neuron-technologies/neuron-web
3
0
Fork 0
Code Issues 2 Pull Requests 5 Actions Packages Projects Releases Wiki Activity

[HOLD — attorney sign-off] Terms: 18+ & never-auto-contact reconcile; add Privacy Policy (fix /legal/privacy 404) #161

Open
will.anderson wants to merge 1 commits from legal/18plus-terms-privacy-reconcile into main
pull from: legal/18plus-terms-privacy-reconcile
merge into: :main
Conversation 1 Commits 1 Files Changed 7
+177 -23
will.anderson commented 2026-07-21 14:55:20 +00:00
Owner
Copy Link
Copy Source

HOLD — PENDING ATTORNEY (DANIEL) SIGN-OFF. Do not merge/deploy.

Prod deploys on push to main, so this PR does not deploy anything until it is merged. Hold the merge until counsel signs off on the Terms and Privacy text.

Why

The published Terms (/legal/terms, live) contradicted two locked safety decisions and the shipping app copy, and the in-app Privacy Policy link 404'd. This is legal-exposure text under CA SB 243 (companion chatbots) and the active AI-companion litigation.

What changed

Terms (src/terms.el)

  • §1 — adds an explicit "You must be 18 or older to use Neuron" eligibility statement (there was none).

  • §11 — replaces "Children and Family Accounts" (which permitted "Children 13 and over" independently and under-13 via family accounts) with an honest "Safety Features" section. Removes:

    • the Hard Bell block — "emergency services and independently designated trusted contacts are notified first … not a setting that can be changed"
    • the mandatory-reporting clause — "emergency services or relevant authorities may be contacted … You cannot opt out of this"

    Both promised an automatic escalation the product does not perform. New copy matches the app exactly: Neuron shows you 988 and how to reach a contact you chose; it never contacts anyone on your behalf; there is no automatic escalation.

Privacy Policy (new — fixes the 404)

  • Adds src/privacy.el and registers it in src/main.el (startup generation, /legal/privacy route, state pointer, sitemap). The in-app link already points at /legal/privacy; it 404'd because no route and no document existed.
  • Ported from docs/legal/privacy-policy-companion-DRAFT.md (2026-07-14): local-first, 18+, and never-auto-contact stated verbatim from the locked draft.
  • Wires privacy.html through Dockerfile.stage, Dockerfile, and deploy.yaml; adds the parity /legal/privacy route to the secondary server.el.

Left for counsel (not invented here)

Effective date, governing law, retention periods, and any SB 243 published-protocol specifics remain human/attorney decisions. The internal DRAFT banners in docs/legal/* still apply.

Verification

  • /legal/terms no longer contains Children 13 and over, notified first, or cannot opt out; contains the 18+ clause and "There is no automatic escalation."
  • /legal/privacy route + document now generated and served; matches the in-app link target.
## HOLD — PENDING ATTORNEY (DANIEL) SIGN-OFF. Do not merge/deploy. Prod deploys on push to `main`, so this PR does **not** deploy anything until it is merged. Hold the merge until counsel signs off on the Terms and Privacy text. ### Why The published Terms (`/legal/terms`, live) contradicted two **locked** safety decisions and the shipping app copy, and the in-app **Privacy Policy link 404'd**. This is legal-exposure text under CA **SB 243** (companion chatbots) and the active AI-companion litigation. ### What changed **Terms (`src/terms.el`)** - **§1** — adds an explicit *"You must be 18 or older to use Neuron"* eligibility statement (there was none). - **§11** — replaces *"Children and Family Accounts"* (which permitted **"Children 13 and over"** independently and under-13 via family accounts) with an honest **"Safety Features"** section. Removes: - the **Hard Bell** block — *"emergency services and independently designated trusted contacts are notified first … not a setting that can be changed"* - the **mandatory-reporting** clause — *"emergency services or relevant authorities may be contacted … You cannot opt out of this"* Both promised an **automatic escalation the product does not perform**. New copy matches the app exactly: Neuron shows you 988 and how to reach a contact you chose; **it never contacts anyone on your behalf; there is no automatic escalation.** **Privacy Policy (new — fixes the 404)** - Adds `src/privacy.el` and registers it in `src/main.el` (startup generation, `/legal/privacy` route, state pointer, sitemap). The in-app link already points at `/legal/privacy`; it 404'd because no route and no document existed. - Ported from `docs/legal/privacy-policy-companion-DRAFT.md` (2026-07-14): local-first, 18+, and never-auto-contact stated verbatim from the locked draft. - Wires `privacy.html` through `Dockerfile.stage`, `Dockerfile`, and `deploy.yaml`; adds the parity `/legal/privacy` route to the secondary `server.el`. ### Left for counsel (not invented here) Effective date, governing law, retention periods, and any SB 243 published-protocol specifics remain human/attorney decisions. The internal DRAFT banners in `docs/legal/*` still apply. ### Verification - `/legal/terms` no longer contains `Children 13 and over`, `notified first`, or `cannot opt out`; contains the 18+ clause and *"There is no automatic escalation."* - `/legal/privacy` route + document now generated and served; matches the in-app link target.
will.anderson added 1 commit 2026-07-21 14:55:23 +00:00
legal: reconcile Terms with locked 18+ and never-auto-contact decisions; add Privacy Policy 4989641b39 
The published Terms directly contradicted two locked safety decisions and the
shipping app copy, and the in-app Privacy Policy link 404'd. Both are legal
exposure under CA SB 243 (companion chatbots) and the AI-companion litigation.

