feat(compliance): ToS, privacy, delete-account, export, age-gate, AI disclaimer (#115)

[thomasluizon]

Legal & Compliance umbrella — frontend + shared side of the paired PRs. Ships as DRAFT.

⚠️ DRAFT — AI-authored legal copy (ToS / privacy / age-gate / medical disclaimer) NEEDS LEGAL REVIEW by a Brazilian data-protection lawyer before un-drafting. Copy uses [LEGAL ENTITY NAME] LTDA + [CNPJ NUMBER] placeholders pending the compliance-ops step.

Children in this PR

• Terms of Service — new web /terms + mobile terms.tsx (registered in _layout.tsx); the broken auth.terms links flipped from /about → /terms on both platforms. Covers provider/LTDA, 13+ eligibility, license/acceptable-use, subscription + auto-renewal + cancellation + refunds, AI terms, not-medical-advice, warranty/liability, termination, governing law = Brazil, changes, contact.
• Privacy hardening — extended the existing web + mobile privacy policy: data controller (LTDA+CNPJ), retention periods, Google OAuth scopes + calendar data, data residency / international-transfer basis, AI/automated-processing section, 13+ minors clause, right-to-export; lastUpdated bumped.
• Public delete-account page — no-login web /delete-account explaining the in-app flow + email fallback + 7-day grace; linked from web Profile. (Mobile deletion already works in-app.) Public URL for the Play Data Safety form: https://app.useorbit.org/delete-account.
• Data export — shared UserDataExport Zod type (shape matches the API response) + API.profile.export + web Server Action + mobile apiClient (writes JSON via expo-file-system, shares the file). 'Download my data' entry in web + mobile Profile.
• Age gate (13+) — shared MINIMUM_AGE = 13; the signup consent line on both platforms now affirms the user is at least 13 (passwordless flow has no separate signup step, so the gate lives in the existing 'by continuing you agree' consent — see Deviations).
• AI transparency + medical disclaimer — 'AI' label next to Astra + 'not medical/professional advice' disclaimer near AI output in chat, today summary, and retrospective (both platforms).

All new strings added to both en.json and pt-BR.json (1595 keys each, parity verified).

Validation

• npm run type-check GREEN (shared + web + mobile, stacked on the type-check fix).
• npm run lint clean (web + mobile).
• npm test: shared 815, web 1448 (incl. i18n parity), mobile 361 — all pass.
• Manual E2E pending (no browser E2E run here).

Deviations

• Age gate is implemented as a 13+ affirmation in the existing passwordless consent line (no separate birthdate/checkbox), because the email-code flow has no distinct signup step and a hard checkbox would force the affirmation on every sign-in. Backed by the shared MINIMUM_AGE constant and consistent with the 13+ clause in ToS/Privacy.

Closes #115
Stacked on #128 (mobile type-check fix).

Paired API PR: thomasluizon/orbit-api#181

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
orbit-ui-mobile-web	Ignored		Jun 5, 2026 12:12am

[claude]

Three clusters of dead i18n keys introduced in this PR — all confirmed by grep with zero callers:

1. deleteAccount.lastUpdated — added to both locale files but the delete-account page never renders it (the terms page uses lastUpdated as a subtitle; this one doesn't).
2. dataExport.title, dataExport.description, dataExport.success — export UI only references .button, .preparing, .error, .shareTitle.
3. ageGate.confirmLabel and ageGate.error — age gate lands entirely in the auth.legalPrefix consent-line change; no checkbox or validation message component exists.

Remove all six keys from both en.json and pt-BR.json. Everything else in the PR — the Terms/Privacy expansions, data export (web + mobile), delete-account public page, AI disclosure badges, cross-platform parity, and i18n parity between the two locales — is solid.

[claude]

One dead export to clean up before this merges.

MINIMUM_AGE (packages/shared/src/validation/constants.ts:17) — exported from @orbit/shared with zero runtime callers. The age affirmation lives in the i18n strings as a hardcoded literal; the constant doesn't drive or enforce any code path. Remove the constant, its re-export in validation/index.ts, and the value-only test case.

Everything else is solid: the prior dead i18n keys (deleteAccount.lastUpdated, the three dataExport keys, ageGate keys) are confirmed removed in the follow-up commit. Terms/Privacy expansions, data export (web Server Action + mobile expo-file-system share), delete-account public page, AI disclosure badges, and cross-platform parity all look correct. i18n parity between en.json and pt-BR.json is maintained at 1595 keys each.

[claude]

Both prior findings fully addressed: the dead i18n key cluster (deleteAccount.lastUpdated, three dataExport keys, two ageGate keys) was removed in e32b6c2, and the unused MINIMUM_AGE export was cleaned up in 37f5b7c. The PR is now clean.

What shipped: ToS screen on web + mobile, privacy policy hardening (data controller, retention, Google scopes, data residency, automated-processing, minors, export), public /delete-account page linked from web Profile, data export via Server Action (web blob download) + expo-file-system share (mobile), AI disclosure badge and medical-advice disclaimer in chat, today-summary, and retrospective on both platforms. All new strings in both en.json and pt-BR.json at parity. Zod schema and shared UserDataExport type live in packages/shared. Cross-platform parity is maintained across all features.

