Repository navigation
chore(mobile,marketing): app store submission metadata and privacy policy - #6408
Conversation
…licy iPhone-only for v1 (supportsTablet: false — device families can be added later but never removed), real review contact phone (org Google Voice, intentionally public-safe), review notes covering Sign in with Apple instant signup and the companion-app empty state, and privacy policy coverage for the mobile app, analytics, and the grace-period deletion flow across all clients.
📝 WalkthroughWalkthroughThe privacy policy now covers mobile applications, data collection, permissions, and account deletion. The mobile configuration disables tablet support and updates the App Store title and review metadata. ChangesPrivacy and mobile release updates
Estimated code review effort: 2 (Simple) | ~10 minutes Mergeability Score: 🟡 Moderate · up to The release metadata currently conflicts with the requirement to keep the app name “Superset Mobile,” and the privacy policy may inaccurately describe speech-data transmission boundaries. These issues could cause App Store submission or privacy-review problems, so the PR is not merge-ready until they are resolved or explicitly accepted. Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@apps/marketing/content/legal/privacy.mdx`:
- Line 34: Update the mobile application privacy disclosure to state that
microphone audio may be sent to Apple for speech recognition before the user
sends a message, reflecting the default expo-speech-recognition behavior. Revise
the “only transmitted when you choose to send them” wording so it applies only
to Superset data, such as photos and dictated text sent in messages.
- Line 75: Update the account-deletion policy text to accurately describe the
implemented behavior: deletion deactivates the account and revokes credentials
without claiming automatic permanent purge or de-identification, and signing in
should be described as entering the recovery flow rather than automatically
restoring the account. Keep the guidance for exercising other rights unchanged.
- Line 24: Update the “Usage Data” disclosure to accurately describe PostHog
identity coverage, including authenticated account identifiers, server-event
distinct IDs, and anonymous or unlinked events. State that reset and opt-out do
not remove historical data, account deletion does not invoke provider deletion,
server captures may not honor client opt-out, and explain the applicable
retention process—or implement provider deletion and server-side opt-out
handling instead.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: fa26b34e-9085-43cd-907e-c1d5707ab864
📒 Files selected for processing (3)
apps/marketing/content/legal/privacy.mdxapps/mobile/app.config.tsapps/mobile/store.config.json
|
|
||
| - **Usage Data:** We collect information about how you interact with our services, including pages visited, features used, and time spent. | ||
| - **Device Data:** We may collect device identifiers, operating system version, browser type, and similar technical information. | ||
| - **Usage Data:** We collect information about how you interact with our services, including pages visited, screens viewed, features used, and time spent. We use analytics providers (such as PostHog) to process this data, associated with your account identifier, name, and email address. |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
rg -n -C 6 -i 'posthog|identify\s*\(|capture\s*\(' \
--glob '*.{ts,tsx,js,jsx}' .Repository: superset-sh/superset
Length of output: 50377
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- PostHog identity and event calls ---'
rg -n --glob '*.{ts,tsx,js,jsx}' \
'\b(posthog|client|ph)\.(identify|capture|screen)\s*\(|\bposthog\.capture\s*\(' \
apps packages \
| rg -v 'stories|test|node_modules' \
| head -n 400
printf '%s\n' '--- PostHog reset, opt-out, and deletion-related code ---'
rg -n -i --glob '*.{ts,tsx,js,jsx}' \
'posthog\.(reset|opt_out_capturing|opt_in_capturing|alias|identify)|delete.*(account|user)|account.*delete|deletion|erase|purge' \
apps packages \
