agent-cto/freno-dev
1
0
Fork 0
forked from Mike/freno-dev
Code Pull Requests Activity

faq: publish the eight objection entries; withdraw the false privacy answer

Browse Source 
Sponsor-approved on FRE-414 card 57e1d01e (faq-publish = approve,
2026-10-31T13:19:10Z), per the FRE-334 option A ruling: the eight /faq
entries from the objections draft (faq-draft rev c48396ea, CTO-verified
in FRE-329) ship, and the live privacy answer comes down in the same
commit - it says no prompt or code content leaves the device, which the
FRE-333 egress inventory and FRE-359 verdict B proved false at HEAD.

Same commit carries the /privacy replacement (privacy-page.patch, rev 4),
corrected against the FRE-333 inventory: the page no longer calls the
hardware UUID masked, discloses the relay registration a Weather panel
performs even with Phone off (licence key included on a licensed Mac),
/deactivate, and the one-time trial-email request.

positioning.md needs no change here: master's 2026-10-29 reconciliation
already withdrew rule 3 and the approved-claims privacy row; this branch
precedes it and the human merge brings the reconciled file in.

Suite: bun test on this tree - 458 pass / 3 skip / 53 fail / 2 errors,
failure set identical to clean master d44133f (environmental: rate
limiting, CSRF, IP handling, lineage redirect). No merge by any agent;
deploy waits on the push credential (FRE-414 card 5c0eb58e).
This commit is contained in:
Paperclip Agent
2026-10-31 13:41:55 +00:00
parent e46c0a2677
commit bb6cf27821
2 changed files with 145 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files

