diff --git a/marketing/drafts/privacy-page.md b/marketing/drafts/privacy-page.md new file mode 100644 index 0000000..88f7b79 --- /dev/null +++ b/marketing/drafts/privacy-page.md @@ -0,0 +1,58 @@ +# `/privacy` — replacement copy, prepared and not applied + +**Status:** patch ready for review. The page file is unchanged; nothing here is published. +**Patch:** `marketing/drafts/privacy-page.patch` — applies cleanly to `c1c498e` and later (`git apply --check`, verified 2026-10-29). +**Evidence base:** [FRE-333 `egress-inventory`](/FRE/issues/FRE-333#document-egress-inventory) rev 1, eleven destinations, file:line per row, read at `The-Nook` `3c3ba7ee`. +**Why this exists:** [FRE-326](/FRE/issues/FRE-326) + [FRE-334](/FRE/issues/FRE-334#document-decision) recorded option A — the privacy claim is withdrawn everywhere, and no privacy claim returns until the inventory exists, `/privacy` matches it, the CTO verifies both, and the sponsor approves the replacement copy. The inventory landed. This is the page half that nobody had written. + +| Field | Value | +|---|---| +| Claim this page carries | None. It is a disclosure page, not a claim: it states what the app sends and what it does not. The one favourable sentence is (j), which is the CTO's FRE-322 §2 code fact. | +| Audience | Someone deciding whether to pay $10 for a tool that reads their prompts. They read this page *before* the FAQ. | +| Channel | `nook.freno.me/privacy`, one page | +| Owner | CMO (copy), Chief of Staff (publish switch), CTO (verification), sponsor (approval of replacement copy) | +| Date | Prepared 2026-10-29. Target apply **2026-11-03**, in the same push as `c1c498e` (FRE-323) and the FRE-326 page patch. Not a public date. | +| What has to be true before it ships | 1) CTO signs the page against `The-Nook` HEAD, paragraph by paragraph. 2) Sponsor/CoS accepts the replacement copy (the FRE-326 publish card is the natural home). 3) The Sentry paragraph matches the build being deployed — see *Contingency*. 4) It deploys in the same push as the FAQ withdrawal; a page that discloses Sentry next to a FAQ that says "anonymous usage telemetry" is worse than either alone. | + +## What changed against the live page + +The live page (fetched 2026-10-29T09:2xZ, HTTP 200) says the app "runs locally on your device and sends only the minimal data required for trial and licensing" and lists four things. Against the inventory that is wrong in two directions: it **omits** Sentry (crash reports with IP address and macOS username, every launch, no off switch), the relay and its install ID, the licence key crossing to the relay, sealed phone payloads, weather coordinates going to the relay *and* to Apple, the GeoIP third parties, the speed test, the changelog fetch, bug-report contents and update checks. It also calls the hardware UUID "masked", which the code contradicts — it sends the raw `IOPlatformUUID`. + +The replacement is organised by *connection*, not by *data type*, because that is how a reader checks it: eleven rows in the inventory, ten of them reachable from the page, one (Sentry) prominent because it is the only one with no off switch. + +## Paragraph-level evidence + +| Paragraph | What it now says | Evidence at `3c3ba7ee` | +|---|---|---| +| (a) Licensing/trial | raw UUID + device name; every launch while trialing; key-only once licensed; fails open | `LicenseService.swift:316-325` (`/trial`), `:277-290` (`/status`), `:247-262` (`/activate`) | +| (b) Crash reporting | on for every launch, **no off switch**; carries IP + macOS username; never prompts or code | `Sources/NookApp/main.swift:272-279` — `sendDefaultPii = true`, `tracesSampleRate = 1.0`, no preference gates it | +| (c) Phone relay | off by default; install ID + license key at registration; sealed payloads; relay sees devices/timing/volume, not content | `SidecarRelayAPI.swift:150-160`, `docs/sidecar-frames.md` (sealing), inventory §B | +| (d) Weather | 0.1° grid snapped **on the Mac**; registers with the relay even with the phone off; Apple sees place lookups and position | `WeatherForecast.swift:25-30`, `SidecarController.swift:269-279`, `WeatherLocation.swift:14-77`, `:89-143` | +| (e) Network panel | third-party IP lookup sees your IP; speed test uploads zeros only | `NetworkInfoService.swift:82,276`, `SpeedTest.swift:10-11,36` | +| (f) Update checks | ship **off**; turning them on fetches `freno.me`, app version + IP | `UpdateManager.swift:48-55` (`automaticallyChecksForUpdates = false`, default key false) | +| (g) Changelog | fetches release notes from `freno.me` | `ChangelogRelease.swift:75-78` | +| (h) Bug reports | user-sent only; machine snapshot listed in full | `BugReportClient.swift:44-94`, `BugReportSnapshot.swift:17-36` | +| (i) Email/payment | unchanged in substance; Stripe | — | +| (j) What does not leave your Mac | hook dials the local socket, bridge only listens, helper has no networking; remote host is the stated exception | `hook/transport.go:143` (`resolveBridge`), `BridgeBindPlan.swift:9-23`, inventory: no `net/http` in `hook/`, no networking in `helper/` | + +Two facts the inventory corrected and the page does not repeat wrongly: Sparkle's automatic checks are **off by default** here (`UpdateManager` owns the schedule; FRE-322 §2.4 said "on by default" and is stale on this row), and the UUID is **raw, not masked**. + +## Contingency — the Sentry paragraph is the only one that moves + +Paragraph (b) as committed describes today's build. The inventory's recommendation (E.1) is an opt-in setting, default off, on Mac and iOS. If that ships, (b) is replaced in the same commit that changes the behaviour: + +> **(b) Crash and error reporting — off unless you turn it on.