| rg -v 'stories|test|node_modules' \
| head -n 500
printf '%s\n' '--- Privacy policy context ---'
cat -n apps/marketing/content/legal/privacy.mdx | sed -n '1,80p'Repository: superset-sh/superset
Length of output: 50376
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
files=(
apps/admin/src/components/PostHogUserIdentifier/PostHogUserIdentifier.tsx
apps/web/src/components/PostHogUserIdentifier/PostHogUserIdentifier.tsx
apps/mobile/screens/RootLayout/components/PostHogUserIdentifier/PostHogUserIdentifier.tsx
apps/desktop/src/renderer/components/PostHogUserIdentifier/PostHogUserIdentifier.tsx
apps/desktop/src/renderer/hooks/useSignOut/useSignOut.ts
packages/trpc/src/trpc.ts
packages/trpc/src/router/user/user.ts
packages/trpc/src/router/admin/admin.ts
packages/trpc/src/lib/analytics.ts
apps/marketing/src/instrumentation-client.ts
apps/marketing/src/components/CookieConsent/CookieConsent.tsx
apps/marketing/src/app/components/WaitlistForm/WaitlistForm.tsx
)
for file in "${files[@]}"; do
if [ -f "$file" ]; then
printf '\n--- %s ---\n' "$file"
cat -n "$file" | sed -n '1,220p'
fi
doneRepository: superset-sh/superset
Length of output: 33450
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
python3 - <<'PY'
from pathlib import Path
import re
roots = [Path("apps"), Path("packages")]
patterns = re.compile(r"\b(?:posthog|client)\.(?:capture|identify|screen)\s*\(")
for root in roots:
for path in root.rglob("*"):
if path.suffix not in {".ts", ".tsx", ".js", ".jsx"}:
continue
if any(part in {"node_modules", "stories"} or part.endswith(".test") for part in path.parts):
continue
try:
lines = path.read_text().splitlines()
except UnicodeDecodeError:
continue
hits = [i for i, line in enumerate(lines) if patterns.search(line)]
if not hits:
continue
print(f"\n--- {path} ---")
for i in hits:
start = max(0, i - 2)
end = min(len(lines), i + 14)
print(f"[lines {start + 1}-{end}]")
for n in range(start, end):
print(f"{n + 1}: {lines[n]}")
PYRepository: superset-sh/superset
Length of output: 29985
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
cat -n apps/marketing/content/legal/privacy.mdx | sed -n '1,70p'
printf '\n--- all PostHog deletion/erasure API references ---\n'
rg -n -i --glob '*.{ts,tsx,js,jsx}' \
'posthog|person.*delete|delete.*person|erase.*(data|user)|data.*(deletion|deletion)|privacy.*request|gdpr' \
apps packages \
| rg -i 'delete|erase|reset|opt.?out|posthog|privacy|gdpr' \
| rg -v 'stories|test|node_modules' \
| head -n 400Repository: superset-sh/superset
Length of output: 42449
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- Desktop telemetry preference flow ---'
cat -n apps/desktop/src/renderer/components/TelemetrySync/TelemetrySync.tsx | sed -n '1,140p'
rg -n -C 5 --glob '*.{ts,tsx}' \
'TelemetrySync|opt_in_capturing|opt_out_capturing|deleteAccount|reactivateAccount' \
apps/desktop apps/mobile apps/web apps/admin packages \
| rg -v 'stories|test|node_modules' \
| head -n 350
printf '%s\n' '--- Account deletion UI and surrounding session behavior ---'
for file in \
apps/mobile/screens/'(authenticated)'/settings/hooks/useDeleteAccount/useDeleteAccount.ts \
apps/mobile/screens/'(authenticated)'/settings/account/AccountSettingsScreen.tsx \
apps/web/src/app/'(dashboard-legacy)'/settings/account/page.tsx \
apps/desktop/src/renderer/routes/_authenticated/settings/account/components/AccountSettings/AccountSettings.tsx
do
if [ -f "$file" ]; then
printf '\n--- %s ---\n' "$file"
cat -n "$file" | sed -n '1,260p'
fi
doneRepository: superset-sh/superset
Length of output: 40362
🌐 Web query:
PostHog JavaScript SDK reset opt_out_capturing delete person historical events documentation
💡 Result:
