ad2app-lib 1.22.0 → 1.23.0

package/.graphifyignore

@@ -0,0 +1,16 @@
+# Story worktrees are checkouts of OTHER branches living inside this repo. Without
+# this, every symbol exists once per worktree and the graph answers structure
+# questions with whichever stale copy it reaches first.
+#
+# This is not hypothetical: on 2026-07-29 ad2app-frontend had no such file, 8
+# worktrees, and 26,693 of 30,385 graph nodes (88%) were stale copies —
+# `graphify explain "Section()"` returned the wrong component from the wrong branch.
+# This repo has no worktrees today, so it is clean by luck, not by configuration.
+# Added preventively so the first worktree here cannot silently poison the graph.
+.wt-*/
+
+# Build + dependency output — never source of truth for structure questions.
+node_modules/
+build/
+dist/
+coverage/

package/dist/legal/index.d.ts

@@ -1,5 +1,20 @@
+import type { LegalSectionsByLocale } from './locales';
 export { LEGAL_META } from './meta';
 export type { LegalMeta } from './meta';
 export type { Block, InlineText, LegalSection, ListItem } from './types';
 export { PRIVACY_SECTIONS } from './privacy';
+export { PRIVACY_SECTIONS_PL } from './privacy.pl';
 export { TERMS_SECTIONS } from './terms';
+export { TERMS_SECTIONS_PL } from './terms.pl';
+export { LEGAL_LAST_UPDATED, sectionsFor } from './locales';
+export type { LegalLocale, LegalSectionsByLocale } from './locales';
+/**
+ * The documents, keyed by locale, for callers that resolve at runtime.
+ *
+ * These live here rather than beside their English halves so that `terms.ts`
+ * and `privacy.ts` never import their own translations: a document should not
+ * have to know it has been translated. Consumers pass one of these maps to
+ * `sectionsFor(map, locale)`.
+ */
+export declare const TERMS_BY_LOCALE: LegalSectionsByLocale;
+export declare const PRIVACY_BY_LOCALE: LegalSectionsByLocale;

package/dist/legal/index.js

@@ -1,9 +1,36 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.TERMS_SECTIONS = exports.PRIVACY_SECTIONS = exports.LEGAL_META = void 0;
+exports.PRIVACY_BY_LOCALE = exports.TERMS_BY_LOCALE = exports.sectionsFor = exports.LEGAL_LAST_UPDATED = exports.TERMS_SECTIONS_PL = exports.TERMS_SECTIONS = exports.PRIVACY_SECTIONS_PL = exports.PRIVACY_SECTIONS = exports.LEGAL_META = void 0;
+const privacy_1 = require("./privacy");
+const privacy_pl_1 = require("./privacy.pl");
+const terms_1 = require("./terms");
+const terms_pl_1 = require("./terms.pl");
 var meta_1 = require("./meta");
 Object.defineProperty(exports, "LEGAL_META", { enumerable: true, get: function () { return meta_1.LEGAL_META; } });
-var privacy_1 = require("./privacy");
-Object.defineProperty(exports, "PRIVACY_SECTIONS", { enumerable: true, get: function () { return privacy_1.PRIVACY_SECTIONS; } });
-var terms_1 = require("./terms");
-Object.defineProperty(exports, "TERMS_SECTIONS", { enumerable: true, get: function () { return terms_1.TERMS_SECTIONS; } });
+var privacy_2 = require("./privacy");
+Object.defineProperty(exports, "PRIVACY_SECTIONS", { enumerable: true, get: function () { return privacy_2.PRIVACY_SECTIONS; } });
+var privacy_pl_2 = require("./privacy.pl");
+Object.defineProperty(exports, "PRIVACY_SECTIONS_PL", { enumerable: true, get: function () { return privacy_pl_2.PRIVACY_SECTIONS_PL; } });
+var terms_2 = require("./terms");
+Object.defineProperty(exports, "TERMS_SECTIONS", { enumerable: true, get: function () { return terms_2.TERMS_SECTIONS; } });
+var terms_pl_2 = require("./terms.pl");
+Object.defineProperty(exports, "TERMS_SECTIONS_PL", { enumerable: true, get: function () { return terms_pl_2.TERMS_SECTIONS_PL; } });
+var locales_1 = require("./locales");
+Object.defineProperty(exports, "LEGAL_LAST_UPDATED", { enumerable: true, get: function () { return locales_1.LEGAL_LAST_UPDATED; } });
+Object.defineProperty(exports, "sectionsFor", { enumerable: true, get: function () { return locales_1.sectionsFor; } });
+/**
+ * The documents, keyed by locale, for callers that resolve at runtime.
+ *
+ * These live here rather than beside their English halves so that `terms.ts`
+ * and `privacy.ts` never import their own translations: a document should not
+ * have to know it has been translated. Consumers pass one of these maps to
+ * `sectionsFor(map, locale)`.
+ */
+exports.TERMS_BY_LOCALE = {
+    en: terms_1.TERMS_SECTIONS,
+    pl: terms_pl_1.TERMS_SECTIONS_PL,
+};
+exports.PRIVACY_BY_LOCALE = {
+    en: privacy_1.PRIVACY_SECTIONS,
+    pl: privacy_pl_1.PRIVACY_SECTIONS_PL,
+};

