Add public Terms of Service and Privacy Policy pages (#794) - #795
Merged
Merged
Conversation
builder.ainative.studio had no legal pages of its own — /terms and /privacy fell through to the auth-gated catch-all and 307'd to /login. This is the real blocker behind Twilio's A2P 10DLC campaign rejection (#781, ZeroVoice#626): the campaign (sid QE2c6890da8086d771620e9b13fadeba0b) was rejected with error 30882 (unverifiable TERMS_AND_CONDITIONS_URL) and 30908 (unverifiable PRIVACY_POLICY_URL) because carriers could not resolve a public, unauthenticated legal page for the product actually sending Cody's SMS messages. - New app/terms and app/privacy pages, SSR, matching the existing Modernist chrome (PublicNav/PublicFooter, same tokens as /about and /help). - Privacy policy explicitly states mobile/SMS data is never shared with third parties for marketing, per Twilio's carrier-review requirements. - Terms includes SMS-specific terms (message frequency, opt-out keywords, HELP/STOP handling) matching what's already registered on the Twilio campaign (message_flow, opt_out_keywords, opt_out_message). - middleware.ts: added /terms and /privacy to the public allowlist so they render for anonymous visitors and automated carrier/compliance review. - PublicFooter: Terms/Privacy links now point at Builder's own pages instead of ainative.studio's. Once live, the Twilio campaign still needs to be resubmitted with these URLs — that part is account/compliance work, not a code change.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
builder.ainative.studiohad no/termsor/privacypages of its own — both paths 307'd to/login(fell through the auth-gated catch-all).QE2c6890da8086d771620e9b13fadeba0b) was rejected with error 30882 (unverifiableTERMS_AND_CONDITIONS_URL) and 30908 (unverifiablePRIVACY_POLICY_URL) — carriers couldn't resolve a public legal page for the product actually sending Cody's SMS messages.app/terms/page.tsxandapp/privacy/page.tsx, SSR, matching the existing Modernist design (PublicNav/PublicFooter, same tokens as/aboutand/help).middleware.ts: added/termsand/privacyto the public allowlist so they render for anonymous visitors (and automated carrier review).PublicFooter: Terms/Privacy links now point at Builder's own pages instead ofainative.studio's.message_flow,opt_out_keywords,opt_out_message).Next step (not code — account/compliance work)
Once this is live on
builder.ainative.studio, the Twilio A2P campaign needs to be resubmitted with:TERMS_AND_CONDITIONS_URL=https://builder.ainative.studio/termsPRIVACY_POLICY_URL=https://builder.ainative.studio/privacyTest plan
npx tsc --noEmit— cleannpx vitest run— 5631 passed, 50 skipped (0 new failures)npx vitest run middleware— 37/37 passedGET /terms→ 200,GET /privacy→ 200 (previously 307 →/login)/termsand/privacy(notainative.studio)