V1 Web PWA · Surface walkthrough

Legal · CCPA Notice

A per-surface walkthrough of the V1 Web PWA customer surface: layout, states, interactions, data, and cross-references.

walked
9sections3 minread
Markdown source
On this page

Context. surface customer · domain onboarding-public · route /legal/ccpa · auth anon · source apps/oshun/web/src/app/legal/ccpa/page.tsx

Last walked. 2026-05-29 automated runtime walk (Playwright headless) — render, /v1 data (2xx), console/page-errors, expected content, screenshot verified; manual screen-reader and real telemetry-delivery checks pending. Evidence: WALKTHROUGH/results/runtime-sweep-2026-05-29.md; 2026-06-28 public-legal-pages Playwright pass covered anonymous routing, exact section inventory, legal nav matrix/active states, TOC/back-to-top/print shell controls, 390 px no-overflow, 44 px touch targets, offline-after-load stability, no telemetry hooks, and axe. Manual AT pass and real telemetry delivery remain pending.

Purpose#

California Consumer Privacy Act / CPRA notice for California residents. Seven sections rendered through LegalPageShell. Supplements the main Privacy Policy.

Entry points#

  • Footer link "CCPA" on /welcome and /landing
  • Sidebar nav from other /legal/* pages
  • Cross-reference from /legal/privacy body copy
  • Direct URL / bookmark — yes (anon)

Layout regions#

page.tsx defines SECTIONS: scope, categories, rights, sale-sharing, retention, exercise-rights, contact.

  • Header (shell): minimal brand + back link
  • Sticky sidebar: cross-legal nav + 7-entry TOC
  • Main article: h1 "California Consumer Privacy Act (CCPA) Notice", data-legal-date "Last updated: February 21, 2026", seven sections:
    • Scope
    • Categories Collected (identifiers, internet activity, geolocation, inferences)
    • Your Rights (six bullets: know, delete, correct, opt-out of sale/sharing, non-discrimination, limit sensitive info)
    • Sale & Sharing — declares "OSHUN does not sell"
    • Retention (90-day analytics window)
    • Exercise Rights — references privacy@oshun.app with "CCPA Request" subject and the in-profile data tools
    • Contact: privacy@oshun.app
  • Floating control: back-to-top button

States#

  • Loading — N/A; static
  • Default — all seven sections render
  • TOC click / active section — clicking a TOC button scrolls to that section and marks it data-active="true"; passive scroll-spy remains IntersectionObserver-driven
  • Back-to-top visible — the shared 44 px control appears after scrolling and returns the user near the document start
  • Narrow viewport (≤ 768px) — sidebar collapses and avoids horizontal overflow at 390 px
  • Print — chrome stripped, hrefs appended after links
  • Offline after load — once loaded, the URL, heading, section inventory, and active legal nav state remain stable when the browser context goes offline
  • Gated — N/A; anonymous-readable

Interactions#

  • Each LEGAL_NAV link — sibling legal page navigation, active state, and at least 44 px mobile target

On-this-page TOC#

  • Each TOC button (7) — scrollIntoView to that section and immediate active state after click

Back-to-top#

  • "↑" — smooth-scroll to top when visible

Body content#

References "data management tools in your profile settings" as plain text (no link to /profile). Email privacy@oshun.app is plain text, not mailto. Verify intent.

Data & contracts#

  • Reads: none — static text
  • Writes: none
  • Caching: SSR static; loaded-route offline stability is asserted. Cold offline navigation / per-legal SW path caching is not asserted, and current sw.js does not path-cache /legal/*.
  • Auth: anon (in middleware PUBLIC_PREFIXES)
  • Metadata: title: 'CCPA Notice', description: 'California Consumer Privacy Act notice for OSHUN users.'

Cross-references#

E2E coverage#

  • Backed by apps/oshun/web/e2e/public-legal-pages.spec.ts — covers anonymous access, exact seven-section inventory, legal nav inventory/active state, shared TOC/back-to-top/print shell behavior, 390 px no-overflow, 44 px touch targets, offline-after-load stability, no telemetry hooks, and axe.

Open questions / known gaps#

  • Cold offline navigation / per-legal SW cache is not asserted and current sw.js does not path-cache /legal/*; PWA shell cache coverage remains in the offline-first / PWA walkthroughs.
  • "Data management tools" reference should likely deep-link to /profile settings — confirm
  • privacy@oshun.app not mailto-linked; confirm intent
  • No automated CCPA request webform; users must email — confirm whether a request flow lives in /profile
  • 45-day response window stated; verify operational SLA