freemyid 0.2.0.dev1__py3-none-any.whl

freemyid/submitters/base.py

@@ -0,0 +1,119 @@
+"""Shared helpers for submitters: data minimization and evidence paths.
+
+DATA MINIMIZATION (shared rule 6): a broker only ever gets
+  * fields its listings already show (Listing.shown_fields), intersected with what the
+    broker needs (Broker.required_fields, or name/city/state/url/email if unspecified);
+  * for a "blind" broker (no search, so no listing): the name, plus city/state only if the
+    broker requires them;
+  * the removal mailbox (never a personal email);
+  * a phone number only if shown AND required AND permissions.allow_phone_disclosure.
+DOB, relatives and personal emails are never included.
+"""
+from __future__ import annotations
+
+from types import SimpleNamespace
+
+from ..models import Broker, Evidence, EvidenceKind, Listing, MatchLevel, Profile, ProfileField
+
+F = ProfileField
+_DEFAULT_NEEDS = {F.FULL_NAME, F.CITY, F.STATE, F.LISTING_URL, F.EMAIL}
+_BLIND_OK = {F.FULL_NAME, F.FIRST_NAME, F.LAST_NAME, F.MIDDLE_NAME, F.CITY, F.STATE,
+             F.LISTING_URL, F.EMAIL}
+_NEVER = {F.DOB, F.ID_DOCUMENT}
+
+
+def confirmed(listings: list[Listing]) -> list[Listing]:
+    return [li for li in listings if li.match_level == MatchLevel.CONFIRMED]
+
+
+def allowed_fields(profile: Profile, broker: Broker, listings: list[Listing]) -> set[F]:
+    """Profile fields this broker may receive for these listings."""
+    needs = set(broker.required_fields) or set(_DEFAULT_NEEDS)
+    if F.FULL_NAME in needs:
+        needs |= {F.FIRST_NAME, F.LAST_NAME}
+    if listings:
+        shown = {f for li in listings for f in li.shown_fields} | {F.LISTING_URL, F.EMAIL}
+        if F.FULL_NAME in shown:
+            shown |= {F.FIRST_NAME, F.LAST_NAME}
+    else:
+        shown = set(_BLIND_OK)
+    out = (needs & shown) - _NEVER
+    if F.PHONE in out and not profile.permissions.allow_phone_disclosure:
+        out.discard(F.PHONE)
+    out.add(F.FULL_NAME)      # the name is how any broker finds the record
+    return out
+
+
+def _current(profile: Profile):
+    return next((a for a in profile.addresses if a.current), profile.addresses[0])
+
+
+def copy_fields(profile: Profile, broker: Broker, listings: list[Listing]) -> dict[str, str]:
+    """Label -> value for the Assisted card's Copy buttons. Minimized (see module doc)."""
+    allowed = allowed_fields(profile, broker, listings)
+    cur = _current(profile)
+    out: dict[str, str] = {}
+    if F.FULL_NAME in allowed:
+        out["Full name"] = f"{profile.name.first} {profile.name.last}"
+    if F.FIRST_NAME in allowed and F.FIRST_NAME in broker.required_fields:
+        out["First name"] = profile.name.first
+    if F.LAST_NAME in allowed and F.LAST_NAME in broker.required_fields:
+        out["Last name"] = profile.name.last
+    if F.CITY in allowed:
+        out["City"] = cur.city
+    if F.STATE in allowed:
+        out["State"] = cur.state
+    if F.STREET_ADDRESS in allowed and cur.street:
+        out["Street address"] = cur.street
+    if F.ZIP in allowed and cur.zip:
+        out["ZIP code"] = cur.zip
+    if F.AGE in allowed and (age := profile.estimated_age()) is not None:
+        out["Age"] = str(age)
+    if F.PHONE in allowed and profile.phones:
+        out["Phone"] = profile.phones[0]
+    for i, li in enumerate(confirmed(listings) or listings):
+        out["Listing link" if i == 0 else f"Listing link {i + 1}"] = li.url
+    if F.EMAIL in allowed and profile.mailbox:
+        out["Email for removals"] = profile.mailbox.address
+    return out
+
+
+def form_vars(profile: Profile, broker: Broker, listing: Listing | None) -> dict:
+    """Variables for FormStep.value templates. Only allowed fields exist; anything else is
+    undefined, so a form step asking for it fails (and the run drops to Assisted)."""
+    lis = [listing] if listing else []
+    allowed = allowed_fields(profile, broker, lis)
+    cur = _current(profile)
+    p: dict[str, object] = {}
+    if F.FULL_NAME in allowed or F.FIRST_NAME in allowed:
+        p.update(first=profile.name.first, last=profile.name.last,
+                 full_name=f"{profile.name.first} {profile.name.last}")
+    if F.MIDDLE_NAME in allowed and profile.name.middle:
+        p["middle"] = profile.name.middle
+    if F.CITY in allowed:
+        p["city"] = cur.city
+    if F.STATE in allowed:
+        p["state"] = cur.state
+    if F.STREET_ADDRESS in allowed and cur.street:
+        p["street"] = cur.street
+    if F.ZIP in allowed and cur.zip:
+        p["zip"] = cur.zip
+    if F.AGE in allowed:
+        p["age"] = profile.estimated_age()
+    if F.PHONE in allowed and profile.phones:
+        p["phone"] = profile.phones[0]
+    return {
+        "profile": SimpleNamespace(**p),
+        "listing": SimpleNamespace(url=listing.url) if listing else None,
+        "mailbox": SimpleNamespace(address=profile.mailbox.address) if profile.mailbox else None,
+        "broker": SimpleNamespace(id=broker.id, name=broker.name),
+    }
+
+
+def evidence(profile_id: str, broker_id: str, kind: EvidenceKind, ext: str, *,
+             listing_id: str | None = None, request_id: str | None = None,
+             caption: str | None = None) -> Evidence:
+    """Evidence record with relpath <profile_id>/<broker_id>/<id>.<ext> (sha set on save)."""
+    ev = Evidence(profile_id=profile_id, broker_id=broker_id, kind=kind, relpath="x",
+                  sha256="", listing_id=listing_id, request_id=request_id, caption=caption)
+    return ev.model_copy(update={"relpath": f"{profile_id}/{broker_id}/{ev.id}.{ext}"})

