[jlipworth]

Summary

Two App Store readiness fixes, handed off from the labstream-infra domain/email setup.

1. In-app privacy policy link (App Review 5.1.1(i)) and real support contact

• LabstreamLinks.swift is the single source for the privacy, support, support-email and bug-form URLs. They still point at jlipworth.github.io/Labstream/…. Moving to labstream.app means changing siteBase plus the App Store metadata URLs. scripts/tests/test_store_links.py fails if the in-app links and the App Store metadata disagree.
• Settings ▸ About, all platforms: Privacy Policy, Support, and Email support@labstream.app. On Apple TV, Privacy Policy and Support are focusable rows that open a QR code with the address.
• Sign-in screen: a Privacy Policy · Support footer, since Settings isn't reachable before signing in. Apple TV shows the privacy address as text under the logo.
• Mac: Help ▸ Labstream Support, Email Support… and Privacy Policy.
• SUPPORT.md: a new Contact section. GitHub stays the public path. Use support@labstream.app for private matters and privacy@labstream.app for privacy questions and deletion requests. Security still goes through the private advisory route.

2. Privacy wording consistency

• PRIVACY.md: a new "Email to the project" section. It covers Cloudflare Email Routing to the maintainer's Gmail mailbox, what's received, use (answering and troubleshooting only), possible redacted public issue summaries, and retention. Retention is kept until deletion is requested, with no fixed maximum (the owner's decision). The Contact section adds privacy@, and the last-updated date is 2026-11-05.
• README.md: no longer says no data reaches the developer. It now says nothing is sent automatically and points to the policy for the demo service and anything the user chooses to send.
• docs/RELEASES.md:
  • the old Data Not Collected mention is marked as superseded;
  • "support storage outside GitHub" is no longer unverified: email is stored in the maintainer's mailbox, disclosed in the policy, and covered by the declared Customer Support type;
  • the demo-retention item stays open.

No public doc (README, SUPPORT, PRIVACY, docs/privacy.md, docs/support.md, App Store metadata) still says the app collects no data.

Flag for the owner: App Privacy label

Contact Info ▸ Email Address is not declared. The manifest and RELEASES.md list User ID, Device ID, Product Interaction, Customer Support, Other Diagnostic Data, Performance Data and Crash Data. Today support email is written in the user's own mail app, outside Labstream, so the app doesn't collect the address, and Customer Support covers the content. The in-app Email support@labstream.app link added here only opens the user's mail app.

When #426 adds a composed in-app Email report, decide between:

• declaring Email Address, or
• documenting the optional-disclosure conditions.

No App Store Connect answer was changed.

Follow-ups folded in (owner decisions, website plan §7a)

• SECURITY.md: security@labstream.app is the first reporting channel, and GitHub private vulnerability reporting is kept as the second. SUPPORT.md and PRIVACY.md now name both. Before, they told people not to use email.
• Canonical tags: the github.io support and privacy pages need a canonical tag pointing at labstream.app, but not before the site is live, so it is tracked in Point github.io support/privacy canonicals at labstream.app once it's live #428 and not shipped here.
• Site source pages: PRIVACY.md and SUPPORT.md already used only absolute links. test_store_links.py now enforces that, because labstream.app renders them outside the repo.
• App Store Connect (done in the browser and recorded in RELEASES.md): the App Review contact email on all four 1.7.2 drafts is now appstore@labstream.app. The Apple TV privacy text now has the support email disclosure.
• check-sensitive-paths.py now flags PRIVACY.md (policies). That's expected for this change.

Linked issue

Refs #426 (low-friction reporting; the in-app Email action comes later). Refs the App Privacy gate in docs/RELEASES.md.

Affected surface

• Platforms: Apple Vision Pro / iPhone / iPad / Apple TV / Mac
• Backends: none

Verification evidence

• Commands run and results:
  • native-test-matrix.py affected build lanes: visionOS, mobile, tvOS (build-for-testing) and macOS all succeeded.
  • macOS hosted LabstreamLinksTests (plus DownloadSignOutPauseTests as a regression guard): 7 of 7 passed.
  • test_store_links.py: 3 of 3 passed.
  • scripts/ci-hygiene.sh: ok.
  • check-sensitive-paths.py --base origin/main: no sensitive paths.
• Simulator evidence (screenshots reviewed):
  • iPhone: the sign-in footer shows Privacy Policy · Support.
  • iPad: Settings ▸ About (browse fixture) shows Privacy Policy, Support and Email support@labstream.app.
  • Apple TV: the sign-in screen shows the privacy address under the logo.
• Not verified (and why):
  • Tapping the links, the Apple TV QR sheet, Vision Pro, and the Mac Help menu need interaction. These are added to TESTING-CHECKLIST.md.
  • The compact iPhone Settings sheet didn't auto-scroll to About in the fixture capture.

Privacy checklist

• No tokens, client identifiers, passwords, or signing/team identifiers.
• No real server hostnames, IPs, or URLs. The new addresses are the project's public support addresses.
• No usernames, media titles, filenames, library paths, or personal home-directory paths.
• Security-sensitive changes were discussed privately first (n/a).

AI assistance

Claude Opus via Claude Code implemented the code and docs from a handoff by another Claude session and the maintainer's decisions on retention and the sign-in link.