How we keep ourselves accountable
Legal risk assessment
Date: 2026-10-15 · Assessor: Claude (AI agent), for The Doxa Way Ltd · Matter: Wamemba me v1 as specified in specs/wamemba-v1/README.md and as built on main (8400a04) · Privileged: No. This is not legal advice and has not been reviewed by a lawyer.
Method. The Claude legal plugin's skills: legal-risk-assessment (severity × likelihood, 1 to 5 each: 1-4 GREEN low, 5-9 YELLOW medium, 10-15 ORANGE high, 16-25 RED critical), compliance (UK GDPR, CCPA, DPA checklist) and contract-review (clause-by-clause against a playbook, GREEN / YELLOW / RED, with redlines). Severity is measured against the business: a small company whose product is trust with children's words.
1. Summary
| Level | Count | Risks |
|---|---|---|
| RED (critical) | 0 | |
| ORANGE (high) | 5 | LR1 email backup can't reach parents; LR2 store deletion, export and paywall rules; LR3 a breach of children's data; LR4 EU storefronts without a representative; LR5 subscription law from January 2027 |
| YELLOW (medium) | 9 | LR6 COPPA and voice clips; LR7 missing DPAs (PostHog, Sentry); LR8 operations AI terms; LR9 trademark; LR10 Namecheap transfer gap; LR11 Apple DPLA not accepted; LR12 public statements outrunning the product; LR13 ICO fee; LR14 children in marketing |
| GREEN (low) | 3 | LR15 separated parents; LR16 PostHog retention drift; LR17 unfair terms challenge |
Top three things to do now. (1) Fix email backup before any public release (custom SMTP). (2) Build in-app account deletion, export, and the paywall's terms and privacy links into S4, as release blockers. (3) Garth decides EU storefronts (representative or exclude), and briefs a solicitor with solicitor-brief.md.
2. Risk register
| ID | Risk | Category | Sev. | Lik. | Score | Level | Owner | Status |
|---|---|---|---|---|---|---|---|---|
| LR1 | "Back up with email" fails for every real parent: Supabase's built-in mailer delivers only to the organisation's team, 2 an hour, "not for production". A parent believes they are backed up when they are not; a lost phone then loses irreplaceable sayings. Misleading, and harmful | Data privacy / consumer | 3 | 5 | 15 | ORANGE | system | Open: custom SMTP before public release |
| LR2 | Store rejection or removal: App Store 5.1.1(v) needs in-app account deletion for any app that creates accounts (anonymous ones included); Google Play needs in-app deletion plus a web link to request it; 3.1.2 needs the paywall and metadata to link the terms and privacy policy and show full renewal prices; spec §3 promises export at any time. None of these is built | Regulatory / platform | 4 | 3 | 12 | ORANGE | system | Open: S4 release blockers |
| LR3 | A breach or RLS error exposes children's names, birthdays, words or (coming) voices | Data privacy | 5 | 2 | 10 | ORANGE | system | Mitigated: RLS tests per table on prod's image in every PR; definer functions for share pages; breach procedure. Residual 5×1 = 5 YELLOW |
| LR4 | Offering the app in EU or EEA storefronts (the spec scales prices to every country) is very likely "targeting" (EDPB 3/2018) and needs an EU Article 27 representative; the exemption doesn't fit regular processing of children's data | Regulatory | 3 | 4 | 12 | ORANGE | Garth | Open: decide before store release |
| LR5 | The DMCC Act 2024 subscription regime starts in January 2027 (GOV.UK, 9 August 2026): pre-contract information, reminder notices, easy online exit, and a 14-day cooling-off after a free trial converts and at each renewal of 12 months or more. Who carries each duty when Apple or Google is the merchant is unclear | Consumer / regulatory | 3 | 4 | 12 | ORANGE | Garth (solicitor) | Open: solicitor brief Q3; design the day-5 trial reminder and renewal reminders to meet it anyway |
