ad2app-lib 1.6.0 → 1.6.1

package/dist/analytics/index.d.ts

@@ -0,0 +1,99 @@
+/**
+ * Canonical PostHog analytics taxonomy for ad2app.
+ *
+ * Single source of truth for event names, event property shapes, and person
+ * property keys across ALL surfaces (frontend, backend, landing, future MCP).
+ * Spec: ad2appus/docs/posthog-implementation.md §3.
+ *
+ * Naming convention: snake_case, object_verb_past_tense.
+ * Do NOT rename events after they ship — historical data does not migrate.
+ */
+/** Canonical PostHog event names. */
+export declare const EVENTS: {
+    readonly LANDING_CTA_CLICKED: "landing_cta_clicked";
+    readonly SIGNED_UP: "signed_up";
+    readonly PROFILE_COMPLETED: "profile_completed";
+    readonly LOGGED_IN: "logged_in";
+    readonly SOCIAL_ACCOUNT_CONNECTED: "social_account_connected";
+    readonly COMPOSE_STARTED: "compose_started";
+    readonly POST_SCHEDULED: "post_scheduled";
+    readonly POST_PUBLISHED: "post_published";
+    readonly ANALYTICS_VIEWED: "analytics_viewed";
+    readonly TRIAL_STARTED: "trial_started";
+    readonly LIMIT_REACHED: "limit_reached";
+    readonly UPGRADE_CLICKED: "upgrade_clicked";
+    readonly CHECKOUT_STARTED: "checkout_started";
+    readonly SUBSCRIPTION_STARTED: "subscription_started";
+    readonly SUBSCRIPTION_CANCELED: "subscription_canceled";
+};
+export type EventName = (typeof EVENTS)[keyof typeof EVENTS];
+/** Property shape per event. Keeps emitters honest across repos. */
+export interface EventProperties {
+    [EVENTS.LANDING_CTA_CLICKED]: {
+        location: 'hero' | 'pricing' | 'final_cta' | 'nav';
+    };
+    [EVENTS.SIGNED_UP]: {
+        method: 'email' | 'google';
+        role: string;
+    };
+    [EVENTS.PROFILE_COMPLETED]: {
+        role: string;
+    };
+    [EVENTS.LOGGED_IN]: {
+        method?: 'email' | 'google';
+    };
+    [EVENTS.SOCIAL_ACCOUNT_CONNECTED]: {
+        platform: string;
+        account_count?: number;
+    };
+    [EVENTS.COMPOSE_STARTED]: {
+        source?: 'wizard' | 'quick';
+    };
+    [EVENTS.POST_SCHEDULED]: {
+        platforms: string[];
+        platform_count: number;
+        scheduled_for?: string;
+    };
+    [EVENTS.POST_PUBLISHED]: {
+        platforms: string[];
+        platform_count: number;
+        status: 'success' | 'partial' | 'failed';
+    };
+    [EVENTS.ANALYTICS_VIEWED]: {
+        scope?: 'overview' | 'account' | 'post';
+    };
+    [EVENTS.TRIAL_STARTED]: {
+        plan: string;
+    };
+    [EVENTS.LIMIT_REACHED]: {
+        limit: 'x_link_posts' | 'accounts';
+        plan: string;
+        cap: number;
+    };
+    [EVENTS.UPGRADE_CLICKED]: {
+        from_plan?: string;
+        to_plan?: string;
+        surface: string;
+    };
+    [EVENTS.CHECKOUT_STARTED]: {
+        plan: string;
+    };
+    [EVENTS.SUBSCRIPTION_STARTED]: {
+        plan: string;
+        mrr?: number;
+        accounts_included?: number;
+    };
+    [EVENTS.SUBSCRIPTION_CANCELED]: {
+        plan: string;
+        reason?: string;
+    };
+}
+/** Canonical person property keys (set via identify / $set). */
+export declare const PERSON_PROPS: {
+    readonly EMAIL: "email";
+    readonly ROLE: "role";
+    readonly PLAN: "plan";
+    readonly ACCOUNT_COUNT: "account_count";
+    readonly TRIAL_ENDS_AT: "trial_ends_at";
+};
+export type PersonPropKey = (typeof PERSON_PROPS)[keyof typeof PERSON_PROPS];

