Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›Foundations›Legal & Compliance·33 in this wave

Approve: Legal & ComplianceTo do · blocker NEEDS MATTHEW: privacy-policy §6 publishes an admission against interestBlocked · blocker Verify support@tactile-connect.com delivers end-to-endTo do · blocker MATTHEW: eight legal documents marked DRAFT — NOT IN FORCE are published and now linked from marketingTo do · blocker Draft Terms of ServiceDone Draft Privacy PolicyTo do Draft Acceptable Use PolicyDone DMCA takedown policy + register agentTo do DSAR + account-deletion processTo do App Store privacy labels + Play Data SafetyTo do DECIDE: "no third-party data sales" pledge dropped from canonical S13To do Add IP-assignment and NDA agreements to S13's pre-launch checklistTo do Add product liability + workers' comp to S13's insurance planTo do Fix cap table misstatement: S13 says "no SAFEs" while one is actively being raisedTo do Decide: restore or drop the "no third-party data sales, ever" pledgeDone Resolve the data-retention contradiction between S13 and Pro analyticsDone Execute IP assignment and NDA agreementsTo do Appoint an Article 27 EU representativeTo do Execute SCCs with all seven sub-processorsTo do Publish the legal pack — /legal index + a page per documentDone Verify entity name "TacTile Connect, Inc." across docsTo do Write support policyDone Audit business plan Section 13 for policy driftTo do Confirm marketing claims match capabilitiesTo do Confirm co-founder equity resolution note and trademark class 45 in S13To do Draft Cookie PolicyDone Draft DPA templateTo do Sign DPAs with sub-processorsTo do Draft refund policyDone Write incident-response planDone Stand up compliance mailboxesDone Publish sub-processor list pageTo do Resolve retention conflict: S13's 90-day blanket vs indefinite Pro analytics retentionTo do

Wave

Legal & Compliance

v1.0 legal + compliance docs and processes — agent-drafted, Matthew signs off. Entity: TacTile Connect, Inc.

TacTile › Launch TacTile › Foundations › Legal & Compliance

10/33 done23 open4 open blockers

Selected taskclear

Publish the legal pack — /legal index + a page per document

DoneOwner · ait_4411d222

Closes the publication gap: nine legal documents existed in docs/legal and nothing in the repo read them. Building markdown-backed marketing routes.

No dependencies in this wave — nothing gates it, and nothing waits on it.

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**Publish the legal pack — /legal index + a page per document** · done

Closes the publication gap: nine legal documents existed in docs/legal and nothing in the repo read them. Building markdown-backed marketing routes.

Where it sits: TacTile › Launch TacTile › Foundations › Legal & Compliance

## The brief on file

DONE 2026-07-28 (Viv) — branch feature/legal-pages, commit 0d8c77c6, pushed. NOT deployed.

WHAT SHIPPED
  /legal (index) + /legal/[slug] for 8 documents, rendered from docs/legal/*.md at build
  time. Statically generated (force-static + generateStaticParams + dynamicParams:false)
  because apps/web runs on workerd via OpenNext where there is no filesystem — a dynamic
  route reading node:fs builds clean then 500s in production.
  Sections get stable ids so paragraphs are deep-linkable. Cross-document markdown links
  are rewritten to /legal/<slug>. Footer gained "All policies". Architecture is ADR-0006.
  Also backfilled docs/adr/INDEX.md, which was missing its ADR-0005 row.

VERIFIED: tsc clean; lint 0 errors (187 pre-existing warnings, none in new files);
pnpm build:web exit 0 with /legal marked Static and /legal/[slug] marked SSG in the route
table; 12/12 loader tests; all 9 routes 200 with zero console errors; /legal/incident-
response-plan and unknown slugs 404; sub-processors' 4-column table scrolls inside itself
at 375px while the page does not.

THREE DEFECTS FOUND THAT THE BUILD WAS GREEN ON — worth remembering, none would have been
caught by CI:
 1. The whole feature was behind auth. middleware.ts PUBLIC_PATHS listed /privacy and
    /terms but not /legal, so every unauthenticated visitor — app-store reviewer,
    regulator, prospect — would have been 307'd to /signin. Static generation does not
    save you; the middleware matcher runs at the edge on every request. +4 lines.
 2. Internal editorial material rendered as VISIBLE BODY TEXT (see the blocked follow-up).
 3. Stripping an inline HTML comment stranded a comma, so the ToS arbitration clause read
    "Los Angeles County, California , under the rules of...". Fixed in the loader.

TWO JUDGMENT CALLS:
  - EIGHT documents publish, not nine. incident-response-plan.md is registered with
    isPublic:false because its own header reads "DRAFT — internal document, not
    customer-facing" and it documents detection timings, escalation paths and internal
    contacts. It stays IN the registry so the loader can recognise cross-references to it
    and flatten them to plain text rather than dead links. Two such references exist.
  - /privacy and /terms are untouched and still serve the hand-written JSX. Replacing a
    live policy with an unsigned draft is worse than temporary duplication.

KNOWN AND ACCEPTED FOR NOW: there are now two privacy policies and two terms publicly
reachable with different content — and different entity names ("TacTile Connect Corp" in
the JSX vs "TacTile Connect, Inc." in the markdown). Retiring the JSX pages is the
follow-up; it depends on sign-off, not on engineering.

NOT DEPLOYED. Every page reads "DRAFT — not in force" and "Effective date: pending".
Merging makes them live.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Legal & Compliance

Publish the legal pack — /legal index + a page per document