From 14dc5cac5c237dd64480da85c4983d1375465adf Mon Sep 17 00:00:00 2001
From: Josh Panka <josh.panka@gmail.com>
Date: Fri, 16 Oct 2026 13:14:15 -0400
Subject: [PATCH] feat: the privacy policy and terms of service, linked from
 the footer

Two pages on the marketing site, /privacy and /terms, written for what
the product does: a self-hosted install sends us nothing but the
sign-in, keys are never pooled, rows go to the providers the person
configured under their keys, the software is Apache 2.0 and an install
is governed by that licence. The operator is Obris LLC, the law
Massachusetts, the mailboxes privacy@, support@ and security@.

The footer is regrouped by what the information is: the fine print on
the left (the copyright naming Obris LLC, the licence, Privacy, Terms)
and the places to go next on the right (Docs, GitHub); on a phone the
groups stack with the links first. "All rights reserved" is gone, since
the licence says otherwise. The sitemap lists both pages.
---
 .../marketing/src/app/_components/Footer.tsx  |  38 +++--
 .../src/app/_components/LegalPage.tsx         |  38 +++++
 web/apps/marketing/src/app/privacy/page.tsx   | 131 ++++++++++++++++
 web/apps/marketing/src/app/sitemap.ts         |   7 +-
 web/apps/marketing/src/app/terms/page.tsx     | 141 ++++++++++++++++++
 5 files changed, 342 insertions(+), 13 deletions(-)
 create mode 100644 web/apps/marketing/src/app/_components/LegalPage.tsx
 create mode 100644 web/apps/marketing/src/app/privacy/page.tsx
 create mode 100644 web/apps/marketing/src/app/terms/page.tsx

diff --git a/web/apps/marketing/src/app/_components/Footer.tsx b/web/apps/marketing/src/app/_components/Footer.tsx
index f8e0aaf9b..6886b521a 100644
--- a/web/apps/marketing/src/app/_components/Footer.tsx
+++ b/web/apps/marketing/src/app/_components/Footer.tsx
@@ -1,23 +1,37 @@
-import { DOCS_URL } from "../_lib/urls";
+import Link from "next/link";
+
+import { DOCS_URL, GITHUB_URL } from "../_lib/urls";
 import { GithubLink } from "./GithubLink";
 
+/** Two groups, which is the information: the fine print (who holds the
+ * copyright, the licence that qualifies it, the two legal pages) on the
+ * left in the quiet tone, and the places to go next (docs, the code) on
+ * the right. On a phone the groups
+ * stack, links first and fine print last, in their order of importance
+ * rather than their DOM order. No "all rights reserved": the software is
+ * Apache 2.0 and the line would say otherwise. */
 export function Footer() {
+  const quiet = "transition-colors hover:text-ink dark:hover:text-paper";
   return (
     <footer className="mt-auto border-t border-ink/10 dark:border-paper/10">
-      <div className="mx-auto flex w-full max-w-6xl flex-wrap items-center justify-between gap-3 px-6 py-8 text-sm text-ink/50 dark:text-paper/50">
-        <p>&copy; {new Date().getFullYear()} OpenBower. All rights reserved.</p>
+      <div className="mx-auto flex w-full max-w-6xl flex-col-reverse gap-y-4 px-6 py-8 text-sm text-ink/50 dark:text-paper/50 sm:flex-row sm:items-center sm:justify-between sm:gap-x-8">
+        <div className="flex flex-wrap items-center gap-x-6 gap-y-1">
+          <p>&copy; {new Date().getFullYear()} Obris LLC</p>
+          <a href={`${GITHUB_URL}/blob/main/LICENSE`} target="_blank" rel="noreferrer noopener" className={quiet}>
+            Apache 2.0
+          </a>
+          <Link href="/privacy" className={quiet}>
+            Privacy
+          </Link>
+          <Link href="/terms" className={quiet}>
+            Terms
+          </Link>
+        </div>
         <div className="flex gap-6">
-          <a
-            href={DOCS_URL}
-            target="_blank"
-            rel="noreferrer noopener"
-            className="transition-colors hover:text-ink dark:hover:text-paper"
-          >
+          <a href={DOCS_URL} target="_blank" rel="noreferrer noopener" className={quiet}>
             Docs
           </a>
-          <GithubLink className="inline-flex items-center gap-1.5 transition-colors hover:text-ink dark:hover:text-paper">
-            GitHub
-          </GithubLink>
+          <GithubLink className={`inline-flex items-center gap-1.5 ${quiet}`}>GitHub</GithubLink>
         </div>
       </div>
     </footer>
diff --git a/web/apps/marketing/src/app/_components/LegalPage.tsx b/web/apps/marketing/src/app/_components/LegalPage.tsx
