Privacy Policy Addendum Candidates

Status: DRAFT — Human legal review required before any of this content is published.

The shared privacy policy at privacy.md covers all Edgeless apps generically. The apps below have non-standard data collection practices that warrant app-specific addendum sections on edgelessmedia.com/legal/privacy or in their individual support doc pages.

---

Critical (must be reviewed before store submission)

Cognitive Stories — Voice Recording + Health Data + Advertising

Why flagged: Unique combination of microphone access, health data (TBI/cognitive recovery metrics), and Google AdMob advertising. This combination triggers heightened App Store and Google Play scrutiny.

Non-standard practices:

• Microphone access: User voice retellings are processed for accuracy scoring via text conversion
• Audio processing: Confirmed (session 13, 2026-04-15) — PlatformSpeechProvider uses platform-native speech recognition only. On iOS: SFSpeechRecognizer (on-device or Apple servers, per Apple's privacy policy). On Android: SpeechRecognizer (may route audio to Google servers). No custom cloud STT API.
• Text input alternative: Confirmed — users can switch to "Type instead" for all exercises (UC-05 test confirms text fallback path)
• Health data: 30/60/90-day cognitive recovery tracking constitutes health data under HIPAA definitions (though app is not a medical device)
• Advertising: Google AdMob shows ads to free-tier users. Cognitive performance metrics must never be passed as ad signals.

Draft addendum text (ready for legal review — no outstanding engineering questions):

Cognitive Stories — Voice & Health Data

Cognitive Stories uses your device microphone to record your story retellings during exercises. Voice input is optional — you can switch to text input at any time for any exercise.

Voice recordings are converted to text by your device's built-in speech recognition engine. On iOS, this uses Apple's speech recognition (on-device or Apple servers, per Apple's privacy policy). On Android, this uses Google's speech recognition, which may send audio to Google's servers. Audio is not retained by Edgeless after conversion and is never used to identify you or create a voice profile.

Your cognitive performance data — accuracy scores, recovery trends, and session history — is stored on your device and, if you sync, on Edgeless Media servers encrypted and accessible only by you. This data is never shared with advertisers, employers, insurers, or any third party.

Cognitive Stories shows contextual ads to free-tier users through Google AdMob. Your cognitive performance data, recovery metrics, and story content are never included in ad requests.

---

Anti-Bias Trainer — Psychological Data + Advertising + ATT

Why flagged: Belief and bias profile data is among the most sensitive personal data a person can share. Combining it with AdMob advertising and the App Tracking Transparency (ATT) dialog creates a compliance risk: users may consent to tracking without understanding their bias profiles are not involved.

Non-standard practices:

• Belief and bias data: Users self-report biases, beliefs, and behavioral observations in journals
• ATT prompt: ATT dialog copy requires legal review to ensure it does NOT imply belief-based ad targeting
• Advertising: AdMob shown to free-tier users. Bias/belief data must never be passed as targeting signals.

Draft addendum text (needs legal review):

Anti-Bias Trainer — Bias Profile & Advertising

Your bias assessments, belief journal entries, and behavioral observations are deeply personal. This data is stored locally on your device and, if you sync, on Edgeless Media servers encrypted and accessible only by you.

Anti-Bias Trainer shows contextual ads to free-tier users. Your bias profile, assessment results, and journal entries are never shared with ad networks or used for ad targeting. Ads are based solely on general app category (personal development), not your personal data.

[LEGAL: Review ATT dialog copy to ensure it does not imply or enable belief-based targeting. Recommended copy: "Allow [App] to show ads that are not based on your personal data. Your bias profile and journal entries are never shared."]

---

High Sensitivity (review before store submission)

Lighthouses — Location + Photos + Advertising

Why flagged: Combination of precise GPS location, user photos, and AdMob advertising. Google Play and App Store flag apps that combine location with advertising for enhanced review.

Non-standard practices:

• Precise GPS: Used on-demand to show nearby lighthouses on the map (foreground-only, not background). GPS coordinates are not stored — visit records contain only which lighthouse was visited and when, not user coordinates.
• Photos: User-captured journal entry photos stored in private MinIO bucket (up to 5 per journal entry). No GPS EXIF metadata captured or stored.
• Advertising: AdMob shown to free-tier users. Location coordinates must never be passed as ad signals.

