Bring the privacy policy, terms and site copy up to date with end-to-end encryption

.github/workflows/ci.yml

@@ -75,8 +75,7 @@ jobs:
       # rules; plain Node.
       - run: npm run test:keys
       - run: npm run build
-      # The extension builds without VITE_AXIOM_TOKEN and then logs to the console only,
-      # which is what a fork gets. Its bundle is not uploaded from here.
+      # The extension's bundle is not uploaded from here.
       - run: npm run build:chrome
 
   android:

AGENTS.md

@@ -38,9 +38,9 @@ original did. Prefer placeholders that are obviously made up (`example.com`,
 `someone@example.com`) over ones that merely sound plausible.
 
 The same goes for credentials. The service account key for `packages/push-test`, Stripe
-keys and webhook secrets, the Axiom token, signing keystores: none of them is ever
-committed, and each has a gitignored place to live (see the docs for each app). If you find
-real content or a secret already in the repo, say so rather than quietly working around it.
+keys and webhook secrets, signing keystores: none of them is ever committed, and each has a
+gitignored place to live (see the docs for each app). If you find real content or a secret
+already in the repo, say so rather than quietly working around it.
 
 ## Commits
 

README.md

@@ -28,11 +28,11 @@ The apps and the Firestore and Storage rules are what decide what a client can r
 write, and they are all here: [apps/web/firestore.rules](apps/web/firestore.rules) and
 [apps/web/storage.rules](apps/web/storage.rules), with their tests beside them. The Cloud
 Functions are here too, but nothing proves that what runs on pushthat.link is this code, so
-that part you take on trust. Pushes are end-to-end encrypted: a push's link, title and file
-are encrypted on the device with a key made from the account password, and Firebase holds
-only ciphertext and the metadata it needs to count, deliver and expire it. [End-to-end
-encryption](docs/e2ee.md) is the specification, and `packages/push-test` is the reference
-the five clients are checked against.
+that part you take on trust. Pushes are end-to-end encrypted: a push's link, title and
+file are encrypted on the device with a key that only the account password, or its
+recovery key, unlocks, and Firebase holds only ciphertext and the metadata it needs to
+count, deliver and expire it. [End-to-end encryption](docs/e2ee.md) is the specification,
+and `packages/push-test` is the reference the five clients are checked against.
 
 ## Layout
 

apps/android/app/src/main/java/com/makerocketgonow/pushthat/e2ee/AccountKeys.kt

@@ -102,6 +102,13 @@ class AccountKeys(
      * registration and at sign-in, so an account made here with a space at either end has
      * the trimmed password in Firebase. The keys are derived from it untrimmed, as the
      * spec says and the other apps do, so it signs in the same everywhere afterwards.
+     *
+     * The fallback stays after every old account has moved, because password resets
+     * depend on it. A reset runs on Firebase's hosted form (docs/e2ee.md, "Password
+     * reset"), which sets the raw new password as the Firebase password, so the first
+     * sign-in after any reset gets in this way and then moves the account back to
+     * `authKey`. It can go only once a reset sets `authKey` itself, which needs the reset
+     * email's action URL unlocked.
      */
     private suspend fun signInToFirebase(email: String, password: String, firebasePassword: String): Boolean {
         try {

apps/android/app/src/main/res/values/strings.xml

@@ -67,7 +67,7 @@
     <!-- %1$d is MIN_NEW_PASSWORD_LENGTH (e2ee/AccountKeys.kt), so the number is written once. -->
     <string name="password_rule">Use at least %1$d characters. Your password is the key to your pushes, so it has to be hard to guess.</string>
     <string name="recovery_key_title">Your recovery key</string>
-    <string name="recovery_key_body">Your password is the key to your pushes. We never see it and cannot reset it for you. Save your recovery key.</string>
+    <string name="recovery_key_body">Your password is the key to your pushes, and we cannot reset it for you. Save your recovery key.</string>
     <string name="recovery_key_shown_once">It is shown only once. If you forget your password, it is the only way to keep your pushes.</string>
     <string name="copy">Copy</string>
     <string name="copied">Copied</string>

apps/ios/PushThat/ViewModels/AuthViewModel.swift

@@ -130,6 +130,12 @@ class AuthViewModel: ObservableObject {
 
     /// Signs in with `base64url(authKey)`, falling back to the raw password for an account
     /// that has not moved yet, then finds the account key (docs/e2ee.md, "Migration").
+    ///
+    /// The fallback stays after every old account has moved, because password resets depend
+    /// on it. A reset runs on Firebase's hosted form (docs/e2ee.md, "Password reset"), which
+    /// sets the raw new password as the Firebase password, so the first sign-in after any
+    /// reset gets in this way and then moves the account back to `authKey`. It can go only
+    /// once a reset sets `authKey` itself, which needs the reset email's action URL unlocked.
     private func signInWithKeys(email: String, password: String) async throws {
         let keys = try await Self.derive(email: email, password: password)
 

apps/ios/PushThat/Views/RecoveryKeyView.swift

@@ -20,7 +20,7 @@ struct RecoveryKeyView: View {
                     .font(.title)
                     .fontWeight(.bold)
 