package/dist/analytics/index.js

@@ -0,0 +1,42 @@
+"use strict";
+/**
+ * Canonical PostHog analytics taxonomy for ad2app.
+ *
+ * Single source of truth for event names, event property shapes, and person
+ * property keys across ALL surfaces (frontend, backend, landing, future MCP).
+ * Spec: ad2appus/docs/posthog-implementation.md §3.
+ *
+ * Naming convention: snake_case, object_verb_past_tense.
+ * Do NOT rename events after they ship — historical data does not migrate.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PERSON_PROPS = exports.EVENTS = void 0;
+/** Canonical PostHog event names. */
+exports.EVENTS = {
+    // Acquisition (landing)
+    LANDING_CTA_CLICKED: 'landing_cta_clicked',
+    // Activation (web app)
+    SIGNED_UP: 'signed_up', // server-owned (backend, on user creation)
+    PROFILE_COMPLETED: 'profile_completed', // the /complete-profile step (influencers)
+    LOGGED_IN: 'logged_in',
+    SOCIAL_ACCOUNT_CONNECTED: 'social_account_connected',
+    COMPOSE_STARTED: 'compose_started',
+    POST_SCHEDULED: 'post_scheduled',
+    POST_PUBLISHED: 'post_published', // server-confirmed (backend)
+    ANALYTICS_VIEWED: 'analytics_viewed',
+    // Revenue (backend = source of truth)
+    TRIAL_STARTED: 'trial_started',
+    LIMIT_REACHED: 'limit_reached', // cap hit (e.g. X link-post cap) — the upsell trigger
+    UPGRADE_CLICKED: 'upgrade_clicked', // client intent
+    CHECKOUT_STARTED: 'checkout_started',
+    SUBSCRIPTION_STARTED: 'subscription_started',
+    SUBSCRIPTION_CANCELED: 'subscription_canceled',
+};
+/** Canonical person property keys (set via identify / $set). */
+exports.PERSON_PROPS = {
+    EMAIL: 'email',
+    ROLE: 'role',
+    PLAN: 'plan', // 'trial' | 'starter' | 'all_platforms' | 'free'
+    ACCOUNT_COUNT: 'account_count',
+    TRIAL_ENDS_AT: 'trial_ends_at',
+};

package/dist/legal/meta.d.ts

@@ -1,5 +1,5 @@
 export declare const LEGAL_META: {
-    readonly lastUpdated: "26 May 2025";
+    readonly lastUpdated: "10 June 2026";
     readonly contactEmail: "kontakt@ad2.app";
     readonly controllerName: "Ad2app sp. z o.o.";
     readonly controllerAddress: "ul. Juliana Smulikowskiego 4A/21, 00-389 Warszawa, Poland";

package/dist/legal/meta.js

@@ -2,7 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.LEGAL_META = void 0;
 exports.LEGAL_META = {
-    lastUpdated: '26 May 2025',
+    lastUpdated: '10 June 2026',
     contactEmail: 'kontakt@ad2.app',
     controllerName: 'Ad2app sp. z o.o.',
     controllerAddress: 'ul. Juliana Smulikowskiego 4A/21, 00-389 Warszawa, Poland',

