DRAFT FOR FORTUNE'S APPROVAL — NOT FINAL
This draft covers only what Fva Connect does today. Anything not yet decided is marked [Fortune to confirm] instead of being guessed.
You register with your name, an email address, and a password of at least 10 characters with an upper-case letter, a lower-case letter, and a number. You can also sign in with Google or GitHub once provider sign-in is configured; until then, the provider buttons return a not-configured message. Keep your password and your authenticator codes to yourself. You are responsible for what is posted from your signed-in session.
Email accounts have a verification step, but the verification email sender is not configured yet, so an email account cannot be verified until that sender is live. Provider accounts are marked verified because the provider already verified the email address. [Fortune to confirm: when the verification email sender goes live.]
You choose the visibility of each post: Public, Professional, or Connections. Connections posts are visible only to you and to people whose connection with you is accepted. You can delete your own posts. You may post job opportunities with a role title and a company name, bookmark jobs, and apply to jobs; an application is recorded once per job.
Do not use Connect to post content you do not have the right to share, to impersonate another person, to harass another user, or to try to break sign-in, sessions, or the human check. Admins can suspend accounts and hide or restore posts, and admin checks are recorded under a Trace ID. [Fortune to confirm: how a suspended user asks for a review, and who decides it.]
Two-factor sign-in, where you turn it on, uses an authenticator app only. Email codes are never accepted as a second factor. After 5 failed sign-in attempts, an account is locked for 30 minutes. The human check, FVAVerify, must pass before registration or sign-in when it is active.
A signed-in session lasts 7 days. You can see your sessions in your profile and revoke one session or all sessions. Signing out clears the session cookie.
Connect has no account deletion route yet and no data download route yet. This draft does not promise them until they exist. [Fortune to confirm: whether deletion and download routes will be added.]
If this draft changes, the changed draft will be shown here before it is treated as final. [Fortune to confirm: the date these terms take effect, and how signed-in users are told about a change.]
Draft only. This page is not final until Fortune approves the wording.