docs: after paying, a one-time claim link, never the key

CHANGELOG.md

@@ -20,6 +20,13 @@ numbers below were the site's earlier, hand-kept numbering and are retired; the
 
 ### Changed
 
+- **After paying: a claim link, not a key.** The extension page's checkout
+  note now says the licence email carries a one-time link (never the key),
+  that it works once for 72 hours and a new one can be asked for, that
+  **Add it to Chrome** adds the licence with no key to copy, and that a
+  school licence's buyer sets it up through the Nyuchi console and Chrome
+  policy. Merge with the licence server's claim links
+  (nyuchi-licence-server, `claude/licence-onboarding`).
 - **0.10.0 is on the Chrome Web Store.** The Releases page shows it as on the store since 13 October 2026, and the test builds 0.9.9 and 0.9.10 open its notes.
 - **The Toddle Enhancement Extension 0.9.0 is on the Chrome Web Store**,
   published on 7 October 2026. The Releases page marks it "On the Chrome Web

src/data/legal.ts

@@ -82,7 +82,7 @@ export const pricing = [
     price: "US$5",
     period: "per year",
     who: "One teacher.",
-    /** Checkout. Buy Me a Coffee for now; the key is issued by email. */
+    /** Checkout. Buy Me a Coffee for now; the licence arrives as a one-time claim link by email, never the key. */
     buy: "https://buymeacoffee.com/bryany/e/581737",
     includes: [
       "Every assessment tool expanded into per-criterion columns",

src/pages/toddle-enhancement-extension.astro

@@ -589,12 +589,17 @@ const schema = [
     </div>
 
     <p class="mt-6 text-caption text-muted-foreground max-w-2xl text-pretty">
-      Checkout is through Buy Me a Coffee, and your licence key is emailed to you
-      automatically, usually within a minute of paying. It is checked on your own machine, so activating it contacts
-      nothing and works offline — and one key covers your laptop and your classroom
-      desktop. It follows your Chrome account, so you
-      enter it once; Chrome's sync carries it, and it is never sent to us. While a key is entered, the extension checks at most once a day for cancelled keys,
-      sending nothing about you.
+      Checkout is through Buy Me a Coffee. Usually within a minute of paying, you get an
+      email with a one-time link to your licence, never the key itself. Open it in
+      Chrome, click <em>Add it to Chrome</em>, and the extension adds your licence:
+      there is no key to copy. The link works once, for 72 hours; if it runs out, open
+      it anyway and ask for a new one, which goes to the same address. A school
+      licence's link goes to whoever bought it, who sets it up for every teacher
+      through the Nyuchi console and Chrome policy. Once added, your licence is
+      checked on your own machine, so it works offline, and it follows your Chrome
+      account to your laptop and your classroom desktop; Chrome's sync carries it, and
+      it is never sent to us. While a licence is in use, the extension checks at most
+      once a day for cancelled keys, sending nothing about you.
     </p>
     <p class="mt-3 text-caption text-muted-foreground max-w-2xl text-pretty">
       <strong class="text-foreground">Upgrading.</strong>{" "}

tests/purchase.test.ts

@@ -0,0 +1,44 @@
+/**
+ * What a buyer is told happens after paying. The licence server emails a
+ * one-time claim link, never the key (nyuchi-licence-server: src/claims.js,
+ * CLAIM_TTL_S = 72 hours), so the page must not promise a key by email.
+ */
+import { describe, expect, it } from "vite-plus/test";
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const root = join(dirname(fileURLToPath(import.meta.url)), "..");
+const page = readFileSync(
+  join(root, "src/pages/toddle-enhancement-extension.astro"),
+  "utf8",
+);
+/* The paragraph under the plans, as one line of text. */
+const checkout = (() => {
+  const at = page.indexOf("Checkout is through Buy Me a Coffee.");
+  expect(at).toBeGreaterThan(-1);
+  return page
+    .slice(at, page.indexOf("</p>", at))
+    .replace(/<[^>]+>/g, "")
+    .replace(/\s+/g, " ");
+})();
+
+describe("after paying", () => {
+  it("says the email carries a one-time link, never the key", () => {
+    expect(checkout).toContain(
+      "one-time link to your licence, never the key itself",
+    );
+    expect(checkout).toContain("there is no key to copy");
+    expect(page).not.toMatch(/licence key is emailed/);
+  });
+
+  it("says how long the link works, as the licence server does (72 hours)", () => {
+    expect(checkout).toContain("The link works once, for 72 hours");
+    expect(checkout).toContain("ask for a new one");
+  });
+
+  it("says how to use it, and how a school licence differs", () => {
+    expect(checkout).toContain("Add it to Chrome");
+    expect(checkout).toContain("Nyuchi console and Chrome policy");
+  });
+});