You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
#1268 removed the sentence "Logs are linked to a persistent per-installation identifier" from ALTIMATE_BASE_DISCLOSURE (packages/core/src/altimate-base-disclosure.ts) — the literal text a user reads before accepting Altimate Base in the TUI onboarding dialog (packages/tui/src/component/altimate-onboarding.tsx). The fact itself was moved to a docs page (docs/docs/configure/providers.md, security-faq.md) that the consent dialog never surfaces or links to.
The persistent-identifier fact is exactly the kind of thing informed-consent expectations (e.g. GDPR Art. 4(11), CCPA notice-at-collection) expect to be disclosed at the point of collection — not reachable only via documentation the user has no reason to open before clicking "Yes".
The removed code comment (visible in the #1268 diff) originally argued the opposite: that this text "must disclose that requests are linkable across launches — not defer that to docs... which a user never sees before accepting." #1268 reversed that call for brevity/softer tone with no new counter-argument.
Where this was flagged
Independently raised by 3 of 5 personas in the v0.11.0 stable release review, from different angles:
Product Manager: flagged as a real informed-consent regression, proposed restoring the sentence.
End User: same finding, P2 — notes the docs still fully disclose it, only the live dialog doesn't.
Restore a short pointer/clause to packages/core/src/altimate-base-disclosure.ts — e.g. append "Logs are linked to a persistent per-installation identifier." back onto the existing disclosure text, or at minimum add "See for details on data retention and identifiers." so the fact is reachable from the consent screen itself.
Provenance
Found during the v0.11.0 stable release's multi-persona review. Deliberately shipped as-is in v0.11.0 (explicit, user-reviewed risk acceptance, not an oversight) — recorded here so the fix isn't lost.
Summary
#1268removed the sentence "Logs are linked to a persistent per-installation identifier" fromALTIMATE_BASE_DISCLOSURE(packages/core/src/altimate-base-disclosure.ts) — the literal text a user reads before accepting Altimate Base in the TUI onboarding dialog (packages/tui/src/component/altimate-onboarding.tsx). The fact itself was moved to a docs page (docs/docs/configure/providers.md,security-faq.md) that the consent dialog never surfaces or links to.The persistent-identifier fact is exactly the kind of thing informed-consent expectations (e.g. GDPR Art. 4(11), CCPA notice-at-collection) expect to be disclosed at the point of collection — not reachable only via documentation the user has no reason to open before clicking "Yes".
The removed code comment (visible in the
#1268diff) originally argued the opposite: that this text "must disclose that requests are linkable across launches — not defer that to docs... which a user never sees before accepting."#1268reversed that call for brevity/softer tone with no new counter-argument.Where this was flagged
Independently raised by 3 of 5 personas in the v0.11.0 stable release review, from different angles:
Proposed fix
Restore a short pointer/clause to
packages/core/src/altimate-base-disclosure.ts— e.g. append "Logs are linked to a persistent per-installation identifier." back onto the existing disclosure text, or at minimum add "See for details on data retention and identifiers." so the fact is reachable from the consent screen itself.Provenance
Found during the v0.11.0 stable release's multi-persona review. Deliberately shipped as-is in v0.11.0 (explicit, user-reviewed risk acceptance, not an oversight) — recorded here so the fix isn't lost.