Report the X pledge conversion

[mikaalnaik]

Fires the X Ads conversion event tw-re2t6-rekr4 when a pledge is successfully recorded.

Changes

• XPixel.tsx — adds an X_EVENTS map and an exported trackXEvent(event, email?) helper, so conversion IDs live next to the tag that reports them rather than being scattered inline.
• PledgeButton.tsx — calls it right after posthog.capture("pledged_to_vote", …), before the redirect to the share page.

Notes

• The outsideRegion path (subscribed, but no pledge recorded) deliberately doesn't fire — only real pledges count as conversions.
• The pledger's email is passed for X's identity matching. It goes in as plain text and uwt.js SHA-256s it in the browser, so the raw address never leaves the page.
• The tag is production-only (existing NODE_ENV guard), so the call is a no-op locally and on previews. To verify by hand, temporarily drop that guard in XPixel.tsx.

🤖 Generated with Claude Code

[greptile-apps]

Greptile Summary

This PR adds a centralized X Ads conversion-event helper and invokes the pledge conversion after a successful in-region pledge. It also supplies the pledger's email for X identity matching.

• Defines the pledged-to-vote conversion ID beside the existing X pixel implementation.
• Reports the conversion before navigating to the pledge-sharing page.
• Leaves outside-region responses excluded from conversion reporting.

Confidence Score: 3/5

The PR should not merge until the new disclosure of pledger email to X advertising code is covered by an informed-consent and disclosure mechanism.

The successful pledge path now forwards personal information and the associated conversion signal to a third-party advertising tag for every production user, while neither the pledge form nor application runtime provides the required consent boundary.

Files Needing Attention: src/components/elections/PledgeButton.tsx and src/components/XPixel.tsx

Security Review

The new successful-pledge path discloses the pledger's email and conversion signal to X advertising code without an informed-consent gate or an advertising-use disclosure on the form.

Important Files Changed

Filename	Overview
src/components/XPixel.tsx	Adds the X conversion-ID map and event helper that forwards optional identity-matching email data to twq.
src/components/elections/PledgeButton.tsx	Reports the new conversion after successful pledges, but introduces an undisclosed and ungated advertising-data disclosure.

Sequence Diagram

sequenceDiagram
    participant U as Pledger
    participant B as PledgeButton
    participant API as Pledge API
    participant X as X Ads tag
    U->>B: Submit pledge and email
    B->>API: POST pledge
    API-->>B: Successful in-region response
    B->>X: pledgedToVote(email_address)
    B-->>U: Navigate to share page

Loading

Prompt To Fix All With AI

### Issue 1
src/components/elections/PledgeButton.tsx:112
**Advertising identity bypasses consent**

When an in-region pledge succeeds in production, this call sends the pledger's email and pledge-conversion signal to X's advertising tag without an advertising-use disclosure or consent gate, exposing personal information to a third-party advertising platform outside the application's stated consent boundary.

**How this was verified:** The submitted email flows directly through `trackXEvent` to the globally mounted `twq` tag, and the pledge form and runtime contain no advertising-consent control.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (1): Last reviewed commit: "Report the X pledge conversion" | Re-trigger Greptile}

[greptile-apps]

Advertising identity bypasses consent

When an in-region pledge succeeds in production, this call sends the pledger's email and pledge-conversion signal to X's advertising tag without an advertising-use disclosure or consent gate, exposing personal information to a third-party advertising platform outside the application's stated consent boundary.

How this was verified: The submitted email flows directly through trackXEvent to the globally mounted twq tag, and the pledge form and runtime contain no advertising-consent control.

Prompt To Fix With AI

This is a comment left during a code review.
Path: src/components/elections/PledgeButton.tsx
Line: 112

Comment:
**Advertising identity bypasses consent**

When an in-region pledge succeeds in production, this call sends the pledger's email and pledge-conversion signal to X's advertising tag without an advertising-use disclosure or consent gate, exposing personal information to a third-party advertising platform outside the application's stated consent boundary.

**How this was verified:** The submitted email flows directly through `trackXEvent` to the globally mounted `twq` tag, and the pledge form and runtime contain no advertising-consent control.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.