CodeIssuesDiscussionsWikiPull RequestsProjectsCommitsActionsReleasesContributorsPulse● GatesSecuritySettingsDeploymentsPipelineInsightsAgents✨ Explain✨ Ask AI✨ Workspace✨ Spec✨ Tests▓ Debt Map✨ NL Search🏛 Archaeology
Blame · Line-by-line history
legal-audit.md
Each line is annotated with the commit that last touched it. Click any SHA to jump to that commit and see the surrounding change.
| 39a9165 | 1 | # Gluecron Legal Pages Audit |
| 2 | ||
| 3 | **Date:** 2026-04-16 | |
| 4 | **Branch:** `claude/setup-multi-repo-dev-BCwNQ` | |
| 5 | **Scope:** Inventory of user-facing legal pages on gluecron.com ahead of attorney review. | |
| 6 | ||
| 04f6b7f | 7 | ## Update — 2026-04-21 |
| 8 | ||
| 9 | Since the original 2026-04-16 audit, the following legal documents have | |
| 10 | landed in-tree under `legal/`: | |
| 11 | ||
| 12 | - ~~Terms of Service~~ — shipped at `legal/TERMS.md` | |
| 13 | - ~~Privacy Policy~~ — shipped at `legal/PRIVACY.md` | |
| 14 | - ~~Acceptable Use Policy~~ — shipped at `legal/AUP.md` | |
| 15 | - ~~Data Processing Agreement template~~ — shipped at `legal/DPA.md` | |
| 16 | (enterprise/SSO customers, GDPR Art. 28 structure) | |
| 17 | ||
| 18 | Items below that were framed as missing pre-launch requirements are | |
| 19 | addressed by these drafts, subject to counsel review. The umbrella-vs- | |
| 20 | standalone posture question (Scenario A vs B) is still open and must be | |
| 21 | resolved by the attorney before public launch. | |
| 22 | ||
| 23 | ### Outstanding | |
| 24 | ||
| 25 | - Attorney review and sign-off on `legal/TERMS.md`, `legal/PRIVACY.md`, | |
| 26 | `legal/AUP.md`, and the new `legal/DPA.md` template. | |
| 27 | - Footer wiring: `src/views/layout.tsx` still needs links to the legal | |
| 28 | documents so users have notice at every page. | |
| 29 | - Scenario A vs B decision (umbrella under Crontech or standalone). | |
| 30 | - DMCA designated agent — the placeholder `[DMCA AGENT EMAIL]` in | |
| 31 | `legal/TERMS.md` must be filled and registered with the U.S. Copyright | |
| 32 | Office for 17 U.S.C. § 512 safe harbour. | |
| 33 | - Sub-processor list in `legal/DPA.md` should be reconciled with any | |
| 34 | additional vendors counsel identifies. | |
| 35 | ||
| 39a9165 | 36 | ## Summary |
| 37 | ||
| 38 | **No user-facing legal pages exist** in the Gluecron codebase as of this audit. | |
| 39 | ||
| 40 | A filesystem search of `src/routes/` and `src/views/` for the conventional filenames | |
| 41 | (`legal.*`, `terms.*`, `privacy.*`, `tos.*`, `eula.*`, `dmca.*`, `cookies.*`) | |
| 42 | returned zero matches. A broader substring grep across `src/` for the words | |
| 43 | `terms`, `privacy`, and `legal` surfaced only unrelated hits (a rate-limit | |
| 44 | error message and a test describing "legal characters" in a package-name | |
| 45 | validator) - no user-visible policy documents, no routes, no views, no links | |
| 46 | in the footer or navigation. | |
| 47 | ||
| 48 | The layout footer (`src/views/layout.tsx`) currently renders only the tagline | |
| 49 | "gluecron - AI-native code intelligence" with no links to Terms, Privacy, | |
| 50 | Acceptable Use, DMCA, or any other policy page. | |
| 51 | ||
| 52 | ## Implication | |
| 53 | ||
| 54 | Gluecron has **no independent legal surface** at this time. There are two | |
| 55 | defensible postures heading into attorney review; the attorney should be | |
| 56 | briefed on both so they can direct which path is taken before public launch: | |
| 57 | ||
| 58 | ### Scenario A - Gluecron operates under Crontech's umbrella legal terms | |
| 59 | ||
