Claude Fable 5
0c9d44e9c9
All checks were successful
CD / Build and push images (push) Successful in 1m18s
CD / Deploy to Test (push) Successful in 12s
CD / Smoke tests against Test (push) Successful in 1m20s
CD / Promote to Int (push) Successful in 11s
CI / Lint, typecheck, test (push) Successful in 4m7s
CI / Build container images (push) Has been skipped
CI / Auth e2e pack (push) Successful in 5m37s
CI / Import/export fidelity gate (push) Successful in 47s
- deploy/legal/dorfteich-online-{impressum,datenschutz}.md: ready-to-
paste Markdown for the flagship instance (Admin → Legal pages after
the wizard) — operator standard texts (§5 DDG, §18(2) MStV, VSBG
no-participation, UGC/liability/copyright notices) plus a privacy
policy grounded in what THIS instance actually does: Hetzner hosting
with DPA, session cookie only (no banner), rate-limit IPs, proxy logs
≤30d, transactional + digest mail with unsubscribe, plaintext content
with versions/comments and public pages, hashed API tokens with
audited writes, nightly backups incl. the encrypted-tunnel mirror to
the operator's private server, self-service export,
deletion/pseudonymization, LfDI BaWü.
- docs/self-hosting/legal-template.md: review checklist and both
language templates extended for the processing added since #82 —
comments/version history, notifications/digest mails, API tokens,
off-host backup copies.
No legal advice; texts follow the operator's standard building blocks
and should get a final human read before publishing.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1
254 lines
12 KiB
Markdown
254 lines
12 KiB
Markdown
# Legal page templates (imprint & privacy policy)
|
|
|
|
Dorfteich ships legal pages as a product feature (issue #82, security.md
|
|
§Privacy): Site Admins paste Markdown into **Administration → Legal pages**,
|
|
and the texts render publicly at `/legal/imprint` and `/legal/privacy` —
|
|
linked from the footer on every view. This document provides starting
|
|
templates whose privacy section matches **what Dorfteich actually
|
|
processes**; keep it in sync when a change adds or removes a processing
|
|
activity (review anchor: security.md §Privacy).
|
|
|
|
> **Not legal advice.** These templates are a technically accurate starting
|
|
> point, not a substitute for a lawyer. Operator-specific parts (identity,
|
|
> hosting provider, log retention, backups) are marked with `[…]`
|
|
> placeholders and MUST be filled in. dorfteich.online uses the operator's
|
|
> own standard texts, applied at go-live (#89) — not these templates.
|
|
|
|
## What Dorfteich processes (review checklist)
|
|
|
|
The privacy templates below cover exactly these activities. When one of
|
|
them changes, update the templates in the same change:
|
|
|
|
| Activity | Data | Where implemented |
|
|
| ----------------------- | ------------------------------------------------------------------ | ---------------------------------------------------------------------------- |
|
|
| Accounts | username, e-mail, password hash, display name, locale | `users` table; signup/verification (ADR 0007) |
|
|
| Sessions | session cookie (`dt_session`), user agent, expiry | `sessions` table |
|
|
| Rate limiting | IP address in short-lived counters | `rate_limits` table (short TTL, operations.md) |
|
|
| Reverse-proxy logs | IP address, requested URL | host level (Caddy/nginx), operator-managed rotation |
|
|
| Transactional e-mail | recipient address, mail content | SMTP relay (wizard/secret store, #80); verification, password reset |
|
|
| Content & uploads | pages, attachments authored by users | ponds/pages/files; server sees plaintext (no E2E, security.md §Out of scope) |
|
|
| Comments & versions | comment threads; per-page version history incl. contributor names | comments (#91), versions (ADR 0013) |
|
|
| Notifications & digests | in-app notifications; digest mails with unsubscribe token | notifications (#94), digests (#95) |
|
|
| API tokens | token hash, scope, last use; writes audit-logged | personal access tokens (#104), MCP (#105) |
|
|
| Off-host backup copies | full backup sets on an operator-chosen target | Nextcloud target (#103), private mirror (#84) |
|
|
| Data export | self-service ZIP (profile + own ponds) | `POST /users/me/data-export` (#68) |
|
|
| Deletion | trash/purge for content; pseudonymized authorship ("deleted user") | PseudonymizationService (#59), trash retention (ADR 0013) |
|
|
| No third-party requests | fonts self-hosted, no CDNs, no analytics | ADR 0016, CSP in nginx.conf |
|
|
|
|
## Imprint template (fill in and paste into Administration → Legal pages)
|
|
|
|
The legal pages render their own localized heading (Imprint/Impressum,
|
|
Privacy policy/Datenschutzerklärung), so the templates start straight with
|
|
the content — do not add a top-level `#` heading of your own.