package/dist/legal/privacy.js

@@ -31,20 +31,24 @@ exports.PRIVACY_SECTIONS = [
                     { text: '**Identity & contact data:** first name, last name, email address, business name, phone number (if provided).' },
                     { text: '**Account credentials:** hashed password; OAuth access and refresh tokens when you connect social media accounts — we store tokens, not your passwords.' },
                     {
-                        text: '**Social platform data via OAuth:** when you authorise a connection to a social media account, we receive data from that platform\'s API as permitted by your OAuth consent. The specific data received depends on the platform and the permissions you grant:',
+                        text: '**Social platform data via OAuth:** when you authorise a connection to one of the social media platforms you choose to connect (currently Instagram, TikTok, X (Twitter), YouTube, LinkedIn, Facebook, Threads, Pinterest, Reddit, and Bluesky), we receive data from that platform\'s API as permitted by your OAuth consent. Across all connected platforms this generally includes your account/profile data (such as user ID, username or handle, display name, avatar, and account statistics where the platform exposes them), the content and media of posts you compose, schedule, or publish through the Service, and performance/analytics data for your published posts. The specific data received depends on the platform and the permissions you grant. For some platforms we describe the data in more detail below; the absence of a platform from the detailed list does not mean less data protection — the same general categories and safeguards apply:',
                         sub: [
                             { text: '**TikTok:** basic profile (user ID, display name, avatar, biography, profile URL), account statistics (follower count, following count, like count, video count), video list and metadata (titles, view counts, engagement metrics), and — where enabled for scheduling features — video upload and publish permissions. We request only the permissions required for the features you actively use.' },
                             { text: '**Instagram:** Instagram Business account data including username, biography, profile picture, account type, and associated business metrics.' },
                             { text: '**Facebook:** public profile information and, where you grant permission, your Facebook email address. Facebook is an independent OAuth provider separate from Instagram.' },
                             { text: '**YouTube:** YouTube channel data (read-only: videos, statistics, channel metadata) and your Google Account profile (name, profile picture URL, Google Account ID) via the Google identity scope used for authentication.' },
+                            { text: '**Other connected platforms (X (Twitter), LinkedIn, Threads, Pinterest, Reddit, Bluesky):** account/profile data, the post content and media you publish through the Service, and published-post analytics, in each case as permitted by the OAuth permissions you grant on that platform.' },
                         ],
                     },
                     { text: '**Audience data (aggregate only):** demographic and engagement statistics about your social media audience, as provided by the connected platform\'s API. This data is processed exclusively in aggregate statistical form and is not linked to any identified individual within your audience. We have assessed whether this data could constitute special category data under Art. 9 GDPR and confirm that we do not process such special category data — audience data is processed solely as aggregate numeric metrics.' },
                     { text: '**Inbox data:** when you use the platform\'s inbox features, direct message conversations and post comments from your connected social media accounts are fetched and displayed. This includes content sent to you by your followers or other third parties on those platforms. See Section 11 for further detail.' },
                     { text: '**Professional data:** influencer category, social media handles, media kit content.' },
                     { text: '**Campaign & collaboration data:** campaign briefs, offer terms, messages exchanged within the platform between brands and influencers.' },
-                    { text: '**Media & content:** files you upload (images, videos, documents) for campaigns or your profile.' },
-                    { text: '**Technical & usage data:** IP address, browser type and version, operating system, pages visited, referral URLs, timestamps, crash reports, and usage events (e.g. feature interactions tracked via Google Analytics 4).' },
+                    { text: '**Post content & scheduled posts:** the content you compose, schedule, and publish through the Service — including post text, captions, hashtags, links, scheduling times, and the images, videos, and other media you upload for those posts — together with the publishing status and metadata of each post.' },
+                    { text: '**Published-post analytics:** performance and engagement metrics for posts you have published through the Service to your connected accounts (e.g. views, impressions, likes, comments, shares, reach, and other statistics), as provided by the connected platform\'s API.' },
+                    { text: '**Media & content:** files you upload (images, videos, documents) for posts, campaigns, or your profile.' },
+                    { text: '**Technical & usage data:** anonymised IP address, browser type and version, operating system, pages visited, referral URLs, timestamps, error and crash reports, and usage events (e.g. feature interactions such as button clicks and page views, tracked via PostHog — see Sections 6 and 9). Usage tracking starts only after you give consent via the cookie banner.' },