freemyid/submitters/email.py

@@ -0,0 +1,40 @@
+"""Email tier: privacy-request letter from the removal mailbox (via engine.outbox).
+
+* dry run           -> DRAFT request (dry_run=True), never sent.
+* APPROVE_EACH      -> QUEUED_FOR_APPROVAL; state unchanged until the user approves.
+* AUTO              -> sent now; the runner marks the broker SUBMITTED.
+* no mailbox        -> falls back to a SEND_EMAIL_MANUALLY to-do (D2).
+"""
+from __future__ import annotations
+
+from ..interfaces import RunContext, Submitter
+from ..models import Listing, ListingState, RequestKind, RequestStatus, SubmitOutcome
+from . import assisted, base
+
+
+class EmailSubmitter(Submitter):
+    method = "email"
+
+    async def search(self, ctx: RunContext) -> list[Listing]:
+        return []          # email brokers are not searched; the letter names the person
+
+    async def submit(self, ctx: RunContext, listings: list[Listing]) -> SubmitOutcome:
+        from ..engine.outbox import compose, queue_email
+        kind: RequestKind = ctx.scratch.get("kind", RequestKind.OPT_OUT)
+        original = ctx.scratch.get("original")
+        use = base.confirmed(listings) or listings
+        if ctx.profile.mailbox is None:
+            subject, body = compose(ctx.profile, ctx.broker, use, ctx.state_law, kind,
+                                    original=original)
+            todo = assisted.manual_email_todo(ctx.profile, ctx.broker, subject, body)
+            return SubmitOutcome(new_state=ListingState.NEEDS_HUMAN, todos=[todo],
+                                 message="manual_email")
+        req = queue_email(ctx.store, ctx.profile, ctx.broker, use, kind=kind,
+                          state_law=ctx.state_law, dry_run=ctx.dry_run, mailer=ctx.mailer,
+                          original=original, now=ctx.now)
+        if req.status == RequestStatus.SENT:
+            new = (ListingState.AWAITING_VERIFICATION if ctx.broker.needs_email_verification
+                   else ListingState.SUBMITTED)
+            return SubmitOutcome(new_state=new, request=req, message="email_sent")
+        return SubmitOutcome(new_state=ListingState.FOUND, request=req,
+                             message="email_draft" if ctx.dry_run else "email_queued")