-                Text("Your password is the key to your pushes. We never see it and cannot reset it for you. Save your recovery key.")
+                Text("Your password is the key to your pushes, and we cannot reset it for you. Save your recovery key.")
                     .multilineTextAlignment(.center)
 
                 Text("It is shown only once. If you forget your password, it is the only way to keep your pushes.")

apps/macos/PushThat/ViewModels/AuthViewModel.swift

@@ -129,6 +129,12 @@ class AuthViewModel: ObservableObject {
 
     /// Signs in with `base64url(authKey)`, falling back to the raw password for an account
     /// that has not moved yet, then finds the account key (docs/e2ee.md, "Migration").
+    ///
+    /// The fallback stays after every old account has moved, because password resets depend
+    /// on it. A reset runs on Firebase's hosted form (docs/e2ee.md, "Password reset"), which
+    /// sets the raw new password as the Firebase password, so the first sign-in after any
+    /// reset gets in this way and then moves the account back to `authKey`. It can go only
+    /// once a reset sets `authKey` itself, which needs the reset email's action URL unlocked.
     private func signInWithKeys(email: String, password: String) async throws {
         let keys = try await Self.derive(email: email, password: password)
 

apps/macos/PushThat/Views/RecoveryKeyView.swift

@@ -20,7 +20,7 @@ struct RecoveryKeyView: View {
                     .font(.title)
                     .fontWeight(.bold)
 
-                Text("Your password is the key to your pushes. We never see it and cannot reset it for you. Save your recovery key.")
+                Text("Your password is the key to your pushes, and we cannot reset it for you. Save your recovery key.")
                     .multilineTextAlignment(.center)
 
                 Text("It is shown only once. If you forget your password, it is the only way to keep your pushes.")

apps/web/.gitignore

@@ -28,5 +28,5 @@ chrome-extension
 # Firebase
 .firebase
 
-# Local environment (see .env.example)
+# Local environment
 .env

apps/web/chrome/background.ts

@@ -1,8 +1,6 @@
 /* eslint-disable @typescript-eslint/no-explicit-any */
 /// <reference types="chrome"/>
 /// <reference lib="webworker" />
-/// <reference types="vite/client" />
-import { Axiom } from '@axiomhq/js';
 import { User } from 'firebase/auth';
 import {
   arrayUnion,
@@ -28,12 +26,6 @@ declare const self: ServiceWorkerGlobalScope & typeof globalThis;
 // Initialize Firebase Cloud Messaging
 const messaging = getMessaging(app);
 
-// The ingest token comes from the build environment (apps/web/.env, see .env.example) so
-// that it is never committed. It still ships inside the built extension, so it has to be an
-// ingest-only token. A build without one logs to the console only.
-const axiomToken = import.meta.env.VITE_AXIOM_TOKEN;
-const axiom = axiomToken ? new Axiom({ token: axiomToken }) : undefined;
-
 interface SignInMessage {
   type: 'ON_AUTH_STATE_CHANGED';
   user: User;
@@ -45,7 +37,7 @@ function isAuthStateChangedInMessage(message: any): message is SignInMessage {
 }
 
 async function updateUserFcmToken(userId: string, token: string) {
-  await debug('Updating user FCM token', { userId });
+  debug('Updating user FCM token', { userId });
   const db = getFirestore(app);
 
   const userRef = doc(db, 'users', userId);
@@ -59,13 +51,13 @@ async function updateUserFcmToken(userId: string, token: string) {
 
       // Only add the token if it doesn't already exist
       if (!existingTokens.includes(token)) {
-        await debug('Adding token to user', { userId });
+        debug('Adding token to user', { userId });
         await updateDoc(userRef, {
           fcmTokens: arrayUnion(token),
         });
       }
     } else {
-      await debug('Creating new user document', { userId });
+      debug('Creating new user document', { userId });
       // Create new user document if it doesn't exist
       try {
         await setDoc(userRef, {
@@ -79,7 +71,7 @@ async function updateUserFcmToken(userId: string, token: string) {
       }
     }
   } catch (error) {
-    await logError('Error updating user FCM token:', { error });
+    logError('Error updating user FCM token:', { error });
     throw error;
   }
 }
@@ -102,21 +94,21 @@ const requestFcmToken = async (userId: string): Promise<string | undefined> => {
 
     return token;
   } catch (error) {
-    await logError('Error getting FCM token:', { error });
+    logError('Error getting FCM token:', { error });
   }
 
   return undefined;
 };
 
 async function start() {
   const { userId } = await chrome.storage.local.get('userId');
-  await debug('START', { userId });
+  debug('START', { userId });
   if (userId) {
-    await debug('Requesting FCM token');
+    debug('Requesting FCM token');
     const token = await requestFcmToken(userId);
-    await debug(`FCM token result: ${!!token}`);
+    debug(`FCM token result: ${!!token}`);
   } else {
-    await debug('No user id found, PushThat will not open new pushes.');
+    debug('No user id found, PushThat will not open new pushes.');
   }
 }
 