| LR6 | COPPA: a stored voice clip "contains a child's voice". If the app prompts the child to speak into it, the FTC could see collection "from a child", needing verifiable parental consent; the 2025 audio exception needs immediate deletion and doesn't fit | Regulatory (US) | 4 | 2 | 8 | YELLOW | Garth (solicitor) | Open: design recording as the parent's act; US opinion before S3 ships |
| LR7 | No executed DPA for the new PostHog organisation; Sentry's DPA not confirmed for organisation wamemba-me; PostHog trains on customer content unless opted out | Data privacy | 3 | 3 | 9 | YELLOW | Garth (PostHog signature), system | Open |
| LR8 | Engineering agents query production under consumer AI terms (no DPA, may train) | Data privacy | 3 | 3 | 9 | YELLOW | Garth | Open: confirm Commercial Terms; rule meanwhile: no family content |
| LR9 | Trademark: an EU/UK "MEMBA" class 9 mark (spec §9) could block or force a change to WAMEMBA ME; a dating app "Wamba" is one letter away | IP | 4 | 2 | 8 | YELLOW | Garth (solicitor) | Open: clearance opinion before filing and before launch spend |
| LR10 | Namecheap email forwarding has no valid UK transfer mechanism (old SCCs, not on DPF) | Data privacy | 2 | 3 | 6 | YELLOW | Garth | Open: move mail to Google Workspace |
| LR11 | The updated Apple Developer Program License Agreement, due 2026-10-28, needs the Account Holder (joy@doxa.app); until accepted, Apple may refuse new submissions | Contract / platform | 3 | 3 | 9 | YELLOW | Garth (Account Holder) | Open (decisions log, 2026-10-14) |
| LR12 | Public documents promise more than the product does (for example, on-device dictation on Android is unverified in Google's documentation; export is manual today) | Consumer / regulatory | 3 | 2 | 6 | YELLOW | system | Mitigated: every public page marks "coming"; airplane-mode test before the Android release |
| LR13 | The Doxa Way Ltd's ICO fee registration is unconfirmed (pending on 2026-10-08) | Regulatory | 2 | 3 | 6 | YELLOW | Garth | Open |
| LR14 | Children in marketing: creator posts or store art that show or voice children, or appeal to children (Apple 5.1.4, Google Families, UK child performance licences, Children's Code drift) | Regulatory / reputational | 3 | 2 | 6 | YELLOW | system | Mitigated by spec §7 and BRAND.md rules |
| LR15 | Separated parents: one shares or keeps a child's words against the other's wishes; a non-account-holder parent asks for the data | Data privacy / reputational | 2 | 2 | 4 | GREEN | system | Procedure in dsar-procedure.md 3.3; solicitor Q6 |
| LR16 | Analytics retention drifts from the policy if PostHog moves to a paid plan (7 years, can't shorten) | Data privacy | 2 | 2 | 4 | GREEN | system | Trigger recorded (lawful-basis-and-retention.md R-4) |
| LR17 | A consumer or regulator challenges a term as unfair (CRA 2015 Part 2; CMA37, reissued 22 July 2026) | Consumer | 2 | 2 | 4 | GREEN | system | Terms written to the playbook below |
3. The high risks in detail
LR1. Email backup can't reach parents
- Severity 3 (moderate): a parent's loss is real and emotional, but limited to those who chose email and then lost a phone; Apple backup works.
- Likelihood 5: certain for every non-team address while the built-in mailer is used.
- Options: (a) custom SMTP through Resend, eu-west-1, before release (High effectiveness, Low effort, recommended); (b) hide email backup until then (High, Low; acceptable interim for TestFlight with external testers).
- Residual: 3×1 = 3 GREEN.
LR2. Store rules for deletion, export and subscriptions
- Severity 4: a rejection delays launch; removal later loses the business's only channel.
- Likelihood 3: the work is planned in S4, but nothing yet enforces it.