|
|
|
|
```markdown
|
|
**Operator of this instance**
|
|
|
|
[Name]
|
|
[Street and number]
|
|
[Postal code, city]
|
|
[Country]
|
|
|
|
**Contact**
|
|
|
|
E-mail: [address]
|
|
[Phone: optional]
|
|
|
|
[If applicable: register entries, VAT ID, persons responsible for content.]
|
|
```
|
|
|
|
German version:
|
|
|
|
```markdown
|
|
**Betreiberin/Betreiber dieser Instanz**
|
|
|
|
[Name]
|
|
[Straße und Hausnummer]
|
|
[PLZ, Ort]
|
|
[Land]
|
|
|
|
**Kontakt**
|
|
|
|
E-Mail: [Adresse]
|
|
[Telefon: optional]
|
|
|
|
[Falls zutreffend: Registereinträge, USt-IdNr., inhaltlich Verantwortliche.]
|
|
```
|
|
|
|
## Privacy policy template (English)
|
|
|
|
```markdown
|
|
This instance of Dorfteich is operated by [operator, see imprint]. We
|
|
process personal data only as far as running this service requires
|
|
(Art. 6 (1) (b) GDPR for accounts, Art. 6 (1) (f) GDPR for abuse
|
|
protection and operational logs).
|
|
|
|
## Accounts
|
|
|
|
When you register, we store your username, e-mail address, a password
|
|
hash (never the password itself), your display name, and your language
|
|
preference. The e-mail address is used to verify your account and for
|
|
password resets. Accounts are visible to other members through the names
|
|
you choose.
|
|
|
|
## Sessions and cookies
|
|
|
|
After signing in, a session cookie (`dt_session`) keeps you signed in.
|
|
We store the session together with the browser identification (user
|
|
agent) your client sends and an expiry time. There are no tracking or
|
|
third-party cookies.
|
|
|
|
## Abuse protection and server logs
|
|
|
|
To protect the service against abuse, IP addresses are counted in
|
|
short-lived rate-limit records that expire automatically. The web server
|
|
in front of this instance additionally writes access logs containing IP
|
|
addresses; these are rotated and deleted after [retention, e.g. 14 days].
|
|
|
|
## E-mail
|
|
|
|
Transactional e-mails (account verification, password reset) are sent
|
|
through the SMTP relay [relay provider]. Your e-mail address and the
|
|
message content are transmitted to that relay for delivery.
|
|
|
|
## Content you create
|
|
|
|
Pages and uploaded files you create are stored on the server and are
|
|
visible to the people your ponds' permissions allow. Content is not
|
|
end-to-end encrypted — the server processes it in plaintext to provide
|
|
search, export, and rendering. Every page keeps a version history
|
|
including the names of its contributors; comments are stored with their
|
|
author. Deleted pages remain restorable from the
|
|
trash for [trash retention, default 30] days before they are permanently
|
|
removed.
|
|
|
|
## Notifications and digest mails
|
|
|
|
If you watch pages or ponds, notifications are collected in the app and
|
|
— depending on your settings — bundled into digest e-mails. Digests can
|
|
be disabled in the settings; every digest carries an unsubscribe link
|
|
that works without signing in.
|
|
|
|
## API tokens
|
|
|
|
If you create personal access tokens (for scripts or AI assistants),
|
|
only a hash of the token is stored. Token access is limited to your own
|
|
permissions; write operations are recorded in the administrative audit
|
|
log.
|
|
|
|
## No third-party requests
|
|
|
|
Your browser talks only to this instance: fonts are self-hosted, and
|
|
there are no CDNs, no analytics, and no embedded third-party services.
|
|
|
|
## Your rights
|
|
|
|
You can export your own data (profile and the ponds you own) as a ZIP
|
|
archive at any time from your account settings (right of access and data
|
|
portability). When your account is deleted, your personal pond and the
|
|
ponds you own are deleted through the trash process, and your authorship
|
|
on shared content is replaced with "deleted user" (pseudonymization).
