@orangecheck/legal 0.7.5 → 0.7.7

package/dist/index.mjs

@@ -283,7 +283,7 @@ var disputeResolution = {
     { kind: "subhead", text: "entity of record" },
     {
       kind: "callout",
-      text: 'OrangeCheck is, at the date of this document, operated as the unincorporated project "[[ENTITY_LONG]]". References to "[[ENTITY]]" mean that project and the operators acting on its behalf; upon formation of a formal legal entity, that entity becomes the party of record and these Terms \u2014 including the arbitration and governing-law provisions \u2014 bind it as successor without further notice.'
+      text: 'At the date of this document, the party of record is [[ENTITY_LONG]]. References to "[[ENTITY]]" mean that party and the operators acting on its behalf; upon formation of a formal legal entity, that entity becomes the party of record and these Terms \u2014 including the arbitration and governing-law provisions \u2014 bind it as successor without further notice.'
     }
   ]
 };
@@ -859,16 +859,16 @@ var privacy = {
 var protocolProfile = { terms, privacy };
 
 // src/content/me.ts
-var COMMERCIAL_NOTE = "**me.ochk.io is a commercial product operated by OrangeCheck.** It is distinct from the non-custodial OrangeCheck protocol sites; the Terms at [ochk.io/terms](https://ochk.io/terms) do not govern me.ochk.io. These Terms do.";
+var COMMERCIAL_NOTE = "**me.ochk.io is a commercial product operated by OrangeCheck.** It is distinct from the non-custodial OrangeCheck protocol sites; the Terms at [ochk.io/terms](https://ochk.io/terms) do not govern me.ochk.io. These Terms do. The same Service is also served at ochk.app, in its own design, from the same accounts and records: these Terms govern it at either address, and \u201Cme.ochk.io\u201D in them means both.";
 var terms2 = {
   kind: "terms",
   eyebrow: "terms",
   title: "Terms of service",
-  description: "The terms governing your use of me.ochk.io \u2014 a Bitcoin-backed identity that pays you in sats. OrangeCheck-custodied during bring-up, federation custody and self-custody graduation as the destination, no KYC.",
+  description: "The terms governing your use of me.ochk.io and ochk.app \u2014 a Bitcoin-backed identity that pays you in sats. OrangeCheck-custodied during bring-up, federation custody and self-custody graduation as the destination, no KYC.",
   metaTitle: "Terms of Service \u2014 me.ochk.io",
   metaDescription: "Terms of service for me.ochk.io: a Bitcoin-backed identity that pays users in sats. OrangeCheck custody during bring-up, federation custody and self-custody graduation as the destination, no KYC.",
   effective: "2026-05-15",
-  updated: "2026-10-09",
+  updated: "2026-10-15",
   preamble: [
     {
       kind: "callout",
@@ -1029,15 +1029,15 @@ var privacy2 = {
   kind: "privacy",
   eyebrow: "privacy",
   title: "Privacy policy",
-  description: "How me.ochk.io handles your data: no KYC, no PII required, a per-integrator scoped identity, and a documented, falsifiable account of every record OrangeCheck stores.",
+  description: "How me.ochk.io and ochk.app handle your data: no KYC, no PII required, a per-integrator scoped identity, and a documented, falsifiable account of every record OrangeCheck stores.",
   metaTitle: "Privacy Policy \u2014 me.ochk.io",
   metaDescription: "me.ochk.io privacy policy. No KYC, no PII required, per-integrator scoped identity, and a full account of what OrangeCheck stores.",
   effective: "2026-05-15",
-  updated: "2026-10-09",
+  updated: "2026-10-15",
   preamble: [
     {
       kind: "callout",
-      text: "me.ochk.io\u2019s product is identity that pays you; its privacy posture is what makes it distinct from Sign in with Google. For a side-by-side comparison you can falsify, see [the privacy comparison](/privacy-compare)."
+      text: "This policy covers the Service at both of its addresses, me.ochk.io and ochk.app: one account, one store of records, one operator; \u201Cme.ochk.io\u201D below means both. Its product is identity that pays you; its privacy posture is what makes it distinct from Sign in with Google. For a side-by-side comparison you can falsify, see [the privacy comparison](/privacy-compare)."
     }
   ],
   sections: [
@@ -1140,7 +1140,11 @@ var privacy2 = {
       blocks: [
         {
           kind: "para",
-          text: "Four cookies. `oc_session` \u2014 the Ed25519-signed session token issued by ochk.io (HttpOnly, Secure, SameSite=None, Domain=.ochk.io). `oc_theme`, `oc_skin` and `oc_motion` \u2014 your dark/light, appearance and reduced-motion preferences (Domain=.ochk.io), not auth-bearing. No tracking cookies, no advertising IDs, no third-party pixels. Page analytics use [Plausible](https://plausible.io/privacy) \u2014 cookie-free, no PII, aggregate only."
+          text: "On me.ochk.io, four cookies. `oc_session` \u2014 the Ed25519-signed session token issued by ochk.io (HttpOnly, Secure, SameSite=None, Domain=.ochk.io). `oc_theme`, `oc_skin` and `oc_motion` \u2014 your dark/light, appearance and reduced-motion preferences (Domain=.ochk.io), not auth-bearing. No tracking cookies, no advertising IDs, no third-party pixels. Page analytics use [Plausible](https://plausible.io/privacy) \u2014 cookie-free, no PII, aggregate only."
+        },
+        {
+          kind: "para",
+          text: "On ochk.app, two cookies of its own, set for ochk.app alone. `__Host-oc_session` \u2014 a sign-in token bound to ochk.app (HttpOnly, Secure, SameSite=Lax); it cannot sign you in anywhere else. `__Host-oc_oauth` \u2014 kept for at most ten minutes while you sign in with Google or GitHub, then deleted. Your light/dark choice stays in your browser\u2019s local storage, not a cookie. Page analytics use orangecheck\u2019s own counter at insights.ochk.io: no cookie; a visit is counted by a hash salted daily, the salt is deleted after 48 hours, and your IP address and browser string are never stored."
         }
       ]
     },