forked from Mike/freno-dev
e46c0a2677
FRE-333's egress inventory landed after this patch was first written, and its own §G proposed a page text. This is that text corrected against the inventory it cites, six differences, each forced by a row: - the opening no longer says prompts are "never sent to us" (sealed frames transit our relay; a remote machine carries them by design) - (d) Weather states that it registers with the relay even with Phone off, and that a licensed Mac presents its license key there - SidecarController.weather() goes through the same relayCredential(licenseKey:) as the phone path - (a) adds /deactivate (key + UUID) and the trial email (email + UUID, once) - (i) stops saying a trial email delivers a license key; it is one reminder before the trial ends, the key is issued at checkout - (b) keeps today's build (on every launch, no off switch, IP + macOS username); the opt-in form is the Contingency swap, so the page is true on the build it deploys with - (j) carries the CTO's FRE-322 §2 code fact, with the remote-machine exception; he may still cut it Page file untouched, nothing published. Patch re-checked with git apply --check and parse-checked with esbuild; the site's own suite is `bun test` and this host has no bun, so that stays an apply-time obligation. Verification is FRE-354; the Sentry opt-in is proposed as FRE-355.
194 lines
11 KiB
Diff
194 lines
11 KiB
Diff
diff --git a/src/routes/nook/privacy.tsx b/src/routes/nook/privacy.tsx
|
||
index da0cc1d..f357ded 100644
|
||
--- a/src/routes/nook/privacy.tsx
|
||
+++ b/src/routes/nook/privacy.tsx
|
||
@@ -1,9 +1,17 @@
|
||
/**
|
||
* The Nook privacy policy — `nook.freno.me/privacy`.
|
||
*
|
||
- * Reflects the actual data The Nook sends when licensing: a masked hardware
|
||
- * UUID + device name for trial/activation limits, the email used for purchase,
|
||
- * and Stripe payment processing.
|
||
+ * Every statement on this page is traced to the egress inventory at
|
||
+ * `The-Nook` HEAD (FRE-333, `document-egress-inventory`): eleven internet
|
||
+ * destinations, file:line evidence per row. When the app's egress changes,
|
||
+ * this page changes in the same commit — not later.
|
||
+ *
|
||
+ * The crash-reporting paragraph below describes the build that ships today:
|
||
+ * Sentry starts unconditionally in `Sources/NookApp/main.swift:272-279`, with
|
||
+ * `sendDefaultPii = true`, and there is no off switch in Settings. If an
|
||
+ * opt-in setting ships, paragraph (b) is replaced by the shorter form held in
|
||
+ * `marketing/drafts/privacy-page.md` §"Contingency" in the same commit that
|
||
+ * makes it true.
|
||
*/
|
||
import { buildMainSiteUrl } from "~/lib/subdomain-url";
|
||
import { PageHead } from "~/components/PageHead";
|
||
@@ -21,39 +29,118 @@ export default function NookPrivacyPolicy() {
|
||
<SubdomainHeader />
|
||
<div class="min-h-screen px-[8vw] py-[10vh]">
|
||
<div class="py-4 text-xl">The Nook's Privacy Policy</div>
|
||
- <div class="py-2">Last Updated: August 26, 2026</div>
|
||
+ <div class="py-2">Last Updated: October 29, 2026</div>
|
||
<div class="py-2">
|
||
- Welcome to The Nook ('We', 'Us', 'Our').
|
||
- Your privacy is important to us. This policy explains what we collect,
|
||
- why, and how it is handled. The app itself runs locally on your device
|
||
- and sends only the minimal data required for trial and licensing.
|
||
+ The Nook runs on your Mac. Your prompts, your code and your agent
|
||
+ sessions are processed on your device. This page lists every
|
||
+ connection the app makes over the network, what each one sends, and
|
||
+ whether you can turn it off.