- Recommended: make in-app Delete account (with the phone's copy wiped, PostHog person deleted), Export, a web deletion-request page (Google Play), and the paywall's links to
/termsand/privacywith the full renewal price, release blockers in S4's PR. Store metadata links to the same URLs. - Residual: 4×1 = 4 GREEN.
LR4. EU storefronts
- Severity 3: enforcement against a small non-EU company is unlikely but possible; reputational for a privacy-first brand.
- Likelihood 4: if the app is released worldwide, the requirement is near certain.
- Options: (a) appoint an EU representative (a service costs a few hundred pounds a year; Medium effort); (b) launch in the UK, US and other non-EU storefronts first (Low effort; loses EU revenue); (c) launch everywhere without one (not recommended).
- Default recommendation: (b) at first release, then (a) when the EU market is wanted. Garth's call (money and market).
LR5. Subscription law from January 2027
- Severity 3; likelihood 4 for a subscription business launching around then.
- Recommended now (cheap): the spec's real day-5 trial reminder; a renewal reminder before each annual renewal; plain cancel instructions in the app and terms; no dark patterns. Ask the solicitor how the cooling-off and exit duties fall between us and the stores.
4. Document review (contract-review method)
4.1 Playbook
There is no legal.local.md playbook in this repository, so this review uses a consumer-fairness playbook written for Wamemba me from the spec, BRAND.md, the Consumer Rights Act 2015 and CMA37 (2026). It is labelled "based on general consumer-law standards", as the skill requires.
| Topic | Standard position (Wamemba me) | Escalation trigger |
|---|---|---|
| Ownership of content | The family owns everything; licence to us only to run the service | Any perpetual, sublicensable or marketing licence |
| Liability | Liable for foreseeable loss from our breach; no exclusion of statutory rights, death or injury, fraud | Any cap or exclusion that touches statutory rights |
| Payment and cancellation | Through the store; clear renewal; cancel any time in the store | Hidden renewal; cancellation only by email; any fee to leave |
| Data on exit | Read and export for good after a lapse; 60 days' notice if the service closes | Data deletion on lapse; no export |
| Changes to terms | Notice in advance for material changes; right to leave with export | Unilateral change without notice |
| Termination by us | Only for serious or repeated breach, with notice and export | At will |
| Law and forum | England and Wales; consumers keep local protections and courts | Exclusive foreign forum; mandatory arbitration; class waiver |
4.2 Terms of use v1.0: clause review
| Clause | Finding | Level | Redline or note |
|---|---|---|---|
| s.4 Your sayings are yours | Ownership stays with the family; licence limited to running the service; ends on deletion (backups 7 days); no marketing use without asking | GREEN | Matches CMA37 transparency; plain language |
| s.5 Sharing rules and removal | Removal and suspension only for breach, with notice unless law or safety prevents | GREEN | |
| s.7 Subscriptions | Store is merchant; auto-renewal stated; cancel in store; deleting the app doesn't cancel; price changes through the store | GREEN | Add the exact renewal price and period in the paywall (3.1.2), not here |
| s.7.2 Refunds and cancellation | Refunds by the store; statutory 14-day right preserved | YELLOW | The interaction of reg. 37 CCRs (express consent and acknowledgement) with store purchases is for the solicitor (Q3). Fallback: keep as drafted |
| s.7.3 Lapse keeps read and export | Stronger than market | GREEN | A promise: removing it later would need notice and would hurt trust |
| s.8 Gifts | Explicitly incomplete ("we will add the full rules before gifts go on sale") | YELLOW | Must be completed before gifts ship: renewal, redemption, refunds, expiry (a gift card may be a voucher with its own rules) |