Note (session 19, 2026-04-15): GPS stores no user coordinates. Prior text "visit tagging" was inaccurate — corrected to match confirmed implementation.

Draft addendum text (needs legal review):

Lighthouses — Location & Photos

Lighthouses accesses your device location (foreground-only, never background) only to show nearby lighthouses on the map and calculate distances. Your GPS coordinates are never stored — visit records contain only which lighthouse you visited and when, not where you were standing. Location is never tracked when the app is closed.

Visit photos you capture are stored in your private, encrypted storage and are never shared with other users or third parties.

Lighthouses shows contextual ads to free-tier users. Your location data, visit history, and photos are never included in ad requests. Location is used only within the app for your trip planning.

---

Grief Companion — Mental Health Data

Why flagged: Grief journal entries, memory archives, and grief assessments constitute sensitive mental health data. The app's excellent privacy posture (no ads, no analytics, local-first) should be prominently disclosed as a differentiator.

Non-standard practices:

• Highly sensitive emotional content: Journal entries, grief assessments, memory preservation (photos, stories, meaningful dates)
• Excellent privacy: No advertising ever, no analytics SDKs, AES-256 encryption at rest
• Should NOT be generic: Users of grief apps are in a vulnerable state and deserve explicit reassurance

Draft addendum text (needs legal review):

Grief Companion — Sensitive Data Commitment

Grief Companion holds some of the most personal data you will ever share with an app — your journal entries, memories, grief assessments, and emotional records. We treat this with the seriousness it deserves.

What we promise:

• Your grief data is stored locally on your device by default, encrypted with AES-256
• If you choose to sync (paid tier), data is stored on Edgeless servers encrypted and accessible only by you
• Grief Companion will never show advertising — not now, not ever
• No analytics company receives any data about your journal entries, grief assessments, or emotional state
• Crash reporting (Sentry) receives only technical error data, never your personal content

If you delete your account, all grief data, memories, and photos are permanently deleted within 30 days.

---

Self-Compassion — Mental Health Journaling

Why flagged: Mood ratings, self-critical thought journals, and self-compassion scores constitute sensitive mental health data.

Non-standard practices:

• Journal entries: Self-critical thoughts and emotional content, AES-256 encrypted at rest
• Mood ratings: Tracked over time (similar to a mental health mood diary)
• Analytics: PostHog used for anonymous usage events (explicitly excludes journal/mood data)

Draft addendum text (needs legal review):

Self-Compassion — Mental Health Data

Self-Compassion stores your journal entries and mood tracking data with AES-256-CBC encryption. Journal entries are encrypted using a key stored only on your device (in your device's secure keychain). The encryption key is not synced to Edgeless servers and cannot be transferred to a new device — if you switch devices, previously encrypted entries cannot be decrypted on the new device. Your personal content — what you write, how you feel, your self-compassion scores — is never shared with any third party.

We use anonymous usage analytics (PostHog) to understand how people use the app. These events record only app actions (e.g., "journal entry created") and never include the content of your entries, your mood ratings, or your self-compassion scores.

Self-Compassion does not show advertising.

---

Medium Sensitivity (review before major store updates)

Bucket List — User Photos (Not Yet Active)

Why flagged: Bucket List has photo infrastructure scaffolded (Photos DB table, PhotosDao, image_picker: ^1.1.2 in pubspec) but the user-facing photo picker feature is not yet implemented. No camera or media permissions are declared in AndroidManifest.xml and no UI code calls ImagePicker. No users can currently attach photos.

Confirmed (2026-04-16): image_picker is in pubspec but inactive — no permissions declared, no picker UI in code. Photo schema exists for future use only.

Current status: No addendum required for the current release. When the photo feature ships, the following draft text should be reviewed and published:

Draft addendum text for future release (needs legal review before publishing):

Bucket List — Photos

Bucket List allows you to attach photos to your goals and completion reflections. Photos are selected from your device's camera or photo library.

