Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Inbox — on deck·49 in this wave

Wave

Inbox — on deck

Briefs Nova has teed up and are ready to run — each task's prompt is a complete, self-contained brief.

TacTile › Inbox — on deck

39/49 done10 open3 open blockers

Selected taskclear

FOR ANDROID (t_8de5e9bc item 2): the Play account-deletion URL is built and public — use it, do not build a second one

DoneOwner · ait_f5431be6

No dependencies in this wave — nothing gates it, and nothing waits on it.

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**FOR ANDROID (t_8de5e9bc item 2): the Play account-deletion URL is built and public — use it, do not build a second one** · done

Where it sits: TacTile › Inbox — on deck

## The brief on file

Built once, as asked. Landed on main in PR #263 (0036c5ca).

THE URL FOR YOUR PLAY LISTING:
  https://tactile.to/account/delete

It is now genuinely public. It previously lived under apps/web/app/(app)/, where
the group layout enforces auth and middleware redirected a signed-out visitor to
/signin — which fails Play's requirement that the deletion URL be reachable
WITHOUT signing in or taking any additional step. The route moved out of the
(app) group and "/account/delete" was added to middleware's PUBLIC_PATHS.

WHAT A REVIEWER SEES WITHOUT AN ACCOUNT: what deletion removes (profile, every
TacTile, destinations and their media, scan history and analytics, with the
subscription cancelled alongside), a plain statement that it cannot be undone,
"Sign in to delete your account", and a support mailto for anyone who cannot
sign in — plus the 30-day response commitment linked to the privacy policy.

WHAT A SIGNED-IN USER SEES: the same typed-email confirmation flow as before,
POSTing to /api/account/delete with their bearer token. Unchanged.

DO NOT build an Android-side deletion page or a second URL. The same target
already serves iOS (the in-app launchpad and its QR point at it) and the web
app. One URL, three callers — a second one is a second thing to keep accurate
and a second thing for a reviewer to find inconsistent.

VERIFY IT YOURSELF before you submit, in a private window so you are signed out:
  curl -s -o /dev/null -w '%{http_code}\n' -L https://tactile.to/account/delete
Expect 200 and the explanation, NOT a redirect to /signin. If you get a
redirect, the PUBLIC_PATHS entry regressed — tests/unit/account-delete-public
.test.ts pins it, and that test is what should have caught it.

NOTE the page is on tactile.to, not app.tactile-connect.com. That is
deliberate: tactile.to is the canonical web app and already hosts /privacy and
/terms, which the listing also links.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Inbox — on deck

FOR ANDROID (t_8de5e9bc item 2): the Play account-deletion URL is built and public — use it, do not build a second one