feat: record terms acceptance from the app, and meet Apple's rules for user-generated content

app/Actions/UpdateUserTermsAcceptance.php

@@ -0,0 +1,18 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Actions;
+
+use App\Models\User;
+
+final readonly class UpdateUserTermsAcceptance
+{
+    /**
+     * Records that they accepted the terms and privacy policy as they stand now.
+     */
+    public function handle(User $user): void
+    {
+        $user->update(['terms_accepted_at' => now()]);
+    }
+}

app/Http/Controllers/Api/DeviceController.php

@@ -5,6 +5,7 @@
 namespace App\Http\Controllers\Api;
 
 use App\Actions\CreateDevice;
+use App\Actions\UpdateUserTermsAcceptance;
 use App\Exceptions\ApiException;
 use App\Http\Requests\CreateApiDeviceRequest;
 use App\Http\Resources\CurrentUserResource;
@@ -19,14 +20,18 @@
      * Approves the key that signed the request as a device, for the user who approved the app on the web, and answers
      * as GET /api/v1/me does. A code redeemed by another request in the meantime gets the same answer as a wrong one.
      */
-    public function store(CreateApiDeviceRequest $request, CreateDevice $action, NotificationGroupsQuery $notifications): CurrentUserResource|JsonResponse
+    public function store(CreateApiDeviceRequest $request, CreateDevice $action, UpdateUserTermsAcceptance $acceptTerms, NotificationGroupsQuery $notifications): CurrentUserResource|JsonResponse
     {
         $device = $action->handle($request->authorizationCode());
 
         if (! $device instanceof Device) {
             return ApiException::invalidGrant()->render();
         }
 
+        if ($request->has('terms_version')) {
+            $acceptTerms->handle($device->user);
+        }
+
         Auth::setUser($device->user);
 
         return CurrentUserResource::make($device->user->loadCounts())->additional([

app/Http/Controllers/Api/UserTermsController.php

@@ -0,0 +1,27 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Controllers\Api;
+
+use App\Actions\UpdateUserTermsAcceptance;
+use App\Http\Requests\UpdateApiUserTermsRequest;
+use App\Http\Resources\CurrentUserResource;
+use App\Models\User;
+use App\Queries\NotificationGroupsQuery;
+use Illuminate\Container\Attributes\CurrentUser;
+
+final readonly class UserTermsController
+{
+    /**
+     * Records that the person ticked the box for the terms and privacy policy in the app, and answers as GET /api/v1/me does.
+     */
+    public function update(UpdateApiUserTermsRequest $request, #[CurrentUser] User $user, UpdateUserTermsAcceptance $action, NotificationGroupsQuery $notifications): CurrentUserResource
+    {
+        $action->handle($user);
+
+        return CurrentUserResource::make($user->loadCounts())->additional([
+            'unread_notifications_count' => $notifications->unreadCount($user),
+        ]);
+    }
+}

app/Http/Requests/CreateApiDeviceRequest.php

@@ -12,6 +12,7 @@
 use Illuminate\Foundation\Http\FormRequest;
 use Illuminate\Support\Facades\Cache;
 use Illuminate\Support\Facades\RateLimiter;
+use Illuminate\Validation\Rule;
 use InvalidArgumentException;
 
 /**
@@ -51,7 +52,8 @@ public function authorize(SignedRequests $signedRequests): bool
     }
 
     /**
-     * The verifier is the one the app made its PKCE challenge from (RFC 7636).
+     * The verifier is the one the app made its PKCE challenge from (RFC 7636). An app that showed the terms and privacy
+     * policy before sending the person to sign in says which version, and it is recorded as accepted.
      *
      * @return array<string, list<string>>
      */
@@ -60,6 +62,7 @@ public function rules(): array
         return [
             'code' => ['required', 'string', 'max:255'],
             'code_verifier' => ['required', 'string', 'regex:/^[A-Za-z0-9._~-]{43,128}$/'],
+            'terms_version' => ['sometimes', 'string', Rule::in([config('legal.terms_version')])],
         ];
     }
 

app/Http/Requests/UpdateApiUserTermsRequest.php

@@ -0,0 +1,30 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Requests;
+
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
+
+/**
+ * The app says which version of the terms the person was shown, so an old build can't accept a version it never
+ * showed them.
+ */
+final class UpdateApiUserTermsRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /**
+     * @return array<string, list<mixed>>
+     */
+    public function rules(): array
+    {
+        return [
+            'version' => ['required', 'string', Rule::in([config('legal.terms_version')])],
+        ];
+    }
+}