Photos you add are stored in your private, encrypted cloud storage and are accessible only by you. Photos are never shared with other users or third parties. If you delete a goal or reflection, associated photos are deleted from storage within 24 hours.

Bucket List does not show advertising.

---

Memoryish — Personal Memory Archive

Why flagged: Stores memory narratives, photos, named people, and linked places — a uniquely sensitive combination. Privacy-first posture should be explicitly communicated.

Draft addendum text (needs legal review):

Memoryish — Memory Archive Privacy

Memoryish stores your memories, linked people, and location context (city/place names — not GPS coordinates). This is personal archive data. It is stored locally by default and never shared with anyone.

Note: Photo capability is not yet implemented in the current release. This section will be updated when photo support ships.

If you enable sync (paid tier), your memories are stored on Edgeless servers encrypted and accessible only by you. The names of people in your memories and the places you link are treated as sensitive personal data and are never included in any analytics events.

Memoryish does not show advertising and will never do so.

---

Better Sleep — Health Data + Advertising

Why flagged: Better Sleep stores sleep health data (bedtime/wake times, quality ratings, habit completion logs) and shows Google AdMob ads to free-tier users. Health data combined with advertising triggers heightened App Store and Google Play scrutiny, similar to Cognitive Stories.

Non-standard practices:

• Health data: Sleep timing, quality ratings, routine completion logs constitute Health & Fitness data
• Advertising: Google AdMob shown to free-tier users via BannerAdWidget
• Health data must never be passed as ad signals — explicit disclosure needed
• RevenueCat handles subscription events (purchase data only, not health content)

Draft addendum text (needs legal review):

Better Sleep — Sleep Data & Advertising

Better Sleep stores your sleep logs — bedtime, wake time, quality ratings, and routine completion history. This is health data. It is stored on your device and, if you sync (paid tier), on Edgeless Media servers encrypted and accessible only by you.

Better Sleep shows contextual ads to free-tier users through Google AdMob. Your sleep logs, quality ratings, and routine history are never included in ad requests. AdMob receives only standard device-level signals (device ID, general region, app category). Subscribing removes all ads.

Your sleep data is never shared with your employer, insurer, or any third party.

---

Unsolicited Advice — Public Community Content + Advertising

Why flagged: Unsolicited Advice is a community platform where user-submitted advice posts and personal stories are public by design — visible to all users. Users are identified by account when posting. The app also shows AdMob interstitial ads to free-tier users after every 5 actions.

Non-standard practices:

• Public UGC: Advice posts and personal stories are visible to all community members; this is more personally identifying than anonymous content contributions
• Identity linked to posts: User accounts are linked to posted content by design (community attribution)
• Advertising: AdMob interstitial ads shown to free-tier users. Posted content and voting behavior must never be used as ad targeting signals.
• The shared policy covers personal data but does not address publicly-contributed content lifecycle, moderation, or user-controlled deletion of public posts

Draft addendum text (needs legal review):

Unsolicited Advice — Community Content & Advertising

Unsolicited Advice is a community platform. Advice posts and personal stories you publish are visible to all users of the app by design. Your account identifier (display name or username) is associated with content you post.

You can delete your own posts at any time from within the app. Deleted posts are removed from the community feed within 24 hours. Your private saved wisdom library and voting history are visible only to you and are deleted when you delete your account.

Unsolicited Advice shows contextual interstitial ads to free-tier users through Google AdMob. Your posted content, voting behavior, and advice preferences are never shared with AdMob or used for ad targeting. Subscribing removes all ads.

---

---

Low Sensitivity (review before major store updates)

Random Reminders — Community Content

Why flagged: Random Reminders allows users to contribute advice/wisdom snippets to a community pool with voting. The policy covers personal data but says nothing about publicly-contributed content — its retention, moderation, or whether it can be linked back to a user.