package/dist/legal/locales.d.ts

@@ -0,0 +1,31 @@
+import type { LegalSection } from './types';
+/**
+ * The languages the legal documents exist in.
+ *
+ * Polish is not optional politeness: Ad2app sp. z o.o. is a Polish provider
+ * selling to consumers, and for a Poland-resident consumer the terms have to
+ * be available in Polish. Until 2026-08-04 only English existed, so every
+ * Polish user was agreeing to a document in a language the law does not let us
+ * rely on against them.
+ */
+export type LegalLocale = 'en' | 'pl';
+/** Per-locale sections for one document. */
+export type LegalSectionsByLocale = Record<LegalLocale, LegalSection[]>;
+/**
+ * Resolve a document for a locale, falling back to English.
+ *
+ * The fallback exists so a partially-translated document can never render as a
+ * blank page. It is NOT a licence to ship a half-translated policy: the
+ * document-level parity test asserts both locales carry the same section ids,
+ * so a missing translation fails the build rather than silently serving
+ * English under a Polish URL.
+ */
+export declare function sectionsFor(byLocale: LegalSectionsByLocale, locale: LegalLocale): LegalSection[];
+/**
+ * The "last updated" line, per locale.
+ *
+ * A single hardcoded English date string ("6 July 2026") inside a Polish
+ * document is the kind of detail that makes a translated policy look
+ * machine-made, and dates are one of the things a reviewer checks first.
+ */
+export declare const LEGAL_LAST_UPDATED: Record<LegalLocale, string>;

package/dist/legal/locales.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LEGAL_LAST_UPDATED = void 0;
+exports.sectionsFor = sectionsFor;
+const meta_1 = require("./meta");
+/**
+ * Resolve a document for a locale, falling back to English.
+ *
+ * The fallback exists so a partially-translated document can never render as a
+ * blank page. It is NOT a licence to ship a half-translated policy: the
+ * document-level parity test asserts both locales carry the same section ids,
+ * so a missing translation fails the build rather than silently serving
+ * English under a Polish URL.
+ */
+function sectionsFor(byLocale, locale) {
+    return byLocale[locale] ?? byLocale.en;
+}
+/**
+ * The "last updated" line, per locale.
+ *
+ * A single hardcoded English date string ("6 July 2026") inside a Polish
+ * document is the kind of detail that makes a translated policy look
+ * machine-made, and dates are one of the things a reviewer checks first.
+ */
+exports.LEGAL_LAST_UPDATED = {
+    // Derived, not copied. The first version of this file duplicated the English
+    // date here and left meta.ts untouched, so the same fact had two homes and
+    // nothing stopped them disagreeing. Only the Polish rendering is new.
+    en: meta_1.LEGAL_META.lastUpdated,
+    pl: '5 sierpnia 2026',
+};

