Giorgio Gilestro
f1903e1e61
Adds the unauthenticated surface that's needed to invite outsiders:
- Landing (/) — dual-purpose root: dashboard for logged-in users,
landing for everyone else. New maybe_current_user soft-auth helper
in app/auth.py supports it without disturbing the per-route
require_token deps on /news, /log, /upload, /settings.
- About, Pricing, Disclaimer, Terms, Privacy — own router
(app/routers/public.py), no auth dep, shared public_base layout
(brand link, thin nav, footer with legal links + ICO ref + date).
- Editorial positioning: news aggregator with a macro brain; tagline
"Understand markets. Don't gamble on them."; anti-trading-as-gambling
stance carried through About and Landing.
Legal pass following an independent lawyer-style review:
- Privacy: explicit UK-GDPR Art. 6 lawful-basis section; Art. 22
automated-decision line; explicit consent for sessionStorage sync
key (PECR); 30-day IP-log retention; Art. 21 objection right;
Children clause; Art. 33/34 breach-notification clause;
international-transfer mechanism (IDTA + UK Addendum). ICO
registration ZC098928 surfaced at the top.
- Pricing: paid-card AI-portfolio-analysis bullet rewritten to remove
advice-shaped wording ("what would invalidate the posture" gone);
added italic carve-out citing FSMA / FCA COBS.
- Disclaimer: separate EU/EEA carve-out + MAR 596/2014 Art. 3(1)(34)
commentator safe-harbour; "qualifies the Terms" line; hallucination
wording fixed.
- Terms: cl.4 explicit AI-training prohibition + harassment line;
cl.5 CCR 2013 14-day cancellation; cl.7 softened AI copyright
claim under CDPA s.9(3) ambiguity; cl.8 proportionate suspension +
pro-rata refund for paid users; cl.10 CRA 2015 Pt 1 statutory-rights
carve-out from the liability cap; cl.11 right to close account on
material change; cl.12 non-exclusive jurisdiction + UK consumer
local courts.
Code-side enforcement of the Privacy claim:
- openrouter.py: outbound OpenRouter calls now carry
X-OR-Allow-Training: false. DeepSeek doesn't expose a per-request
flag; the Privacy page discloses this caveat verbatim.
Apex domain prep:
- branding.APP_URL flipped to https://read.markets (was app.). DNS for
the apex already resolves; pending operator NPM step is a cert that
covers the bare apex + a 301 from app.read.markets. No hard-coded
subdomain references remain in code (verified with grep).
Nav + chrome:
- app dropdown gains Pricing / Terms / Privacy / Disclaimer links.
- login.html gains a small legal-links footer for the
highest-leverage moment to surface them.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
54 lines
1.9 KiB
HTML
54 lines
1.9 KiB
HTML
<!DOCTYPE html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="UTF-8" />
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
|
|
<title>{{ BRAND_NAME }} · Sign in</title>
|
|
<script>
|
|
(function() {
|
|
try { document.documentElement.dataset.theme = localStorage.getItem('cassandra.theme') || 'light'; }
|
|
catch (e) { document.documentElement.dataset.theme = 'light'; }
|
|
})();
|
|
</script>
|
|
<link rel="stylesheet" href="{{ url_for('static', path='/css/cassandra.css') }}" />
|
|
</head>
|
|
<body>
|
|
<div class="auth-shell">
|
|
<div class="auth-card">
|
|
<div class="auth-card__brand">{{ BRAND_NAME }}</div>
|
|
<div class="auth-card__hint">sign in with email</div>
|
|
|
|
{% if referrer_present %}
|
|
<div class="auth-info auth-info--invited">
|
|
<strong>You've been invited.</strong>
|
|
When you subscribe, you and your friend both get
|
|
<strong>50% off for 3 months</strong>. Sign up below to lock it in.
|
|
</div>
|
|
{% endif %}
|
|
|
|
<p class="auth-card__lede">
|
|
Enter your email and we'll send you a 6-digit code. No password.
|
|
First-time visitors get an account; returning visitors get a sign-in.
|
|
</p>
|
|
|
|
{% if error %}<div class="auth-error">{{ error }}</div>{% endif %}
|
|
|
|
<form method="post" action="/login" autocomplete="on">
|
|
<input type="hidden" name="next" value="{{ next_path or '/' }}">
|
|
{% if ref %}<input type="hidden" name="ref" value="{{ ref }}">{% endif %}
|
|
<label>Email
|
|
<input type="email" name="email" value="{{ email or '' }}" required autofocus>
|
|
</label>
|
|
<button type="submit">Send code</button>
|
|
</form>
|
|
|
|
<p class="auth-card__legal" style="margin-top:18px; font-size:11px; color: var(--muted); line-height:1.6;">
|
|
By signing in you agree to our
|
|
<a href="/terms">Terms</a> and
|
|
<a href="/privacy">Privacy notice</a>, and confirm you’ve read
|
|
the <a href="/disclaimer">financial disclaimer</a>.
|
|
</p>
|
|
</div>
|
|
</div>
|
|
</body>
|
|
</html>
|