147
src/routes/nook/privacy.tsx
View File

@@ -1,9 +1,17 @@
/**
* The Nook privacy policy — `nook.freno.me/privacy`.
*
* Reflects the actual data The Nook sends when licensing: a masked hardware
* UUID + device name for trial/activation limits, the email used for purchase,
* and Stripe payment processing.
* Every statement on this page is traced to the egress inventory at
* `The-Nook` HEAD (FRE-333, `document-egress-inventory`): eleven internet
* destinations, file:line evidence per row. When the app's egress changes,
* this page changes in the same commit — not later.
*
* The crash-reporting paragraph below describes the build that ships today:
* Sentry starts unconditionally in `Sources/NookApp/main.swift:272-279`, with
* `sendDefaultPii = true`, and there is no off switch in Settings. If an
* opt-in setting ships, paragraph (b) is replaced by the shorter form held in
* `marketing/drafts/privacy-page.md` §"Contingency" in the same commit that
* makes it true.
*/
import { buildMainSiteUrl } from "~/lib/subdomain-url";
import { PageHead } from "~/components/PageHead";
@@ -21,39 +29,118 @@ export default function NookPrivacyPolicy() {
<SubdomainHeader />
<div class="min-h-screen px-[8vw] py-[10vh]">
<div class="py-4 text-xl">The Nook&apos;s Privacy Policy</div>
<div class="py-2">Last Updated: August 26, 2026</div>
<div class="py-2">Last Updated: October 29, 2026</div>
<div class="py-2">
Welcome to The Nook (&apos;We&apos;, &apos;Us&apos;, &apos;Our&apos;).
Your privacy is important to us. This policy explains what we collect,
why, and how it is handled. The app itself runs locally on your device
and sends only the minimal data required for trial and licensing.
The Nook runs on your Mac. Your prompts, your code and your agent
sessions are processed on your device. This page lists every
connection the app makes over the network, what each one sends, and
whether you can turn it off.
</div>
<ol>
<div class="py-2">
<div class="pb-2 text-lg">
<span class="-ml-4 pr-2">1.</span> Data We Collect
<span class="-ml-4 pr-2">1.</span> What leaves your Mac
</div>
<div class="pl-4">
<div class="pb-2">
<div class="-ml-6">(a) Device hardware UUID:</div> When you start
a trial or activate a license, The Nook sends a hardware UUID
from your Mac. It is used solely to enforce the 14-day trial and
the 3-device activation limit, and to prevent resetting the
trial by reinstalling the app.
<div class="-ml-6">(a) Licensing and trial:</div> When you start
a trial or activate a license, The Nook sends your Mac&apos;s
hardware UUID and device name to our licensing server
(freno.me). The UUID enforces the 14-day trial and the 3-device
activation limit and stops a trial being reset by reinstalling
the app; the device name is so you can recognize the Mac among
your activations. While you are on the trial, this is sent at
each launch. Once you are licensed, each launch re-checks only
that your key has not been revoked. Deactivating a Mac sends the
license key and that Mac&apos;s UUID. If you add an email during
the trial, that request carries the email and the UUID, and it
is sent once. All of these calls fail open: with no connection,
the app keeps working, because license verification itself is
offline.
</div>
<div class="pb-2">
<div class="-ml-6">(b) Device name:</div> The Nook sends your
Mac&apos;s name so you can recognize the device in your license
activations. It is not used for any other purpose.
<div class="-ml-6">(b) Crash and error reporting:</div> Crash
reports, error events, hang reports and performance traces are
sent to Sentry, our crash-reporting processor, and this is on
for every launch in this version — there is no setting that
turns it off. Each report carries the app version, the macOS
version, the Mac model and what the app was doing when it
failed, and Sentry also receives your IP address and your macOS
username. Reports never include your prompts, your code or your
session content.
</div>
<div class="pb-2">
<div class="-ml-6">(c) Email:</div> The email you provide at
checkout is used to deliver your license key and to look up your
order.
<div class="-ml-6">(c) Phone connection:</div> The phone
connection ships off and is yours to enable. When you turn it
on, your Mac registers with our relay (nook-relay.freno.me)
using a random install ID, and a licensed Mac presents its
license key once at registration. Everything your Mac and your
phone then exchange — session updates, approvals, replies — is
encrypted end-to-end: the relay routes it and cannot read it.
The relay can see which devices are connected, when, and how
much traffic they exchange.
</div>
<div class="pb-2">
<div class="-ml-6">(d) Payment:</div> Payments are processed by
Stripe. We never see or store your card details.
<div class="-ml-6">(d) Weather:</div> If you add the Weather
module, your Mac asks our relay for forecasts using coordinates
rounded to a 0.1° grid — about 11 km — and the rounding happens
on your Mac before anything is sent. The Weather module
registers with the relay for this even if you never turn on the
phone connection, and on a licensed Mac that registration
presents the license key, exactly as the phone connection&apos;s
does. &quot;My Location&quot; asks macOS for your
approximate position, and naming or searching for a place uses
Apple&apos;s Maps service, so Apple sees those lookups. Neither
feature sends us your precise location.
</div>
<div class="pb-2">
<div class="-ml-6">(e) The Network panel:</div> While the
Network panel&apos;s connection section is on screen, The Nook
asks a third-party IP-lookup service (get.geojs.io, with
ipwho.is as backup) what your public IP address and provider
are — that is how the panel can show them to you. Those services
necessarily see your IP address. The speed-test button measures
against Cloudflare&apos;s public speed endpoint and uploads only
zeros, never your data.
</div>
<div class="pb-2">
<div class="-ml-6">(f) Update checks:</div> Automatic update
checks ship off. If you turn them on, or press &quot;Check for
Updates&quot;, The Nook fetches the update feed from freno.me
and the request carries your app version. Like every request on
this page, it also arrives from your IP address.
</div>
<div class="pb-2">
<div class="-ml-6">(g) Changelog:</div> Opening Settings ›
Changelog fetches the release notes from freno.me.
</div>
<div class="pb-2">
<div class="-ml-6">(h) Bug reports:</div> only what you choose
to send. If you write a bug report, you decide what it says.
Bug reports also include a machine snapshot — macOS version, Mac
model, CPU, memory, free disk, locale, and your displays&apos;
names and resolutions — so the problem can be reproduced. The
optional contact email is used only to reply to you.
</div>
<div class="pb-2">
<div class="-ml-6">(i) Your email and payment:</div> The email
you give at checkout delivers your license key and looks up your
order. An email you add during the trial is used for one
reminder before the trial ends. Payments are processed by
Stripe; we never see or store your card details.
</div>
<div class="pb-2">
<div class="-ml-6">(j) What does not leave your Mac:</div> The
hook and the bridge that connect your agents to The Nook talk to
nothing but your Mac — the hook dials the local bridge socket,
and the bridge only listens. Two paths carry agent data across
the network, and both are switched on by you: if you add a
remote machine, the hook on that machine dials this Mac over
SSH; and if you use the phone connection, the session updates,
approvals and replies described in (c) travel through the relay,
sealed end to end.
The privileged helper that controls fans and charging has no
networking code at all.
</div>
</div>
</div>
@@ -63,9 +150,11 @@ export default function NookPrivacyPolicy() {
<span class="-ml-4 pr-2">2.</span> How We Use It
</div>
<div class="pb-2 pl-4">
Device identifiers, your email, and license records are used only
to operate the trial, deliver purchases, and enforce the 3-device
license. We do not use them for advertising or sell them to anyone.
Device identifiers, install IDs, your email and license records are
used only to operate the trial and the licenses, to run the relay
and the weather service, to answer bug reports, and to deliver
purchases. We do not use them for advertising and we do not sell
them to anyone.
</div>
</div>
@@ -74,9 +163,11 @@ export default function NookPrivacyPolicy() {
<span class="-ml-4 pr-2">3.</span> Data Security
</div>
<div class="pb-2 pl-4">
License keys are signed and verified with Ed25519. The connection
to our servers uses TLS. Your license key is stored in the macOS
Keychain on your Mac.
License keys are signed and verified with Ed25519 and stored in
the macOS Keychain. Phone traffic is encrypted end-to-end with
keys your own devices generate at pairing; our relay holds no key
that can read it. Every connection described on this page uses
TLS.
</div>
</div>