Celebrity Signatures: correct a FALSE 'Data Not Collected' privacy instruction (TK-10387)

919eed10a9346e1dded75ac45618da1ca6d82a89 · 2026-09-04 08:53:23 -0700 · Steve Abrams

The repo's own store-listing file instructed filing 'Data Not Collected.' That is false
against the shipped binary, and it is the file someone would naturally work from when
filling in App Store Connect — so it would have produced a filed misrepresentation on an
account already carrying seven rejections.

Verified in source rather than inferred:
  api.ts:119  login(email, password)
  api.ts:121  signup(email, password, name)
  api.ts:18   appleSignIn()
  api.ts:113  leaderboardSubmit(game, diff, score, name)
  api.ts:65   User = { email, name }
  server.js:569  Stripe Checkout session creation

An app with accounts, a public leaderboard and a paid checkout does not collect nothing.
Replaced with the correct declarations (Contact Info, User Content, Identifiers, Purchases,
all App Functionality / tracking = NO), plus a flagged item to verify: whether the mural
checkout collects a shipping address. The old note dismissed that as 'collected by the
website, not the binary' — reasoning that does not hold when the purchase flow is presented
inside the app.

Also softened a marketing line that read 'the app does no tracking' into a claim that is
actually true and defensible. NO_TRACK stripping analytics inside the checkout WebView is a
tracking argument, not a collection argument; the two questionnaire questions are separate.

Found by generalizing the check that had just caught the same class on Costa Rica.
Docs only; no product code touched.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QfGYEoLBywwJD1nfrHe1on

Files touched

M apps/mobile/APP-STORE-LISTING.md

Diff

commit 919eed10a9346e1dded75ac45618da1ca6d82a89
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Fri Sep 4 08:53:23 2026 -0700

    Celebrity Signatures: correct a FALSE 'Data Not Collected' privacy instruction (TK-10387)
    
    The repo's own store-listing file instructed filing 'Data Not Collected.' That is false
    against the shipped binary, and it is the file someone would naturally work from when
    filling in App Store Connect — so it would have produced a filed misrepresentation on an
    account already carrying seven rejections.
    
    Verified in source rather than inferred:
      api.ts:119  login(email, password)
      api.ts:121  signup(email, password, name)
      api.ts:18   appleSignIn()
      api.ts:113  leaderboardSubmit(game, diff, score, name)
      api.ts:65   User = { email, name }
      server.js:569  Stripe Checkout session creation
    
    An app with accounts, a public leaderboard and a paid checkout does not collect nothing.
    Replaced with the correct declarations (Contact Info, User Content, Identifiers, Purchases,
    all App Functionality / tracking = NO), plus a flagged item to verify: whether the mural
    checkout collects a shipping address. The old note dismissed that as 'collected by the
    website, not the binary' — reasoning that does not hold when the purchase flow is presented
    inside the app.
    
    Also softened a marketing line that read 'the app does no tracking' into a claim that is
    actually true and defensible. NO_TRACK stripping analytics inside the checkout WebView is a
    tracking argument, not a collection argument; the two questionnaire questions are separate.
    
    Found by generalizing the check that had just caught the same class on Costa Rica.
    Docs only; no product code touched.
    
    Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
    Claude-Session: https://claude.ai/code/session_01QfGYEoLBywwJD1nfrHe1on
---
 apps/mobile/APP-STORE-LISTING.md | 29 ++++++++++++++++++++++++-----
 1 file changed, 24 insertions(+), 5 deletions(-)

diff --git a/apps/mobile/APP-STORE-LISTING.md b/apps/mobile/APP-STORE-LISTING.md
index bb7f227..b5fb129 100644
--- a/apps/mobile/APP-STORE-LISTING.md
+++ b/apps/mobile/APP-STORE-LISTING.md
@@ -31,7 +31,8 @@ FEATURES
 • The signature game — test your eye across six ways to play: match, guess, and rank the marks.
 • Murals — turn a signature into a large-format printed mural, made to order and shipped to
   your door (a physical product; ordering opens a secure checkout).
-• Private by design — the app does no tracking; there are no ads inside the app.
+• Private by design — no ads in the app, and no tracking: nothing you do here is used to
+  follow you across other apps or sites.
 
 Whether you're a collector, a design lover, or just curious whose hand made that mark,
 Celebrity Signatures makes the world's most recognizable autographs a pleasure to explore.
@@ -49,10 +50,28 @@ https://celebsignatures.com
 https://celebsignatures.com/privacy
 
 ## App Privacy questionnaire (Data types)
-Data Not Collected. The app performs NO tracking (NO_TRACK strips analytics/ads even inside
-the mural-checkout WebView) and contains no in-app advertising. Declare "Data Not Collected."
-(If the mural checkout later collects a shipping address server-side, that is collected by the
-website at purchase, not by the app binary — but review the questionnaire against final flow.)
+
+> ⛔ **CORRECTED 2026-09-04 (TK-10387). The previous instruction here said "Data Not Collected."
+> That was FALSE against the shipped binary and would have been a filed misrepresentation.**
+> Verified in source, not inferred:
+> `api.ts:119` `login(email, password)` · `api.ts:121` `signup(email, password, name)` ·
+> `api.ts:18` `appleSignIn()` · `api.ts:113` `leaderboardSubmit(game, diff, score, name)` ·
+> `api.ts:65` `User = { email, name }` · Stripe Checkout sessions created in `server.js:569`.
+> An app with accounts, a public leaderboard and a paid checkout does not collect nothing.
+
+**Declare these — all App Functionality, tracking = NO:**
+- **Contact Info** — Email Address, Name (account signup/login and Sign in with Apple). Linked to identity.
+- **User Content** — the display name a player submits to the public leaderboard. Linked to identity.
+- **Identifiers** — User ID (the account identifier). Linked to identity.
+- **Purchases** — mural order history. Linked to identity.
+- **Physical Address** — IF the mural checkout collects a shipping address for fulfilment.
+  **Verify this against the live Stripe Checkout session config before filing.** The old note
+  waved this away as "collected by the website, not the binary" — that reasoning does not hold
+  when the purchase flow is presented inside the app, so check it rather than assume it.
+
+`NO_TRACK` stripping analytics/ads inside the checkout WebView is true and worth stating in the
+review notes, but it is an argument about **tracking**, not about **collection**. The two questions
+are separate: tracking = NO is defensible; "collects nothing" is not.
 
 ## Age rating
 4+ (no objectionable content). Confirm during the ASC questionnaire.

← 4794797 add gated Printify fulfillment path for wear · back to CelebritySignatures · wear/POD: fix 4 correctness bugs from codex's 2026-09-04 rev f197cfc →