Privacy policy: credential custody, transfer mechanisms, sharing clause - #119
Merged
Conversation
aterga
force-pushed
the
claude/privacy-transfers-p4el4n
branch
from
August 5, 2026 08:16
5d63983 to
4dd179e
Compare
aterga
force-pushed
the
claude/privacy-transfers-p4el4n
branch
from
August 5, 2026 08:30
4dd179e to
d440428
Compare
Wording updates to the served privacy policy and its source text, from the review rounds of 2026-08-03/04: - Credential custody: the long-term credentials are never sent to the Service; passkey private keys remain with the authenticator, recovery material with the user, and linked-account credentials with their providers. The follow-on custody paragraph is aligned. - International transfers: the network paragraph describes the processing factually. The Service submits requests deliberately at the user's direction; node locations are set by the network's governance and can include countries without an adequacy finding; the text names what travels. The AWS residual-access sentence names the concrete mechanism (the AWS Data Processing Addendum incorporating the EU Standard Contractual Clauses, with the Swiss extension). - Sharing: no sale, no disclosure for advertising, disclosure only to the recipients section 2 describes, and section 2 now includes the public-authorities recipient category so the comply-with-law clause has a covered recipient. - The source doc's header notes are updated to neutral maintenance notes recording the rounds; engineering follow-ups are tracked in issues #120, #121, and #122. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TGhwpdTbUqQbR5AiiN8Ljw
aterga
force-pushed
the
claude/privacy-transfers-p4el4n
branch
from
August 5, 2026 12:27
d440428 to
aa4c3d1
Compare
…eads The transfer paragraph said every request travels under a pseudonymous per-application identifier, but public reads made without signing in run through the shared anonymous agent and carry no user identifier (canister_query permits omitting derivation_origin). The sentence now separates the two cases. Also record both halves of issue #121 in the source doc's follow-ups note. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TGhwpdTbUqQbR5AiiN8Ljw
Adopt the reviewer's transfer sentence: authenticated requests carry the section-6 pseudonymous per-application identifier; unauthenticated public reads use the network's shared anonymous principal, which identifies no one. The source document now contains the synchronization notice and the policy text only. Operational and review notes are maintained outside this repository. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TGhwpdTbUqQbR5AiiN8Ljw
MRmarioruci
approved these changes
Aug 6, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adopts the wording corrections from the legal review rounds of 2026-08-03/04, in both the served page and the source text. The reviews' engineering items are tracked as issues (#120, #121, #122) — the policy keeps describing current behaviour honestly until they ship.
1. Credential custody
"Your long-term authentication credentials never leave Internet Identity" implied Internet Identity stores them. Adopted the review's correction: they are never sent to the Service, and each lives where it actually lives — passkey private keys with your authenticator, recovery material with you, linked-account credentials with their respective providers. The follow-on custody paragraph's "your credentials stay with Internet Identity" is aligned ("stay where they already live") so the corrected claim isn't contradicted two sentences later.
2. International transfers
3. Sharing clause de-contradicted
"We do not share it with third parties for their own purposes" conflicted with section 2's recipient disclosures. Adopted the review's replacement: no sale, no disclosure for advertising, disclosure only to the recipients described above as necessary to perform requests, secure the Service, or comply with law — plus (Copilot round) a "Public authorities, where the law requires it" recipient category in section 2, so the "only … comply with law" clause actually has a covered recipient.
Related issues
main.Changes
src/assets/privacy-policy.html: the corrections above.docs/icp-mcp-privacy-policy-draft.md: same corrections, plus maintenance notes recording the review rounds.Testing
cargo build --locked --bin imcp2— page compiles in viainclude_str!cargo test --locked --all-targets— n/a beyond build; no code paths changednpm test --prefix monitoring/mcp-status— n/a, dashboard unchangedChecklist
🤖 Generated with Claude Code
https://claude.ai/code/session_01TGhwpdTbUqQbR5AiiN8Ljw