app/Http/Resources/CurrentUserResource.php

@@ -12,7 +12,7 @@
 /**
  * The signed-in user: their public profile, plus what only they see on the web's profile settings. That is the lane
  * or custom color they chose (`null` for Automatic) and the one Automatic gives them, their GitHub Sponsors page, and when their profile
- * was last mirrored from GitHub. Their Remotes are `null` while turned off, as the web hides them, and otherwise say who
+ * was last mirrored from GitHub. The version of the terms in force, when they accepted, and whether it was this version, so the app knows to ask. Their Remotes are `null` while turned off, as the web hides them, and otherwise say who
  * can push to them, whether they share pulls, what the site lets them choose, and the unread count the web's nav shows.
  *
  * @mixin User
@@ -36,6 +36,9 @@ public function toArray(Request $request): array
             'automatic_lane' => $this->automaticLane(),
             'sponsors_url' => $this->has_sponsors_listing ? "https://github.com/sponsors/{$this->handle}" : null,
             'github_synced_at' => $this->github_synced_at?->toIso8601ZuluString(),
+            'terms_version' => config('legal.terms_version'),
+            'terms_accepted_at' => $this->terms_accepted_at?->toIso8601ZuluString(),
+            'terms_accepted' => $this->hasAcceptedCurrentTerms(),
             'remotes' => $this->remotes_enabled && $user instanceof User ? [
                 'from' => $this->remotes_from,
                 'pull_receipts' => $this->pull_receipts,

app/Models/User.php

@@ -64,6 +64,7 @@
  * @property-read CarbonInterface|null $github_synced_at
  * @property-read CarbonInterface|null $last_seen_at
  * @property-read CarbonInterface|null $banned_at
+ * @property-read CarbonInterface|null $terms_accepted_at
  * @property-read CarbonInterface|null $commit_rules_accepted_at
  * @property-read CarbonInterface|null $emails_unsubscribed_at
  * @property-read CarbonInterface $created_at
@@ -115,6 +116,7 @@
     'last_seen_at',
     'banned_at',
     'commit_rules_accepted_at',
+    'terms_accepted_at',
     'emails_unsubscribed_at',
 ])]
 final class User extends Authenticatable
@@ -163,6 +165,7 @@ final class User extends Authenticatable
         'last_seen_at' => null,
         'banned_at' => null,
         'commit_rules_accepted_at' => null,
+        'terms_accepted_at' => null,
         'emails_unsubscribed_at' => null,
     ];
 
@@ -209,6 +212,7 @@ public function casts(): array
             'last_seen_at' => 'date',
             'banned_at' => 'datetime',
             'commit_rules_accepted_at' => 'datetime',
+            'terms_accepted_at' => 'datetime',
             'emails_unsubscribed_at' => 'datetime',
             'created_at' => 'datetime',
             'updated_at' => 'datetime',
@@ -411,6 +415,14 @@ public function getAuthPassword(): string
         return '';
     }
 
+    /**
+     * Whether they have accepted the terms and privacy policy as they stand now.
+     */
+    public function hasAcceptedCurrentTerms(): bool
+    {
+        return $this->terms_accepted_at?->gte(config()->string('legal.terms_version')) ?? false;
+    }
+
     public function isOnboarded(): bool
     {
         return $this->onboarded_at !== null;

config/legal.php

@@ -0,0 +1,20 @@
+<?php
+
+declare(strict_types=1);
+
+return [
+
+    /*
+    |--------------------------------------------------------------------------
+    | Terms version
+    |--------------------------------------------------------------------------
+    |
+    | The version of the terms and privacy policy people accept: the moment it took effect, as an ISO 8601 UTC timestamp.
+    | Anyone who accepted at or after it accepted this version. Set a new version to the moment it ships, never earlier,
+    | and keep its date in step with resources/js/lib/legal.ts. Raising it asks everyone to accept again in the app.
+    |
+    */
+
+    'terms_version' => '2026-10-25T00:00:00Z',
+
+];

database/migrations/2026_10_23_120000_add_terms_acceptance_to_users_table.php

@@ -0,0 +1,21 @@
+<?php
+
+declare(strict_types=1);
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * When someone accepted the terms and privacy policy. The version they accepted is the one in force at that moment,
+     * so it is not stored. Everyone already here is left empty: the apps ask them to accept the first time they open them.
+     */
+    public function up(): void
+    {
+        Schema::table('users', function (Blueprint $table): void {
+            $table->timestamp('terms_accepted_at')->nullable();
+        });
+    }
+};

resources/js/pages/privacy/show.tsx

@@ -54,6 +54,15 @@ export default function Show() {
                                 listing, your public SSH key fingerprints, and
                                 who you follow and who follows you.
                             </>,
+                            <>
+                                <strong>
+                                    From Apple, when you sign in with Apple in
+                                    the iOS app:
+                                </strong>{' '}
+                                your Apple account identifier, and the name and
+                                email address you choose to share, which may be
+                                Apple's private relay address.
+                            </>,
                             <>
                                 <strong>
                                     From the commit script, when you run it:
@@ -115,6 +124,14 @@ export default function Show() {
                                 you use the service, such as the last day you
                                 used it.
                             </>,
+                            <>
+                                <strong>From the iOS app:</strong> a key the app
+                                makes on your phone to sign its requests, which
+                                never leaves it, and the name of your phone. The
+                                app asks for your photos or camera only when you
+                                attach an image, and for your microphone only
+                                when you record a voice note.
+                            </>,
                             <>
                                 <strong>Cookies and browser storage</strong>{' '}
                                 needed for the service to work, such as for
@@ -127,8 +144,8 @@ export default function Show() {
                         others give us about you, or that is generated when you
                         use the service. New features may involve other data,
                         which this policy covers once it is updated to describe
-                        it. Signing in with GitHub is required to use the
-                        service.
+                        it. Signing in with GitHub, or with Apple in the iOS
+                        app, is required to use the service.
                     </p>
                 </DocumentSection>
 
