Changelog

All notable changes to Generous.nz are recorded here, grouped by version. Every deployed build has a version number, a git tag, and an entry below.

Versioning scheme

Versions follow MAJOR.MINOR.PATCH:

0.x — pre-launch. Minor bumps mark a completed build phase or major feature set; patches are bug fixes on the current build.
1.0.0 — first public launch.
1.x+ — post-launch: minor = new features, patch = fixes, major = breaking changes or significant re-architecture.

Each version is tagged in git (v0.2.0) and the current version is kept in package.json. See docs/version-control.md for how to cut a release.

Mobile layout fixes — no more horizontal scrolling.

Public header: added a real mobile menu — a hamburger button on small screens that opens a dropdown with every link plus Sign in / Start fundraising. The desktop nav stays a row on larger screens. Previously the nav rendered as one long unwrapped row on mobile, pushing the page wider.
Dashboard sidebar: the nav now wraps on mobile (it was a horizontal row of links that overflowed) and stays a vertical column on desktop.
Global guard: overflow-x: hidden on html/body so any residual wide content can never create side-to-side scrolling again.

The help widget already uses a responsive width (min(92vw, 400px)), so it doesn't overflow on small screens.

Business page — clearer "how a sale looks" breakdown.

The worked example now shows the full picture with correct arithmetic: $100 sale − $2.95 Stripe processing (approx, varies) − $10 fundraiser cut (min 10%) − $5.75 platform fee = $81.30 you keep. The first-sale line (platform fee waived) now correctly reads $87.05.
Footnote clarifies the figures are approximate, Stripe's rate varies by card type, and exact numbers are in the dashboard.

Legal documents go live — draft banners removed.

All ten policy documents (Terms, Privacy, Seller, Fundraiser, Wholesaler, Prohibited Items, Refund, Dispute, AML/CFT, Charity Verification) now show Version + Effective date 24 August 2026 with no "Draft for legal review" banners. Draft-only disclaimers removed; useful notes (e.g. CGA rights, Stripe Connect KYC reliance) retained in plain form.
The internal policy index (docs/policies/README.md) updated to reflect the live status.

The money-flow description these documents rely on is the Option A pack (docs/legal-signoff-option-a.md) — still worth sending to your lawyer for the formal review, but the pages are no longer labelled drafts.

AI fraud protection as a business selling point.

Business page now markets the platform's AI checks: a new "AI fraud protection" feature card and a full "Protected by AI, reviewed by humans" section covering order screening, fundraiser/product pre-live checks, delivery-address verification, and the human-review rule for anything flagged. Metadata description updated too.
Copy reflects what's already wired: fundraisers, products, reviews and organisations are AI-reviewed on submission; orders are screened at checkout; delivery zones are AI-verified.

Order fraud screening runs once ORDER_FRAUD_ENABLED=true and a provider key are set on the server; the rest of the checks run automatically with the DeepSeek key configured.

Business fee confirmed: 5% + GST with the first $1,000 of sales free.

Free-first-$1,000 is now the product default (not just a server setting): wholesalerFreeSalesThresholdCents() defaults to 100000 cents, so every approved business gets its first $1,000 of sales with no platform fee — a $50 saving at 5%. Per-business overrides still available in admin; WHOLESALER_FREE_SALES_CENTS=0 disables it.
Business sign-up page makes it the headline: hero banner "No platform charges on your first $1,000 in sales", updated feature card, the example now shows the first sale keeping $90 (fee waived), and the sign-up checklist states it up front. Metadata description updated too.
Help centre and docs updated ("first $1,000 free" instead of the generic "$X").

International business applications require manual admin review.

New country field on business applications (default New Zealand; common countries selectable, "Other" with a free-text name).
Non-NZ applications are flagged for manual review: the admin wholesalers page shows the country and an "International — manual review" badge; applications remain in APPLIED status until an admin decides (approval is admin-only, and the audit log records the country).
Migration 0026_business_country.

Stats everywhere — views, popular products, top purchasers, downloads.

Page-view tracking: every fundraiser page counts total views and unique daily views (rate-limited, deduped per IP/day; migration 0025_views).
Fundraiser stats dashboard (Dashboard → Stats & orders): views, raised, orders, units, average order, raised-per-day chart, most popular items, top purchasers (buyer name/email — owner-only, for privacy), recent orders, and a CSV export with delivery details.
Business analytics upgrade: paid-to-you, orders/units, fundraiser page views, top buyer spend, sales-per-day chart, most popular products, top purchasers, and a "what works" table — every fundraiser selling your products with views, orders, units and what you receive. Filter by fundraiser to see each campaign's contribution. Download all orders CSV now includes the full delivery address + commission and honours the fundraiser filter — ready to fulfil.
Admin analytics: fundraiser page views, site-wide most popular products and top purchasers, alongside the existing totals/charts.

Buyer names/emails appear only in owner/admin dashboards, not on public pages (Privacy Act 2020).

Off-site backup to Dedirock (hardened SFTP).

Dedirock backup target configured (23.95.7.102): dedicated non-login backup user, key-only auth, forced internal-sftp confined to /home/backup/generosity, and the authorized key restricted to this server's IP with forwarding/PTY disabled — a compromised app server can't reach the rest of the backup host.
Backup job (scripts/offsite-backup.sh): pg_dump → gzip, uploads tar, pushed via restricted SFTP with 14-copy retention.
Setup guide (docs/backup-offsite.md) with the one-time root commands to finish on the app server (move key, install script, cron, test).

Requires the one-time root steps in the guide (the key is staged at /home/deepseekcs/.ssh/generosity-backup on the app server).