new file mode 100644
index 000000000..3b6fdaf78
--- /dev/null
+++ b/web/apps/marketing/src/app/_components/LegalPage.tsx
@@ -0,0 +1,38 @@
+import type { ReactNode } from "react";
+
+import { Footer } from "./Footer";
+import { Navbar } from "./Navbar";
+
+/** The shell the two legal pages share: the site chrome around a
+ * narrow reading measure. Sections are plain h2 + paragraphs so the
+ * text, not the layout, carries the page. */
+export function LegalPage({ title, effective, children }: { title: string; effective: string; children: ReactNode }) {
+  return (
+    <>
+      <Navbar />
+      <main className="mx-auto w-full max-w-3xl px-6 py-24">
+        <h1 className="text-3xl font-bold text-ink dark:text-paper">{title}</h1>
+        <p className="mt-3 text-sm text-ink/60 dark:text-paper/60">Effective {effective}</p>
+        <div className="legal mt-10 space-y-5 text-base leading-7 text-ink/80 dark:text-paper/80">{children}</div>
+      </main>
+      <Footer />
+    </>
+  );
+}
+
+export function Section({ title, children }: { title: string; children: ReactNode }) {
+  return (
+    <section className="space-y-4 pt-4">
+      <h2 className="text-xl font-semibold text-ink dark:text-paper">{title}</h2>
+      {children}
+    </section>
+  );
+}
+
+export function Mail({ address }: { address: string }) {
+  return (
+    <a href={`mailto:${address}`} className="text-signal hover:underline">
+      {address}
+    </a>
+  );
+}
diff --git a/web/apps/marketing/src/app/privacy/page.tsx b/web/apps/marketing/src/app/privacy/page.tsx
new file mode 100644
index 000000000..c373c9293
--- /dev/null
+++ b/web/apps/marketing/src/app/privacy/page.tsx
@@ -0,0 +1,131 @@
+import type { Metadata } from "next";
+import Link from "next/link";
+
+import { LegalPage, Mail, Section } from "../_components/LegalPage";
+
+export const metadata: Metadata = {
+  title: "Privacy policy",
+  description: "What OpenBower collects, what it does with it, and what it never does.",
+};
+
+export default function PrivacyPage() {
+  return (
+    <LegalPage title="Privacy policy" effective="October 16, 2026">
+      <Section title="1. Who this covers">
+        <p>
+          OpenBower is operated by Obris LLC (&quot;we&quot;). This policy covers the website at openbower.ai, the
+          hosted app at app.openbower.ai, and the account service at auth.openbower.ai that signs you into both
+          (together, the &quot;Service&quot;).
+        </p>
+        <p>
+          A self-hosted install of OpenBower is your own. It runs on your machine, and we receive nothing from it
+          except the sign-in described below. Everything else it holds, your sheets, your keys, your results, stays
+          with you.
+        </p>
+      </Section>
+
+      <Section title="2. What we collect">
+        <p>
+          <strong>Your account.</strong> Your email address and, if you choose a password, a hash of it. If you sign in
+          with Google or GitHub, the stable identifier that provider assigns you and the email address it reports as
+          verified. We never see your password at the provider.
+        </p>
+        <p>
+          <strong>Your content in the hosted app.</strong> The sheets, rows, columns, agent configurations and webhook
+          settings you create there.
+        </p>
+        <p>
+          <strong>Keys you add.</strong> API keys for the model and data providers you connect are stored to run your
+          own work and nothing else. We never pool them, share what they return with other accounts, or build anything
+          on what a provider returned through your key.
+        </p>
+        <p>
+          <strong>Operational records.</strong> Request logs with IP address, browser type and timestamps, kept to
+          operate and secure the Service.
+        </p>
+        <p>
+          <strong>Updates you ask for.</strong> The email address you give us to hear from us, and nothing else about
+          you.
+        </p>
+      </Section>
+
+      <Section title="3. How we use it">
+        <p>
+          To sign you in, run the research you ask for, deliver the webhooks you configure, keep the Service working,
+          and reply when you write to us. We do not sell your information and we do not use your content to train
+          models.