freemyid/submitters/web_form.py

@@ -0,0 +1,276 @@
+"""Automatic tier: data-driven search (`Broker.search`) and opt-out (`Broker.form`).
+
+No per-broker Python. Every request goes through BrowserManager (NetPolicy allowlist,
+honest UA, polite delays). A challenge page, an unexpected page or ANY error drops the
+broker to the Assisted tier (an ASSISTED_OPT_OUT to-do) instead of failing the run. In an
+interactive run a challenge is first handed to the person in a visible window
+(HumanHandoff); Free My ID never solves it.
+
+Page text is data: it is only matched against selectors / expected text, never obeyed.
+"""
+from __future__ import annotations
+
+import logging
+import re
+from typing import TYPE_CHECKING, Any
+from urllib.parse import quote, urljoin, urlsplit
+
+from jinja2 import StrictUndefined
+from jinja2.sandbox import SandboxedEnvironment
+
+from ..engine import matcher
+from ..engine.browser import BlockedByPolicy, ChallengeEncountered
+from ..interfaces import RunContext, Submitter
+from ..models import (
+    Broker,
+    EvidenceKind,
+    FormStep,
+    Listing,
+    ListingState,
+    Method,
+    Profile,
+    Request,
+    RequestKind,
+    RequestStatus,
+    SubmitOutcome,
+    Todo,
+    TodoKind,
+    utcnow,
+)
+from ..netpolicy import _host_ok
+from . import assisted, base
+
+if TYPE_CHECKING:
+    from playwright.async_api import Page
+
+    from ..engine.browser import BrowserManager
+
+log = logging.getLogger(__name__)
+
+_env = SandboxedEnvironment(undefined=StrictUndefined, autoescape=False)
+MAX_RESULTS = 25
+
+
+class UnexpectedPage(Exception):
+    """The page did not look like the registry said it would (PII-free label)."""
+
+
+class HumanStep(Exception):
+    """A `human` form step: a person has to do this part."""
+
+
+# --------------------------------------------------------------------------- search
+
+
+def _slug(s: str) -> str:
+    return quote(re.sub(r"\s+", "-", s.strip().lower()), safe="-")
+
+
+def search_url(broker: Broker, profile: Profile) -> str | None:
+    """Fill Broker.search_url_pattern. Phone only with allow_phone_disclosure."""
+    if not broker.search_url_pattern:
+        return None
+    cur = next((a for a in profile.addresses if a.current), profile.addresses[0])
+    vals: dict[str, str | None] = {
+        "first": profile.name.first, "last": profile.name.last,
+        "middle": profile.name.middle, "city": cur.city, "state": cur.state,
+        "state_name": matcher.STATE_NAMES.get(cur.state, cur.state), "zip": cur.zip,
+        "phone": matcher.digits(profile.phones[0])
+        if profile.phones and profile.permissions.allow_phone_disclosure else None,
+    }
+    import string
+    fields = {f for _, f, _, _ in string.Formatter().parse(broker.search_url_pattern) if f}
+    if any(not vals.get(f) for f in fields):
+        return None
+    url = broker.search_url_pattern.format(**{f: _slug(str(vals[f])) for f in fields})
+    return url if _host_ok(urlsplit(url).hostname or "", set(broker.domains)) else None
+
+
+async def _text(el: Any, sel: str | None) -> str | None:
+    if not sel:
+        return None
+    sub = await el.query_selector(sel)
+    if sub is None:
+        return None
+    t = (await sub.inner_text()).strip()
+    return t[:500] or None
+
+
+def _split(t: str | None) -> list[str]:
+    if not t:
+        return []
+    return [p.strip() for p in re.split(r"[\n;|]+", t) if p.strip()][:20]
+
+
+async def parse_results(page: Page, broker: Broker) -> list[matcher.Candidate]:
+    """Candidates from a results page using Broker.search selectors. Links off the broker's
+    domains are dropped."""
+    spec = broker.search
+    if spec is None or not spec.result_selector:
+        return []
+    out: list[matcher.Candidate] = []
+    for el in (await page.query_selector_all(spec.result_selector))[:MAX_RESULTS]:
+        href = None
+        if spec.link_selector:
+            a = await el.query_selector(spec.link_selector)
+            href = await a.get_attribute("href") if a else None
+        url = urljoin(page.url, href) if href else page.url