| 60 | If the business structure is that Crontech is the legal entity and Gluecron | |
| 61 | is a product surface of that entity, then Crontech's published Terms, | |
| 62 | Privacy Policy, Acceptable Use Policy, and DMCA notice would apply to | |
| 63 | Gluecron users by reference. | |
| 64 | ||
| 65 | Required before launch under this scenario: | |
| 66 | - Crontech's existing legal pages must explicitly name Gluecron and git | |
| 67 | hosting as covered products (or the umbrella clause must be demonstrably | |
| 68 | broad enough to cover user-uploaded code, git pushes, and third-party | |
| 69 | code hosted on behalf of users). | |
| 70 | - A footer link on every Gluecron page pointing to the Crontech legal pages | |
| 71 | so users have notice and can locate the governing terms. | |
| 72 | - Any Gluecron-specific data flows (e.g. git clone/push logs, SSH key | |
| 73 | retention, webhook payload retention, AI ingestion of hosted code) must | |
| 74 | be reflected in Crontech's privacy policy or addressed in a Gluecron | |
| 75 | supplement. | |
| 76 | ||
| 77 | ### Scenario B - Gluecron requires independent legal pages before public launch | |
| 78 | ||
| 79 | If Gluecron is (or will be) a separately-branded product with distinct | |
| 80 | risk surface (user-uploaded code, third-party repositories, AI review of | |
| 81 | private code, DMCA takedowns, export-controlled content), independent | |
| 82 | legal pages are likely required regardless of the corporate relationship | |
| 83 | to Crontech. | |
| 84 | ||
| 85 | Required before launch under this scenario: | |
| 86 | - Terms of Service (including acceptable use, content licensing grant | |
| 87 | from users to the platform for the purpose of hosting/serving, AI | |
| 88 | processing disclosure). | |
| 89 | - Privacy Policy (covering git hosting data, SSH keys, webhooks, | |
| 90 | access logs, AI ingestion, retention, subprocessors). | |
| 91 | - DMCA / Copyright policy (with a designated agent - statutory | |
| 92 | requirement for safe harbor under 17 U.S.C. § 512). | |
| 93 | - Acceptable Use Policy (malware hosting, phishing kits, abuse, | |
| 94 | rate-limit bypass). | |
| 95 | - Cookie / tracking notice if any analytics or third-party embeds are | |
| 96 | used on the public site. | |
| 97 | ||
| 98 | ## Recommendation to Attorney | |
| 99 | ||
| 100 | Brief the attorney on **both** scenarios. Ask them to: | |
| 101 | ||
| 102 | 1. Advise which posture Gluecron should adopt at launch (umbrella vs. | |
| 103 | standalone). | |
| 104 | 2. If umbrella: confirm Crontech's existing pages cover Gluecron's risk | |
| 105 | surface, or list the gaps that need patching. | |
| 106 | 3. If standalone: provide drafts (or approve drafts) for Terms, Privacy, | |
| 107 | DMCA, and Acceptable Use. | |
| 108 | 4. In either case, confirm the pre-launch banner currently shipped on | |
| 109 | gluecron.com ("Pre-launch - Gluecron is in final validation. Public | |
| 110 | signups and git hosting for non-owner users open after launch review.") | |
| 111 | is sufficient to manage reliance expectations during the validation | |
| 112 | window. | |
| 113 | ||
| 114 | ## Appendix - Files inspected | |
| 115 | ||
| 116 | - `src/routes/` - no legal-related routes | |
| 117 | - `src/views/layout.tsx` - footer has no legal links | |
| 118 | - `src/views/` - no legal-related view files | |
| 119 | - `docs/` - did not exist prior to this audit | |
| 120 | - Grep of `src/` for `terms`, `privacy`, `legal` (case-insensitive) - | |
| 121 | only non-legal hits (rate-limit error string, test description) |