Accounts + uploads + DMs means “I’ll explain it if asked” is no longer enough.
What landed:
- Public Privacy Policy and Terms of Use on the Astro site (
/privacy,/terms) - Required agree + age ≥ 13 checkboxes on access request and signup
- Compact Privacy/Terms links on the admin auth shells
- Same story the product already tells: members Hub via invite or approved request, no ads, no sale of data, operator contact on the page
Not a corporate compliance theater pack — just clear rules for friends using a personal host. If the words and the code disagree later, fix the words or the code; do not let them drift.