+        if not _host_ok(urlsplit(url).hostname or "", set(broker.domains)):
+            continue
+        name = await _text(el, spec.name_selector)
+        locs = _split(await _text(el, spec.location_selector))
+        out.append(matcher.Candidate(
+            url=url, name=name, age=matcher.parse_age(await _text(el, spec.age_selector)),
+            locations=locs, relatives=_split(await _text(el, spec.relatives_selector))))
+    return out
+
+
+async def search_listings(ctx: RunContext) -> list[Listing]:
+    """Search one broker with the browser; stores a page screenshot in ctx.scratch."""
+    bm: BrowserManager = ctx.scratch["browser"]
+    url = search_url(ctx.broker, ctx.profile)
+    if url is None:
+        raise UnexpectedPage("search_url_unavailable")
+    bctx = await bm.new_context(ctx.broker.domains)
+    try:
+        page = await bctx.new_page()
+        resp = await bm.goto(page, url)
+        if resp is not None and resp.status >= 400:
+            # an error page is not "no results": never record NOT_FOUND from it
+            raise UnexpectedPage(f"search_http_{resp.status}")
+        spec = ctx.broker.search
+        html = await page.content()
+        if spec and spec.no_results_text and spec.no_results_text.lower() in html.lower():
+            return []
+        cands = await parse_results(page, ctx.broker)
+        if not cands and spec and spec.no_results_text:
+            # neither results nor the site's "no results" text: the page changed
+            raise UnexpectedPage("search_page_unrecognized")
+        listings = matcher.score_all(ctx.profile, ctx.broker.id, cands,
+                                     (ctx.now or utcnow()).date())
+        if listings:
+            ctx.scratch["search_screenshot"] = await page.screenshot(full_page=True)
+        return listings
+    finally:
+        await bctx.close()
+
+
+# --------------------------------------------------------------------------- form
+
+
+def render_value(tpl: str | None, vars: dict) -> str:
+    return _env.from_string(tpl or "").render(**vars)
+
+
+async def run_steps(bm: BrowserManager, page: Page, steps: list[FormStep], vars: dict,
+                    shots: list[bytes]) -> None:
+    """Execute declarative steps. Raises ChallengeEncountered / UnexpectedPage / HumanStep."""
+    for st in steps:
+        a = st.action
+        if a == "human":
+            raise HumanStep(st.note or "human step")
+        if a == "goto":
+            await bm.goto(page, render_value(st.url, vars), timeout_ms=st.timeout_ms)
+            continue
+        sel = st.selector or ""
+        if a in ("fill", "select", "check", "click", "wait_for", "submit") and not sel:
+            raise UnexpectedPage(f"step_{a}_without_selector")
+        if a == "fill":
+            await page.fill(sel, render_value(st.value, vars), timeout=st.timeout_ms)
+        elif a == "select":
+            await page.select_option(sel, render_value(st.value, vars),
+                                     timeout=st.timeout_ms)
+        elif a == "check":
+            await page.check(sel, timeout=st.timeout_ms)
+        elif a == "wait_for":
+            await page.wait_for_selector(sel, timeout=st.timeout_ms)
+        elif a in ("click", "submit"):
+            await page.click(sel, timeout=st.timeout_ms)
+            await page.wait_for_load_state("domcontentloaded", timeout=st.timeout_ms)
+            bm.check_escaped(page)          # SEC-16: a submit may redirect off-list
+            await bm.raise_if_challenge(page)
+        elif a == "screenshot":
+            shots.append(await page.screenshot(full_page=True))
+        elif a == "expect_text":
+            want = render_value(st.value, vars)
+            if want.lower() not in (await page.inner_text("body")).lower():
+                raise UnexpectedPage("expected_text_missing")
+
+
+class WebFormSubmitter(Submitter):
+    method = "web_form"
+
+    async def search(self, ctx: RunContext) -> list[Listing]:
+        return await search_listings(ctx)
+
+    async def submit(self, ctx: RunContext, listings: list[Listing]) -> SubmitOutcome:
