Clear App Store Connect Add for Review blockers

.github/workflows/asc-metadata.yml

@@ -0,0 +1,77 @@
+# Fills the App Store Connect listing fields that block "Add for Review":
+# content rights, Music category, privacy policy URL, support URL, review
+# contact (and turns OFF "sign-in required"), and a 1.0.x build if one exists.
+#
+# Uses the same ASC_KEY_ID / ASC_ISSUER_ID / ASC_KEY_P8 secrets as TestFlight.
+# The key must be Admin — App Manager cannot write App Information.
+#
+# Screenshots are left alone (phone uploads in progress 409 if we race them).
+# The App Privacy *questionnaire* still has to be published once in the UI
+# ("No, we do not collect data" → Publish).
+name: App Store Connect listing
+
+on:
+  workflow_dispatch:
+    inputs:
+      contact_phone:
+        description: "App Review contact phone (E.164). Optional if TestFlight already has one."
+        required: false
+        type: string
+      privacy_url:
+        description: "Override privacy policy URL"
+        required: false
+        type: string
+      support_url:
+        description: "Override support URL"
+        required: false
+        type: string
+  push:
+    branches: [main]
+    paths:
+      - Scripts/fill_asc_metadata.py
+      - docs/site/**
+      - PRIVACY.md
+      - .github/workflows/asc-metadata.yml
+
+concurrency:
+  group: asc-metadata
+  cancel-in-progress: false
+
+jobs:
+  fill:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install JWT deps
+        run: pip install --disable-pip-version-check PyJWT cryptography
+
+      - name: Write App Store Connect API key
+        env:
+          ASC_KEY_P8: ${{ secrets.ASC_KEY_P8 }}
+          ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
+        run: |
+          set -eu
+          if [ -z "$ASC_KEY_P8" ] || [ -z "$ASC_KEY_ID" ]; then
+            echo "::error::ASC_KEY_ID / ASC_ISSUER_ID / ASC_KEY_P8 secrets are not configured — see TestFlight workflow header."
+            exit 1
+          fi
+          mkdir -p "$HOME/private_keys"
+          echo "$ASC_KEY_P8" | base64 --decode > "$HOME/private_keys/AuthKey_${ASC_KEY_ID}.p8"
+
+      - name: Fill listing
+        env:
+          ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
+          ASC_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }}
+          ASC_CONTACT_PHONE: ${{ github.event.inputs.contact_phone || '' }}
+          PRIVACY_URL: ${{ github.event.inputs.privacy_url || '' }}
+          SUPPORT_URL: ${{ github.event.inputs.support_url || '' }}
+        run: |
+          set -eu
+          export ASC_KEY_P8_PATH="$HOME/private_keys/AuthKey_${ASC_KEY_ID}.p8"
+          python3 Scripts/fill_asc_metadata.py

.github/workflows/pages.yml

@@ -0,0 +1,31 @@
+# Optional public site for the privacy policy + support pages Apple wants
+# as HTTPS URLs. Enable Pages once: Settings → Pages → Source = GitHub Actions,
+# then run this workflow. Until then the listing workflow falls back to
+# PRIVACY.md on GitHub and github.com/ContinuityInc/Continuity/issues.
+name: GitHub Pages
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+concurrency:
+  group: pages
+  cancel-in-progress: true
+
+jobs:
+  deploy:
+    runs-on: ubuntu-24.04
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/upload-pages-artifact@v3
+        with:
+          path: docs/site
+      - id: deployment
+        uses: actions/deploy-pages@v4

.gitignore

@@ -20,3 +20,7 @@ xcuserdata/
 /Cache/
 *.m4a
 *.caf
+
+# Python (ASC listing script)
+__pycache__/
+*.py[cod]

PRIVACY.md

@@ -0,0 +1,26 @@
+# Privacy Policy — Continuity
+
+**Last updated:** 21 September 2026
+
+Continuity is a personal music player made by ContinuityInc. It does not have accounts, analytics, advertising, or any server that stores your library.
+
+## What stays on your device
+
+- Audio files you import from the Files app
+- Artwork extracted from those files
+- Playback position, skip history, and transition settings
+- On-device analysis (tempo, key, loudness) and stem-separated audio used for blends
+
+None of that is uploaded. Continuity does not have user accounts, so it never asks for a name, email, or password.
+
+## Network use
+
+The only network request Continuity makes is a one-time download of the on-device stem-separation model (~158 MB, MIT-licensed HT-Demucs weights hosted on Hugging Face) the first time vocal-aware blends need it. That download is a model file, not your music.
+
+## Data we do not collect
+
+Continuity does not collect names, emails, identifiers, location, contacts, browsing history, or usage analytics. There is no tracking and no third-party SDK that phones home.
+
+## Contact
+
+Questions and support: [github.com/ContinuityInc/Continuity/issues](https://github.com/ContinuityInc/Continuity/issues)