Changelog

The Type DELETE to confirm step in the account deletion modal is now visually prominent, red-tinted, and self-explaining. A founding creator reported that the prior treatment was easy to miss and the confirm button looked inactive. The fix makes the step unmissable on first glance.

Contact Support in the footer now opens a form that writes a ticket to the platform inbox without needing a configured desktop mail client. Webmail users and anyone whose mailto handler is not set up can now reach the team. The form takes a subject, message, and reply email; the team responds within 48 hours during business days.

Three new public surfaces ship together. The glossary defines the platform-specific and provenance terminology a first-time visitor encounters. The DMCA page documents the copyright notice and counter-notice process with provenance-aware framing. The changelog is this page.

About, How it works, FAQ, and References pages shipped together as the visitor-education foundation. The landing page now carries a small credibility strip with cross-links to the trust posture, how-it-works walk-through, and standards references. The footer was reorganised into a two-row layout grouping the visitor-education cluster separately from the legal cluster.

security.txt at /.well-known/security.txt published per RFC 9116. Vulnerability disclosure policy with safe-harbor language at /security-policy. Accessibility statement with honest gap acknowledgments at /accessibility. Sitemap rewritten to the canonical arcvelvet.com domain.

The trust infrastructure document that describes the platform's certificate posture, verifier endpoints, signing model, and known gaps is now reachable at arcvelvet.com/trust. It was previously only visible to people browsing the source repository.

The desktop footer now shows ArcVelvet Studios LLC and the current copyright year. Small surface, real credibility lift for external reviewers landing on the platform.

The cookie consent banner now explicitly names PostHog as the analytics service, links to PostHog's own privacy policy, and skips PostHog initialisation entirely when the browser sends the Do Not Track header. The existing opt-in and opt-out mechanism stays the same.

Defensive coercion against a render-time crash in the deletion confirmation modal. A local error boundary inside the modal surfaces the actual error instead of letting it propagate to the global System interruption fallback. A new spend-down prompt names the user's non-withdrawable AE balance and explains the forfeit policy so the user can spend it before confirming if they want to.

Signal share URLs now take the form arcvelvet.com/@username/post/{signalId} when the creator's username is known. Profile share URLs are arcvelvet.com/@username. Old /post/{signalId} URLs continue to work indefinitely. The signal id remains the canonical resolver server-side; the username is decorative and survives handle reclamation.

Share affordances on signal cards, the signal detail console, and the profile grid open a modal with six platform-specific share targets (Twitter or X, Bluesky, LinkedIn, email, copy link, download card) plus the Web Share API on supported devices. Inbound share traffic is analytics-tracked with UTM attribution.

The deletion flow now includes a 30-day grace period with the option to cancel, an automatic Stripe payout attempt for withdrawable AE, a 12-month escrow window for funds the payout could not deliver, and an email-verified recovery path for the escrow even after the account closes. Signed content with associated sales is preserved with name replacement so buyers retain verifiability.

The platform's verifier endpoint now reports manifest conformance and credential format strings that match the C2PA v2.2 substrate exactly. Third-party verifier toolchains and standards-community reviewers see the same version disclosure ArcVelvet ships against.

Third-party verifier toolchains can now fetch the platform's C2PA signing certificate at /.well-known/c2pa-certs and the corresponding public key at /.well-known/c2pa-jwks. Both follow the RFC 8615 well-known URI convention so verifiers do not need per-vendor coordination.