+                    { text: '**Session replay data:** with your consent (see Section 9), we record replays of your interactions with the Service (mouse movement, scrolling, clicks, page navigation) to diagnose usability problems and errors. All text you type into input fields is masked before recording and never leaves your browser in readable form. Recordings are retained for 30 days.' },
                     { text: '**Billing data:** billing address and payment reference. Payment card details are handled exclusively by Stripe and are never stored by ad2app.' },
                     { text: '**Waitlist data:** if you submit your email address via our waitlist form before registering, we store that email address to notify you when access is available.' },
                     { text: '**Feedback data:** free-text feedback submitted via the in-app feedback form. This may incidentally contain personal data you choose to include.' },
@@ -63,15 +67,15 @@ exports.PRIVACY_SECTIONS = [
                 headers: ['Purpose', 'Legal basis (GDPR Art. 6)'],
                 rows: [
                     ['Creating and managing your account', 'Art. 6(1)(b) — performance of contract'],
-                    ['Providing platform features (campaigns, collaborations, messaging, inbox)', 'Art. 6(1)(b) — performance of contract'],
-                    ['Processing social media data received via OAuth connections (audience metrics, engagement data, video metadata, inbox messages)', 'Art. 6(1)(b) — performance of contract: necessary to deliver influencer-brand matching, campaign analytics, and inbox features as contracted. Audience data is processed in aggregate and anonymised form only. No Art. 9 special category data is processed.'],
+                    ['Providing platform features (scheduling and publishing posts to your connected accounts, post analytics, campaigns, collaborations, messaging, inbox)', 'Art. 6(1)(b) — performance of contract'],
+                    ['Processing social media data received via OAuth connections (profile/account data, post content and media you publish, published-post analytics, audience metrics, engagement data, video metadata, inbox messages)', 'Art. 6(1)(b) — performance of contract: necessary to deliver post scheduling and publishing, post analytics, influencer-brand matching, campaign analytics, and inbox features as contracted. Audience data is processed in aggregate and anonymised form only. No Art. 9 special category data is processed.'],
                     ['Automated influencer–campaign matching and recommendations (profiling within the meaning of Art. 4(4) GDPR)', 'Art. 6(1)(b) — performance of contract. No binding automated decision with legal or similarly significant effect is made solely by automated means — all matches require affirmative acceptance by both parties. Human review is available on request.'],
                     ['Temporary retention of account data for 30 days following account deletion (account recovery window)', 'Art. 6(1)(f) — legitimate interests: ad2app\'s and the user\'s shared interest in preventing irreversible accidental data loss, balanced against the minimal additional retention period.'],
                     ['Processing payments and issuing invoices (via Stripe)', 'Art. 6(1)(b) & Art. 6(1)(c) — contract & legal obligation'],
                     ['Complying with legal obligations (tax, accounting, record-keeping)', 'Art. 6(1)(c) — legal obligation: Polish Accounting Act (Ustawa o rachunkowości), Tax Ordinance (Ordynacja podatkowa), VAT Act (Ustawa o VAT).'],
                     ['Waitlist email: notifying you when platform access is available', 'Art. 6(1)(a) — consent (given at the point of waitlist submission; withdrawable at any time).'],
                     ['Processing in-app feedback', 'Art. 6(1)(f) — legitimate interests: ad2app\'s interest in improving the Service through user feedback.'],
-                    ['Improving and developing the Service (usage analytics via Google Analytics 4)', 'Art. 6(1)(f) — legitimate interests: ad2app\'s interest in understanding usage patterns to improve product quality, balanced against minimal privacy impact through pseudonymisation. Where analytics cookies are used, Art. 6(1)(a) consent applies.'],
+                    ['Improving and developing the Service (usage analytics, session replay, and error tracking via PostHog)', 'Art. 6(1)(a) — consent, given via the cookie consent banner and withdrawable at any time. No analytics events are captured and no analytics cookies are set before you make a choice. Supplemented by Art. 6(1)(f) — legitimate interests — for aggregate, pseudonymised product statistics.'],
                     ['Security, fraud prevention, and abuse detection', 'Art. 6(1)(f) — legitimate interests: ad2app\'s interest in maintaining platform integrity and protecting users from harm, which overrides the minimal intrusiveness of security logging.'],
                     ['Transfer of personal data in a merger, acquisition, or business asset sale', 'Art. 6(1)(f) — legitimate interests: ad2app\'s legitimate interest in completing lawful business restructuring, balanced against data subjects\' interests. Data subjects will be notified before their data is subject to a materially different privacy policy.'],
                     ['Sending marketing communications', 'Art. 6(1)(a) — consent (withdrawable at any time without affecting prior processing).'],
@@ -90,10 +94,13 @@ exports.PRIVACY_SECTIONS = [
                 items: [
                     { text: '**Account data:** for the duration of your account plus 30 days after deletion (account recovery window), then permanently deleted. You may request immediate permanent deletion — waiving the recovery window — by explicitly stating this in your request to kontakt@ad2.app.' },