package/dist/legal/meta.d.ts

@@ -1,5 +1,5 @@
 export declare const LEGAL_META: {
-    readonly lastUpdated: "6 July 2026";
+    readonly lastUpdated: "5 August 2026";
     readonly contactEmail: "kontakt@ad2.app";
     readonly controllerName: "Ad2app sp. z o.o.";
     readonly controllerAddress: "ul. Juliana Smulikowskiego 4A/21, 00-389 Warszawa, Poland";

package/dist/legal/meta.js

@@ -2,7 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.LEGAL_META = void 0;
 exports.LEGAL_META = {
-    lastUpdated: '6 July 2026',
+    lastUpdated: '5 August 2026',
     contactEmail: 'kontakt@ad2.app',
     controllerName: 'Ad2app sp. z o.o.',
     controllerAddress: 'ul. Juliana Smulikowskiego 4A/21, 00-389 Warszawa, Poland',

package/dist/legal/privacy.js

@@ -33,7 +33,7 @@ exports.PRIVACY_SECTIONS = [
                     {
                         text: '**Social platform data via OAuth:** when you authorise a connection to one of the social media platforms you choose to connect (currently Instagram, TikTok, X (Twitter), YouTube, LinkedIn, Facebook, Threads, Pinterest, Reddit, and Bluesky), we receive data from that platform\'s API as permitted by your OAuth consent. Across all connected platforms this generally includes your account/profile data (such as user ID, username or handle, display name, avatar, and account statistics where the platform exposes them), the content and media of posts you compose, schedule, or publish through the Service, and performance/analytics data for your published posts. The specific data received depends on the platform and the permissions you grant. For some platforms we describe the data in more detail below:',
                         sub: [
-                            { text: '**TikTok:** basic profile (user ID, display name, avatar, biography, profile URL), account statistics (follower count, following count, like count, video count), video list and metadata (titles, view counts, engagement metrics), and — where enabled for scheduling features — video upload and publish permissions. We request only the permissions required for the features you actively use.' },
+                            { text: '**TikTok:** basic profile (user ID, display name, avatar, biography, profile URL), account statistics (follower count, following count, like count, video count), video list and metadata (titles, view counts, engagement metrics), and, where enabled for scheduling features, video upload and publish permissions. We request only the permissions required for the features you actively use.' },
                             { text: '**Instagram:** Instagram Business account data including username, biography, profile picture, account type, and associated business metrics.' },
                             { text: '**Facebook:** public profile information and, where you grant permission, your Facebook email address. Facebook is an independent OAuth provider separate from Instagram.' },
                             { text: '**YouTube:** YouTube channel data (read-only: videos, statistics, channel metadata) and your Google Account profile (name, profile picture URL, Google Account ID) via the Google identity scope used for authentication.' },
@@ -41,15 +41,15 @@ exports.PRIVACY_SECTIONS = [
                         ],
                     },
                     { text: '**OAuth tokens and account connections:** publishing to your connected platforms is handled by our processor Zernio (see Section 6). For the platforms Zernio publishes to, we do not store your OAuth tokens ourselves; the tokens are held by Zernio on our behalf, and we hold only a reference to your connected account (platform name and username). For a small number of platforms where we read analytics directly (TikTok, Instagram, YouTube, Facebook), we may hold an access token ourselves. We are completing a technical review to confirm and, where needed, encrypt at rest every token we hold directly (see Section 10).' },
-                    { text: '**Audience data (aggregate only):** demographic and engagement statistics about your social media audience, as provided by the connected platform\'s API. This data is processed exclusively in aggregate statistical form and is not linked to any identified individual within your audience. We have assessed whether this data could constitute special category data under Art. 9 GDPR and confirm that we do not process such special category data — audience data is processed solely as aggregate numeric metrics.' },
+                    { text: '**Audience data (aggregate only):** demographic and engagement statistics about your social media audience, as provided by the connected platform\'s API. This data is processed exclusively in aggregate statistical form and is not linked to any identified individual within your audience. We have assessed whether this data could constitute special category data under Art. 9 GDPR and confirm that we do not process such special category data: audience data is processed solely as aggregate numeric metrics.' },
