privacy: declare product email as a purpose for the login email - #448
Merged
Conversation
The policy said the login email was 'Required to authenticate you' and nothing else. Emailing users a product survey would therefore have exceeded the declared purpose — and the user base spans EU territories (DE, FR, IT, DK, PL, BE, AT), so purpose limitation is not academic here. Declares the second purpose and bounds it: occasional product email only (a short survey, or notice of a change that materially affects someone); NOT marketing, NOT shared, NOT frequent, NOT a condition of anything; one-click opt out on every such email, immediate and permanent. Any incentive offered for a survey is unconditional on the answer, and nothing is ever traded for an App Store review — Apple forbids it and so should we. Adds a matching 'Stop product email' entry under Your controls, because a declared purpose with no way to refuse it is not a control. Mirrors docs/privacy.html on the public site (the page users actually read). The legacy jasonyeyuhe.github.io copy needs no edit — verified today that it is a meta-refresh stub pointing at the main site (1,047 bytes vs 18,647), which also confirms AGENTS.md's description of it is still accurate. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The policy said the login email is "Required to authenticate you" — and nothing else. Emailing users a product survey would have gone beyond the declared purpose.
That is not academic: the user base spans EU territories (DE, FR, IT, DK, PL, BE, AT), and there are 204 addresses on file.
What changes
Declares the second purpose and bounds it:
Adds a matching "Stop product email" entry under Your controls — a declared purpose with no way to refuse it is not a control.
The page users actually read
PRIVACY.mdis the repo copy; the live page isdocs/privacy.htmlin thepublicremote. Both are updated with the same wording and a#product-emailanchor.The legacy
jasonyeyuhe.github.iocopy needs no edit: verified today that it's a meta-refresh stub pointing at the main site (1,047 bytes vs 18,647), which also confirms AGENTS.md's description of it is still accurate. Shipped builds link to that host, so it was worth checking rather than assuming.Sequencing
This must be live before any survey goes out, not after. Sending first and updating the policy afterwards is the failure this PR exists to prevent.
🤖 Generated with Claude Code