                     { text: '**Campaign & collaboration data:** for the duration of your account plus 12 months after account deletion to allow dispute resolution, after which it is permanently deleted. Anonymised aggregated analytics may be retained indefinitely.' },
+                    { text: '**Post content, scheduled posts, and published-post analytics:** retained for the duration of your account and deleted with your account data (subject to the 30-day account recovery window). Anonymised aggregated analytics may be retained indefinitely.' },
                     { text: '**OAuth access and refresh tokens:** revoked and deleted immediately upon disconnection or account deletion, with a maximum retention of 24 hours for revocation processing logs.' },
                     { text: '**Inbox data (DMs and comments):** retained for the duration of your account; deleted with your account data.' },
                     { text: '**Invoices and billing records:** 5 years from the end of the fiscal year (Polish Accounting Act).' },
                     { text: '**Technical logs:** up to 90 days.' },
+                    { text: '**Product analytics events (PostHog):** retained in pseudonymised form for the operation of our analytics; deleted within 30 days of an erasure request or consent withdrawal.' },
+                    { text: '**Session replay recordings (PostHog):** 30 days, then automatically deleted.' },
                     { text: '**Marketing consent records:** until consent is withdrawn plus 3 years for compliance evidence.' },
                     { text: '**Waitlist emails:** until you register for an account or request deletion, or 24 months from submission if you do not register — whichever comes first.' },
                     { text: '**In-app feedback:** up to 24 months from submission.' },
@@ -116,7 +123,7 @@ exports.PRIVACY_SECTIONS = [
                         sub: [
                             { text: '**Zernio (ARBICHAT, S.L.)** — social media API aggregation: we pass OAuth tokens, post content, media files, and inbox data to Zernio solely to execute publishing and inbox operations on your behalf. Zernio is incorporated in Spain (EEA); however, data is processed on infrastructure with residency in North America (United States). This constitutes an international data transfer covered by Standard Contractual Clauses (Commission Decision 2021/914).' },
                             { text: '**Stripe** — payment processing: billing address, email, and payment reference are shared with Stripe to process subscription payments. Stripe is located in the United States and operates under the EU–US Data Privacy Framework.' },
-                            { text: '**Google Analytics 4** — product analytics: pseudonymised usage event data (feature interactions, session data, device/browser info) is sent to Google only after you have given explicit analytics consent. Google is located in the United States and participates in the EU–US Data Privacy Framework.' },
+                            { text: '**PostHog (PostHog, Inc.)** — product analytics, session replay, and error tracking: pseudonymised usage event data (feature interactions, page views, device/browser info), masked session recordings, and error reports are processed only after you have given explicit analytics consent via the cookie banner. Our PostHog instance is **PostHog Cloud EU, hosted in Frankfurt, Germany** — analytics data is stored and processed within the EEA. PostHog, Inc. is incorporated in the United States; any residual access from outside the EEA is governed by a Data Processing Agreement incorporating Standard Contractual Clauses (Commission Decision 2021/914).' },
                             { text: '**Vercel Inc.** — backend API hosting and compute: server-side application code, API requests, and associated request logs are processed on Vercel\'s infrastructure. Vercel is located in the United States and transfers are covered by Standard Contractual Clauses (Commission Decision 2021/914).' },
                             { text: '**Neon Inc.** — PostgreSQL database hosting: all structured platform data (accounts, campaigns, collaborations, social account metadata) is stored in a Neon-hosted PostgreSQL database. Neon is located in the United States and transfers are covered by Standard Contractual Clauses (Commission Decision 2021/914).' },
                             { text: '**Google Firebase (Firebase Authentication)** — authentication token verification: authentication tokens issued to users may be verified against Firebase Authentication to validate active sessions. Firebase is a Google service located in the United States and operates under the EU–US Data Privacy Framework.' },
@@ -133,7 +140,7 @@ exports.PRIVACY_SECTIONS = [
         id: 's7',
         title: '7. International Data Transfers',
         blocks: [
-            { kind: 'p', text: 'Your data is primarily processed within the European Economic Area (EEA). We use certain processors located outside the EEA, including processors based in the United States (currently: Vercel, Neon, Google Firebase, Stripe, Google Analytics 4, and Zernio). For all such transfers we ensure adequate safeguards through one or more of the following mechanisms:' },
+            { kind: 'p', text: 'Your data is primarily processed within the European Economic Area (EEA). Product analytics data (PostHog) is stored and processed on EU servers in Frankfurt, Germany. We use certain processors located outside the EEA, including processors based in the United States (currently: Vercel, Neon, Google Firebase, Stripe, and Zernio; plus residual support access by PostHog, Inc.). For all such transfers we ensure adequate safeguards through one or more of the following mechanisms:' },
             {
                 kind: 'ul',
                 items: [
@@ -177,10 +184,10 @@ exports.PRIVACY_SECTIONS = [
                 items: [