Non-standard practices:

• Community-contributed content: User-submitted advice snippets are public and visible to all users
• Voting/rating: User votes on content are associated with their account
• Policy says nothing about community content lifecycle or moderation

Draft addendum text (needs legal review):

Random Reminders — Community Content

Random Reminders allows you to contribute advice and wisdom snippets to a shared community pool. Content you contribute is public by design — it may be seen by any other Random Reminders user.

Community-contributed content is not subject to the same privacy protections as your personal data. You can delete your contributed content from within the app at any time. Deleted contributions are removed from the community pool within 24 hours.

---

Cross-App Policy Gap — Behavioral Data Classification

Why flagged: Multiple apps collect assessment-derived scores and behavioral patterns that are not explicitly classified in the policy:

• Anti-Bias Trainer: bias pattern profiles, cognitive focus history
• Self-Compassion: mood ratings, mindfulness session data
• Better Sleep: sleep quality trends
• Cognitive Stories: cognitive accuracy trends, retelling patterns

The policy lists specific apps under "Health and Sensitive Data" but uses ad-hoc language. Assessment scores and behavioral patterns arguably qualify as sensitive personal data under GDPR and CCPA.

Recommended shared policy addition (needs legal sign-off):

Assessment scores, behavioral patterns, and emotional state trackers (mood ratings, cognitive accuracy trends, bias profiles, mindfulness usage) are treated as health data and protected with the same safeguards as other sensitive personal information. This data is never shared with advertisers, employers, or insurers.

---

Action Items for Legal Review

App	Issue	Draft committed?	Blocker?
Cognitive Stories	⚠️ Open engineering question (session 15): Draft (FACTORY-8450) says Android STT on-device forcing is unresolved — contradicts session 13 finding. Engineering must re-verify before legal review. Draft committed to docs/privacy-addendum-draft.md.	Yes — FACTORY-8450	Legal review — resolve Android STT question first
Anti-Bias Trainer	(1) ATT dialog copy needs legal sign-off; (2) Journal encryption not implemented (plaintext despite encryptedContent field) — engineering fix required. Draft committed (FACTORY-8741).	Yes — FACTORY-8741	YES — BOTH must resolve before store submission
Better Sleep	⚠️ Engineering gap (session 15): Committed draft (FACTORY-8450) omits AdMob disclosure. Verified: BannerAdWidget present in 3 screens (sleep_log, home, learn). Draft must be corrected before legal review.	Yes — FACTORY-8450, but INCOMPLETE	YES — AdMob disclosure missing from draft
Lighthouses	Location + journal text + mood ratings. Draft committed to docs/privacy-addendum-draft.md (FACTORY-8450). Photo upload not yet implemented (noted in draft).	Yes — FACTORY-8450	Review recommended before submission
Grief Companion	Detailed addendum draft in grief-companion/docs/privacy-addendum-draft.md (FACTORY-8742); explicitly notes server sync consent requirement for future release.	Yes — FACTORY-8742	No blocker for current release; publish recommended
Self-Compassion	Journal encryption (AES-256-CBC, device-keychain) documented in draft. Draft committed (FACTORY-8450).	Yes — FACTORY-8450	No blocker, but publish recommended
Memoryish	Memory narratives, people/place entities, whereish context. Photo sync not yet implemented (noted in draft). Draft committed (FACTORY-8450).	Yes — FACTORY-8450	No blocker, but publish recommended
Unsolicited Advice	Public UGC + identity linking + AdMob + sensitive topic categories. Legal team flagged in draft. Draft committed (FACTORY-8767).	Yes — FACTORY-8767	Review before next store update
Bucket List	Goals/aspirations + photo reflections. Photo library permission used for completion photos. Draft committed (FACTORY-8767). Note: image_picker IS used for completion photo attachments (different from earlier-audited full photo picker).	Yes — FACTORY-8767	Review recommended — photos now active
Random Reminders	Personal reminders + reflection journals + community content. Draft committed (FACTORY-8767).	Yes — FACTORY-8767	Low priority, review before next major update
Big Bad Words	New (session 15): Username (paid tier, multiplayer) + game stats. Draft committed (FACTORY-8951). Risk: LOW. Was previously "cleared" with no addendum — now has per-app draft for completeness.	Yes — FACTORY-8951	Low priority — no sensitive data, just completeness
Sizzle	Recipe + gamification data. Draft committed (FACTORY-8951). Risk: LOW.	Yes — FACTORY-8951	Low priority — no sensitive data
Vocabulary	Learning progress (word mastery, SRS intervals). Draft committed (FACTORY-8951). Risk: LOW.	Yes — FACTORY-8951	Low priority — no sensitive data
Scrabble Trainer	Learning progress (word accuracy, SRS). AdMob used. Draft committed (FACTORY-8951). Risk: LOW.	Yes — FACTORY-8951	Low priority — word data not sensitive
Musician's Process	Workflow/creative project data. AdMob used. Draft committed (FACTORY-8951). Risk: LOW.	Yes — FACTORY-8951	Low priority — workflow data not sensitive
All apps with assessments	Behavioral data classification — add explicit category to shared policy	—	Low priority, improves GDPR/CCPA clarity

