ParaSend takes its API key from the session, and from nowhere else

docs/site-claims.md

@@ -56,7 +56,7 @@ Pages not in scope: everything behind a login or in a one-shot flow
 | 25 | The sub-processor lists are the parties the server code calls, and no page may deny the US one | privacy, dpa, press, architecture, sweep | Every `https.request({hostname})`, `fetch('https://…')` and `*_HOST` constant in `relay/*.js`, `relay/lib/*.js`, `admin/server.js`, `admin/lib/*.js`. That is `api.resend.com` and `api.mollie.com`. **Mollie was missing from the /dpa table** that customers sign while /privacy named it; added. Bunny.net (DNS, Slovenia) added to the /privacy list, which the rest of the site already named. Extended in the review round: /press and /architecture said "No US entity in the chain" while the signed /dpa table names Resend Inc. in the US under SCCs, so no page may make that denial while a US row stands | this PR |
 | 26 | Signing-envelope and delivery-receipt retention | privacy, dpa | `relay/envelope.js` `DEFAULT_TTL_DAYS = 30`, `MAX_TTL_DAYS = 365`; `relay/relay.js` `RECEIPT_TTL_MS = 15 * 60 * 1000`. The page said "until its expiry" for the first and nothing at all for the second; both now carry the number, and the signed /dpa sub-processor row carries the same two figures instead of "may persist until envelope expiry" | this PR |
 | 27 | The CT-log hash | privacy, dpa | `relay/lib/ct-hash.js` is SHA3-256 throughout. /dpa said SHA3-256, /privacy said SHA-256 in the same row; corrected | this PR |
-| 28 | The browser-storage list | privacy | Every `localStorage` key the frontend writes, resolved through literals, constants and key-building helpers. The page listed `ps_free_uses` "to enforce the 10/day limit" and `pm_docs_key`, neither of which exists anywhere in the repository, and the limit it described is 10 a month; it did not list `paramant_api_key`, `paramant_status_v1`, `parasign.placement.tpl.v1`, `paramant_fp_…` or `paramant.keysetup.dismissed.v1`, which it does write. Pinned in both directions | this PR |
+| 28 | The browser-storage list | privacy | Every `localStorage` key the frontend reads or writes, resolved through literals, constants and key-building helpers. The page listed `ps_free_uses` "to enforce the 10/day limit" and `pm_docs_key`, neither of which exists anywhere in the repository, and the limit it described is 10 a month; it did not list `paramant_status_v1`, `parasign.placement.tpl.v1`, `paramant_fp_…` or `paramant.keysetup.dismissed.v1`, which it does write. `paramant_api_key` was listed as "removed when you sign out" while nothing removed it; ParaSend has since stopped writing it altogether (`/parashare` reads `GET /api/user/account/key` on every load and keeps the key in memory), so the row is off the list and the two remaining mentions in the frontend are `removeItem` cleanup of what an older build stored. The harvest therefore counts get/set as storage and asserts a remove-only key is NOT named: claiming a key the browser no longer keeps is the same untruth as omitting one it does. Pinned in both directions, plus a named assertion that no frontend file writes `paramant_api_key` again | this PR |
 | 29 | What a self-hosted relay logs | security | `deploy/nginx-selfhost.conf` `log_format paramant_minimal` starts with `$remote_addr`. The IP-logging row described the hosted config only, so a self-hoster read "logging is off" about a config that logs addresses. Row extended | this PR |
 | 30 | One Hetzner location | dpa, privacy, README, sweep | The DPA is the document a customer relies on and says Nuremberg (NBG1); `README.md` said Frankfurt in the table that claims EU jurisdiction. Corrected to the DPA, and no file may name a second city. Which datacentre actually runs the service is still not provable from this repository | this PR |
 | 31 | What Mollie receives, and the billing stance | dpa, privacy, terms | `relay/relay.js` routes `/v2/billing/checkout` and `/v2/billing/webhook` and calls `mollie.createPayment` unconditionally, so the sub-processor row stays. The payload is amount, description, redirectUrl, webhookUrl and `metadata{accountId, product, plan, interval}`, and **no e-mail**: the only path that would send one is `ensureCustomer`, which returns `recurring_disabled` while `BILLING_MODE` is unset (`relay/lib/billing-recurring.js:123`, `relay/lib/mollie.js` `billingStance`). /dpa named an e-mail address it never sends; /privacy and /terms still said billing was not live and plans were arranged by hand. All three now describe one-off Mollie payments with no subscriptions, and the stance is asserted by calling `billingStance()` rather than by reading it | this PR |

frontend/js/nav-auth.js

@@ -115,6 +115,7 @@
       try {
         await fetch('/api/user/logout', { method: 'POST', credentials: 'include' });
       } catch (err) {}
+      try { localStorage.removeItem('paramant_api_key'); } catch (err) {} // legacy: /parashare no longer writes it, clear an old one
       if (location.pathname === '/account' || location.pathname.startsWith('/auth/')) {
         location.href = '/';
       } else {