+        </p>
+      </Section>
+
+      <Section title="4. Where your rows go">
+        <p>
+          When an agent fills a column, the rows it works on are sent to the model and search providers you have
+          configured, under your keys and their terms. The hosted company universe behind look-alike discovery is
+          built from data licensed to us; nothing you add to it comes from another user&apos;s keys.
+        </p>
+      </Section>
+
+      <Section title="5. Who else sees it">
+        <p>
+          The infrastructure providers that host the Service and deliver its email, under contracts that limit them to
+          providing that service to us; and authorities when the law requires it. No one else.
+        </p>
+      </Section>
+
+      <Section title="6. Cookies">
+        <p>
+          The Service sets the cookies sign-in needs: a session cookie at auth.openbower.ai and one at the app. Your
+          theme preference and a remembered email live in your browser alone. There is no advertising or cross-site
+          tracking.
+        </p>
+      </Section>
+
+      <Section title="7. Keeping and deleting">
+        <p>
+          We keep your account and content for as long as you use the Service. Write to{" "}
+          <Mail address="privacy@openbower.ai" /> to delete your account; we remove your content and sign-in records
+          within 30 days, and operational logs age out on their own.
+        </p>
+      </Section>
+
+      <Section title="8. Security">
+        <p>
+          Traffic to the Service is encrypted in transit. Passwords are stored as salted hashes, and the tokens that
+          sign you into the hosted app are encrypted at rest. Report a concern to{" "}
+          <Mail address="security@openbower.ai" />.
+        </p>
+      </Section>
+
+      <Section title="9. Your rights">
+        <p>
+          You can see, correct, export or delete what we hold about you. Where the law gives you rights beyond these,
+          you have them. Write to <Mail address="privacy@openbower.ai" />.
+        </p>
+      </Section>
+
+      <Section title="10. Children">
+        <p>
+          The Service is not for anyone under 13, and we do not knowingly collect their information. If we learn that
+          we have, we delete it.
+        </p>
+      </Section>
+
+      <Section title="11. Changes">
+        <p>
+          When this policy changes, the date at the top changes with it. A change that matters to you is announced in
+          the app before it takes effect.
+        </p>
+      </Section>
+
+      <Section title="12. Contact">
+        <p>
+          <Mail address="privacy@openbower.ai" /> for anything about this policy. The{" "}
+          <Link href="/terms" className="text-signal hover:underline">
+            terms of service
+          </Link>{" "}
+          cover the rest.
+        </p>
+      </Section>
+    </LegalPage>
+  );
+}
diff --git a/web/apps/marketing/src/app/sitemap.ts b/web/apps/marketing/src/app/sitemap.ts
index 09db1e7cb..7f514dc0e 100644
--- a/web/apps/marketing/src/app/sitemap.ts
+++ b/web/apps/marketing/src/app/sitemap.ts
@@ -1,5 +1,10 @@
 import type { MetadataRoute } from "next";
 
 export default function sitemap(): MetadataRoute.Sitemap {
-  return [{ url: "https://openbower.ai", lastModified: new Date() }];
+  const now = new Date();
+  return [
+    { url: "https://openbower.ai", lastModified: now },
+    { url: "https://openbower.ai/privacy", lastModified: now },
+    { url: "https://openbower.ai/terms", lastModified: now },
+  ];
 }
diff --git a/web/apps/marketing/src/app/terms/page.tsx b/web/apps/marketing/src/app/terms/page.tsx
new file mode 100644
index 000000000..c9e26eff9
--- /dev/null
+++ b/web/apps/marketing/src/app/terms/page.tsx
@@ -0,0 +1,141 @@
+import type { Metadata } from "next";
+import Link from "next/link";
+
+import { GITHUB_URL } from "../_lib/urls";
+import { LegalPage, Mail, Section } from "../_components/LegalPage";
+
+export const metadata: Metadata = {
+  title: "Terms of service",
+  description: "The terms for the hosted OpenBower service and the open-source software behind it.",
+};
+
+export default function TermsPage() {
+  return (
+    <LegalPage title="Terms of service" effective="October 16, 2026">
+      <Section title="1. What these terms cover">
+        <p>
+          These terms are between you and Obris LLC (&quot;we&quot;), the operator of OpenBower, and cover the website
+          at openbower.ai, the hosted app at app.openbower.ai and the account service at auth.openbower.ai (together,
+          the &quot;Service&quot;). Using the Service means you accept them.