                     { text: '**Inbox data:** when you use the platform\'s inbox features, direct message conversations and post comments from your connected social media accounts are fetched and displayed. This includes content sent to you by your followers or other third parties on those platforms. See Section 11 for further detail.' },
                     { text: '**Post content and scheduled posts:** the content you compose, schedule, and publish through the Service, including post text, captions, hashtags, links, scheduling times, and the images, videos, and other media you upload for those posts, together with the publishing status and metadata of each post. Where we cache a thumbnail or media preview for display in the app, we store only a pointer (a URL) to the file hosted by Zernio; we do not copy the underlying media into our own storage.' },
                     { text: '**Published-post analytics:** performance and engagement metrics for posts you have published through the Service to your connected accounts (e.g. views, impressions, likes, comments, shares, reach, and other statistics), as provided by the connected platform\'s API.' },
                     { text: '**Media and content:** files you upload (images, videos, documents) for posts or your profile.' },
-                    { text: '**Technical & usage data:** anonymised IP address, browser type and version, operating system, pages visited, referral URLs, timestamps, error and crash reports, and usage events (e.g. feature interactions such as button clicks and page views, tracked via PostHog — see Sections 6 and 9). Usage tracking starts only after you give consent via the cookie banner.' },
+                    { text: '**Technical & usage data:** anonymised IP address, browser type and version, operating system, pages visited, referral URLs, timestamps, error and crash reports, and usage events (e.g. feature interactions such as button clicks and page views, tracked via PostHog, see Sections 6 and 9). Usage tracking starts only after you give consent via the cookie banner.' },
                     { text: '**Session replay data:** with your consent (see Section 9), we record replays of your interactions with the Service (mouse movement, scrolling, clicks, page navigation) to diagnose usability problems and errors. Values you type into form fields are masked before recording. We are extending this masking to also cover other user-authored text shown on screen during a recording (for example post captions or inbox messages displayed as read-only text); until that work is complete, such text may appear in a recording in readable form. Recordings are automatically deleted after 30 days.' },
                     { text: '**Billing data:** Stripe, our payment processor, collects and holds your billing address and payment details when you subscribe. We ourselves store only a reference to your Stripe customer and subscription records (not your card details or billing address).' },
-                    { text: '**Marketing email preference:** whether you have opted in to marketing and lifecycle emails, and when (see Section 4). This preference is opt-in only — it is never pre-selected on your behalf — and you can withdraw it at any time via the unsubscribe link in any such email or by contacting us at {EMAIL}.' },
+                    { text: '**Marketing email preference:** whether you have opted in to marketing and lifecycle emails, and when (see Section 4). This preference is opt-in only, it is never pre-selected on your behalf, and you can withdraw it at any time via the unsubscribe link in any such email or by contacting us at {EMAIL}.' },
                     { text: '**Feedback data:** free-text feedback submitted via the in-app feedback form. This may incidentally contain personal data you choose to include.' },
                 ],
             },
@@ -115,21 +115,21 @@ exports.PRIVACY_SECTIONS = [
                 kind: 'ul',
                 items: [
                     {
-                        text: '**Service providers (data processors)** — engaged under contractual terms that include data protection obligations. A signed Data Processing Agreement (Art. 28 GDPR) is in place with our publishing sub-processor (Zernio); we are finalising written terms for the remaining sub-processors where not yet bound by their standard online DPA:',
+                        text: '**Service providers (data processors)**, engaged under contractual terms that include data protection obligations. A signed Data Processing Agreement (Art. 28 GDPR) is in place with our publishing sub-processor (Zernio); we are finalising written terms for the remaining sub-processors where not yet bound by their standard online DPA:',
                         sub: [
                             { text: '**Zernio** (contracting entity: ARBICHAT, S.L., trading as \u201cZernio\u201d, zernio.com), social media API aggregation and publishing: we pass OAuth tokens, post content, media files, and inbox data to Zernio solely to execute publishing and inbox operations on your behalf. The vendor is based in Girona, Spain (EEA); see Zernio\'s own privacy policy for details of the infrastructure it uses. We have a signed Data Processing Agreement with this vendor; to the extent Zernio processes data outside the EEA, such transfers are covered by Standard Contractual Clauses (Commission Decision 2021/914) under that agreement.' },