                     { text: '**Strictly necessary cookies:** required for authentication sessions and core platform functionality. Cannot be disabled without breaking the Service. Legal basis: Art. 6(1)(b) — contract performance; no consent required. Duration: session cookies expire when you close your browser; authentication cookies expire after 30 days of inactivity.' },
                     { text: '**Functional cookies:** set only in direct response to an action you take (e.g. selecting a language or theme preference), and strictly necessary to deliver that specific function you have requested. They do not track you across sessions beyond preserving your chosen setting. Legal basis: strictly necessary to fulfil your explicit request under Art. 173 of the Polish Telecommunications Act (ePrivacy); no separate consent required. Duration: up to 12 months, or cleared when you clear your browser data.' },
-                    { text: '**Analytics cookies (Google Analytics 4):** collect pseudonymised usage event data to help us understand how the Service is used. Legal basis: Art. 6(1)(a) — consent. No analytics cookies are set prior to your affirmative consent via the cookie consent banner shown on first visit. The `_ga` cookie set by Google Analytics expires after 2 years; `_ga_*` expires after 2 years. Data is sent to Google LLC (United States) under the EU–US Data Privacy Framework.' },
+                    { text: '**Analytics cookies (PostHog):** collect pseudonymised usage event data, enable session replay (with all typed input masked), and capture error reports to help us understand and improve how the Service is used. Legal basis: Art. 6(1)(a) — consent. **No analytics cookies are set and no analytics events are captured before you make a choice** in the cookie consent banner shown on first visit. If you accept, PostHog sets a first-party cookie (name beginning `ph_`) on the `ad2.app` domain, valid for up to 1 year, shared between our website and the app so you are not asked twice. If you decline, no analytics cookie is set and no events are collected. Analytics data is processed on PostHog Cloud EU servers in Frankfurt, Germany (see Section 6).' },
                 ],
             },
-            { kind: 'p', text: 'You may withdraw or update your cookie consent at any time through the consent management panel accessible via the cookie settings link in the footer. Withdrawing analytics consent does not affect platform functionality.' },
+            { kind: 'p', text: 'You may withdraw or update your cookie consent at any time via the "Cookie settings" link in the footer of our website, or on this Privacy Policy page in the app. Withdrawing analytics consent does not affect platform functionality.' },
             { kind: 'subheading', text: 'Browser local storage' },
             { kind: 'p', text: 'In addition to cookies, we use browser local storage to preserve application state between sessions. This includes: your language and theme preferences; a cached copy of your subscription tier and status (retained for up to 30 days then invalidated); and draft campaign deadline data. Local storage data is stored on your device only and is not transmitted to our servers independently of your normal usage. It is cleared when you clear your browser data or log out.' },
         ],
@@ -208,7 +215,7 @@ exports.PRIVACY_SECTIONS = [
         id: 's11',
         title: '11. Third-Party Links, Social Platforms, and Inbox Data',
         blocks: [
-            { kind: 'p', text: 'The Service allows you to connect social media accounts (TikTok, Instagram, Facebook, or YouTube) to enable platform features. When you authorise an OAuth connection, ad2app receives data from that platform\'s API as permitted by your OAuth consent screen. The source of all such data is the respective social media platform\'s API.' },
+            { kind: 'p', text: 'The Service allows you to connect the social media accounts you choose to enable platform features. Supported platforms currently include Instagram, TikTok, X (Twitter), YouTube, LinkedIn, Facebook, Threads, Pinterest, Reddit, and Bluesky. When you authorise an OAuth connection, ad2app receives data from that platform\'s API as permitted by your OAuth consent screen. The source of all such data is the respective social media platform\'s API.' },
             { kind: 'p', text: '**Inbox data and third-party communications:** when you use the inbox features, direct message conversations and post comments from your connected social media accounts are fetched and stored. This includes messages and comments sent by your followers and other third parties on those platforms. Those individuals have not directly provided their data to ad2app. We process this data under Art. 6(1)(b) (to provide the inbox feature you have contracted for) and rely on the exemption in Art. 14(5)(b) GDPR — providing individual notice to each such person would require disproportionate effort given the volume and platform-derived nature of the data. Inbox data is not used for profiling, advertising, or any purpose beyond displaying your social media communications within the platform.' },
             { kind: 'p', text: '**Audience data (Art. 14 GDPR):** when you connect a social media account, the connected platform may provide aggregate audience data (e.g. demographic statistics about your followers). This data originates from the social platform and relates to individuals who are not in a direct relationship with ad2app. We rely on Art. 14(5)(b) GDPR — individual notification is impossible given the aggregate and platform-derived nature of this data. It is processed solely in aggregated form for influencer–brand matching and campaign analytics, and is not used for any other purpose.' },
             { kind: 'p', text: 'We are not responsible for the privacy practices of third-party social platforms. Please review their privacy policies before connecting your accounts.' },

