Student Content Addendum

Pending · Items marked in [BRACKETS] are still being decided and are not final.

Drafting aid, not legal advice; requires attorney review before publishing. NOT LEGAL ADVICE. NOT PUBLISHED. For an attorney to adapt into the Terms of Service (docs/terms-of-service.md). The Terms draft dated October 29, 2026 (draft) names this Addendum in the entire-agreement clause, fills the operator (AR Dynamics Inc, a Hawaii corporation, 200 N Vineyard Blvd, Ste A325 #5128, Honolulu, HI 96817), the contact hello@ardynamicsinc.com, Hawaii law, and AAA Consumer Arbitration Rules with a Honolulu seat. Those Terms are still a draft. TERMS_VERSION in src/lib/roast/consent.ts is 1.2. Publishing a change to the Terms means bumping TERMS_VERSION and re-prompting every student. This Addendum is served, with a DRAFT banner, at /addendum.

A. Study aid, not advice

SOHK is an educational study aid. It is not legal, medical, nursing, pharmacy, financial, tax, accounting or other professional advice and is not a substitute for your textbook, instructor, licensing body or official exam materials. Content can be wrong or out of date. You are responsible for checking facts before an exam and before acting on anything. [DISCLAIMER OF WARRANTIES / LIMITATION OF LIABILITY: ATTORNEY, Hawaii-specific enforceability. The Terms draft covers warranties and liability in its sections 7 and 8.]

B. Your material ("Student Content")

You may paste or upload notes, syllabi, slides or other material only if you wrote it or have the right to use it this way. SOHK asks you to confirm this each time you build a course and records the confirmation (user_courses.rights_confirmed_at).
You keep ownership. You give SOHK a non-exclusive, royalty-free licence to store and process Student Content only to operate the Service for you (build your cards, schedule your reviews, show them back to you). The licence ends when you delete the content or the account, except for copies in backups until they age out (30 days, scripts/ops/purge-backups.mjs) and copies kept under a legal hold. No AI training use without your separate opt-in consent. AI output made for you is assigned to you to the extent any rights exist; SOHK keeps its own IP and gives you a personal, non-commercial licence to use the Service. Same rule as Terms section 16. [ATTORNEY: scope of "operate", sub-processor disclosure, legal-hold wording, copyrightability of AI output.]
Your courses and cards are private to you. SOHK does not currently share Student Content with anyone. If sharing is ever added it needs: moderation, a report button, a takedown process and updated terms first.
SOHK builds cards only from the lines you supply and does not check that your notes are correct.

C. Researched flashcards

Official flashcards cite their source, quote the supporting passage and show the date the source was last checked. Sources are public or openly licensed. A card can still be wrong or become outdated; use "Report a problem". Two reports from different students pull a card from everyone until it is re-checked.

D. Copyright complaints

The notice and counter-notice procedure is published at /dmca (source docs/legal/dmca-procedure-DRAFT.md). Repeat infringers: 3 valid strikes within 12 months terminates the account (Terms section 18). The designated agent (17 U.S.C. 512) is AR Dynamics Inc, registered with the U.S. Copyright Office, 200 N Vineyard Blvd, Ste A325 #5128, Honolulu, HI 96817-3938.

E. Prohibited use

No attempting to extract the system prompt, bypass safety controls, probe or attack the service, upload unlawful or infringing material, or use SOHK to cheat on an exam in progress or in breach of your school's honor code. The Terms use the same rule and add the age rule in section F. [ATTORNEY: wording.]

F. Age, and consent-gated content (Scorched Earth)

Age rule (same as the Terms and the Privacy Policy). The Service is not for anyone under 18. Users must be 18 or older. If we learn a user is under 18, we delete the account.