Apps Reviewed and Cleared (no addendum needed)

Note (session 15): All apps previously in this table now have per-app addendum drafts committed (FACTORY-8767, FACTORY-8951) for completeness — even those with no sensitive data. The drafts are LOW risk and exist for consistency, not because a policy gap was found. The original clearance rationale remains accurate; drafts just add explicit per-app disclosures.

App	Permission	Reason No Addendum Needed	Draft status
Random Reminders	permission_handler (Notifications)	Notification permission only. Community content issue tracked in action items.	Draft committed for completeness (FACTORY-8767)
Sizzle	No ads, UGC recipes	Recipe data is private; no sensitive data.	Draft committed for completeness (FACTORY-8951)
Vocabulary	No ads, learning progress	Learning data is non-sensitive; no ads.	Draft committed for completeness (FACTORY-8951)
Scrabble Trainer	AdMob + learning progress	Word drill data not sensitive; AdMob disclosed.	Draft committed for completeness (FACTORY-8951)
Musicians Process	AdMob + workflow data	Workflow data not sensitive; AdMob disclosed.	Draft committed for completeness (FACTORY-8951)
Big Bad Words	Username (multiplayer) + game stats	Moved to action items — LOW risk but draft committed for username disclosure.	Draft committed (FACTORY-8951)

---

Session Audit Log

Session 15 (2026-04-19) — Content Writer

Incremental check. Large batch of per-app addendum draft files committed since session 14.

• 13 new draft commits: All apps now have docs/privacy-addendum-draft.md committed. Commits grouped under FACTORY-8450, FACTORY-8767, FACTORY-8951.
• Better Sleep gap found: Draft (FACTORY-8450) omits AdMob disclosure. Confirmed: BannerAdWidget present in 3 screens (sleep_log_screen.dart, home_screen.dart, learn_screen.dart). Draft must be corrected before legal review. Added to action items as engineering blocker.
• Cognitive Stories open question: Draft (FACTORY-8450) flags Android STT on-device forcing as unresolved — contradicts session 13 finding that "STT confirmed as platform-native." Engineering must re-verify: does Android STT route audio to Google servers? The Play Store data safety form requires accurate disclosure.
• Bucket List photo clarification: Draft reveals image_picker IS active for completion photo attachments (photo reflections on goals). This is different from the full-photo-picker feature audited in session 6. image_picker is used for completion reflection photos. Camera and READ_MEDIA_IMAGES permissions should be verified in manifest.
• Big Bad Words: Was "cleared" — now has addendum draft for username (paid tier, multiplayer). LOW risk but now tracked.
• Store metadata: All 15 apps current. No feature commits requiring updates since session 14.
• Demo scripts: Not changed since session 14.
• Tracker: FACTORY-8979

Session 14 (2026-04-19) — Content Writer

Incremental check. No new commits since session 13. No-op session.

• All 15 apps: Only post-session-13 commits are the two privacy addendum drafts already captured (FACTORY-8741, FACTORY-8742). No new data collection changes.
• Store metadata: All 15 apps current. No changes required.
• Demo scripts: All 425+ scripts clean — zero TODO/FIXME/STALE flags across all apps.
• Privacy addendum: No engineering changes. All action items remain blocked on human legal review. Anti-Bias Trainer journal encryption + ATT dialog copy remain store submission blockers.
• Tracker: FACTORY-8761

Session 13 (2026-04-19) — Content Writer

Incremental check. Two new privacy addendum drafts committed since session 12.