Terms (§1, §11):
- Add an explicit "you must be 18 or older" eligibility statement. The old §11
  permitted "Children 13 and over" independently and under-13 via family
  accounts — the exact minor path the app's age gate forbids and the litigation
  epicenter targets.
- Replace §11 "Children and Family Accounts" with an honest "Safety Features"
  section. Removes the Hard Bell auto-notify block ("emergency services and
  trusted contacts are notified first", "cannot be changed") and the
  mandatory-reporting clause ("emergency services or relevant authorities may
  be contacted", "cannot opt out") — both promised an automatic escalation the
  product does not perform. New copy matches the app: Neuron shows you 988 and
  how to reach a contact you chose; it never contacts anyone on your behalf;
  there is no automatic escalation.

Privacy Policy (new):
- Add src/privacy.el + register it in main.el (generation, /legal/privacy route,
  state pointer, sitemap). Fixes the in-app link, which pointed at
  /legal/privacy (404 — no route, no doc existed).
- Ported from docs/legal/privacy-policy-companion-DRAFT.md (2026-07-14):
  local-first, 18+, and never-auto-contact stated verbatim from the locked draft.
- Wire privacy.html through Dockerfile.stage / Dockerfile / deploy.yaml; add the
  secondary /legal/privacy route to server.el for parity.

PENDING ATTORNEY (Daniel) SIGN-OFF before merge/publish. Bracketed legal
decisions (governing law, effective date, retention periods) left for counsel.
will.anderson commented 2026-08-03 18:59:38 +00:00
Author
Owner
Copy Link
Copy Source

GROOMING — 2026-08-03
Status: HELD pending attorney/counsel sign-off — Terms 18+/never-auto-contact reconcile plus new Privacy Policy fixing the /legal/privacy 404; legal-exposure text under CA SB 243. PR self-flags HOLD until counsel signs off.
Next action: Daniel/counsel reviews and signs off on the Terms and Privacy text; Will merges after. Do not merge or deploy.
Owner: Daniel/counsel (Will to land after sign-off)
Priority: HELD

**GROOMING — 2026-08-03** **Status:** HELD pending attorney/counsel sign-off — Terms 18+/never-auto-contact reconcile plus new Privacy Policy fixing the /legal/privacy 404; legal-exposure text under CA SB 243. PR self-flags HOLD until counsel signs off. **Next action:** Daniel/counsel reviews and signs off on the Terms and Privacy text; Will merges after. Do not merge or deploy. **Owner:** Daniel/counsel (Will to land after sign-off) **Priority:** HELD
will.anderson added the HELD label 2026-08-03 18:59:44 +00:00
You are not authorized to merge this pull request.
This pull request can be merged automatically.
This branch is out-of-date with the base branch
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin legal/18plus-terms-privacy-reconcile:legal/18plus-terms-privacy-reconcile
git checkout legal/18plus-terms-privacy-reconcile
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
BETA-CRITICAL
On the beta critical path — must resolve before ship
 HELD
Blocked pending an external decision (counsel / dual sign-off)
 ORTHOGONAL
Parallel workstream (testing/hardening) — safe to assign off critical path
 POST-BETA
Important but not blocking the beta ship
No labels HELD
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
andre.almeida (Andre Almeida) tim.lingo (Tim Lingo) will.anderson (Will Anderson)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: neuron-technologies/neuron-web#161
Delete Branch "legal/18plus-terms-privacy-reconcile"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?