                             { text: '**Stripe**, payment processing: billing address and payment details are collected and held directly by Stripe; we share your email and account identifiers with Stripe to set up and manage your subscription. For processing your subscription payments on our behalf, Stripe acts as our data processor; for fraud prevention, anti-money-laundering checks, and its own regulatory compliance, Stripe acts as an independent data controller under its own privacy policy. Stripe is located in the United States and operates under the EU-US Data Privacy Framework.' },
                             { text: '**PostHog (PostHog, Inc.)**, product analytics, session replay, and error tracking: usage event data (feature interactions, page views, device/browser info), masked session recordings, and error reports are processed only after you have given explicit analytics consent via the cookie banner. Some data we send is identifying rather than pseudonymised in specific cases (for example, transactional email delivery tracking uses your email address directly so we can tell whether an email reached you); we are reviewing which flows can be pseudonymised further. Our PostHog instance is **PostHog Cloud EU, hosted in Frankfurt, Germany**, analytics data is stored and processed within the EEA. PostHog, Inc. is incorporated in the United States; any residual access from outside the EEA is governed by a Data Processing Agreement incorporating Standard Contractual Clauses (Commission Decision 2021/914).' },
                             { text: '**Resend**, transactional and product email delivery: we use Resend to send account verification emails, onboarding and lifecycle emails, and to maintain the list of users eligible for those emails. Resend receives your email address, and where relevant your first name and the content of the email (which may include a verification or unsubscribe link). Under Resend\'s data processing terms, personal data held by Resend is deleted within 90 days after termination of our agreement with them. Resend is a company based in the United States; transfers are covered by Standard Contractual Clauses (Commission Decision 2021/914) or the EU-US Data Privacy Framework where applicable.' },
-                            { text: '**Vercel Inc.** — backend API hosting and compute: server-side application code, API requests, and associated request logs are processed on Vercel\'s infrastructure. Vercel is located in the United States and transfers are covered by Standard Contractual Clauses (Commission Decision 2021/914).' },
+                            { text: '**Vercel Inc.**: backend API hosting and compute: server-side application code, API requests, and associated request logs are processed on Vercel\'s infrastructure. Vercel is located in the United States and transfers are covered by Standard Contractual Clauses (Commission Decision 2021/914).' },
                             { text: '**Neon, LLC (an affiliate of Databricks, Inc.)**, PostgreSQL database hosting: all structured platform data (accounts, connected-account metadata, post content and scheduling metadata) is stored in a Neon-hosted PostgreSQL database operated under the Databricks Master Cloud Services Agreement and the Databricks Privacy Notice. Neon, LLC and Databricks, Inc. are companies incorporated in the United States; whether the database contents leave the EEA depends on the hosting region of our database instance, which we are confirming. To the extent data is processed outside the EEA, transfers are covered by Standard Contractual Clauses (Commission Decision 2021/914).' },
-                            { text: '**Google Firebase (Firebase Authentication)** — authentication token verification: authentication tokens issued to users may be verified against Firebase Authentication to validate active sessions. Firebase is a Google service located in the United States and operates under the EU–US Data Privacy Framework.' },
+                            { text: '**Google Firebase (Firebase Authentication)**: authentication token verification: authentication tokens issued to users may be verified against Firebase Authentication to validate active sessions. Firebase is a Google service located in the United States and operates under the EU–US Data Privacy Framework.' },
                             { text: 'A current list of sub-processors (including names, countries of processing, and applicable transfer safeguards) is available on request at kontakt@ad2.app.' },
                         ],
                     },
                     { text: '**Third-party tools you authorize:** see Section 6a. These tools are recipients acting on your instruction, not our sub-processors.' },
                     { text: '**Legal authorities:** where required by law, court order, or to protect the rights and safety of ad2app or third parties.' },