** If you enable crash reporting in Settings, The Nook sends crash and error reports to Sentry, our crash-reporting processor. Reports include the app version, macOS version, Mac model and what the app was doing when it failed, and Sentry also receives your IP address. They never include your prompts or code. + +**Sequence call, and why it is escalated rather than decided here:** shipping (b)-with-no-off-switch is honest and would not be the first time this page told the truth about a weakness — but it puts "no off switch" in front of a buyer during launch week. The better order is the build change first, then this page. That is a priority call for the Chief of Staff and the sponsor ([FRE-334](/FRE/issues/FRE-334#document-decision) keeps the decision), so this patch carries the truthful-today text and the swap is one paragraph. Publishing the truthful-today version is never blocked by that choice; the *preferred* order is. + +## If the CTO declines paragraph (j) + +(j) is the only favourable sentence on the page and the only one carrying a CTO verdict rather than an inventory row. It is [FRE-322 §2](/FRE/issues/FRE-322#document-verdict) — *"verified as a code fact, not publishable yet… publishing it before the disclosure work lands would put a true sentence next to false ones."* The disclosure work is this page. If the CTO still declines it, delete the whole (j) block; nothing else on the page depends on it, and the page stays complete and true. + +## Rules this page obeys + +- No competitor named (category nouns only, and none needed here). +- No claim without a row in the inventory. Where the inventory has no row, the page says nothing. +- No roadmap promise: the page never says a feature or fix is "coming", so the Sentry paragraph does not promise an off switch. +- No price, no discount, no date, no launch language. +- It is a correction of an existing page, not new marketing; nothing was added to sell anything. diff --git a/marketing/drafts/privacy-page.patch b/marketing/drafts/privacy-page.patch new file mode 100644 index 0000000..c2eb0fc --- /dev/null +++ b/marketing/drafts/privacy-page.patch @@ -0,0 +1,184 @@ +diff --git a/src/routes/nook/privacy.tsx b/src/routes/nook/privacy.tsx +index da0cc1d..6a0acc0 100644 +--- a/src/routes/nook/privacy.tsx ++++ b/src/routes/nook/privacy.tsx +@@ -1,9 +1,17 @@ + /** + * The Nook privacy policy — `nook.freno.me/privacy`. + * +- * Reflects the actual data The Nook sends when licensing: a masked hardware +- * UUID + device name for trial/activation limits, the email used for purchase, +- * and Stripe payment processing. ++ * Every statement on this page is traced to the egress inventory at ++ * `The-Nook` HEAD (FRE-333, `document-egress-inventory`): eleven internet ++ * destinations, file:line evidence per row. When the app's egress changes, ++ * this page changes in the same commit — not later. ++ * ++ * The crash-reporting paragraph below describes the build that ships today: ++ * Sentry starts unconditionally in `Sources/NookApp/main.swift:272-279`, with ++ * `sendDefaultPii = true`, and there is no off switch in Settings. If an ++ * opt-in setting ships, paragraph (b) is replaced by the shorter form held in ++ * `marketing/drafts/privacy-page.md` §"Contingency" in the same commit that ++ * makes it true. + */ + import { buildMainSiteUrl } from "~/lib/subdomain-url"; + import { PageHead } from "~/components/PageHead"; +@@ -21,39 +29,109 @@ export default function NookPrivacyPolicy() { + +
+
The Nook's Privacy Policy
+-
Last Updated: August 26, 2026
++
Last Updated: October 29, 2026
+
+- Welcome to The Nook ('We', 'Us', 'Our'). +- Your privacy is important to us. This policy explains what we collect, +- why, and how it is handled. The app itself runs locally on your device +- and sends only the minimal data required for trial and licensing. ++ The Nook runs on your Mac. Your prompts, your code and your agent ++ sessions are processed on your device. This page lists every ++ connection the app makes over the network, what each one sends, and ++ whether you can turn it off. +
+
    +
    +
    +- 1. Data We Collect ++ 1. What leaves your Mac +
    +
    +
    +-
    (a) Device hardware UUID:
    When you start +- a trial or activate a license, The Nook sends a hardware UUID +- from your Mac. It is used solely to enforce the 14-day trial and +- the 3-device activation limit, and to prevent resetting the +- trial by reinstalling the app. ++
    (a) Licensing and trial:
    When you start ++ a trial or activate a license, The Nook sends your Mac's ++ hardware UUID and device name to our licensing server ++ (freno.me). The UUID enforces the 14-day trial and the 3-device ++ activation limit and stops a trial being reset by reinstalling ++ the app; the device name is so you can recognize the Mac among ++ your activations. While you are on the trial, this is sent at ++ each launch. Once you are licensed, each launch re-checks only ++ that your key has not been revoked. These calls fail open: with ++ no connection, the app keeps working, because license ++ verification itself is offline. ++