|
||
</div>
|
||
<ol>
|
||
<div class="py-2">
|
||
<div class="pb-2 text-lg">
|
||
- <span class="-ml-4 pr-2">1.</span> Data We Collect
|
||
+ <span class="-ml-4 pr-2">1.</span> What leaves your Mac
|
||
</div>
|
||
<div class="pl-4">
|
||
<div class="pb-2">
|
||
- <div class="-ml-6">(a) Device hardware UUID:</div> When you start
|
||
- a trial or activate a license, The Nook sends a hardware UUID
|
||
- from your Mac. It is used solely to enforce the 14-day trial and
|
||
- the 3-device activation limit, and to prevent resetting the
|
||
- trial by reinstalling the app.
|
||
+ <div class="-ml-6">(a) Licensing and trial:</div> When you start
|
||
+ a trial or activate a license, The Nook sends your Mac's
|
||
+ hardware UUID and device name to our licensing server
|
||
+ (freno.me). The UUID enforces the 14-day trial and the 3-device
|
||
+ activation limit and stops a trial being reset by reinstalling
|
||
+ the app; the device name is so you can recognize the Mac among
|
||
+ your activations. While you are on the trial, this is sent at
|
||
+ each launch. Once you are licensed, each launch re-checks only
|
||
+ that your key has not been revoked. Deactivating a Mac sends the
|
||
+ license key and that Mac's UUID. If you add an email during
|
||
+ the trial, that request carries the email and the UUID, and it
|
||
+ is sent once. All of these calls fail open: with no connection,
|
||
+ the app keeps working, because license verification itself is
|
||
+ offline.
|
||
+ </div>
|
||
+ <div class="pb-2">
|
||
+ <div class="-ml-6">(b) Crash and error reporting:</div> Crash
|
||
+ reports, error events, hang reports and performance traces are
|
||
+ sent to Sentry, our crash-reporting processor, and this is on
|
||
+ for every launch in this version — there is no setting that
|
||
+ turns it off. Each report carries the app version, the macOS
|
||
+ version, the Mac model and what the app was doing when it
|
||
+ failed, and Sentry also receives your IP address and your macOS
|
||
+ username. Reports never include your prompts, your code or your
|
||
+ session content.
|
||
+ </div>
|
||
+ <div class="pb-2">
|
||
+ <div class="-ml-6">(c) Phone connection:</div> The phone
|
||
+ connection ships off and is yours to enable. When you turn it
|
||
+ on, your Mac registers with our relay (nook-relay.freno.me)
|
||
+ using a random install ID, and a licensed Mac presents its
|
||
+ license key once at registration. Everything your Mac and your
|
||
+ phone then exchange — session updates, approvals, replies — is
|
||
+ encrypted end-to-end: the relay routes it and cannot read it.
|
||
+ The relay can see which devices are connected, when, and how
|
||
+ much traffic they exchange.
|
||
+ </div>
|
||
+ <div class="pb-2">
|
||
+ <div class="-ml-6">(d) Weather:</div> If you add the Weather
|
||
+ module, your Mac asks our relay for forecasts using coordinates
|
||
+ rounded to a 0.1° grid — about 11 km — and the rounding happens
|
||
+ on your Mac before anything is sent. The Weather module
|
||
+ registers with the relay for this even if you never turn on the
|
||
+ phone connection, and on a licensed Mac that registration
|
||
+ presents the license key, exactly as the phone connection's
|
||
+ does. "My Location" asks macOS for your
|
||
+ approximate position, and naming or searching for a place uses
|
||
+ Apple's Maps service, so Apple sees those lookups. Neither
|
||
+ feature sends us your precise location.
|
||
+ </div>
|
||
+ <div class="pb-2">
|
||
+ <div class="-ml-6">(e) The Network panel:</div> While the
|
||
+ Network panel's connection section is on screen, The Nook
|
||
+ asks a third-party IP-lookup service (get.geojs.io, with
|
||
+ ipwho.is as backup) what your public IP address and provider
|
||
+ are — that is how the panel can show them to you. Those services
|
||
+ necessarily see your IP address. The speed-test button measures
|
||
+ against Cloudflare's public speed endpoint and uploads only
|
||
+ zeros, never your data.
