metaTitle: "Privacy Policy \u2014 OC Vault",
   metaDescription: "OC Vault privacy policy. End-to-end encrypted; OrangeCheck stores ciphertext only and cannot read your vault contents.",
   effective: "2026-05-15",
-  updated: "2026-10-31",
+  updated: "2026-11-06",
   preamble: [
     {
       kind: "callout",
@@ -1755,7 +1755,7 @@ var privacy3 = {
       blocks: [
         {
           kind: "para",
-          text: "No cookies of vault.ochk.io's own. The family sign-in cookie `oc_session` (set by ochk.io: HttpOnly; Secure; SameSite=None; Domain=.ochk.io; 30 days) and the appearance cookies `oc_theme`, `oc_skin` and `oc_motion` apply here. Your vault data lives in your browser's IndexedDB, under your account. Page analytics use [Plausible](https://plausible.io/privacy) \u2014 cookie-free, no PII, aggregate only. No advertising or tracking cookies."
+          text: "No cookies of vault.ochk.io's own. The family sign-in cookie `oc_session` (set by ochk.io: HttpOnly; Secure; SameSite=None; Domain=.ochk.io; 30 days) and the appearance cookies `oc_theme`, `oc_skin`, `oc_motion` and `oc_logo` (your logo choice, set only when you open a page with `?logo=` in its address) apply here. Your vault data lives in your browser's IndexedDB, under your account. Page analytics use [Plausible](https://plausible.io/privacy) \u2014 cookie-free, no PII, aggregate only. No advertising or tracking cookies."
         }
       ]
     },