• anti-bias-trainer (e14613d, FACTORY-8741): docs/privacy-addendum-draft.md added. HIGH risk — journal encryption not implemented (encryptedContent field exists but stores plaintext). STORE SUBMISSION BLOCKER. AdMob and Sentry disclosures included.
• grief-companion (4c91e81, FACTORY-8742): docs/privacy-addendum-draft.md added. HIGH sensitivity — grief journals, mood assessments, memories, on-device-only storage currently. No ads, no analytics SDKs. Draft notes server sync consent requirement for future release.
• sips-reference (c8eab3a): Test-runner auth fix — internal tooling only, no user-facing data collection impact.
• Store metadata: All 15 apps current. No changes required.
• Demo scripts: All current. No changes required.
• Privacy addendum: Two new drafts ready for legal review (anti-bias-trainer, grief-companion). Anti-Bias Trainer journal encryption remains a store submission blocker (both ATT copy AND encryption now).
• Tracker: FACTORY-8757

Session 12 (2026-04-19) — Content Writer

Incremental check. No new commits since session 11. No-op session.

• All 15 apps: No commits since session 11 (8:53am). All prior findings remain accurate.
• Store metadata: All 15 apps current. No changes required.
• Demo scripts: All current. No changes required.
• Privacy addendum: No engineering changes. All action items remain blocked on human legal review. Anti-Bias Trainer ATT dialog copy remains the only store submission blocker.
• Tracker: FACTORY-8688

Session 11 (2026-04-19) — Content Writer

Incremental check. No new commits since session 10. No-op session.

• All 15 apps: No commits since session 10. All prior findings remain accurate.
• Store metadata: All 15 apps current. No changes required.
• Demo scripts: All current. No changes required.
• Privacy addendum: No engineering changes. All action items remain blocked on human legal review. Anti-Bias Trainer ATT dialog copy remains the only store submission blocker.
• Tracker: FACTORY-8607

Session 10 (2026-04-19) — Content Writer

Incremental check. One sizzle metadata correction noted (made by SIZZLE-127, not this session).

• All 15 apps: Reviewed commits since session 9. Substantive commits:
  • sizzle (SIZZLE-127, d325a94): Recipe count corrected 126→120. Session 8 had incorrectly updated 120→126 based on batch file row counts; actual seed count is 120. Onboarding copy also corrected (category-picker removed in SIZZLE-58, replaced with Welcome → Ready to Cook flow). Store metadata and demo script now accurate.
  • anti-bias-trainer (411eaf5): API method name suffix shifts after sips_client v3.0.0 regen (listTemplates4→5, listStreaks1→2, listMilestones1→2, updateStreak→updateStreak1) — no data collection changes.
  • sips-reference (33 commits): New Scheduling and History primitives added — reference app only, not published to stores, no user data collection impact.
  • Remaining: brand config/gitignore batch updates across all apps — no privacy impact.
• Store metadata: All 15 apps current. Sizzle corrected by SIZZLE-127.
• Demo scripts: All current. Sizzle UC-01 onboarding script corrected by SIZZLE-127.
• Privacy addendum: No new engineering changes affect existing classifications. All action items remain blocked on human legal review. Anti-Bias Trainer encryption no-op and ATT copy remain the only store submission blockers.
• Tracker: FACTORY-8597

Session 9 (2026-04-19) — Content Writer

Incremental check. No new findings. No-op session.

• All 15 apps: No commits since session 8 (all 2026-04-18 activity already captured). No new data collection, permissions, or third-party integrations.
• Store metadata: All 15 apps current. No feature commits requiring updates.
• Demo scripts: All current. No deprecated or stale scripts.
• Privacy addendum: No updates required. All action items remain blocked on human legal review (Anti-Bias Trainer ATT dialog is still the only store submission blocker).
• Tracker: FACTORY-8227

Session 8 (2026-04-18) — Content Writer

Incremental check. One metadata fix applied.