    ++
    ++
    (b) Crash and error reporting:
    Crash ++ reports, error events, hang reports and performance traces are ++ sent to Sentry, our crash-reporting processor, and this is on ++ for every launch in this version — there is no setting that ++ turns it off. Each report carries the app version, the macOS ++ version, the Mac model and what the app was doing when it ++ failed, and Sentry also receives your IP address and your macOS ++ username. Reports never include your prompts, your code or your ++ session content. ++
    ++
    ++
    (c) Phone connection:
    The phone ++ connection ships off and is yours to enable. When you turn it ++ on, your Mac registers with our relay (nook-relay.freno.me) ++ using a random install ID, and a licensed Mac presents its ++ license key once at registration. Everything your Mac and your ++ phone then exchange — session updates, approvals, replies — is ++ encrypted end-to-end: the relay routes it and cannot read it. ++ The relay can see which devices are connected, when, and how ++ much traffic they exchange. ++
    ++
    ++
    (d) Weather:
    If you add the Weather ++ module, your Mac asks our relay for forecasts using coordinates ++ rounded to a 0.1° grid — about 11 km — and the rounding happens ++ on your Mac before anything is sent. The Weather module ++ registers with the relay for this even if you never turn on the ++ phone connection. "My Location" asks macOS for your ++ approximate position, and naming or searching for a place uses ++ Apple's Maps service, so Apple sees those lookups. Neither ++ feature sends us your precise location. ++
    ++
    ++
    (e) The Network panel:
    While the ++ Network panel's connection section is on screen, The Nook ++ asks a third-party IP-lookup service (get.geojs.io, with ++ ipwho.is as backup) what your public IP address and provider ++ are — that is how the panel can show them to you. Those services ++ necessarily see your IP address. The speed-test button measures ++ against Cloudflare's public speed endpoint and uploads only ++ zeros, never your data. ++
    ++
    ++
    (f) Update checks:
    Automatic update ++ checks ship off. If you turn them on, or press "Check for ++ Updates", The Nook fetches the update feed from freno.me ++ and the request carries your app version. Like every request on ++ this page, it also arrives from your IP address. ++
    ++
    ++
    (g) Changelog:
    Opening Settings › ++ Changelog fetches the release notes from freno.me. +
    +
    +-
    (b) Device name:
    The Nook sends your +- Mac's name so you can recognize the device in your license +- activations. It is not used for any other purpose. ++
    (h) Bug reports:
    only what you choose ++ to send. If you write a bug report, you decide what it says. ++ Bug reports also include a machine snapshot — macOS version, Mac ++ model, CPU, memory, free disk, locale, and your displays' ++ names and resolutions — so the problem can be reproduced. The ++ optional contact email is used only to reply to you. +
    +
    +-
    (c) Email:
    The email you provide at +- checkout is used to deliver your license key and to look up your +- order. ++
    (i) Your email and payment:
    The email ++ you give at trial start or checkout delivers your license key ++ and looks up your order. Payments are processed by Stripe; we ++ never see or store your card details. +
    +
    +-
    (d) Payment:
    Payments are processed by +- Stripe. We never see or store your card details. ++
    (j) What does not leave your Mac:
    The ++ hook and the bridge that connect your agents to The Nook talk to ++ nothing but your Mac — the hook dials the local bridge socket, ++ and the bridge only listens. The exception is deliberate and ++ yours: if you add a remote machine, the hook on that machine ++ dials this Mac, and that is the one case where agent traffic ++ crosses the network. The privileged helper that controls fans ++ and charging has no networking code at all. +
    +
    +
    +@@ -63,9 +141,11 @@ export default function NookPrivacyPolicy() { + 2. How We Use It +
+
+- Device identifiers, your email, and license records are used only +- to operate the trial, deliver purchases, and enforce the 3-device +- license. We do not use them for advertising or sell them to anyone. ++ Device identifiers, install IDs, your email and license records are ++ used only to operate the trial and the licenses, to run the relay ++ and the weather service, to answer bug reports, and to deliver ++ purchases. We do not use them for advertising and we do not sell ++ them to anyone. +
+ + +@@ -74,9 +154,11 @@ export default function NookPrivacyPolicy() { + 3. Data Security + +
+- License keys are signed and verified with Ed25519. The connection +- to our servers uses TLS. Your license key is stored in the macOS +- Keychain on your Mac. ++ License keys are signed and verified with Ed25519 and stored in ++ the macOS Keychain. Phone traffic is encrypted end-to-end with ++ keys your own devices generate at pairing; our relay holds no key ++ that can read it. Every connection described on this page uses ++ TLS. +
+ +