A grievance is filed from a signed-in account

Decision

Only a signed-in user can file a grievance or attach a file to one. A visitor who is not signed in sees a prompt to sign in, and the grievance officer's email address for anyone who cannot.

Why

The owner's call: a grievance asks for someone's data, or for it to be changed or erased, and that request should come from the account it is about. An anonymous form lets anyone file in anyone's name, and an anonymous upload path is a bucket a script can fill.

One group cannot sign in and still has rights over their data: a person whose account is deleted or whose inbox is gone, and a person whose details someone else uploaded. They are served by the published email address, which stays on /legal/grievance and in the footer. That address is the fallback this decision depends on — do not remove it.

Whether an email-only channel for people without an account satisfies the DPDP Act's grievance-redressal duty is a legal question nobody here has answered. Ask counsel before launch.

Impact

• fileGrievance — requireSignedIn: true, App Check enforced like every other callable; the case is tied to the caller's uid from the session, not from the form. The per-IP limiter for anonymous callers is deleted.
• apps/website/.../legal/grievance/GrievanceForm.tsx — the signed-out prompt.
• firebase/storage.rules — grievances/_intake writes need a signed-in user.
• .context/designs/web/marketing/grievance-locked.html — the signed-out state.

Sources

• Owner, in chat, 2026-10-05.