2c917e63e8
The live page says the app 'sends only the minimal data required for trial
and licensing' and calls the hardware UUID masked. Against the FRE-333 egress
inventory that is wrong in two directions: it omits Sentry (every launch,
sendDefaultPii = true, no off switch), the relay and its install ID, the
licence key crossing to the relay, sealed phone payloads, weather to the relay
and to Apple, the GeoIP lookups, the speed test, the changelog fetch,
bug-report contents and update checks; and the UUID it sends is raw.
Reorganised by connection, ten reachable rows from the inventory, one
favourable sentence (the FRE-322 §2 hook/bridge fact) that the CTO may still
decline. Sentry paragraph describes today's build with the opt-in swap held in
the rationale file. Page file untouched; the patch applies cleanly to c1c498e.
7.3 KiB
/privacy — replacement copy, prepared and not applied
Status: patch ready for review. The page file is unchanged; nothing here is published.
Patch: marketing/drafts/privacy-page.patch — applies cleanly to c1c498e and later (git apply --check, verified 2026-10-29).
Evidence base: FRE-333 egress-inventory rev 1, eleven destinations, file:line per row, read at The-Nook 3c3ba7ee.
Why this exists: FRE-326 + FRE-334 recorded option A — the privacy claim is withdrawn everywhere, and no privacy claim returns until the inventory exists, /privacy matches it, the CTO verifies both, and the sponsor approves the replacement copy. The inventory landed. This is the page half that nobody had written.
| Field | Value |
|---|---|
| Claim this page carries | None. It is a disclosure page, not a claim: it states what the app sends and what it does not. The one favourable sentence is (j), which is the CTO's FRE-322 §2 code fact. |
| Audience | Someone deciding whether to pay $10 for a tool that reads their prompts. They read this page before the FAQ. |
| Channel | nook.freno.me/privacy, one page |
| Owner | CMO (copy), Chief of Staff (publish switch), CTO (verification), sponsor (approval of replacement copy) |
| Date | Prepared 2026-10-29. Target apply 2026-11-03, in the same push as c1c498e (FRE-323) and the FRE-326 page patch. Not a public date. |
| What has to be true before it ships | 1) CTO signs the page against The-Nook HEAD, paragraph by paragraph. 2) Sponsor/CoS accepts the replacement copy (the FRE-326 publish card is the natural home). 3) The Sentry paragraph matches the build being deployed — see Contingency. 4) It deploys in the same push as the FAQ withdrawal; a page that discloses Sentry next to a FAQ that says "anonymous usage telemetry" is worse than either alone. |
What changed against the live page
The live page (fetched 2026-10-29T09:2xZ, HTTP 200) says the app "runs locally on your device and sends only the minimal data required for trial and licensing" and lists four things. Against the inventory that is wrong in two directions: it omits Sentry (crash reports with IP address and macOS username, every launch, no off switch), the relay and its install ID, the licence key crossing to the relay, sealed phone payloads, weather coordinates going to the relay and to Apple, the GeoIP third parties, the speed test, the changelog fetch, bug-report contents and update checks. It also calls the hardware UUID "masked", which the code contradicts — it sends the raw IOPlatformUUID.
The replacement is organised by connection, not by data type, because that is how a reader checks it: eleven rows in the inventory, ten of them reachable from the page, one (Sentry) prominent because it is the only one with no off switch.
Paragraph-level evidence
| Paragraph | What it now says | Evidence at 3c3ba7ee |
|---|---|---|
| (a) Licensing/trial | raw UUID + device name; every launch while trialing; key-only once licensed; fails open | LicenseService.swift:316-325 (/trial), :277-290 (/status), :247-262 (/activate) |
| (b) Crash reporting | on for every launch, no off switch; carries IP + macOS username; never prompts or code | Sources/NookApp/main.swift:272-279 — sendDefaultPii = true, tracesSampleRate = 1.0, no preference gates it |
| (c) Phone relay | off by default; install ID + license key at registration; sealed payloads; relay sees devices/timing/volume, not content | SidecarRelayAPI.swift:150-160, docs/sidecar-frames.md (sealing), inventory §B |
| (d) Weather | 0.1° grid snapped on the Mac; registers with the relay even with the phone off; Apple sees place lookups and position | WeatherForecast.swift:25-30, SidecarController.swift:269-279, WeatherLocation.swift:14-77, :89-143 |
| (e) Network panel | third-party IP lookup sees your IP; speed test uploads zeros only | NetworkInfoService.swift:82,276, SpeedTest.swift:10-11,36 |
| (f) Update checks | ship off; turning them on fetches freno.me, app version + IP |
UpdateManager.swift:48-55 (automaticallyChecksForUpdates = false, default key false) |
| (g) Changelog | fetches release notes from freno.me |
ChangelogRelease.swift:75-78 |
| (h) Bug reports | user-sent only; machine snapshot listed in full | BugReportClient.swift:44-94, BugReportSnapshot.swift:17-36 |
| (i) Email/payment | unchanged in substance; Stripe | — |
| (j) What does not leave your Mac | hook dials the local socket, bridge only listens, helper has no networking; remote host is the stated exception | hook/transport.go:143 (resolveBridge), BridgeBindPlan.swift:9-23, inventory: no net/http in hook/, no networking in helper/ |
Two facts the inventory corrected and the page does not repeat wrongly: Sparkle's automatic checks are off by default here (UpdateManager owns the schedule; FRE-322 §2.4 said "on by default" and is stale on this row), and the UUID is raw, not masked.
Contingency — the Sentry paragraph is the only one that moves
Paragraph (b) as committed describes today's build. The inventory's recommendation (E.1) is an opt-in setting, default off, on Mac and iOS. If that ships, (b) is replaced in the same commit that changes the behaviour:
(b) Crash and error reporting — off unless you turn it on. If you enable crash reporting in Settings, The Nook sends crash and error reports to Sentry, our crash-reporting processor. Reports include the app version, macOS version, Mac model and what the app was doing when it failed, and Sentry also receives your IP address. They never include your prompts or code.
Sequence call, and why it is escalated rather than decided here: shipping (b)-with-no-off-switch is honest and would not be the first time this page told the truth about a weakness — but it puts "no off switch" in front of a buyer during launch week. The better order is the build change first, then this page. That is a priority call for the Chief of Staff and the sponsor (FRE-334 keeps the decision), so this patch carries the truthful-today text and the swap is one paragraph. Publishing the truthful-today version is never blocked by that choice; the preferred order is.
If the CTO declines paragraph (j)
(j) is the only favourable sentence on the page and the only one carrying a CTO verdict rather than an inventory row. It is FRE-322 §2 — "verified as a code fact, not publishable yet… publishing it before the disclosure work lands would put a true sentence next to false ones." The disclosure work is this page. If the CTO still declines it, delete the whole (j) block; nothing else on the page depends on it, and the page stays complete and true.
Rules this page obeys
- No competitor named (category nouns only, and none needed here).
- No claim without a row in the inventory. Where the inventory has no row, the page says nothing.
- No roadmap promise: the page never says a feature or fix is "coming", so the Sentry paragraph does not promise an off switch.
- No price, no discount, no date, no launch language.
- It is a correction of an existing page, not new marketing; nothing was added to sell anything.