Both documents, in full, when you make an account

No checkbox

Creating the account is the acceptance

Both documents are linked in full from the sign-on screen and open in a reader that shows the whole text. There is no tick box anywhere in the flow, because a checkbox claiming somebody read two documents they never opened is the thing this is meant to avoid.

Accepting is not consent to anything else. The capture switch, the training switch and the rest are untouched by it, and a test asserts the defaults after a registration rather than trusting a comment. Consent bundled with account creation is consent nobody gave.

Versions

Which text, and when

Recording that somebody accepted is close to useless. What answers the question later is which text they accepted and when. So a document is a name, a version is the text, and an acceptance points at a version rather than at a document. Changing a word publishes a new version and never edits the old one, and the old text stays readable forever, because the only way to answer “what did I agree to” is to show it.

A published version cannot be edited, and that is proved at the database rather than kept by convention. Four locks: deletion was already revoked from the application; inserting and updating are revoked here; the tables carry a read rule and no write rule; and a trigger refuses the change for the database superuser too, which is the only one of the four that binds the account most likely to be at a prompt at three in the morning. The test turns that trigger off and watches the edit succeed, so the other three are evidence rather than coincidence.

A superseded version does not lock anybody out. They are asked again at the next sensible moment and the record shows both.

What the documents say

The transparency page, transcribed

The privacy statement in the flow is the transparency page on this site, transcribed rather than rewritten. It has been argued over carefully and it is specific about what is settled and what is not.

The terms of service is a first version whose first line says there is no terms of service yet, because writing one is a lawyer’s job. The sentence about no lawyer having read it goes into the flow unsoftened, and it comes out of a column rather than out of the page’s source, so it stops appearing on the day it stops being true rather than on the day somebody remembers to delete it.

Which document is read first is a decision now, and it used to be an accident. The ordering fell through to comparing names, and both rows were written in the same transaction with the same timestamp to the microsecond, so the placeholder came first because “p” sorts before “t”. Nobody chose that.

The reader

Headings, bullets and bold, and nothing else

The document reader in the apps understands three constructs and no more. It never assigns markup and never resolves a URL it finds in a body, and a test asserts both against the source. A document from our own server is not the threat; a renderer that makes an exception for a trusted source is one somebody points at an untrusted source later.