• All 15 apps: Reviewed commits since session 7. Majority are brand config/gitignore batch updates (no privacy impact). Substantive commits:
  • anti-bias-trainer: SIPS auth provider wiring (sips_provider.dart) — auth mechanism change, no new data collection
  • cognitive-stories: Session import fix (ambiguous_import) — no data changes
  • sizzle: Added batch recipe data (batch1.json 42, batch2.json 43, batch3.json 41 = 126 total) — recipe count in store metadata was stale (said 120)
  • random-reminders: Store metadata updated for 9-locale localization (already accurate)
  • memoryish-app: Demo scripts revised for consistency; UC-22 PDF export script deleted
• Store metadata: Fixed sizzle — updated recipe count from 120→126 in 3 locations (full_description ×2, whats_new). All other 14 apps current.
• Demo scripts: All current. Memoryish UC-22 deletion is intentional (export PDF feature scope change).
• Privacy addendum: No engineering changes affect existing classifications. All action items remain blocked on human legal review (Anti-Bias Trainer ATT dialog is still the only submission blocker).

Session 7 (2026-04-16) — Content Writer

Incremental check. No new findings.

• All 15 apps: No engineering commits since session 6. Post-session commits are test fixes (anti-bias-trainer UC-25 scroll) and docs-only changes (brand-book.md for grief-companion and self-compassion). No new data collection.
• Store metadata: All 15 apps current. No feature commits requiring updates.
• Demo scripts: All 15 scripts confirmed current. Session 6 corrections (privacy note, recipe count, badge claims) remain in effect.
• Privacy addendum: No updates required. All action items remain blocked on human legal review.

Session 6 (2026-04-16) — Content Writer

Incremental check. No new findings.

• All 15 apps: Post-session commits are content/docs only (demo scripts, store metadata chores, brand books). No engineering changes affecting data collection.
• big-bad-words R5 mechanics: "AI Time Limit" is a game mechanic (AI opponent move timer), not an AI data processing feature — no privacy implications.
• lighthouses GPS fix: Already captured in document (confirmed session-only, not persisted).
• Privacy addendum: No updates required. All action items remain blocked on human legal review.
• Store metadata: All 15 apps current. Multiple R1 demo scripts added (bucket-list, scrabble-trainer, unsolicited-advice, vocabulary, memoryish-app, musicians-process) — all new additions, none stale.
• Demo scripts: Corrections applied this cycle: cognitive-stories privacy note, sizzle recipe count (64→120), big-bad-words fabricated badge claims. No deprecated or TODO-flagged scripts.

Session 5 (2026-04-16) — Content Writer

Incremental check after session 4 ran earlier today. No new findings.

• Anti-bias-trainer: 2 post-session commits are test fixes only (UC-25 scroll/account-link). No new data collection, classification unchanged.
• Store metadata: All 15 apps still current.
• Privacy addendum: No engineering changes require document updates. All action items remain blocked on human legal review.

Session 4 (2026-04-16) — Content Writer

Performed full portfolio audit: all 15 apps, store metadata, demo scripts, and privacy candidates.

• Store metadata: All 15 apps current (no feature commits since last metadata update on any app)
• Demo scripts: All 425+ scripts clean — zero deprecated/TODO/FIXME flags across all apps
• Privacy addendum candidates: Confirmed document accuracy — no new engineering findings change existing classifications
• Bucket List photo feature: Confirmed still inactive (no camera permissions, no picker UI) — no addendum needed for current release
• Action items: Unchanged — all items blocked on human legal review

Shared Policy Fix Applied (2026-04-13)

The shared privacy.md was corrected to remove a false claim. The prior text stated "Share your information with advertisers" under "What We Never Do" — inaccurate because 6 apps use Google AdMob. The corrected policy:

• Clarifies we never share personal content with ad networks
• Adds an explicit "Advertising" section explaining AdMob's role and limitations
• Adds Microphone to the permissions table (Cognitive Stories)