+        if ctx.dry_run:
+            raise RuntimeError("submit() must never be called in a dry run")
+        now = ctx.now or utcnow()
+        use = base.confirmed(listings)
+        uses_listing = any("listing" in (s.value or "") + (s.url or "") for s in ctx.broker.form)
+        if uses_listing and not use:
+            return self._fallback(ctx, listings, "no_confirmed_listing")
+        targets: list[Listing | None] = list(use) if uses_listing else [use[0] if use else None]
+        req = Request(profile_id=ctx.profile.id, broker_id=ctx.broker.id,
+                      kind=ctx.scratch.get("kind", RequestKind.OPT_OUT), method=Method.WEB_FORM,
+                      listing_ids=[li.id for li in use], created_at=now)
+        evs = []
+        try:
+            for li in targets:
+                shots = await self._fill_one(ctx, li)
+                for i, png in enumerate(shots):
+                    ev = base.evidence(ctx.profile.id, ctx.broker.id, EvidenceKind.SCREENSHOT,
+                                       "png", listing_id=li.id if li else None,
+                                       request_id=req.id,
+                                       caption="confirmation page" if i == len(shots) - 1
+                                       else "form step")
+                    evs.append(ctx.store.save_evidence(ev, png))
+        except ChallengeEncountered as e:
+            return self._fallback(ctx, listings, "challenge", detail=e.kind)
+        except HumanStep:
+            return self._fallback(ctx, listings, "human_step")
+        except (UnexpectedPage, BlockedByPolicy) as e:
+            return self._fallback(ctx, listings, "error", detail=type(e).__name__)
+        except Exception as e:  # noqa: BLE001 - any error drops to Assisted (D1)
+            return self._fallback(ctx, listings, "error", detail=type(e).__name__)
+        req = req.model_copy(update={"status": RequestStatus.SENT, "sent_at": now})
+        ctx.store.save_request(req)
+        new = (ListingState.AWAITING_VERIFICATION if ctx.broker.needs_email_verification
+               else ListingState.SUBMITTED)
+        return SubmitOutcome(new_state=new, request=req, evidence=evs, message="form_submitted")
+
+    async def _fill_one(self, ctx: RunContext, listing: Listing | None) -> list[bytes]:
+        bm: BrowserManager = ctx.scratch["browser"]
+        vars = base.form_vars(ctx.profile, ctx.broker, listing)
+        bctx = await bm.new_context(ctx.broker.domains)
+        shots: list[bytes] = []
+        try:
+            page = await bctx.new_page()
+            if ctx.broker.form[0].action != "goto" and ctx.broker.opt_out_url:
+                await bm.goto(page, str(ctx.broker.opt_out_url))
+            try:
+                await run_steps(bm, page, ctx.broker.form, vars, shots)
+            except ChallengeEncountered as e:
+                if not ctx.interactive:
+                    raise
+                todo = Todo(profile_id=ctx.profile.id, broker_id=ctx.broker.id,
+                            kind=TodoKind.CAPTCHA,
+                            title=f"{ctx.broker.name} wants a human check",
+                            body="Finish the check in the window that opened, then come back.",
+                            links=[page.url])
+                if not await ctx.handoff.request(todo, page):
+                    raise
+                await bm.raise_if_challenge(page)
+                del e
+            shots.append(await page.screenshot(full_page=True))
+            return shots
+        finally:
+            await bctx.close()
+
+    def _fallback(self, ctx: RunContext, listings: list[Listing], reason: str,
+                  detail: str | None = None) -> SubmitOutcome:
+        todo = assisted.todo_for(ctx.profile, ctx.broker, listings, ctx.state_law,
+                                 reason="challenge" if reason == "challenge" else "error")
+        msg = f"fallback_assisted:{reason}" + (f":{detail}" if detail else "")
+        return SubmitOutcome(new_state=ListingState.NEEDS_HUMAN, todos=[todo], message=msg)