|
||
+ </div>
|
||
+ <div class="pb-2">
|
||
+ <div class="-ml-6">(f) Update checks:</div> Automatic update
|
||
+ checks ship off. If you turn them on, or press "Check for
|
||
+ Updates", The Nook fetches the update feed from freno.me
|
||
+ and the request carries your app version. Like every request on
|
||
+ this page, it also arrives from your IP address.
|
||
+ </div>
|
||
+ <div class="pb-2">
|
||
+ <div class="-ml-6">(g) Changelog:</div> Opening Settings ›
|
||
+ Changelog fetches the release notes from freno.me.
|
||
</div>
|
||
<div class="pb-2">
|
||
- <div class="-ml-6">(b) Device name:</div> The Nook sends your
|
||
- Mac's name so you can recognize the device in your license
|
||
- activations. It is not used for any other purpose.
|
||
+ <div class="-ml-6">(h) Bug reports:</div> only what you choose
|
||
+ to send. If you write a bug report, you decide what it says.
|
||
+ Bug reports also include a machine snapshot — macOS version, Mac
|
||
+ model, CPU, memory, free disk, locale, and your displays'
|
||
+ names and resolutions — so the problem can be reproduced. The
|
||
+ optional contact email is used only to reply to you.
|
||
</div>
|
||
<div class="pb-2">
|
||
- <div class="-ml-6">(c) Email:</div> The email you provide at
|
||
- checkout is used to deliver your license key and to look up your
|
||
- order.
|
||
+ <div class="-ml-6">(i) Your email and payment:</div> The email
|
||
+ you give at checkout delivers your license key and looks up your
|
||
+ order. An email you add during the trial is used for one
|
||
+ reminder before the trial ends. Payments are processed by
|
||
+ Stripe; we never see or store your card details.
|
||
</div>
|
||
<div class="pb-2">
|
||
- <div class="-ml-6">(d) Payment:</div> Payments are processed by
|
||
- Stripe. We never see or store your card details.
|
||
+ <div class="-ml-6">(j) What does not leave your Mac:</div> The
|
||
+ hook and the bridge that connect your agents to The Nook talk to
|
||
+ nothing but your Mac — the hook dials the local bridge socket,
|
||
+ and the bridge only listens. Two paths carry agent data across
|
||
+ the network, and both are switched on by you: if you add a
|
||
+ remote machine, the hook on that machine dials this Mac over
|
||
+ SSH; and if you use the phone connection, the session updates,
|
||
+ approvals and replies described in (c) travel through the relay,
|
||
+ sealed end to end.
|
||
+ The privileged helper that controls fans and charging has no
|
||
+ networking code at all.
|
||
</div>
|
||
</div>
|
||
</div>
|
||
@@ -63,9 +150,11 @@ export default function NookPrivacyPolicy() {
|
||
<span class="-ml-4 pr-2">2.</span> How We Use It
|
||
</div>
|
||
<div class="pb-2 pl-4">
|
||
- Device identifiers, your email, and license records are used only
|
||
- to operate the trial, deliver purchases, and enforce the 3-device
|
||
- license. We do not use them for advertising or sell them to anyone.
|
||
+ Device identifiers, install IDs, your email and license records are
|
||
+ used only to operate the trial and the licenses, to run the relay
|
||
+ and the weather service, to answer bug reports, and to deliver
|
||
+ purchases. We do not use them for advertising and we do not sell
|
||
+ them to anyone.
|
||
</div>
|
||
</div>
|
||
|
||
@@ -74,9 +163,11 @@ export default function NookPrivacyPolicy() {
|
||
<span class="-ml-4 pr-2">3.</span> Data Security
|
||
</div>
|
||
<div class="pb-2 pl-4">
|
||
- License keys are signed and verified with Ed25519. The connection
|
||
- to our servers uses TLS. Your license key is stored in the macOS
|
||
- Keychain on your Mac.
|
||
+ License keys are signed and verified with Ed25519 and stored in
|
||
+ the macOS Keychain. Phone traffic is encrypted end-to-end with
|
||
+ keys your own devices generate at pairing; our relay holds no key
|
||
+ that can read it. Every connection described on this page uses
|
||
+ TLS.
|
||
</div>
|
||
</div>
|
||
|