package/dist/legal/terms.js

@@ -14,7 +14,17 @@ exports.TERMS_SECTIONS = [
         id: 's2',
         title: '2. Service Description',
         blocks: [
-            { kind: 'p', text: 'ad2app is a B2B influencer marketing platform that enables brands and agencies ("Advertisers") to discover, manage, and collaborate with content creators and influencers ("Influencers") on marketing campaigns. The Service includes:' },
+            { kind: 'p', text: 'ad2app is a social media management platform for content creators. At its core, the Service lets you connect your own social media accounts, compose a post once, schedule and publish it to the platforms you choose, and track the performance of your published posts. The Service includes:' },
+            {
+                kind: 'ul',
+                items: [
+                    { text: 'Connecting your own social media accounts via authorised access (OAuth) — currently Instagram, TikTok, X (Twitter), YouTube, LinkedIn, Facebook, Threads, Pinterest, Reddit, and Bluesky.' },
+                    { text: 'Composing a post once and scheduling and publishing it to the connected platforms you select.' },
+                    { text: 'Analytics and reporting on your published posts.' },
+                    { text: 'Media and content file management.' },
+                ],
+            },
+            { kind: 'p', text: 'ad2app also operates as a broader B2B influencer marketing platform. Depending on your account type and the features made available to you, the Service may additionally enable brands and agencies ("Advertisers") to discover, manage, and collaborate with content creators and influencers ("Influencers") on marketing campaigns, including:' },
             {
                 kind: 'ul',
                 items: [
@@ -23,10 +33,9 @@ exports.TERMS_SECTIONS = [
                     { text: 'Collaboration and offer management workflows.' },
                     { text: 'Messaging between Advertisers and Influencers.' },
                     { text: 'Social media inbox management (DMs and comments from connected platforms).' },
-                    { text: 'Analytics and reporting features.' },
-                    { text: 'Media and content file management.' },
                 ],
             },
+            { kind: 'p', text: 'Not all features described in these Terms are available to every User or in every plan. Where a clause applies only to a particular feature or account type (for example, campaigns or collaborations between Users), it applies to you only to the extent you use that feature.' },
             { kind: 'p', text: 'We reserve the right to modify, suspend, or discontinue any part of the Service at any time, with reasonable prior notice where technically or commercially practicable.' },
         ],
     },
@@ -82,7 +91,7 @@ exports.TERMS_SECTIONS = [
             },
             { kind: 'subheading', text: 'Platform non-liability for User Content' },
             { kind: 'p', text: '**ad2app does not create, edit, endorse, or control User Content.** We act solely as a hosting intermediary within the meaning of Article 6 of the EU Digital Services Act (Regulation (EU) 2022/2065) and are not liable for User Content unless we have actual knowledge of its illegal nature and fail to act expeditiously to remove or disable access to it.' },
-            { kind: 'p', text: 'You are **solely and exclusively responsible** for any content you create, publish, share, or distribute through the Service, including — but not limited to — campaign materials, promotional posts, sponsored content, images, videos, captions, hashtags, and any other material posted on third-party platforms (such as TikTok, Instagram, Facebook, or YouTube) using ad2app as a tool or workflow. ad2app assumes no liability for such content regardless of whether it was planned, briefed, or tracked through the platform.' },
+            { kind: 'p', text: 'You are **solely and exclusively responsible** for any content you create, publish, share, schedule, or distribute through the Service, including — but not limited to — scheduled posts, captions, images, videos, hashtags, campaign materials, promotional posts, sponsored content, and any other material posted on third-party platforms (including the social media platforms you connect, such as Instagram, TikTok, X (Twitter), YouTube, LinkedIn, Facebook, Threads, Pinterest, Reddit, and Bluesky) using ad2app as a tool or workflow. ad2app assumes no liability for such content regardless of whether it was composed, scheduled, planned, briefed, or tracked through the platform.' },
             { kind: 'p', text: 'In particular, you are responsible for ensuring that all published content complies with: (a) applicable advertising and marketing laws; (b) platform-specific community guidelines and terms of service of any third-party social media platform; (c) intellectual property rights of third parties; and (d) all applicable laws of the jurisdiction(s) where the content is distributed or viewed.' },
             { kind: 'subheading', text: 'Digital Services Act — Points of Contact (Art. 11 DSA)' },
             { kind: 'p', text: 'In accordance with Art. 11 of Regulation (EU) 2022/2065 (Digital Services Act), ad2app designates the following single point of contact for direct communication with Member State authorities, the European Commission, and the European Board for Digital Services: kontakt@ad2.app. Communications may be conducted in Polish or English.' },
@@ -104,7 +113,7 @@ exports.TERMS_SECTIONS = [
         id: 's6',
         title: '6. Intellectual Property',
         blocks: [
-            { kind: 'p', text: 'The Service, including its software, design, logos, trademarks, and documentation, is owned by or licensed to ad2app and is protected by intellectual property laws. You are granted a limited, non-exclusive, non-transferable, revocable licence to access and use the Service solely for your internal business purposes in accordance with these Terms. You must not:' },
+            { kind: 'p', text: 'The Service, including its software, design, logos, trademarks, and documentation, is owned by or licensed to ad2app and is protected by intellectual property laws. You are granted a limited, non-exclusive, non-transferable, revocable licence to access and use the Service solely for your own purposes in accordance with these Terms. You must not:' },
             {
                 kind: 'ul',
                 items: [
@@ -119,7 +128,7 @@ exports.TERMS_SECTIONS = [
         id: 's7',
         title: '7. Campaigns and Collaborations Between Users',
         blocks: [
-            { kind: 'p', text: 'The Service facilitates agreements between Advertisers and Influencers. ad2app is not a party to any agreement reached between Users through the platform and has no control over the performance, quality, legality, or accuracy of campaigns or content produced. **ad2app is not responsible for any content that Users publish, broadcast, or distribute on any platform — including third-party social media platforms — whether or not that content was planned, briefed, approved, or tracked through the Service.**' },
+            { kind: 'p', text: 'This section applies where the Service is used to facilitate campaigns or collaborations between Users; it does not apply to your use of the scheduling, publishing, and analytics features for your own accounts. Where the Service facilitates agreements between Advertisers and Influencers, ad2app is not a party to any agreement reached between Users through the platform and has no control over the performance, quality, legality, or accuracy of campaigns or content produced. **In all cases, ad2app is not responsible for any content that Users publish, broadcast, schedule, or distribute on any platform — including third-party social media platforms — whether or not that content was composed, scheduled, planned, briefed, approved, or tracked through the Service.**' },
             { kind: 'p', text: 'Each User is solely responsible for:' },
             {
                 kind: 'ul',
@@ -208,6 +217,7 @@ exports.TERMS_SECTIONS = [
         title: '13. Data Protection',
         blocks: [
             { kind: 'p', text: 'Our collection and use of personal data is governed by our {PRIVACY}, which forms part of these Terms. By accepting these Terms, you acknowledge that you have read and understood our Privacy Policy.' },
+            { kind: 'p', text: 'The Service uses third-party data processors — including EU-hosted product analytics (PostHog Cloud EU), payment processing (Stripe), and social media API aggregation (Zernio) — as listed and described in the Privacy Policy. Usage analytics and session replay operate only with your consent, which you may give or withdraw at any time via the cookie consent controls described in the Privacy Policy.' },
             { kind: 'p', text: 'Where you, as an Advertiser, use the Service to access, communicate with, or manage Influencer personal data through the platform, ad2app acts as a **data processor** on your behalf under Article 28 GDPR, and you act as the **data controller** for that processing. Our Data Processing Agreement (available on request at kontakt@ad2.app) governs that relationship. You remain solely responsible for ensuring you have a valid legal basis for any personal data processing you direct through the platform and for your own compliance with GDPR in your capacity as controller.' },
         ],
     },