freemyid/templates/_identity.txt.j2

@@ -0,0 +1,19 @@
+{# Shared identifying block. Only contains fields the listing already shows. #}
+Name: {{ name }}
+{% if city or state %}Location shown on your site: {{ [city, state] | select | join(", ") }}
+{% endif %}
+{% if age %}Approximate age shown: {{ age }}
+{% endif %}
+{% if street_address %}Street address shown: {{ street_address }}{% if zip %} {{ zip }}{% endif %}
+
+{% endif %}
+{% if phone %}Phone number shown: {{ phone }}
+{% endif %}
+{% if listing_urls %}
+Listing URL(s):
+{% for u in listing_urls %}
+  - {{ u }}
+{% endfor %}
+{% endif %}
+{% if mailbox %}Contact email for this request: {{ mailbox }}
+{% endif %}

freemyid/templates/_signature.txt.j2

@@ -0,0 +1,7 @@
+{% if is_agent and agent_name %}
+Submitted by {{ agent_name }} as authorized agent / guardian on behalf of {{ name }}.
+Proof of authorization is available on request.
+{% else %}
+Sincerely,
+{{ name }}
+{% endif %}

freemyid/templates/ccpa.txt.j2

@@ -0,0 +1,16 @@
+Subject: CCPA/CPRA request to delete and to opt out of sale/sharing
+To {{ broker_name or "the privacy team" }},
+
+I am a California resident. Under the {{ statute_name or "California Consumer Privacy Act, as amended by the CPRA" }}
+({{ citation or "Cal. Civ. Code §§ 1798.105, 1798.120" }}), I request that you:
+
+  1. Delete all personal information you hold about me (right to delete); and
+  2. Stop selling and sharing my personal information (right to opt out of sale/sharing).
+
+{% include "_identity.txt.j2" %}
+
+Please also direct any service providers and contractors to delete this information.
+You must respond within {{ response_days or 45 }} days of receiving this request.
+Please do not ask for more information than is needed to locate the records above.
+
+{% include "_signature.txt.j2" %}

freemyid/templates/follow_up.txt.j2

@@ -0,0 +1,15 @@
+Subject: Follow-up: deletion request{% if original_request_date %} of {{ original_request_date }}{% endif %}{% if reference %} (ref {{ reference }}){% endif %}
+
+To {{ broker_name or "the privacy team" }},
+
+On {{ original_request_date or "an earlier date" }} I asked you to remove my personal information.
+{% if response_deadline %}The response period ended on {{ response_deadline }}. {% endif %}My information still appears
+on your site, or I have not received confirmation that it was removed.
+
+{% include "_identity.txt.j2" %}
+
+{% if statute_name %}This request is made under the {{ statute_name }}{% if citation %} ({{ citation }}){% endif %}.
+{% endif %}
+Please complete the deletion and confirm in writing.
+
+{% include "_signature.txt.j2" %}

freemyid/templates/generic_removal.txt.j2

@@ -0,0 +1,12 @@
+Subject: Request to remove my personal information
+To {{ broker_name or "the privacy team" }},
+
+I am asking you to remove my personal information from your website and records, and to
+stop selling or sharing it. The record(s) concerned:
+
+{% include "_identity.txt.j2" %}
+
+Please delete these records, suppress them from future publication, and confirm by email
+when this is done.
+
+{% include "_signature.txt.j2" %}