In the PostHog JavaScript SDK, you can control data collection using specific opt-out methods, and you can manage historical data through the PostHog API or interface. Opting Out of Capture To prevent data collection on the client side, use the following methods: - posthog.opt_out_capturing: This disables event tracking and data persistence (such as cookies or localStorage) for the current instance [1][2]. - posthog.opt_in_capturing: This re-enables data collection if a user previously opted out [3][4]. - posthog.has_opted_out_capturing: Use this to check the user's current opt-out status [3][5]. - opt_out_capturing_by_default: You can initialize the SDK with this option set to true to ensure no data is captured until the user provides consent [3][4]. Resetting the User To clear user state (e.g., when a user logs out or switches accounts), use posthog.reset [6][7]. This unlinks future events from the previous user's profile [6][7]. Note that calling reset returns the instance to its default consent state; if you use opt_out_capturing_by_default: true, reset will effectively stop capturing until you call opt_in_capturing again [1]. Deleting Historical Events The PostHog JavaScript SDK does not provide a direct method to delete historical events already ingested into the platform. Instead, you must use PostHog's data management tools: - Via the PostHog API: You can use the Bulk Delete Persons endpoint to delete a person and their associated events [8]. To delete the events specifically, include the delete_events=true parameter in your request [8]. - Via the PostHog UI: You can navigate to the Persons tab, search for the user, and select the option to delete the person, which removes them and all associated data [8][9]. - Filtering: If you simply want to exclude certain data from your analytics without deleting it, you can add filters in your project settings (e.g., internal and test account filtering) [6][7].
Citations:
- 1: https://posthog.com/docs/references/posthog-js.md
- 2: https://posthog.com/docs/references/posthog-js-1.386.0
- 3: https://posthog.com/docs/privacy/data-collection
- 4: https://posthog.com/docs/libraries/js
- 5: https://posthog.com/docs/references/posthog-js/types/PostHogInterface
- 6: https://github.com/PostHog/posthog.com/blob/master/contents/docs/libraries/js/usage.mdx
- 7: https://posthog.com/docs/libraries/js/usage
- 8: https://posthog.com/docs/privacy/data-storage.md
- 9: https://posthog.com/docs/data/persons
Align the PostHog disclosure with the actual data flow.
Authenticated clients identify users with account ID, name, and email. However, server events often include only distinctId, while anonymous marketing, pageview, and unlinked Slack events have no account identity. posthog.reset() and opt_out_capturing() do not delete historical PostHog data. Account deletion also does not call a PostHog deletion API, and server captures do not honor client opt-out. State these limits and the retention process, or add provider deletion and server-side opt-out handling.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@apps/marketing/content/legal/privacy.mdx` at line 24, Update the “Usage Data”
disclosure to accurately describe PostHog identity coverage, including
authenticated account identifiers, server-event distinct IDs, and anonymous or
unlinked events. State that reset and opt-out do not remove historical data,
account deletion does not invoke provider deletion, server captures may not
honor client opt-out, and explain the applicable retention process—or implement
provider deletion and server-side opt-out handling instead.
|
|
||
| ### 2.4 Mobile Application | ||
|
|
||
| Our mobile application lets you monitor and chat with AI agents running in your workspaces. With your permission, it can access your photo library, camera, and microphone so you can attach images to messages and dictate text; speech recognition may be processed by Apple. Photos and dictated text are only transmitted when you choose to send them. The mobile application collects the same account, usage, and device data described above. |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
rg -n -C 8 -i 'speech|microphone|camera|photo|attachment|upload|transcrib|recogn' \
apps/mobile --glob '*.{ts,tsx,js,jsx}'Repository: superset-sh/superset
Length of output: 50377
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- speech-recognition references ---'
rg -n -C 6 -i 'expo-speech-recognition|SpeechRecognizer|speechToText|transcrib|recognition' apps/mobile \