package/dist/types/scheduling/I_SchedulingProUpgrade.d.ts

@@ -4,7 +4,7 @@
  * Covers subscription tier state, Stripe checkout flows,
  * and the customer portal redirect.
  */
-export type SchedulingSubscriptionTier = 'free' | 'starter' | 'pro';
+export type SchedulingSubscriptionTier = 'free' | 'pro';
 export type SchedulingSubscriptionStatus = 'active' | 'canceled' | 'expired';
 /**
  * Current subscription state for the authenticated user.
@@ -14,7 +14,6 @@ export declare class SchedulingSubscriptionInfoDTO {
     tier: SchedulingSubscriptionTier;
     status: SchedulingSubscriptionStatus;
     expiresAt: string | null;
-    maxPlatforms: number;
     constructor(data: SchedulingSubscriptionInfoDTO);
 }
 /**
@@ -33,18 +32,6 @@ export declare class SchedulingPortalSessionResultDTO {
     url: string;
     constructor(data: SchedulingPortalSessionResultDTO);
 }
-export interface SchedulingPlanPriceDTO {
-    tier: 'starter' | 'pro';
-    amount: number;
-    currency: string;
-    interval: string;
-    maxPlatforms: number;
-}
-export declare class SchedulingProductPricesDTO {
-    starter: SchedulingPlanPriceDTO;
-    pro: SchedulingPlanPriceDTO;
-    constructor(data: SchedulingProductPricesDTO);
-}
 /**
  * Aggregated Pro-upgrade context DTO.
  * Combines subscription info with action URLs for UI display.

package/dist/types/scheduling/I_SchedulingProUpgrade.js

@@ -6,7 +6,7 @@
  * and the customer portal redirect.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SchedulingProUpgradeDTO = exports.SchedulingProductPricesDTO = exports.SchedulingPortalSessionResultDTO = exports.SchedulingCheckoutSessionResultDTO = exports.SchedulingSubscriptionInfoDTO = void 0;
+exports.SchedulingProUpgradeDTO = exports.SchedulingPortalSessionResultDTO = exports.SchedulingCheckoutSessionResultDTO = exports.SchedulingSubscriptionInfoDTO = void 0;
 // ── SchedulingSubscriptionInfoDTO ────────────────────────────────────────────
 /**
  * Current subscription state for the authenticated user.
@@ -17,7 +17,6 @@ class SchedulingSubscriptionInfoDTO {
         this.tier = data.tier;
         this.status = data.status;
         this.expiresAt = data.expiresAt;
-        this.maxPlatforms = data.maxPlatforms;
     }
 }
 exports.SchedulingSubscriptionInfoDTO = SchedulingSubscriptionInfoDTO;
@@ -43,14 +42,6 @@ class SchedulingPortalSessionResultDTO {
     }
 }
 exports.SchedulingPortalSessionResultDTO = SchedulingPortalSessionResultDTO;
-// ── SchedulingProductPricesDTO ────────────────────────────────────────────────
-class SchedulingProductPricesDTO {
-    constructor(data) {
-        this.starter = data.starter;
-        this.pro = data.pro;
-    }
-}
-exports.SchedulingProductPricesDTO = SchedulingProductPricesDTO;
 // ── SchedulingProUpgradeDTO ───────────────────────────────────────────────────
 /**
  * Aggregated Pro-upgrade context DTO.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ad2app-lib",
-  "version": "1.6.0",
+  "version": "1.6.1",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "type": "commonjs",