[claude]

All prior findings (dead i18n keys, unused MINIMUM_AGE export) were addressed in earlier commits and confirmed clean. The final commit (cf565fa) is a pure text substitution — [LEGAL ENTITY NAME] → TL SOFTWARE ENGINEERING LTDA in both locale files — with no logic changes. The [CNPJ NUMBER] placeholder remaining is intentional per the PR description. No new high-signal issues. Code is solid: Zod schema in shared, Server Action on web, expo-file-system share on mobile, AI disclosure badges and medical-advice disclaimer across all AI surfaces on both platforms, full i18n parity at 1595 keys each.

[claude]

The two new commits since last approval are clean placeholder fill-ins: [LEGAL ENTITY NAME] LTDA (CNPJ [CNPJ NUMBER]) → TL SOFTWARE ENGINEERING LTDA (CNPJ 58.429.979/0001-06) in both privacy.controller.body and terms.provider.body, applied symmetrically to en.json and pt-BR.json. No logic change, both locales consistent. The full PR (ToS screen web+mobile, privacy hardening, public /delete-account, data export via Server Action + expo-file-system share, AI disclosure badges + medical-disclaimer, age-gate consent line, shared UserDataExport Zod type) was verified clean in the prior pass. Ship it.

[claude]

This compliance umbrella lands cleanly. ToS, privacy hardening, public delete-account page, data export, age-gate affirmation, and AI disclaimers are all present on both platforms with full i18n parity (en + pt-BR). No any, no console.log, all user-facing strings routed through i18n, userDataExportSchema is Zod-typed and covered by a dedicated test. The web export (Blob + anchor download via Server Action) and mobile export (expo-file-system File + Share) are platform-appropriate adapters. The login Terms link fix (/about → /terms) is correctly applied on both web email-step.tsx and mobile login.tsx. The public /delete-account page being web-only is intentional — it provides the Play Data Safety form URL while mobile users already have the full deletion flow in-app.

[claude]

The final commit (dc996ae) is a clean parity fix — removes the redundant /delete-account navigation button that was added to the web Profile but absent on mobile (users are served by the existing in-app DeleteAccountModal). Nothing new to flag.

Full PR ships correctly: ToS screen (web + mobile), privacy hardening, public /delete-account page, data export via Server Action (web Blob download) + expo-file-system File + Share (mobile), AI disclosure badge and medical-advice disclaimer across all AI surfaces on both platforms, age-gate affirmation in the consent line (both platforms). Shared userDataExportSchema is Zod-typed and covered by a dedicated test. All user-facing strings routed through i18n with full en/pt-BR parity at 1595 keys each. No any, no console.log, 'use client' is justified on the new public pages (auth store + navigation hooks). Cross-platform parity is maintained across every feature in this PR.

[claude]

Solid compliance umbrella. The implementation is consistent and thorough across all six deliverables.

What landed: ToS page (web + mobile), privacy policy hardening with LGPD-specific sections (controller, retention, Google scopes, data residency, automated processing, minors, export), public /delete-account page with Play-required no-login URL, data export flow (shared Zod type + endpoint constant + web Server Action + mobile expo-file-system write + Share), 13+ age affirmation in the passwordless consent line on both platforms, and AI label + medical disclaimer in chat/today summary/retrospective on both platforms.

Checks: No any, no console.log, i18n parity confirmed (136 keys added to both locales). The expo-file-system v2 File.create()/File.write() calls are synchronous so the Share call correctly follows a fully-written file. Public routes (/terms, /delete-account) properly added to the proxy allowlist with a test covering all three legal pages. 'use client' on the public pages is consistent with the existing privacy page pattern. The emptyState parent has alignItems: 'center' so the chat disclaimer's maxWidth is correctly centered. Tests added for the shared userDataExportSchema.

[sonarqubecloud]

Quality Gate failed

Failed conditions
20.0% Duplication on New Code (required ≤ 3%)

See analysis details on SonarQube Cloud

[claude]

Solid compliance umbrella. Here's what I checked:

Data export — shared UserDataExport Zod type with tests, API.profile.export constant, web Server Action, mobile expo-file-system write + Share, and the export button wired identically on both platforms. The web anchor-click download pattern and mobile synchronous file write are both correct.

Legal pages — terms and privacy land on both platforms with identical structure. Mobile uses useGoBackOrFallback + useAuthStore for the back action (same as the existing privacy screen). The 'use client' directives on the web public pages are justified by the router hooks.

Public route allowlist — /terms and /delete-account added to PUBLIC_PATHS in proxy.ts, proxy test updated to cover all three legal paths.

AI disclosure — "AI" badge and "not medical advice" disclaimer placed consistently on the today summary, chat empty state, and retrospective on both platforms. showDisclaimer guard condition is identical in web and mobile.

i18n — 1595 keys in both en.json and pt-BR.json; common.backToProfile and common.goBack keys pre-exist and are used correctly. No hardcoded user-facing strings in the diff.

Cross-platform parity — all six feature areas (ToS, privacy hardening, delete-account, data export, age-gate, AI disclaimer) are present on both apps/web and apps/mobile, with acceptable platform-only differences (web uses Blob download, mobile uses expo-file-system + Share; delete-account is a public informational web page only since mobile deletion is already in-app).