freemyid/templates/legal_demand.txt.j2

@@ -0,0 +1,20 @@
+Subject: Formal demand: unanswered personal data deletion request{% if reference %} (ref {{ reference }}){% endif %}
+
+To {{ broker_name or "the privacy team" }} (legal / privacy officer),
+
+This is a formal demand. On {{ original_request_date or "an earlier date" }} I requested deletion of my personal
+information{% if statute_name %} under the {{ statute_name }}{% if citation %} ({{ citation }}){% endif %}{% endif %}.
+{% if response_deadline %}Your response was due by {{ response_deadline }}. {% endif %}I have also sent a follow-up.
+The information remains published or unconfirmed.
+
+{% include "_identity.txt.j2" %}
+
+Unless the deletion is completed and confirmed in writing within 15 days, I intend to file
+a complaint with the appropriate regulator{% if complaint_urls %}:
+{% for u in complaint_urls %}
+  - {{ u }}
+{% endfor %}
+{% else %}, including my state Attorney General.
+{% endif %}
+
+{% include "_signature.txt.j2" %}

freemyid/templates/phone_script.txt.j2

@@ -0,0 +1,25 @@
+Phone call script: {{ broker_name }}
+{% if broker_phone %}Number: {{ broker_phone }}
+{% endif %}
+
+1. "Hello, I'm calling to have my personal information removed from your records and
+   to opt out of the sale or sharing of my information."
+2. If asked for identifying details, give ONLY what their listing already shows:
+   - Name: {{ name }}
+{% if city or state %}   - Location: {{ [city, state] | select | join(", ") }}
+{% endif %}
+{% if age %}   - Approximate age: {{ age }}
+{% endif %}
+{% for u in listing_urls %}   - Listing: {{ u }}
+{% endfor %}
+{% if mailbox %}   - Email for confirmation: {{ mailbox }}
+{% endif %}
+3. Do NOT give your date of birth, Social Security number, payment details or relatives.
+{% if not phone %}   Do not give a phone number (phone disclosure is turned off for this person).
+{% endif %}
+4. Ask for a reference / ticket number and write it down: ________________
+5. Ask how long removal takes and note the date: ________________
+6. Never agree to pay. Removal requests are free.
+{% if statute_name %}
+If they refuse: "I'm making this request under the {{ statute_name }}{% if citation %}, {{ citation }}{% endif %}."
+{% endif %}

freemyid/templates/postal_letter.txt.j2

@@ -0,0 +1,20 @@
+{{ today }}
+
+{% if broker_postal %}{{ broker_postal }}
+{% else %}{{ broker_name }}
+Attn: Privacy / Opt-Out
+{% endif %}
+
+Re: Request to delete personal information and opt out of sale
+
+To {{ broker_name or "the privacy team" }},
+
+I am asking you to remove my personal information from your website and records, and to
+stop selling or sharing it. The record(s) concerned:
+
+{% include "_identity.txt.j2" %}
+
+Please delete these records, suppress them from future publication, and confirm in writing
+when this is done.
+
+{% include "_signature.txt.j2" %}

freemyid/templates/state_privacy.txt.j2

@@ -0,0 +1,17 @@
+Subject: Request to delete personal data{% if statute_name %} under the {{ statute_name }}{% endif %}
+
+To {{ broker_name or "the privacy team" }},
+
+I am a resident of {{ state_name or state or "the United States" }}.{% if statute_name %} Under the
+{{ statute_name }}{% if citation %} ({{ citation }}){% endif %}, I am exercising my right to have my personal data
+deleted and to opt out of its sale and use for targeted advertising.{% else %} I request that you
+delete my personal data and stop selling or sharing it.{% endif %}
+
+
+{% include "_identity.txt.j2" %}
+
+{% if response_days %}The law requires a response within {{ response_days }} days.
+{% endif %}
+Please confirm by email when the deletion is complete.
+
+{% include "_signature.txt.j2" %}