Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›Foundations›Legal & Compliance·33 in this wave

Approve: Legal & ComplianceTo do · blocker NEEDS MATTHEW: privacy-policy §6 publishes an admission against interestBlocked · blocker Verify support@tactile-connect.com delivers end-to-endTo do · blocker MATTHEW: eight legal documents marked DRAFT — NOT IN FORCE are published and now linked from marketingTo do · blocker Draft Terms of ServiceDone Draft Privacy PolicyTo do Draft Acceptable Use PolicyDone DMCA takedown policy + register agentTo do DSAR + account-deletion processTo do App Store privacy labels + Play Data SafetyTo do DECIDE: "no third-party data sales" pledge dropped from canonical S13To do Add IP-assignment and NDA agreements to S13's pre-launch checklistTo do Add product liability + workers' comp to S13's insurance planTo do Fix cap table misstatement: S13 says "no SAFEs" while one is actively being raisedTo do Decide: restore or drop the "no third-party data sales, ever" pledgeDone Resolve the data-retention contradiction between S13 and Pro analyticsDone Execute IP assignment and NDA agreementsTo do Appoint an Article 27 EU representativeTo do Execute SCCs with all seven sub-processorsTo do Publish the legal pack — /legal index + a page per documentDone Verify entity name "TacTile Connect, Inc." across docsTo do Write support policyDone Audit business plan Section 13 for policy driftTo do Confirm marketing claims match capabilitiesTo do Confirm co-founder equity resolution note and trademark class 45 in S13To do Draft Cookie PolicyDone Draft DPA templateTo do Sign DPAs with sub-processorsTo do Draft refund policyDone Write incident-response planDone Stand up compliance mailboxesDone Publish sub-processor list pageTo do Resolve retention conflict: S13's 90-day blanket vs indefinite Pro analytics retentionTo do

Wave

Legal & Compliance

v1.0 legal + compliance docs and processes — agent-drafted, Matthew signs off. Entity: TacTile Connect, Inc.

TacTile › Launch TacTile › Foundations › Legal & Compliance

10/33 done23 open4 open blockers

Selected taskclear

Verify support@tactile-connect.com delivers end-to-end

To doOwner · Vivt_500d6202Blocker

Every legal document and product surface now publishes this one address. Nothing has proven it actually arrives.

Unlocks 2DMCA takedown policy + register agent Approve: Legal & Compliance

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**Verify support@tactile-connect.com delivers end-to-end** · to do · blocker

Every legal document and product surface now publishes this one address. Nothing has proven it actually arrives.

Where it sits: TacTile › Launch TacTile › Foundations › Legal & Compliance

## Unlocks 2

- DMCA takedown policy + register agent
- Approve: Legal & Compliance

## The brief on file

Viv — prove support@tactile-connect.com actually receives mail, then close this out. Surface anything needing Matthew's sign-off.

WHY THIS IS A BLOCKER. As of 2026-07-29 TacTile publishes exactly ONE contact address. The Terms, Privacy Policy, Acceptable Use Policy, DMCA Policy, Cookie Policy, Refund Policy, Support Policy, every app screen, both marketplace listings and the marketing site all name support@tactile-connect.com and nothing else. There is no second address to fall back on. If it does not deliver, every published policy names a dead mailbox — which is the exact failure the consolidation was meant to prevent, only now concentrated into a single point.

Three checks:

1. HUMAN MAIL. Send a plain message to support@tactile-connect.com from an outside address and confirm it lands in matthew@tactile.to. MX on tactile-connect.com is Cloudflare Email Routing (route1/2/3.mx.cloudflare.net); the forward rule exists but has never been proven. Zone dashboard: https://dash.cloudflare.com/f7c19f155c573c536a5c6070c97461c6/tactile-connect.com/email/routing/routes

2. APPLICATION MAIL. Once the API is deployed, POST a report to /api/abuse/report on staging and confirm the notification arrives with subject "[STAGING] [ABUSE — …]". This exercises Resend + the template + the routing rule together, which the human-mail test does not. Requires RESEND_API_KEY set on the worker — without it the stub provider silently no-ops.

3. SOMEONE IS WATCHING. Confirm who reads the inbox and how often. The AUP commits to acknowledging within 2 business days, and immediately for CSAM, credible threats and active phishing. A monitored inbox is the entire basis of that promise.

While you are there: check whether the deliverability basics are in place on tactile-connect.com — SPF, DKIM and DMARC. Resend sends as noreply@tactile.to (a different domain), so alignment is worth confirming rather than assuming.

Context: docs/DOMAIN-MAP.md §Email records the decision and the per-domain mail plumbing. docs/legal/README.md row 8 tracks it as resolved-pending-this-check. `pnpm verify:one-contact-address` keeps a second address from creeping back in.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Legal & Compliance

Verify support@tactile-connect.com delivers end-to-end