--glob '*.{ts,tsx,js,jsx,json}' \
| head -n 400
printf '%s\n' '--- mobile package metadata ---'
rg -n -C 3 'expo-speech-recognition|expo-av|react-native-voice' apps/mobile package.json bun.lockb bun.lock 2>/dev/null || true
printf '%s\n' '--- privacy policy context ---'
cat -n apps/marketing/content/legal/privacy.mdx | sed -n '20,42p'Repository: superset-sh/superset
Length of output: 28593
🌐 Web query:
expo-speech-recognition 56.0.1 iOS requiresOnDeviceRecognition default Apple server SFSpeechRecognizer
💡 Result:
In expo-speech-recognition version 56.0.1, the requiresOnDeviceRecognition option for iOS defaults to false [1][2][3]. When requiresOnDeviceRecognition is set to false (the default), the library utilizes Apple's standard SFSpeechRecognizer behavior, which sends audio data to Apple's servers for processing [4][5]. When set to true, it forces the underlying SFSpeechRecognitionRequest to perform recognition entirely on-device, preventing audio from being sent over the network [6][7][5]. Key considerations for using requiresOnDeviceRecognition: 1. Performance and Accuracy: Apple notes that on-device recognition may be less accurate than server-based recognition [6][7]. 2. Availability: Not all locales are supported for on-device recognition [5]. Before enabling this option, you should verify support for the target locale using the library's provided utility, ExpoSpeechRecognitionModule.supportsOnDeviceRecognition [8][9]. 3. System Requirements: For on-device recognition to succeed on iOS, the user must have the appropriate dictation language downloaded and enabled in their device settings (General > Keyboard > Dictation) [10]. If the required language model is missing or the configuration is incomplete, the request will fail [9][10]. 4. Privacy: Setting requiresOnDeviceRecognition to true is the primary method for ensuring that audio data never leaves the device, which is often a critical requirement for privacy-focused applications [5].
Citations:
- 1: https://npmx.dev/package/expo-speech-recognition/v/56.0.1
- 2: https://github.com/jamsch/expo-speech-recognition/blob/main/README.md
- 3: https://www.npmjs.com/package/expo-speech-recognition
- 4: https://stackoverflow.com/questions/79761805/how-to-handle-limitations-and-platform-differences-when-using-expo-speech-recogn?r=31
- 5: https://intrepidkarthi.com/writing/sfspeechrecognizer-on-device-deep-dive/
- 6: https://developer.apple.com/documentation/speech/sfspeechrecognitionrequest/requiresondevicerecognition
- 7: https://developer.apple.com/documentation/speech/sfspeechrecognitionrequest/requiresondevicerecognition?language=objc
- 8: https://github.com/jamsch/expo-speech-recognition/releases
- 9: https://cdn.jsdelivr.net/npm/expo-speech-recognition@3.1.0/src/ExpoSpeechRecognitionModule.types.ts
- 10: https://developer.apple.com/forums/thread/731230
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
sed -n '1,150p' 'apps/mobile/screens/(authenticated)/(home)/home/components/NewChatWidget/hooks/useVoiceDictation/useVoiceDictation.ts'
rg -n -C 5 'requiresOnDevice|onDevice|SFSpeech|recognitionRequest|processLocally|speech' . \
--glob '!bun.lock' \
--glob '!apps/mobile/components/ai-elements/**' \
--glob '!**/*.stories.*' \
| head -n 300Repository: superset-sh/superset
Length of output: 27676
Disclose microphone audio sent to Apple.
On iOS, expo-speech-recognition uses Apple’s server-based recognition by default because requiresOnDeviceRecognition is not set. State that microphone audio may be sent to Apple before the user sends the message. Limit “only transmitted” to Superset data.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@apps/marketing/content/legal/privacy.mdx` at line 34, Update the mobile
application privacy disclosure to state that microphone audio may be sent to
Apple for speech recognition before the user sends a message, reflecting the
default expo-speech-recognition behavior. Revise the “only transmitted when you
choose to send them” wording so it applies only to Superset data, such as photos
and dictated text sent in messages.
