timescale.info#175 · Review the terms for children's and users' protection; delete comments and accounts
- timeline-app
- pull request
Closes #166. A review of the terms, privacy notice and copyright policy against the laws protecting children and users, as of October 2026, with the changes the review called for. Not legal advice: the operator items are in `legal/LAUNCH.md`, for review once the operator, hosting and markets are confirmed. ## What changed in the app - **Deleting your comments.** On a pull request, the author of a comment sees **Delete** on it. Only the author can delete it; everyone else gets a 404. - **Deleting your account.** Go to **Account → Delete your account**. You confirm with your username, your password and, if two-factor authentication is on, a code. - **Deleted:** the timelines you own (with their history, pull requests and comments), the pull requests and comments you wrote on others' timelines, plugins, suites, stars, memberships, API keys, sign-in methods and sessions. - **Kept:** others' forks of your timelines, and changes already merged into others' timelines. - Moderation records stay, without your name. - The last active administrator can't delete their account. - Expected by the GDPR (Art. 17), the UK Children's Code and California's eraser law for minors. - **Neutral age screen.** Under COPPA's amended rule (in force since 22 April 2026), neither the sign-up form nor the refusal says what age is needed. - The refusal now reads "Sorry, we can't create an account for you." - A browser that was refused is refused again for a day (`oc_age_refusals`: a hash of the browser's sign-in token, deleted when it expires). This stops a child from going back and giving a different year. - **High-privacy defaults for accounts that may be under 18** (UK Children's Code): their profiles no longer show the timelines they star. Warnings before sensitive content and browsing without labelled timelines were already in place. ## What changed in the documents | Document | Changes | | --- | --- | | TERMS | **Young people** (the protective defaults; parents can contact the operator). **How content is moderated:** report categories; people decide, with no automated detection; what decisions can do; CSAM reporting; ranking by standing and the human-verification challenges. **Complaints:** about content, about decisions, about anything else. These are what the UK Online Safety Act's terms duties (ss. 10, 12, 21) and the EU DSA (Art. 14) ask terms to say. Self-service deletion. | | PRIVACY | Self-service deletion: what goes and what stays. Image links rather than "embedded images" (left over from #174). Cloudflare Turnstile, which wasn't disclosed before. The age-refusal record. Minors' defaults. | | COPYRIGHT | In-app Report with a copyright category (it still said there was no in-app reporting). Linked images (#109). How repeat infringers are judged. | | LAUNCH | COPPA (written security program and retention policy), a Children's Code DPIA, US state minors and social-media laws (Texas SCOPE Act, NY SAFE for Kids Act rules from 25 January 2027, app store accountability laws), and Australia's under-16 minimum age (likely outside it; record why). | | docs/moderation.md, RISK-ASSESSMENT | Updated to match. | ## Tests - `test/deletion-postgres.mjs`: - comment deletion: author only; 404 for others; 401 when signed out; - account deletion: wrong confirmation and wrong password refused; signs out; owned timelines, pull requests, comments and stars gone; another account's fork and timeline survive; - the last administrator refused. - `test/deletion-live-postgres.mjs`, in a live browser: - the owner sees no Delete on others' comments, and the author deletes one of theirs; - account deletion from Account: a wrong username is refused, then the right one signs out and redirects; - the account's timeline and profile are then 404, the owner's timeline stays, and the pull request is gone. - `test/ages-postgres.mjs`: a retry from the same browser is refused; another browser can sign up. - Both new tests are added to CI.