-                    { text: '**Business transfers:** in the event of a merger, acquisition, or sale of assets, personal data may be transferred under Art. 6(1)(f) — you will be notified before it becomes subject to a different privacy policy.' },
+                    { text: '**Business transfers:** in the event of a merger, acquisition, or sale of assets, personal data may be transferred under Art. 6(1)(f). You will be notified before it becomes subject to a different privacy policy.' },
                 ],
             },
         ],
@@ -180,7 +180,7 @@ exports.PRIVACY_SECTIONS = [
                     { text: '**Right to object (Art. 21):** object to processing based on legitimate interests. We will cease unless we demonstrate compelling legitimate grounds.' },
                     { text: '**Right to withdraw consent (Art. 7(3)):** where processing is based on your consent (analytics cookies, marketing emails), you may withdraw it at any time without affecting the lawfulness of prior processing. Marketing-email consent can be withdrawn at any time via the unsubscribe link in any marketing email or by contacting us at {EMAIL}.' },
                     { text: '**Automated decision-making (Art. 22):** we do not make any decision producing legal or similarly significant effects concerning you based solely on automated processing.' },
-                    { text: '**Right to lodge a complaint (Art. 77):** you have the right to lodge a complaint with the Polish supervisory authority — Urząd Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warszawa, https://uodo.gov.pl — if you believe we are processing your personal data in violation of the GDPR.' },
+                    { text: '**Right to lodge a complaint (Art. 77):** you have the right to lodge a complaint with the Polish supervisory authority, Urząd Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warszawa, https://uodo.gov.pl, if you believe we are processing your personal data in violation of the GDPR.' },
                 ],
             },
             { kind: 'note', label: 'Mandatory vs. optional data', text: 'Providing certain personal data (email address, name, account credentials) is a contractual requirement for accessing the Service, without it, we cannot create or maintain your account. Other fields (such as phone number) are voluntary. Connecting social media accounts via OAuth is optional but required to access publishing, analytics, and inbox features. Marketing-email consent is entirely optional and never a condition of using the Service.' },
@@ -194,9 +194,9 @@ exports.PRIVACY_SECTIONS = [
             {
                 kind: 'ul',
                 items: [
-                    { text: '**Strictly necessary cookies:** required for authentication sessions and core platform functionality. Cannot be disabled without breaking the Service. Legal basis: Art. 6(1)(b) — contract performance; no consent required. Duration: session cookies expire when you close your browser; authentication cookies expire after 30 days of inactivity.' },
+                    { text: '**Strictly necessary cookies:** required for authentication sessions and core platform functionality. Cannot be disabled without breaking the Service. Legal basis: Art. 6(1)(b), contract performance; no consent required. Duration: session cookies expire when you close your browser; authentication cookies expire after 30 days of inactivity.' },
                     { text: '**Functional cookies:** set only in direct response to an action you take (e.g. selecting a language or theme preference), and strictly necessary to deliver that specific function you have requested. They do not track you across sessions beyond preserving your chosen setting. Legal basis: strictly necessary to fulfil your explicit request under Art. 173 of the Polish Telecommunications Act (ePrivacy); no separate consent required. Duration: up to 12 months, or cleared when you clear your browser data.' },
-                    { text: '**Analytics cookies (PostHog):** collect usage event data in pseudonymised form (other than the identifying flows described in Section 6), enable session replay (with form-field values masked; see Section 3), and capture error reports to help us understand and improve how the Service is used. Legal basis: Art. 6(1)(a) — consent. **No analytics cookies are set and no analytics events are captured before you make a choice** in the cookie consent banner shown on first visit. If you accept, PostHog sets a first-party cookie (name beginning `ph_`) on the `ad2.app` domain, valid for up to 1 year, shared between our website and the app so you are not asked twice. If you decline, no analytics cookie is set and no events are collected. Analytics data is processed on PostHog Cloud EU servers in Frankfurt, Germany (see Section 6).' },
