Repository navigation
Disclose the Pubchi outbound flow in the Terms and Privacy dialogs - #188
Draft
JeanlChristophe wants to merge 1 commit into
Draft
JeanlChristophe wants to merge 1 commit into
JeanlChristophe wants to merge 1 commit into
Conversation
…cy dialogs This deployment offers Pubchi, which sends a user's question, the conversation so far and the context assembled to answer it to a third-party provider of AI language models. The inherited Pubky App Terms and Privacy Policy describe a social client and say nothing about that flow, so a user at this origin is shown a document that does not cover the feature that defines the site. Adds one section to each dialog, following the existing conventions in these files: an all-caps heading, an italic intro in the Terms, bold-led paragraphs, and the existing privacy@synonym.to link for the two requests a user can make. The provider is named as a category rather than a company. GDPR Article 13(1)(e) requires the recipients or the categories of recipients, so the text stays accurate if the provider changes, and the identity is given on request. The transfer paragraph is written the same way so it holds whether the provider sits inside or outside the UK and EEA. Each dialog test gains an assertion on the disclosure itself, so the sections cannot disappear silently in a merge that overwrites these files.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
@BitcoinErrorLog for review. Opened as a draft on purpose: the text is ready but two things below are yours to decide, and it is your project to ship.
Why
bots.pubky.appserves the inherited Pubky App Terms and Privacy Policy, effective 29 January 2026. I checked the live bundle:artificial intelligenceandmodel providerappear zero times in it, whilePubchiandkimiappear in the application code. So a user at this origin reads a social-only contract that says nothing about the feature that defines the site.When someone asks their Pubchi something, their question, the conversation so far, the context assembled for it and their public key leave the device, and part of that is passed to a third-party model provider. Nothing in the current documents covers an outbound flow of user content to a model vendor, because nothing in Pubky App does that.
What this adds
One section at the end of each dialog, following the conventions already in those files: an all-caps heading, an italic intro in the Terms using
baseCSSItalic, bold-led paragraphs, and the existingprivacy@synonym.tolink.DialogTerms.tsx, Section 26, PUBCHI, YOUR PERSONAL BOT: what a Pubchi is, what leaves the device, that private material can be included in what is sent, that output is not published until the user publishes it, that answers are not advice, responsibility for tags applied to other people, what the bot key cannot do, availability, and that prohibited uses still apply.DialogPrivacy.tsx, Section 17, PUBCHI: what is processed, why, who receives it, where it goes, what never leaves the device, how long, the user's choices, and other people's information.One drafting decision worth knowing about
The provider is named as a category, "a third-party provider of AI language models", not as a company. GDPR Article 13(1)(e) requires the recipients or the categories of recipients, so this is sufficient, and it means the text stays accurate when the provider changes. The identity is given on request. The transfer paragraph is written the same way, so it holds whether the provider sits inside or outside the UK and EEA.
The practical consequence: this can ship without waiting on a vendor decision.
Oracle
tsc --noEmitclean.DialogTermsasserts the heading, the sentence naming the third-party provider, the sentence about the identity secret, and the no-advice sentence.DialogPrivacyasserts the heading, the recipient sentence, the transfer sentence, and the no-training commitment.prettier --checkandeslintclean on all four files. The pre-commit hook passed.Two things for you to decide
The Privacy text promises that the provider is engaged on terms that forbid training on inputs and limit it to returning the answer. That is a promise about a contract, so the contract has to match it. If the current setup calls a public API under its standard consumer terms, that sentence is not yet true and the fix is the provider arrangement, not the wording.
This edits the two 64 KB legal files directly, which is the simplest thing to review but will conflict on the next merge from upstream
dev. The added tests are there precisely so a lost merge fails loudly rather than silently. If you would rather carry the text in a small separate module that upstream leaves empty, say so and I will restructure it.Not in this PR
A consent screen before the first request leaves the device. A disclosure in a modal is not consent, and the shape to copy already exists in this codebase: the Pulse consent gate from pubky#2527 asks before anything initializes, records the acceptance time under a versioned key, and deletes what it held on withdrawal. Happy to do that separately if you want it.
The footer on this deployment also still reads "By creating a Pubky account... built with love and dedication by Synonym Software, S.A. DE C.V.", while both documents behind it say Synonym Software Ltd. Left alone here since it is a separate question.
Made with Cursor