| s.10 Closing the service: 60 days' notice and export | A commitment the company must be able to keep | YELLOW | Garth to confirm the 60 days (default kept). Market range 30 to 90 days |
| s.11 Termination by us | For serious or repeated breach, with notice and export | GREEN | |
| s.12 Liability | CRA-compliant: foreseeable loss, statutory rights preserved, device damage remedy (s.46), no cap | GREEN | A cap (for example, 12 months' fees) is common but risks unfairness for a memory product; left out by choice |
| s.13 Apple minimum terms | Includes Apple's usual third-party-beneficiary and responsibility terms | YELLOW | Unverified against Apple's current "minimum terms" list; App Store Connect keeps the standard EULA unless a custom one is entered. Recommended: keep Apple's standard EULA and link these terms from the description and the app |
| s.14 Changes | 30 days' notice for material changes; leave with export | GREEN | |
| s.15 Law and forum | England and Wales; Scotland and NI courts; local mandatory protections kept; no arbitration or class waiver | GREEN | US counsel may want a US-specific clause (Q8) |
| s.2 18+ only | Clear | GREEN | |
| Missing: US "as is" disclaimer and liability cap for US users | Deliberate (one plain set of terms) | YELLOW | Q8 for US counsel |
4.3 Privacy policy v2.0: compliance review
Checked against UK GDPR Articles 13 and 14, Apple 5.1.1(i), CCPA notice at collection (regs §7012) and the privacy-policy requirements (§7011).
| Requirement | Where | Level |
|---|---|---|
| Identity and contact of the controller | s.1 | GREEN |
| Purposes and lawful basis per use | s.2 tables | GREEN |
| Legitimate interests stated | s.2.9, 2.10, 2.11 | GREEN |
| Recipients | s.4 | GREEN |
| Transfers and safeguards | s.5 | GREEN |
| Retention | s.7 | GREEN |
| Rights, withdrawal of consent, complaint to the regulator (correct name since 30 September 2026) | s.9 | GREEN |
| Source of data not obtained from the person (children's data comes from the parent; Art. 14) | s.2.2, 2.9 | GREEN |
| Automated decisions | s.3 (none) | GREEN |
| CCPA: categories, purposes, sources, sale/share statement, sensitive PI (children under 16), rights, methods | s.11 | GREEN |
| Apple 5.1.1(i): third parties give equal protection; retention and deletion; how to revoke consent | s.4, s.7, s.9 | GREEN |
| Accuracy against today's product | "Coming" markers throughout | YELLOW: re-check at every slice |
| DPO, EU representative | None appointed; EU marked coming | YELLOW (LR4) |
4.4 Vendor DPAs (compliance skill checklist)
Full detail per vendor: register/subprocessors.json. RED items (no valid contract or transfer tool for data that flows): PostHog (DPA not executed for the new organisation), Namecheap (no UK transfer tool), Anthropic for operations (plan unconfirmed). YELLOW: Sentry (acceptance unconfirmed), Expo (no breach-notice clause; no UK fallback to DPF), Supabase (built-in mailer not for production), RevenueCat (AI sub-processors to check before use). GREEN: Vercel, Google Workspace, GitHub, Apple and Google (independent controllers).
5. Monitoring
- Re-run this assessment at each slice (S3, S4, S6 especially), before the first public release, and quarterly until launch. Next: 2027-01-15.
- Watch: DUAA commencements and ICO guidance on the Children's Code; the DMCC subscription regulations; the FTC's COPPA enforcement; the DPF appeal (C-703/25 P); FISA s.702.
6. Next steps
- Custom SMTP for auth email before release (system).
- S4 release blockers: delete, export, web deletion page, paywall links and prices, analytics consent and opt-out (system).
- EU storefront decision (Garth).
- Engage a UK solicitor with
solicitor-brief.md; US counsel for COPPA and US terms (Garth). - Sign the PostHog DPA (Garth); accept Sentry's and opt out of PostHog training (system).
- Confirm the operations AI plan (Garth).
- Move mail to Google Workspace (Garth decides the cost).
- Accept the Apple DPLA (Account Holder) and confirm the ICO registration (Garth).