+        </p>
+        <p>
+          The OpenBower software itself is open source under the Apache License, Version 2.0, in{" "}
+          <a href={GITHUB_URL} className="text-signal hover:underline" target="_blank" rel="noreferrer noopener">
+            its repository
+          </a>
+          . A self-hosted install is governed by that license, not by these terms.
+        </p>
+      </Section>
+
+      <Section title="2. The Service">
+        <p>
+          OpenBower is a spreadsheet for prospecting whose columns are filled by AI research agents you configure. The
+          hosted app runs that for you on our infrastructure. Access to it is granted per account; an account you
+          create on your own install signs into the hosted app only once it has been granted.
+        </p>
+      </Section>
+
+      <Section title="3. Your account">
+        <p>
+          You must be 13 or older. You are responsible for what happens under your account and for keeping its
+          credentials to yourself; tell us at <Mail address="security@openbower.ai" /> if you think someone else has
+          them.
+        </p>
+      </Section>
+
+      <Section title="4. Your keys and the providers behind them">
+        <p>
+          The model, search and data providers you connect are your relationships, under their terms and at their
+          prices. What a provider returns through your key is licensed to you and stays in your account; we never pool
+          it or pass it to anyone else.
+        </p>
+      </Section>
+
+      <Section title="5. Acceptable use">
+        <p>You agree not to use the Service to:</p>
+        <ul className="list-disc space-y-2 pl-6">
+          <li>break the law, or contact people in ways the law or their consent does not allow;</li>
+          <li>collect or process personal data you have no right to;</li>
+          <li>interfere with the Service, probe it for weaknesses without permission, or evade its limits;</li>
+          <li>resell access to the hosted app or present its output as your own product.</li>
+        </ul>
+      </Section>
+
+      <Section title="6. Your content">
+        <p>
+          Your sheets, rows and configurations are yours. You give us only the permission needed to store them and run
+          the work you ask for. You are responsible for having the right to the data you bring in and for what you do
+          with what comes out.
+        </p>
+      </Section>
+
+      <Section title="7. Our content">
+        <p>
+          The hosted company universe behind look-alike discovery, and the Service&apos;s name and marks, are ours. You
+          may use the universe through the Service for your own prospecting and not to rebuild or redistribute it.
+        </p>
+      </Section>
+
+      <Section title="8. Availability and changes">
+        <p>
+          The hosted app is early. We change it often, and we may suspend or withdraw it. We give notice in the app for
+          changes that affect how you use it, and you can export your sheets at any time.
+        </p>
+      </Section>
+
+      <Section title="9. Disclaimers">
+        <p>
+          The Service is provided as is. Research agents are wrong sometimes, and sources can be stale; check what
+          matters before you act on it. We do not promise that the Service will be uninterrupted or error free.
+        </p>
+      </Section>
+
+      <Section title="10. Limitation of liability">
+        <p>
+          To the fullest extent the law allows, we are not liable for indirect or consequential loss, lost profits or
+          lost data arising from the Service, and our total liability to you is limited to the amount you paid us for
+          the Service in the twelve months before the claim, or one hundred US dollars if you paid nothing.
+        </p>
+      </Section>
+
+      <Section title="11. Indemnification">
+        <p>
+          You will defend and indemnify us against claims arising from your content, your use of the Service, or your
+          breach of these terms.
+        </p>
+      </Section>
+
+      <Section title="12. Ending the agreement">
+        <p>
+          You can leave at any time by asking us to delete your account at <Mail address="privacy@openbower.ai" />.
+          We can suspend or end an account that breaks these terms. Sections 6, 7, 9, 10 and 11 survive.
+        </p>
+      </Section>
+
+      <Section title="13. Governing law">
+        <p>
+          These terms are governed by the laws of the Commonwealth of Massachusetts, without regard to its conflict of
+          law rules. Nothing in them limits rights you have under the law where you live.
+        </p>
+      </Section>
+
+      <Section title="14. Changes to these terms">
+        <p>
+          When these terms change, the date at the top changes with it, and a change that matters to you is announced
+          in the app before it takes effect. Using the Service after that is acceptance.
+        </p>
+      </Section>
+
+      <Section title="15. Contact">
+        <p>
+          <Mail address="support@openbower.ai" /> for anything about these terms. How we handle your information is in
+          the{" "}
+          <Link href="/privacy" className="text-signal hover:underline">
+            privacy policy
+          </Link>
+          .
+        </p>
+      </Section>
+    </LegalPage>
+  );
+}