legal(monthly): flag Chrome extension, PostHog identify, new sub-processors for review

[devin-ai-integration]

Summary

Monthly automated review of legal documentation against product changes from the last 30 days (Jan 30 – Mar 1, 2026). This PR adds a review report (LEGAL_REVIEW_2026_03.md) flagging 8 findings across Privacy Policy, Terms of Service, Cookie Policy, and DPA. No legal documents were modified.

The 3 HIGH-priority findings are:

1. New Chrome extension (apps/chrome) collects Google Meet participant names, mute state, and URLs — not mentioned in any legal doc
2. PostHog $identify now links analytics to user accounts (email/ID), but DPA still describes PostHog as "for logging clicks"
3. Missing DPA sub-processors: Nango (OAuth), Chatwoot (support chat), and Google (Calendar/Drive) were added but are not in the sub-processor list

Review & Testing Checklist for Human

• Verify Chrome extension data flow: Report assumes data stays local via Native Messaging. Confirm no cloud transmission occurs — this determines whether Privacy Policy needs a "local only" or "cloud" disclosure.
• Verify Cookie Policy outdated services claim: Report flags Intercom, Zendesk, Google Ads, and Facebook Pixel as unused. This was inferred from absence in recent commits — verify these aren't still embedded in the marketing site or loaded via tag managers.
• Verify Cactus is local-only: Report assumes Cactus STT/LLM is purely on-device. If any Cactus processing hits a remote server, it would need DPA listing.
• Check for missed changes: The report was generated from git log --since="30 days ago" with keyword filtering. Skim the full log for anything the automated scan may have missed.
• Forward HIGH findings to legal counsel before making any doc changes.

Notes

• Devin Session
• Requested by: bot_apk (apk@cognition.ai)

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR that start with 'DevinAI' or '@devin'.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[netlify]

✅ Deploy Preview for hyprnote canceled.

Name	Link
🔨 Latest commit	d959a37
🔍 Latest deploy log	https://app.netlify.com/projects/hyprnote/deploys/69a39ef011c1a90008712460

[netlify]

✅ Deploy Preview for hyprnote-storybook canceled.

Name	Link
🔨 Latest commit	d959a37
🔍 Latest deploy log	https://app.netlify.com/projects/hyprnote-storybook/deploys/69a39ef0e2e3f80008e594c9