Don't let your deploys go unnoticed.

• The web comment form and "ask for this item" now honour blocks, and the

rule lives in the model (Donation#open_to?, a Comment validation), so any
future path is covered as well.

• The web comment controller hides drafts like the donation page does.


• Reports of a draft listing, or of a comment on one, 404 for anyone but

the owner, so they can't be used to find out that a draft exists.

What App Review guideline 1.2 asks of an app with user content:

• Reports of listings, comments and people (POST /api/reports), emailed to

support straight away.

• Blocks (/api/blocks): a blocked person's listings, comments and activity

are hidden, their requests are withdrawn, and they can no longer ask for
or comment on the blocker's things.

• A whole-word filter (config/content_filter.yml) on listing titles,

descriptions and comments, in all seven languages.

• App users must accept the terms (POST /api/me/accept_terms) before they

post, comment or ask for things.
The privacy policy now names every service that handles data (Hetzner,
Resend, OpenAI for photo suggestions, the sign-in providers), how long data
is kept and how to delete an account; the terms state zero tolerance for
objectionable content and how reports are handled. Both are now in all
seven languages instead of English only.
Maps use OpenStreetMap's tiles, with the attribution they require, instead
of Carto.

The API skipped localized routes and so always spoke the default language:
errors, activity messages and notification text reached a Danish iPhone in
English. It now follows Accept-Language. Photo suggestions (title and
description) are written in the request's language as well, on the web
form too.

• ApiTokens get a scope: mcp tokens (made on the settings page) only work on

/mcp, and the iPhone app's tokens only on /api.

• The website hand-off redirects to https://<host>/app/callback, which iOS

only gives to the app named in the new apple-app-site-association, instead
of a custom URL scheme any app could claim.

• Sign in with Apple no longer signs in to an existing account with the same

email, since emails here are not verified.

Bearer token auth on /api with the existing ApiTokens, Sign in with Apple
(POST /api/session/apple), and a website hand-off at /app/authorize so every
existing way of signing in works in the app without it handling passwords.
Adds posting with a photo, editing and deleting, requesting, approving and
rejecting, regions, charities filtered by currency, notifications, and the
account (including deleting it, which App Review requires).

The API serialised donations with as_json, so image_url came back as the
Active Storage attachment (with the whole record nested inside) instead of
a URL, and every column was exposed - requesters, unsubscribers, transfer,
transaction_id, and a comment's payment details.
Responses are now built field by field, with image_url, thumbnail_url,
charity logo_url and user avatar_url as URLs. Drafts 404 through the API
for anyone but their owner, matching the web page.

Structured data on every public page (Organization sitewide, Product,
NGO, Place, ProfilePage, CollectionPage, Article, BreadcrumbList),
robots directives with noindex on personal and search-result pages,
a sitewide RSS feed, image entries in the sitemap, and llms.txt /
llms-full.txt rendered from the database instead of static files.
Translate the SEO category landing pages and giving guides into
Swedish, Norwegian, German, French and Spanish, and move the guides'
hardcoded badges and calls to action into locale keys.