wtclaude
d6d5a70ed4
All checks were successful
PR checks / checks (pull_request) Successful in 2m33s
Play counts data that leaves the device as collected, whoever runs the server it lands on. The generated Data Safety notes answered "not collected" because we run no server, which is true of /privacy and the wrong answer to the form (org lead, 2026-10-29, Android PLAN.md M8). An audit of the app's edge (every body, query and header in data/api/) found more leaving the phone than section 2 listed. New rows: the User-Agent, game-account links and creation, the Contact form, staff posts and moderation, notification read state and preferences, search text. The sign-in and trusted-device rows now say what is sent (the credentials, the device's make and model). - PlayMapping: a list of console types, plus required and purposes, checked against PLAY_DATA_TYPES / PLAY_PURPOSES (the first version filed "Other user-generated content" under Messages). - The generator answers per data type, lists every type not collected, and answers the form's security questions. - The premise test now asserts what is still true: nothing is shared. - legal.lastUpdated moves to 2026-10-29 with /privacy. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
54 lines
2.6 KiB
JavaScript
54 lines
2.6 KiB
JavaScript
/**
|
|
* legal.mjs — the handful of values the legal pages and the signup form must agree on.
|
|
* PLAN.md §9, built in phase 6.
|
|
*
|
|
* ---------------------------------------------------------------------------------------
|
|
* WHY THESE THREE THINGS ARE HERE AND NOT IN THE PAGES
|
|
* ---------------------------------------------------------------------------------------
|
|
* Each is stated in more than one place and would be wrong in exactly one of them:
|
|
*
|
|
* `minimumAge` /terms says it, /privacy repeats it, the consent sentence beside the
|
|
* signup checkbox commits somebody to it, and the Play Data Safety notes
|
|
* answer a question about it. Four surfaces, one number (D31).
|
|
* `lastUpdated` A legal page with no date is a legal page nobody can reason about, and
|
|
* two pages with different dates invites the reader to work out which one
|
|
* is stale. They changed together; they say so together.
|
|
* `licence` Quoted on /terms and in the footer.
|
|
*
|
|
* The contact address is deliberately NOT here. It is a `brand.json` field read through
|
|
* `src/lib/brand.mjs` (D13), so that changing the published address stays a file copy on a
|
|
* mount rather than an edit to the source — and `checkFacts.mjs` fails the build if one is
|
|
* typed into any file under `src/`.
|
|
*/
|
|
|
|
export const legal = {
|
|
/**
|
|
* The date the legal pages last changed, in the format they render it.
|
|
*
|
|
* Bump it in the same commit that changes what either page says. It is not generated
|
|
* from git: a build timestamp would move on every rebuild and tell a reader nothing,
|
|
* and a commit date would move when a stylesheet changed.
|
|
*/
|
|
lastUpdated: '2026-10-29',
|
|
|
|
/**
|
|
* The minimum age to sign up for the beta. The org lead's decision, 2026-08-24 (D31).
|
|
*
|
|
* Eighteen, chosen over thirteen and sixteen: it is above the children's-consent
|
|
* threshold in every EEA state, so consent works as a basis with no parental-consent
|
|
* machinery — which this form has no way to obtain and no way to verify. It is the
|
|
* simplest thing to state truthfully for a beta that needs twelve people.
|
|
*
|
|
* A number rather than a sentence because four surfaces render it. What the site can
|
|
* actually enforce is a statement, not a check, and every one of those surfaces is
|
|
* written to say so plainly rather than implying verification that does not happen.
|
|
*/
|
|
minimumAge: 18,
|
|
|
|
/** The licence, quoted on /terms and in the footer. */
|
|
licence: {
|
|
id: 'GPL-3.0-or-later',
|
|
url: 'https://www.gnu.org/licenses/gpl-3.0.html',
|
|
},
|
|
};
|