@orangecheck/legal 0.7.8 → 0.7.10

package/dist/index.js

@@ -827,7 +827,7 @@ var privacy = {
             },
             {
               k: "account, sign-in identities, passkeys and sign-in log",
-              v: "kept until you ask us to delete them at [[PRIVACY_CONTACT]]; there is no automatic deletion yet"
+              v: "deleted when your account-deletion request completes; file one in your account settings, or ask at [[PRIVACY_CONTACT]]"
             },
             {
               k: "support emails",
@@ -908,7 +908,7 @@ var terms2 = {
       blocks: [
         {
           kind: "para",
-          text: "You may create an identity two ways: **BIP-322** (you sign with your own Bitcoin wallet \u2014 full self-custody of your signing key) or **email-OTP** (a one-time code; you hold no key of your own, so OrangeCheck holds what you accrue during bring-up). Both produce a stable, opaque `did:oc` identifier. No password is ever stored."
+          text: "You may create an identity two ways: **BIP-322** (you sign with your own Bitcoin wallet \u2014 full self-custody of your signing key) or **email-OTP** (a one-time code; you hold no key of your own, so OrangeCheck holds your signing key). Either way, during bring-up OrangeCheck holds the cashback you accrue; see custody below. Both produce a stable, opaque `did:oc` identifier. No password is ever stored."
         },
         {
           kind: "para",
@@ -935,7 +935,7 @@ var terms2 = {
       blocks: [
         {
           kind: "para",
-          text: "Custody depends on how you sign in, and the honest answer differs today from the design.\n\n**If you sign in with BIP-322, you hold your own keys.** They never leave your device. OrangeCheck verifies signatures and relays envelopes; it cannot move the funds in your wallet. That is true now and does not change.\n\n**What you earn is a different matter.** Cashback you accrue is a balance OrangeCheck owes you until it is paid out to the destination you bind. During bring-up OrangeCheck holds those sats for every user, however they sign in.\n\n**If you sign in with email, OrangeCheck currently holds the key that pays you.** The design is that a Fedimint federation \u2014 run by independent guardian operators, not OrangeCheck \u2014 holds funds under a threshold scheme, and you may **graduate** to full self-custody at any time. That federation does not exist yet: there are no independent guardians today, and during bring-up the signing key for the paying rail is operated by OrangeCheck. So for email users, during this period, OrangeCheck is a custodian and the party that moves the money.\n\nWe state that plainly rather than describing the destination as though it were the present. **The live status of the paying rail \u2014 which posture is in force, what bounds it, and what has actually settled \u2014 is published on [the custody page](/custody) and machine-readable at `/api/federations`.** Those surfaces are computed from the system rather than written by hand, so they cannot drift from this document the way a fixed sentence would."
+          text: "Custody depends on how you sign in, and the honest answer differs today from the design.\n\n**If you sign in with BIP-322, you hold your own keys.** They never leave your device. OrangeCheck verifies signatures and relays envelopes; it cannot move the funds in your wallet. That is true now and does not change.\n\n**What you earn is a different matter.** Cashback you accrue is a balance OrangeCheck owes you until it is paid out to the destination you bind. During bring-up OrangeCheck holds those sats for every user, however they sign in.\n\n**If you sign in with email, OrangeCheck currently holds the key that pays you.** The design is that a Fedimint federation \u2014 run by independent guardian operators, not OrangeCheck \u2014 holds funds under a threshold scheme, and you may **graduate** to full self-custody at any time. That federation does not exist yet: there are no independent guardians today, and during bring-up the signing key for the paying rail is operated by OrangeCheck. So during this period OrangeCheck is a custodian, of email users\u2019 signing keys and of every user\u2019s accrued cashback, and the party that moves the money.\n\nWe state that plainly rather than describing the destination as though it were the present. **The live status of the paying rail \u2014 which posture is in force, what bounds it, and what has actually settled \u2014 is published on [the custody page](/custody) and machine-readable at `/api/federations`.** Those surfaces are computed from the system rather than written by hand, so they cannot drift from this document the way a fixed sentence would."
         },
         {
           kind: "stub",
@@ -1075,7 +1075,7 @@ var privacy2 = {
             },
             {
               k: "deletable",
-              v: "you can permanently revoke your identity in your settings"
+              v: "you can delete your account in your settings: your data is erased and your sign-in closes"
             }
           ]
         }
@@ -1192,7 +1192,7 @@ var privacy2 = {
             },
             {
               k: "account row",
-              v: "deleted on request via the account-deletion flow, subject to the immutability of anchored data"
+              v: "deleted, with your sign-in identities, passkeys and sessions, when your account-deletion request completes; anchored and published data cannot be deleted by anyone"
             }
           ]
         }
@@ -1215,7 +1215,7 @@ var privacy2 = {
       blocks: [
         {
           kind: "para",
-          text: "In [your settings](/me/settings), under advanced, you can permanently revoke your OrangeCheck identity. Deleting does not pay out sats OrangeCheck owes you, and there is no sweep to self-custody to run first: no federation is bound during bring-up. Settle a non-zero balance before you delete. OrangeCheck deletes the operational records it holds about you; hashes already anchored to Bitcoin and commitments published to Nostr are immutable and cannot be deleted by anyone; neither names you."
+          text: "In [your settings](/me/settings) you can delete your account. A person reviews the request within 48 hours. Completing it erases your data on ochk.io, me.ochk.io, vault, chat and cosign and closes your sign-in, so signing in again starts a new account. Payment receipts are kept for accounting under an id that no longer leads to you, and backups roll off within 30 days. Deleting does not pay out sats OrangeCheck holds for you: settle a non-zero balance first. Hashes anchored to Bitcoin and records published to Nostr cannot be deleted by anyone. me.ochk.io's own anchors name no one, but attestations, polls, pledges, stamps and a chat listing you published carry your Bitcoin address."
         }
       ]
     },