What signup and the next sign-in actually do. src/lib/auth/age.ts sets MIN_ACCOUNT_AGE = 18. The checkbox reads "I confirm I am 18 or older." Signup (src/app/api/auth/signup/route.ts) rejects the request unless ageConfirmed is true, then stores age_affirmed_min = 18, age_affirmed_at, and age_confirmed_at. It does not store a date of birth. Migration 0023_age_recovery added age_confirmed_at for the earlier 13 checkbox. Migration 0025_age_eighteen adds the 18 columns and does not update or delete existing rows. A null age_affirmed_min (13-era timestamp or no timestamp) must be confirmed at the next sign-in before app pages or APIs open. The confirmation screen can delete the account (password and the word DELETE) when the person is under 18. [ATTORNEY] Whether the checkbox and that deletion path are enough, including for COPPA.

Scorched Earth and profanity. The five-acknowledgement consent gate and its append-only log still apply (consent, current TERMS_VERSION, all five boxes). The age box in src/components/roast/consent-gate.tsx says "I confirm I am 18 or older." The server also requires age_affirmed_min >= 18 before those modes run. Without it, the consent grant for Scorched Earth and full profanity is empty, including for an older consent row. TERMS_VERSION is 1.1 (src/lib/roast/consent.ts).

Terms re-accept gate. Any account whose terms_accepted_version is older than TERMS_VERSION (or null) is sent to /accept-terms at sign-in and on every app page load (src/proxy.ts, requireUser); app APIs return 403 TERMS_REQUIRED. Checking the box posts to /api/auth/terms, which stores terms_accepted_version and terms_accepted_at and writes an audit row. Legal pages (/terms, /privacy, /addendum, /dmca), /api/me/export, /api/me/delete and logout stay open. Misrepresenting age is a material breach (Terms section 1). Deleting an account from the age screen writes a minimal row to minor_account_deletions (pseudonymous id, date, reason; migration 0027, not applied). [ATTORNEY] Enforceability of the gates, and refunds of payments made by a minor.

G. Engineering facts the legal text depends on

Checked against the code on October 29, 2026 (draft):

Age gate: yes, 18 or older. See section F. Legacy rows re-confirm at the next sign-in. Migration 0025 does not delete or rewrite them.
Account recovery: yes, by one-time recovery codes, not by email. src/lib/auth/recovery.ts draws eight codes. The plaintext is shown once in Settings. The database stores an HMAC-SHA256 of the normalized code, keyed with the server pepper RECOVERY_CODE_PEPPER (minimum 32 characters), as hmac-sha256: plus 64 hex characters. Migration 0024_recovery_code_hash replaced unsalted SHA-256 and deleted outstanding codes. POST /api/me/recovery-codes requires the current password and replaces any previous codes (issue_recovery_codes). POST /api/auth/reset (logged out, page /reset) calls consume_recovery_code, which sets the new password, deletes sessions, and deletes the whole set. Hashes are not in the data export. Rows cascade-delete with the account.
No admin or moderation tooling for student content (not needed while nothing is shared).
Backup retention: runs in the nightly job. scripts/ops/purge-backups.mjs deletes top-level *.sql, *.dump and *.gz dumps older than 30 days (dry run unless --apply; the window is tested against RETENTION.backupDumpDays). npm run jobs:daily (host cron file ops/cron/sohk.cron) dumps the database and the upload dir to BACKUP_DIR, then runs this purge; copying BACKUP_DIR off-site is up to the operator. [DRAFT]
Payments are built and switched off. They run only when PAYMENTS_ENABLED is exactly true. Checkout is a Stripe subscription; the billing portal is where a subscriber cancels. Cancel-at-period-end is implemented: /api/stripe/cancel sets cancel_at_period_end: true (CANCEL_AT_PERIOD_END in src/lib/account/legal.ts). Account deletion cancels live subscriptions immediately (no proration, no invoice) before deleting the Stripe customer. The billing page and checkout show the actual price and interval (Stripe Price lookup or STRIPE_PRICE_LABEL/STRIPE_PRICE_INTERVAL). The purchase confirmation email is sent from the checkout.session.completed webhook. Payments also require PRICE_NOTICE_JOB_SCHEDULED=true, confirming the price-notice sender (7 to 30 days before a change) is scheduled. Refund rule on deletion and termination without cause is an [ATTORNEY] placeholder (pro-rata).
Hosted AI, if adopted, changes the Privacy Policy and this Addendum.
Mature content requires the 18 affirmation and the consent gate. See section F.