@orangecheck/legal 0.7.4 → 0.7.6

package/dist/index.mjs

@@ -656,7 +656,7 @@ var privacy = {
   metaTitle: "Privacy Policy \u2014 OrangeCheck",
   metaDescription: "How OrangeCheck handles data and privacy. Non-custodial by design, minimal data collection, no account required, privacy-preserving analytics only.",
   effective: "2025-09-30",
-  updated: "2026-10-08",
+  updated: "2026-10-09",
   preamble: [
     {
       kind: "callout",
@@ -742,6 +742,10 @@ var privacy = {
               k: "sign-in log",
               v: "each sign-in and each identity you link or remove, with the IP address and user-agent at the time \u2014 kept for security"
             },
+            {
+              k: "when you first sign in",
+              v: "OrangeCheck\u2019s operators get an email, sent through our email provider (Resend), naming your `did:oc` and the identity you signed in with: your Bitcoin address or your email address"
+            },
             { k: "never", v: "a password, a private key, or a seed phrase" }
           ]
         },
@@ -855,7 +859,7 @@ var privacy = {
 var protocolProfile = { terms, privacy };
 
 // src/content/me.ts
-var COMMERCIAL_NOTE = "**me.ochk.io is a commercial product operated by OrangeCheck.** It is distinct from the non-custodial OrangeCheck protocol sites; the Terms at [ochk.io/terms](https://ochk.io/terms) do not govern me.ochk.io. These Terms do.";
+var COMMERCIAL_NOTE = "**me.ochk.io is a commercial product operated by OrangeCheck.** It is distinct from the non-custodial OrangeCheck protocol sites; the Terms at [ochk.io/terms](https://ochk.io/terms) do not govern me.ochk.io. These Terms do. The same Service is also served at ochk.app, in its own design, from the same accounts and records: these Terms govern it at either address, and \u201Cme.ochk.io\u201D in them means both.";
 var terms2 = {
   kind: "terms",
   eyebrow: "terms",
@@ -864,7 +868,7 @@ var terms2 = {
   metaTitle: "Terms of Service \u2014 me.ochk.io",
   metaDescription: "Terms of service for me.ochk.io: a Bitcoin-backed identity that pays users in sats. OrangeCheck custody during bring-up, federation custody and self-custody graduation as the destination, no KYC.",
   effective: "2026-05-15",
-  updated: "2026-10-09",
+  updated: "2026-10-15",
   preamble: [
     {
       kind: "callout",
@@ -1029,11 +1033,11 @@ var privacy2 = {
   metaTitle: "Privacy Policy \u2014 me.ochk.io",
   metaDescription: "me.ochk.io privacy policy. No KYC, no PII required, per-integrator scoped identity, and a full account of what OrangeCheck stores.",
   effective: "2026-05-15",
-  updated: "2026-10-09",
+  updated: "2026-10-15",
   preamble: [
     {
       kind: "callout",
-      text: "me.ochk.io\u2019s product is identity that pays you; its privacy posture is what makes it distinct from Sign in with Google. For a side-by-side comparison you can falsify, see [the privacy comparison](/privacy-compare)."
+      text: "This policy covers the Service at both of its addresses, me.ochk.io and ochk.app: one account, one store of records, one operator; \u201Cme.ochk.io\u201D below means both. Its product is identity that pays you; its privacy posture is what makes it distinct from Sign in with Google. For a side-by-side comparison you can falsify, see [the privacy comparison](/privacy-compare)."
     }
   ],
   sections: [
@@ -1136,7 +1140,11 @@ var privacy2 = {
       blocks: [
         {
           kind: "para",
-          text: "Four cookies. `oc_session` \u2014 the Ed25519-signed session token issued by ochk.io (HttpOnly, Secure, SameSite=None, Domain=.ochk.io). `oc_theme`, `oc_skin` and `oc_motion` \u2014 your dark/light, appearance and reduced-motion preferences (Domain=.ochk.io), not auth-bearing. No tracking cookies, no advertising IDs, no third-party pixels. Page analytics use [Plausible](https://plausible.io/privacy) \u2014 cookie-free, no PII, aggregate only."
+          text: "On me.ochk.io, four cookies. `oc_session` \u2014 the Ed25519-signed session token issued by ochk.io (HttpOnly, Secure, SameSite=None, Domain=.ochk.io). `oc_theme`, `oc_skin` and `oc_motion` \u2014 your dark/light, appearance and reduced-motion preferences (Domain=.ochk.io), not auth-bearing. No tracking cookies, no advertising IDs, no third-party pixels. Page analytics use [Plausible](https://plausible.io/privacy) \u2014 cookie-free, no PII, aggregate only."
+        },
+        {
+          kind: "para",
+          text: "On ochk.app, two cookies of its own, set for ochk.app alone. `__Host-oc_session` \u2014 a sign-in token bound to ochk.app (HttpOnly, Secure, SameSite=Lax); it cannot sign you in anywhere else. `__Host-oc_oauth` \u2014 kept for at most ten minutes while you sign in with Google or GitHub, then deleted. Your light/dark choice stays in your browser\u2019s local storage, not a cookie. Page analytics use orangecheck\u2019s own counter at insights.ochk.io: no cookie; a visit is counted by a hash salted daily, the salt is deleted after 48 hours, and your IP address and browser string are never stored."
         }
       ]
     },