Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›Foundations›Legal & Compliance·33 in this wave

Approve: Legal & ComplianceTo do · blocker NEEDS MATTHEW: privacy-policy §6 publishes an admission against interestBlocked · blocker Verify support@tactile-connect.com delivers end-to-endTo do · blocker MATTHEW: eight legal documents marked DRAFT — NOT IN FORCE are published and now linked from marketingTo do · blocker Draft Terms of ServiceDone Draft Privacy PolicyTo do Draft Acceptable Use PolicyDone DMCA takedown policy + register agentTo do DSAR + account-deletion processTo do App Store privacy labels + Play Data SafetyTo do DECIDE: "no third-party data sales" pledge dropped from canonical S13To do Add IP-assignment and NDA agreements to S13's pre-launch checklistTo do Add product liability + workers' comp to S13's insurance planTo do Fix cap table misstatement: S13 says "no SAFEs" while one is actively being raisedTo do Decide: restore or drop the "no third-party data sales, ever" pledgeDone Resolve the data-retention contradiction between S13 and Pro analyticsDone Execute IP assignment and NDA agreementsTo do Appoint an Article 27 EU representativeTo do Execute SCCs with all seven sub-processorsTo do Publish the legal pack — /legal index + a page per documentDone Verify entity name "TacTile Connect, Inc." across docsTo do Write support policyDone Audit business plan Section 13 for policy driftTo do Confirm marketing claims match capabilitiesTo do Confirm co-founder equity resolution note and trademark class 45 in S13To do Draft Cookie PolicyDone Draft DPA templateTo do Sign DPAs with sub-processorsTo do Draft refund policyDone Write incident-response planDone Stand up compliance mailboxesDone Publish sub-processor list pageTo do Resolve retention conflict: S13's 90-day blanket vs indefinite Pro analytics retentionTo do

Wave

Legal & Compliance

v1.0 legal + compliance docs and processes — agent-drafted, Matthew signs off. Entity: TacTile Connect, Inc.

TacTile › Launch TacTile › Foundations › Legal & Compliance

10/33 done23 open4 open blockers

Selected taskclear

MATTHEW: eight legal documents marked DRAFT — NOT IN FORCE are published and now linked from marketing

To doOwner · met_58981363Blocker

No dependencies in this wave — nothing gates it, and nothing waits on it.

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**MATTHEW: eight legal documents marked DRAFT — NOT IN FORCE are published and now linked from marketing** · to do · blocker

Where it sits: TacTile › Launch TacTile › Foundations › Legal & Compliance

## The brief on file

ESCALATED 2026-08-09 by the round-14 web session. This is a decision task — no agent can close it.

WHAT CHANGED. ADR-0006 already accepted that duplicate policies exist, so that is not the news. What is new is that **MarketingShell now links "All policies" → /legal**, which put eight documents into a customer's navigation path. Every one of the eight is published with `isPublic: true` and every one OPENS with **"DRAFT — not in force"**. Meanwhile /privacy and /terms render hand-written JSX that looks undated and carries no qualifier at all — so a visitor sees either an explicit draft or an unqualified page, and nothing that is actually in force.

WHY IT IS ON THE CRITICAL PATH: both the App Store and Play Console require a working privacy-policy URL for submission. This is not a content-quality issue that can trail the launch.

FIVE OF THE EIGHT NAME A SPECIFIC BLOCKER, and each needs YOU, not an agent:
 1. The privacy policy's §6 and §8 contradict each other (note: it is the PRIVACY POLICY that carries this, not the ToS — an earlier brief had that backwards).
 2. The DMCA agent is unregistered.
 3. Refund windows need your numbers.
 4. A cookie-inventory pass has never been done.
 5. A sub-processor verification pass has never been done.

THE DECISION THAT UNBLOCKS EVERYTHING ELSE: which pair is canonical — the hand-written JSX at `/privacy` and `/terms`, or the markdown pack at `/legal`? Publishing both is the root cause; ADR-0006 accepted it when nothing linked to `/legal`, and that premise no longer holds.

DELIBERATELY NOT BUILT, and the session was right not to: a gate asserting that a document containing "not in force" cannot be `isPublic: true`. That check would turn `gate.sh` RED ON MAIN IMMEDIATELY and block every unrelated merge on this surface until the five blockers above are resolved. It is the correct gate to add — but only AFTER you have set effective dates and cleared the blockers, not before. Add it as the last step, not the first.

SUGGESTED SHAPE OF YOUR ANSWER, so a session can act on it:
 (a) canonical pair = JSX or markdown;
 (b) effective date to stamp on the canonical pair;
 (c) for each of the five blockers: fix now, accept and publish with a stated limitation, or unpublish that document until resolved;
 (d) whether /privacy and /terms should redirect to /legal (or vice versa) once (a) is settled.

Once (a)-(d) exist, the remaining work is mechanical and an agent can take it: stamp the dates, remove the DRAFT banners from the canonical pair, unpublish or redirect the duplicates, then add the not-in-force gate.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Legal & Compliance

MATTHEW: eight legal documents marked DRAFT — NOT IN FORCE are published and now linked from marketing