Data inventory: G12 closed (Scores choice on the account web and in the launcher)

docs/compliance/data-inventory.md

@@ -382,7 +382,7 @@ Tables `feed_items`, `feed_members`, `feed_reactions`, `feed_firsts` (0017). Ite
 | Basis (proposed) | Art. 6(1)(b) for the feature; the audience limits who sees it. |
 | How | The net service submits a score for the running title (60 per account per 10 minutes). A better score replaces the row, an equal one keeps the earlier time. A board is made on the first accepted score (at most 64 boards per title, 16 made by one account, a score kept on at most 1,000). A score outside the board's bounds is refused. The cloud does not check the game ([ADR 0041](https://github.com/anyplaynet/network/blob/main/docs/adr/0041-leaderboards-are-boards-of-best-scores-named-by-the-game.md)). |
 | Who sees it | The owner always. A friend, unless the owner's audience is `nobody`. Anyone else, including signed-out visitors on the web board page (handle, score, time), only if the audience is `everyone`. A block in either direction hides the two accounts from each other and a banned account is in no view. Ranks are counted among the entries the viewer may see, so a hidden entry leaves no gap. Moderators can remove and restore entries. |
-| Setting | `scores` audience: `GET`/`PUT /v1/me/score-privacy` (also works while the feature is off). Neither the launcher nor the account web shows it yet (G12). |
+| Setting | `scores` audience: `GET`/`PUT /v1/me/score-privacy` (also works while the feature is off). The account web shows it under Privacy, the launcher (0.3.8 and newer) under Account. |
 | Kept | The score row for the life of the account. A moderator's removal stays on the row (so the same account cannot post the score again) until a moderator restores it. A board row stays when its last entry goes, because it holds the moderator's order and bounds; it keeps no personal data (`made_by` is set to null with the account). |
 | On deletion | `scores` and `score_privacy` cascade with the account, the removal mark with the row. |
 | Export | `scores` (title ID, board, score, achieved, removed_at, removed_reason) and `scores_shown_to`. |
@@ -425,4 +425,4 @@ Ordered by how much they matter. The IDs are used in the other documents.
 | G9 | **Age and terms record: done in migration 0008.** `age_confirmed_at`, `terms_version` and `terms_accepted_at` are stored on the account (no birth date); the account web names the age (16 in the EU unless the country sets a lower one) and asks again when `terms_version` changes. Accounts made before the migration have no record; the API's own sign-up records the age only. | `routes/auth.rs` (`create_account`), `web/flow.rs` | Decide whether older accounts are asked once (O-question for the lawyer); the privacy notice should name the cookie and the passkeys. |
 | G10 | **Partly closed** (backup change). `deploy/backup.sh` archives the whole `cloud-data` volume (database, `signing.key`, `ban.key`) before every update and keeps the newest 14 (mode 0600, SHA256 manifest); `deploy/restore.sh` proves an archive in a scratch volume (integrity check, account count) and is the documented restore path ([deploy.md](../deploy.md#backups)). **Open:** no encryption of the archives at rest, no off-machine copy, an erasure period for backups is not decided (a restore brings back accounts deleted since; `restore.sh` replays them from the deletion ledger, built; `backup.sh` keeps by count, not age, so the 90 days the privacy notice names are not enforced for regular archives), and processor contracts for a backup provider. | `deploy/backup.sh`, `deploy/restore.sh`, `docs/deploy.md` | Decide the retention period and the off-machine target; see [open-questions.md](open-questions.md). |
 | G11 | **A stable endpoint ID and handle in sessions** let members recognise each other across sessions. | `members` | Document it; consider a per-session endpoint pseudonym later. |
-| G12 | **The leaderboard audience has no screen.** `PUT /v1/me/score-privacy` works, but neither the launcher nor the account web offers the choice, so every player stays at `friends`. | `routes/boards.rs`, web account privacy page | Add a "Scores" row to the Privacy page and the launcher before many players use boards; `everyone` and `nobody` are unreachable until then. |
+| G12 | **Closed.** The account web (Privacy, web#51) and the launcher (Account, launcher#251, from 0.3.8) offer the choice: Friends, Everyone or Only You, `friends` by default. | `routes/boards.rs`, web account privacy page, launcher Account page | |