@@ -155,14 +147,14 @@ async function readReceivedPush(pushId: string): Promise<Push | undefined> {
  */
 async function handleEncryptedPush(data: { pushId?: string; deviceId?: string }) {
   if (data.deviceId && data.deviceId === (await deviceId())) {
-    await debug('Skipping a push this browser sent');
+    debug('Skipping a push this browser sent');
     return;
   }
   let push: Push | undefined;
   try {
     push = data.pushId ? await readReceivedPush(data.pushId) : undefined;
   } catch (error) {
-    await logError('Could not read a received push:', { error: String(error) });
+    logError('Could not read a received push:', { error: String(error) });
   }
 
   if (push?.url && push.type === 'url') {
@@ -186,15 +178,10 @@ async function handlePush(event: PushEvent) {
   // The data says which push, never what is in it; the URL is not logged once decrypted.
   debug('Received push notification ', { pushId: data?.pushId, type: data?.type });
 
-  try {
-    // Every push is announced by its id alone (functions/src/notifications.ts): the rules
-    // refuse a plaintext push, so the message that carried a URL and a device name to open
-    // from is never sent, and a URL is only ever opened once it has been decrypted here.
-    if (data?.pushId) await handleEncryptedPush(data);
-  } finally {
-    // Axiom batches in the background; make sure the logs land before the worker is allowed to sleep.
-    await axiom?.flush();
-  }
+  // Every push is announced by its id alone (functions/src/notifications.ts): the rules
+  // refuse a plaintext push, so the message that carried a URL and a device name to open
+  // from is never sent, and a URL is only ever opened once it has been decrypted here.
+  if (data?.pushId) await handleEncryptedPush(data);
 }
 
 // Handle notification clicks
@@ -213,7 +200,7 @@ self.addEventListener('notificationclick', async (event) => {
 
 chrome.runtime.onMessage.addListener(async (message: any, sender, sendResponse) => {
   if (isAuthStateChangedInMessage(message)) {
-    await debug('ON_AUTH_STATE_CHANGED', { userId: message.user?.uid });
+    debug('ON_AUTH_STATE_CHANGED', { userId: message.user?.uid });
 
     if (message.user && message.user.uid) {
       // Save userId to storage
@@ -233,11 +220,11 @@ chrome.runtime.onMessage.addListener(async (message: any, sender, sendResponse)
 self.addEventListener('activate', async (event) => {
   try {
     // Run code when service worker becomes active
-    await debug('Service worker activating');
+    debug('Service worker activating');
 
     start();
   } catch (error) {
-    await logError('Activation error:', { error });
+    logError('Activation error:', { error });
   }
 });
 
@@ -255,36 +242,20 @@ chrome.runtime.onInstalled.addListener(async (details) => {
 
 // Add wake-up listeners
 // chrome.idle.onStateChanged.addListener(async (state) => {
-//   await debug('System state changed:', { state });
+//   debug('System state changed:', { state });
 // });
 
 chrome.runtime.onStartup.addListener(async () => {
-  await debug('Extension starting up');
+  debug('Extension starting up');
   await start();
 });
 
-async function debug(message: string, optionalParams?: any) {
+// Logs stay in the extension's own console. They went to Axiom as well until it was removed:
+// that sent user and push ids to a third party the privacy policy did not name.
+function debug(message: string, optionalParams?: any) {
   console.debug(message, optionalParams);
-  return axiom?.ingest('push-that-chrome', [
-    {
-      type: 'debug',
-      message,
-      source: 'chrome-extension',
-      timestamp: Date.now(),
-      ...(optionalParams ? { ...optionalParams } : {}),
-    },
-  ]);
 }
 
-async function logError(message: string, optionalParams?: any) {
+function logError(message: string, optionalParams?: any) {
   console.error(message, optionalParams);
-  return axiom?.ingest('push-that-chrome', [
-    {
-      type: 'error',
-      message,
-      source: 'chrome-extension',
-      timestamp: Date.now(),
-      ...(optionalParams ? { ...optionalParams } : {}),
-    },
-  ]);
 }

apps/web/package.json

@@ -18,7 +18,6 @@
     "spellcheck": "cspell -c ../../cspell.json --gitignore \"**/*.{js,json,jsx,md,ts,tsx}\""
   },
   "dependencies": {
-    "@axiomhq/js": "^1.3.1",
     "@heroicons/react": "^2.2.0",
     "clsx": "^2.1.1",
     "firebase": "^11.2.0",

apps/web/src/components/KeyGate.tsx

@@ -197,7 +197,7 @@ function NewRecoveryKey({ recoveryKey }: { recoveryKey: string }) {
       </h2>
       {/* docs/e2ee.md, Saying so: the sign-up's words, word for word. */}
       <p className={styles.message}>
-        Your password is the key to your pushes. We never see it and cannot reset it for you. Save your recovery key.
+        Your password is the key to your pushes, and we cannot reset it for you. Save your recovery key.
       </p>
       <p className={styles.message}>
         It is shown only once. If you forget your password, it is the only way to keep your pushes.