| - The right to data portability | ||
|
|
||
| To exercise these rights, please contact us using the information provided below. | ||
| You can delete your account at any time from Settings → Account → Delete account in our mobile or desktop applications, or from your account settings on our website. Your account is deactivated immediately and permanently deleted after a 30-day recovery period, during which you can restore it by signing back in. After deletion, content you created in shared organizations is retained in de-identified form as part of those organizations' records. To exercise your other rights, please contact us using the information provided below. |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
rg -n -C 8 -i \
'Delete account|deleteAccount|restore|30.?day|permanently deleted|de-ident|anonym|onDelete' \
apps packages --glob '*.{ts,tsx,js,jsx,md,mdx}'Repository: superset-sh/superset
Length of output: 50377
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- privacy policy ---'
sed -n '60,85p' apps/marketing/content/legal/privacy.mdx
printf '%s\n' '--- account-deletion candidates ---'
rg -l -i \
'delete account|deleteAccount|account deletion|deletion request|30.?day|recover.*account|restore.*account|de-identif|anonymiz' \
apps packages \
--glob '*.{ts,tsx,js,jsx,md,mdx}' \
--glob '!**/node_modules/**' \
| sort
printf '%s\n' '--- exact account-deletion references ---'
rg -n -i \
'delete account|deleteAccount|account deletion|deletion request|recover.*account|restore.*account|de-identif|anonymiz' \
apps packages \
--glob '*.{ts,tsx,js,jsx,md,mdx}' \
--glob '!**/node_modules/**' \
| head -n 500Repository: superset-sh/superset
Length of output: 9829
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- relevant route and API filenames ---'
rg --files apps packages | rg -i \
'(account|user|session|privacy|delete|restore|recover|admin)' \
| rg -i '(settings|auth|api|router|route|hook|legal|content)' \
| head -n 500
printf '%s\n' '--- deletion-related API procedures and database operations ---'
rg -n -i \
'(delete|restore|recover|deactivat|anonym|purge).*(account|user|member)| (account|user).*(delete|restore|recover|deactivat|anonym|purge)' \
apps packages \
--glob '*.{ts,tsx,js,jsx}' \
--glob '!**/node_modules/**' \
| head -n 500Repository: superset-sh/superset
Length of output: 50376
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
for file in \
packages/shared/src/constants.ts \
packages/trpc/src/router/user/user.ts \
packages/trpc/src/router/admin/admin.ts \
apps/web/src/app/'(dashboard-legacy)'/settings/account/page.tsx \
apps/web/src/app/account-pending-deletion/page.tsx \
apps/web/src/proxy.ts \
apps/desktop/src/renderer/routes/_authenticated/settings/account/components/AccountSettings/AccountSettings.tsx \
apps/desktop/src/renderer/routes/_authenticated/components/PendingDeletionScreen/PendingDeletionScreen.tsx \
apps/mobile/screens/account-pending-deletion/AccountPendingDeletionScreen.tsx
do
printf '\n--- %s ---\n' "$file"
wc -l "$file"
rg -n -C 10 \
'ACCOUNT_DELETION_GRACE_DAYS|deleteAccount|pending.?deletion|restore|deactivat|perman|shared|organization|organizationId|author|createdBy|anonym|de-ident' \
"$file" || true
doneRepository: superset-sh/superset
Length of output: 23665
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- admin.deleteUser call sites ---'
rg -n -C 5 \
'admin\.deleteUser|deleteUser\.mutate|deleteUser\.mutateAsync|deleteUser' \
apps packages \
--glob '*.{ts,tsx,js,jsx}' \
--glob '!**/node_modules/**'
printf '%s\n' '--- complete user deletion and reactivation mutations ---'
sed -n '60,155p' packages/trpc/src/router/user/user.ts
printf '%s\n' '--- pending-deletion routing and sign-in recovery ---'
rg -n -C 8 \
'deletionRequestedAt|reactivateAccount|PendingDeletionScreen|account-pending-deletion|signIn' \
apps/web apps/desktop apps/mobile packages/auth packages/trpc \
--glob '*.{ts,tsx,js,jsx}' \
--glob '!**/node_modules/**' \
| head -n 1000Repository: superset-sh/superset
Length of output: 50376
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- user-linked persisted content fields ---'
rg -n -C 3 \
'(createdBy|creatorId|authorId|userId|ownerId|assignedTo|created_by|author_id|user_id)' \
packages/db/src/schema packages/local-db/src/schema \
--glob '*.ts' \
| head -n 1200
printf '%s\n' '--- delete-user cascade behavior in schema ---'
rg -n -C 4 \
'references\(\(\) => users\.id|references\(\(\) => members\.|onDelete: "cascade"|onDelete: "set null"' \