+                    { text: '**Analytics cookies (PostHog):** collect usage event data in pseudonymised form (other than the identifying flows described in Section 6), enable session replay (with form-field values masked; see Section 3), and capture error reports to help us understand and improve how the Service is used. Legal basis: Art. 6(1)(a), consent. **No analytics cookies are set and no analytics events are captured before you make a choice** in the cookie consent banner shown on first visit. If you accept, PostHog sets a first-party cookie (name beginning `ph_`) on the `ad2.app` domain, valid for up to 1 year, shared between our website and the app so you are not asked twice. If you decline, no analytics cookie is set and no events are collected. Analytics data is processed on PostHog Cloud EU servers in Frankfurt, Germany (see Section 6).' },
                 ],
             },
             { kind: 'p', text: 'You may withdraw or update your cookie consent at any time via the "Cookie settings" link in the footer of our website, or on this Privacy Policy page in the app. Withdrawing analytics consent does not affect platform functionality.' },
@@ -212,15 +212,15 @@ exports.PRIVACY_SECTIONS = [
             {
                 kind: 'ul',
                 items: [
-                    { text: 'Encryption in transit (TLS 1.2+).' },
-                    { text: 'Hashed storage of passwords using bcrypt with appropriate cost factors.' },
-                    { text: 'We are completing a review to ensure any OAuth tokens we hold directly are encrypted at rest; tokens held by our publishing processor Zernio are subject to Zernio\'s own security measures.' },
+                    { text: 'Encryption in transit (TLS 1.2+) on every connection, enforced by our hosting and database providers.' },
+                    { text: 'Hashed storage of passwords using bcrypt with appropriate cost factors. Where you sign in with Google, we never receive a password at all.' },
+                    { text: 'OAuth tokens we hold directly are encrypted at rest (AES via a server-side key that is never stored beside the data); tokens held by our publishing processor Zernio are subject to Zernio\'s own security measures under our Data Processing Agreement' },
                     { text: 'Server-enforced access grants for third-party tools you authorize via MCP (Section 6a): every request is checked against the access you approved, and grants are individually revocable.' },
-                    { text: 'Role-based access controls with least-privilege principles; access logs retained for audit purposes.' },
-                    { text: 'Pseudonymisation of analytics and usage data where technically feasible.' },
-                    { text: 'Regular vulnerability assessments and periodic penetration testing.' },
-                    { text: 'Incident detection, response, and escalation procedures — including UODO notification within 72 hours of a qualifying breach under Art. 33 GDPR, and notification to affected data subjects where required under Art. 34 GDPR.' },
-                    { text: 'Business continuity and data recovery procedures tested at least annually.' },
+                    { text: 'Access to production systems is limited to the two people who operate ad2app, each through their own provider account. Every request to a protected part of the Service is authenticated and checked against the account making it, request rates are limited to blunt automated abuse, all input is validated at the API boundary, and our cross-origin policy fails closed, so an unlisted origin is refused rather than allowed. We do not keep a separate application-level audit log of staff access; the logs kept by our hosting, database and payment providers are what we rely on.' },
+                    { text: 'Pseudonymisation of analytics and usage data where technically feasible, and masking of text in session recordings, so message and comment bodies are not captured (see Section 3).' },
+                    { text: 'Automated dependency vulnerability scanning; secret scanning before any code is committed; a required review of every change by a second person before it reaches production; and automated test, type and database-schema checks that must pass before a deploy. Our deploy also refuses to build if a required configuration secret is missing, so a misconfigured environment cannot silently reach production. **We do not commission external penetration tests.** For a two-person company we judge that proportionate to the risk under Art. 32 GDPR, and we will update this page if that changes.' },
+                    { text: 'Incident detection, response, and escalation procedures, including UODO notification within 72 hours of a qualifying breach under Art. 33 GDPR, and notification to affected data subjects where required under Art. 34 GDPR.' },
+                    { text: 'Our database provider takes continuous backups with point-in-time recovery, which is what a restore would use, and deleted accounts are held for 30 days before being purged so an accidental deletion can be undone. **We have not yet run a full restore drill**, so we do not claim a tested recovery time.' },
                 ],
             },
         ],
@@ -230,7 +230,7 @@ exports.PRIVACY_SECTIONS = [
         title: '11. Third-Party Links, Social Platforms, and Inbox Data',
         blocks: [