@@ -234,10 +251,11 @@ export default function Show() {
                 <DocumentSection id="rights" title="Your rights">
                     <p>
                         You can export your data or delete your account from{' '}
-                        <Link href={profileSettings()}>settings</Link>. Under
-                        the GDPR, you may also have the right to access,
-                        correct, erase, restrict, or port your data, to object
-                        to its processing, and to lodge a complaint with a data
+                        <Link href={profileSettings()}>settings</Link>, or
+                        delete it in the iOS app under Settings. Under the GDPR,
+                        you may also have the right to access, correct, erase,
+                        restrict, or port your data, to object to its
+                        processing, and to lodge a complaint with a data
                         protection authority, such as Portugal's CNPD. You may
                         object at any time to processing based on our legitimate
                         interests. To exercise these rights, write to <Mail />.

resources/js/pages/terms/show.tsx

@@ -55,10 +55,10 @@ export default function Show() {
                 <DocumentSection id="eligibility" title="Who can use it">
                     <p>
                         You must be at least 16 years old, sign in with your own
-                        account, and be allowed to use the service under the
-                        laws that apply to you, including sanctions and export
-                        laws. If you use it for an organization, you accept
-                        these terms on its behalf.
+                        GitHub or Apple account, and be allowed to use the
+                        service under the laws that apply to you, including
+                        sanctions and export laws. If you use it for an
+                        organization, you accept these terms on its behalf.
                     </p>
                 </DocumentSection>
 
@@ -152,9 +152,15 @@ export default function Show() {
                         ]}
                     />
                     <p>
-                        To report content you believe is illegal or infringes
-                        your rights, write to <Mail />. We decide how to handle
-                        reports.
+                        There is no place on the service for objectionable
+                        content or abusive users, and we have zero tolerance for
+                        them. Report a commit with Report in its menu, and use
+                        Mute and Block on a profile to stop seeing someone. To
+                        report content you believe is illegal or infringes your
+                        rights, or anything else, write to <Mail />. We review
+                        reports and act on content that breaks these rules
+                        within 24 hours, by removing it and restricting or
+                        banning the account that posted it.
                     </p>
                 </DocumentSection>
 
@@ -170,11 +176,11 @@ export default function Show() {
                     </p>
                     <p>
                         If you break these terms, we may stop you from posting
-                        for a while (a timeout) or ban you. A ban applies to
-                        your GitHub account, so you can't sign up again with it,
-                        even after deleting your account. We keep a record of
-                        timeouts and bans, and the GitHub account they apply to,
-                        after your account is deleted.
+                        for a while (a timeout) or ban you. A ban applies to the
+                        GitHub or Apple account you signed in with, so you can't
+                        sign up again with it, even after deleting your account.
+                        We keep a record of timeouts and bans, and the account
+                        they apply to, after your account is deleted.
                     </p>
                 </DocumentSection>
 
@@ -197,6 +203,25 @@ export default function Show() {
                     </p>
                 </DocumentSection>
 
+                <DocumentSection id="apple" title="Apple">
+                    <p>
+                        If you use the iOS app, these terms are between you and
+                        us only, not Apple. Apple is not responsible for the app
+                        or its content, and has no obligation to provide
+                        maintenance or support for it. If the app fails to
+                        conform to a warranty, you may tell Apple, and Apple
+                        will refund the purchase price, if any; Apple has no
+                        other warranty obligation for the app. We, not Apple,
+                        answer any claim about the app, including product
+                        liability, legal or regulatory compliance, and consumer
+                        protection. Apple and its subsidiaries are third-party
+                        beneficiaries of these terms and may enforce them
+                        against you once you accept them. You confirm that you
+                        are not in a country under a U.S. government embargo or
+                        listed as a restricted party.
+                    </p>
+                </DocumentSection>
+
                 <DocumentSection id="disclaimer" title="No warranty">
                     <p className="font-medium uppercase">
                         The service is provided "as is" and "as available",

routes/api.php

@@ -56,6 +56,7 @@
 use App\Http\Controllers\Api\UserProfileController;
 use App\Http\Controllers\Api\UserRemotePreferencesController;
 use App\Http\Controllers\Api\UserRemotesController;
+use App\Http\Controllers\Api\UserTermsController;
 use App\Http\Controllers\Cli\CommitController;
 use App\Http\Controllers\Cli\KeyLookupController;
 use App\Http\Middleware\AuthenticateSignedRequest;
@@ -118,6 +119,7 @@
 
         // Pastéis...
         Route::put('me/pasteis-mode', [UserPasteisModeController::class, 'update'])->name('api-user-pasteis-mode.update');
+        Route::put('me/terms', [UserTermsController::class, 'update'])->name('api-user-terms.update');
 
         // User Profile: mirrored from GitHub again, as Sync from GitHub does on the web...
         Route::put('me/github', [UserProfileController::class, 'update'])