packages/db/src/schema packages/local-db/src/schema \
--glob '*.ts' \
| head -n 1200
printf '%s\n' '--- explicit anonymization or author replacement logic ---'
rg -n -C 8 -i \
'de-ident|deident|anonym|anonymous|author.*(null|deleted|unknown)|createdBy.*(null|deleted|unknown)|userId.*(null|deleted|unknown)' \
apps packages \
--glob '*.{ts,tsx,js,jsx,sql}' \
--glob '!**/node_modules/**' \
| head -n 1000Repository: superset-sh/superset
Length of output: 50377
Align the policy with the deletion implementation. user.deleteAccount only marks the account and revokes credentials; no scheduled path invokes admin.deleteUser. Signing in opens the recovery flow but does not restore the account automatically. The purge also deletes user-authored shared content through cascading foreign keys, with no de-identification step.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@apps/marketing/content/legal/privacy.mdx` at line 75, Update the
account-deletion policy text to accurately describe the implemented behavior:
deletion deactivates the account and revokes credentials without claiming
automatic permanent purge or de-identification, and signing in should be
described as entering the recovery flow rather than automatically restoring the
account. Keep the guidance for exercising other rights unchanged.
🧹 Preview Cleanup CompleteThe following preview resources have been cleaned up:
Thank you for your contribution! 🎉 |
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
apps/mobile/store.config.json (1)
8-8: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winRestore the required App Store title.
The PR objective says to keep the app name as
Superset Mobile, but this value publishesSuperset: AI Agent Manager. RestoreSuperset Mobile, or update the release requirement before merging.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@apps/mobile/store.config.json` at line 8, Update the title value in the app store configuration to “Superset Mobile” so the published app name matches the release requirement.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@apps/mobile/store.config.json`:
- Line 8: Update the title value in the app store configuration to “Superset
Mobile” so the published app name matches the release requirement.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 063fa0d5-87fa-424f-b588-cfd70e674466
📒 Files selected for processing (1)
apps/mobile/store.config.json
The final code/content changes before TestFlight (launch-gate D3, D4, D7, D8):
supportsTablet: false): no iPad screenshot set, no iPad review pass, and no stretched phone UI judged on a 13" display. One-way-door aware: device families can be added in any later update but never removed, so claiming iPad now would be irreversible.store.config.json): real phone — the org Google Voice number, which is intentionally public-safe (it also serves as the published EU trader phone if we later enable EU storefronts). Review notes rewritten: Sign in with Apple creates a free account instantly (no demo credentials), companion-app empty state explained, account deletion location cited.Not included by design: app name stays "Superset Mobile" (D5), EU storefronts deferred (D6 — trader declaration is an ASC manual step regardless).
After this: manual ASC steps (age rating questionnaire, privacy nutrition labels, screenshots, trader declaration) →
eas metadata:push→ first production build → TestFlight.Summary by cubic
Makes the iOS app iPhone‑only, updates App Store metadata (title, review contact, pro‑gated companion‑app notes and demo access), and expands the privacy policy for mobile permissions, analytics, and the 30‑day account deletion window. This narrows v1 review scope and aligns storefront and policy with real behavior.
What to review
supportsTablet: false, wastrue).demoRequiredset totrue(wasfalse); notes clarify no in‑app purchases, external Pro subscription, companion‑app scope, demo access via “Sign in with email,” and that SSO creates a free account that lands on the subscription‑required screen; deletion path called out.PostHog) tied to account identifiers, and documents immediate deactivation, a 30‑day recovery window, and de‑identified retention for shared org content.Rollout
eas metadata:push, build, and submit to TestFlight.Written for commit 801a82a. Summary will update on new commits.
Summary by CodeRabbit
Documentation
Configuration