             { kind: 'p', text: 'The Service allows you to connect the social media accounts you choose to enable platform features. Supported platforms currently include Instagram, TikTok, X (Twitter), YouTube, LinkedIn, Facebook, Threads, Pinterest, Reddit, and Bluesky. When you authorise an OAuth connection, ad2app receives data from that platform\'s API as permitted by your OAuth consent screen. The source of all such data is the respective social media platform\'s API.' },
-            { kind: 'p', text: '**Inbox data and third-party communications:** when you use the inbox features, direct message conversations and post comments from your connected social media accounts are fetched and stored. This includes messages and comments sent by your followers and other third parties on those platforms. Some of this data (for example public post comments) originates from publicly accessible sources on the connected platform; direct messages do not. Those individuals have not directly provided their data to ad2app. We process this data under Art. 6(1)(b) (to provide the inbox feature you have contracted for) and rely on the exemption in Art. 14(5)(b) GDPR — providing individual notice to each such person would require disproportionate effort given the volume and platform-derived nature of the data. In line with Art. 14(5)(b), and having regard to the number of individuals concerned, the age of the data, and the safeguards applied, we take appropriate measures to protect these individuals\' rights, freedoms, and legitimate interests, including by making this information publicly available in this policy and by handling any rights request from such a person received at {EMAIL}; our balancing assessment is documented in our Record of Processing Activities (Art. 30 GDPR). Inbox data is not used for profiling, advertising, or any purpose beyond displaying your social media communications within the platform.' },
+            { kind: 'p', text: '**Inbox data and third-party communications:** when you use the inbox features, direct message conversations and post comments from your connected social media accounts are fetched and stored. This includes messages and comments sent by your followers and other third parties on those platforms. Some of this data (for example public post comments) originates from publicly accessible sources on the connected platform; direct messages do not. Those individuals have not directly provided their data to ad2app. We process this data under Art. 6(1)(b) (to provide the inbox feature you have contracted for) and rely on the exemption in Art. 14(5)(b) GDPR: providing individual notice to each such person would require disproportionate effort given the volume and platform-derived nature of the data. In line with Art. 14(5)(b), and having regard to the number of individuals concerned, the age of the data, and the safeguards applied, we take appropriate measures to protect these individuals\' rights, freedoms, and legitimate interests, including by making this information publicly available in this policy and by handling any rights request from such a person received at {EMAIL}; our balancing assessment is documented in our Record of Processing Activities (Art. 30 GDPR). Inbox data is not used for profiling, advertising, or any purpose beyond displaying your social media communications within the platform.' },
             { kind: 'p', text: '**Audience data (Art. 14 GDPR):** when you connect a social media account, the connected platform may provide aggregate audience data (e.g. demographic statistics about your followers). This data originates from the social platform and relates to individuals who are not in a direct relationship with ad2app. It is processed solely as anonymous, aggregate statistics and does not identify any individual; it is therefore not personal data within the meaning of the GDPR (Recital 26) and Art. 14 does not apply to it. Insofar as any element of this data were nevertheless treated as personal data, we would rely on the exemption in Art. 14(5)(b) GDPR (disproportionate effort) and discharge our obligation by making this information publicly available in this policy. Audience data is not used for any other purpose.' },
             { kind: 'p', text: 'We are not responsible for the privacy practices of third-party social platforms. Please review their privacy policies before connecting your accounts.' },
         ],

package/dist/legal/privacy.pl.d.ts

@@ -0,0 +1,14 @@
+import type { LegalSection } from './types';
+/**
+ * Polish version of the Privacy Policy.
+ *
+ * Structural parity with `PRIVACY_SECTIONS` (./privacy.ts) is load-bearing: the
+ * same section ids in the same order, the same block kinds, and the same number
+ * of list items and table rows. A document-level parity test asserts the ids,
+ * so a drifting translation fails the build rather than silently serving a
+ * shorter policy to Polish consumers.
+ *
+ * Inline markup ({EMAIL}, `code`, **bold**) and proper nouns are carried over
+ * verbatim. Legal instruments use their Polish official names (RODO, UODO).
+ */
+export declare const PRIVACY_SECTIONS_PL: LegalSection[];