|
|
You further have the right to rectification, erasure, restriction of
|
|
processing, and to lodge a complaint with a supervisory authority. To
|
|
exercise your rights, contact [address from the imprint].
|
|
|
|
## Hosting and backups
|
|
|
|
This instance is hosted at [provider, location]. Backups are kept for
|
|
[retention] and stored [location/provider]. [If configured: a copy of
|
|
each backup set is transferred to [target, e.g. a Nextcloud / a private
|
|
server] and kept there for [retention].]
|
|
```
|
|
|
|
## Privacy policy template (Deutsch)
|
|
|
|
```markdown
|
|
Diese Dorfteich-Instanz wird betrieben von [Betreiberin/Betreiber, siehe
|
|
Impressum]. Wir verarbeiten personenbezogene Daten nur, soweit der
|
|
Betrieb dieses Dienstes es erfordert (Art. 6 Abs. 1 lit. b DSGVO für
|
|
Konten, Art. 6 Abs. 1 lit. f DSGVO für Missbrauchsschutz und
|
|
Betriebs-Logs).
|
|
|
|
## Konten
|
|
|
|
Bei der Registrierung speichern wir Benutzername, E-Mail-Adresse, einen
|
|
Passwort-Hash (nie das Passwort selbst), den Anzeigenamen und die
|
|
Spracheinstellung. Die E-Mail-Adresse dient der Bestätigung des Kontos
|
|
und dem Zurücksetzen des Passworts. Konten sind für andere Mitglieder
|
|
unter den von dir gewählten Namen sichtbar.
|
|
|
|
## Sitzungen und Cookies
|
|
|
|
Nach der Anmeldung hält ein Sitzungs-Cookie (`dt_session`) dich
|
|
angemeldet. Wir speichern die Sitzung zusammen mit der von deinem
|
|
Browser übermittelten Kennung (User-Agent) und einem Ablaufzeitpunkt.
|
|
Es gibt keine Tracking- oder Drittanbieter-Cookies.
|
|
|
|
## Missbrauchsschutz und Server-Logs
|
|
|
|
Zum Schutz vor Missbrauch werden IP-Adressen in kurzlebigen
|
|
Rate-Limit-Einträgen gezählt, die automatisch verfallen. Der
|
|
vorgeschaltete Webserver schreibt zusätzlich Zugriffs-Logs mit
|
|
IP-Adressen; diese werden rotiert und nach [Aufbewahrung, z. B. 14
|
|
Tagen] gelöscht.
|
|
|
|
## E-Mail
|
|
|
|
Transaktions-E-Mails (Konto-Bestätigung, Passwort-Zurücksetzen) werden
|
|
über den SMTP-Server [Anbieter] versendet. Dafür werden deine
|
|
E-Mail-Adresse und der Nachrichteninhalt an diesen Server übermittelt.
|
|
|
|
## Von dir erstellte Inhalte
|
|
|
|
Von dir angelegte Seiten und hochgeladene Dateien liegen auf dem Server
|
|
und sind für die Personen sichtbar, die die Berechtigungen deiner Teiche
|
|
zulassen. Inhalte sind nicht Ende-zu-Ende-verschlüsselt — der Server
|
|
verarbeitet sie im Klartext, um Suche, Export und Darstellung
|
|
bereitzustellen. Zu jeder Seite wird eine Versionshistorie
|
|
einschließlich der beteiligten Autorinnen und Autoren geführt;
|
|
Kommentare werden mit ihrer Autorin/ihrem Autor gespeichert. Gelöschte
|
|
Seiten bleiben [Aufbewahrung, Standard 30]
|
|
Tage im Papierkorb wiederherstellbar, bevor sie endgültig entfernt
|
|
werden.
|
|
|
|
## Benachrichtigungen und Digest-Mails
|
|
|
|
Wenn du Seiten oder Teiche beobachtest, werden Benachrichtigungen in der
|
|
App gesammelt und — je nach Einstellung — als Sammel-E-Mails („Digests")
|
|
zugestellt. Digests lassen sich in den Einstellungen abschalten; jede
|
|
Digest-Mail enthält einen ohne Anmeldung funktionierenden Abmeldelink.
|
|
|
|
## API-Tokens
|
|
|
|
Wenn du persönliche API-Tokens anlegst (für Skripte oder
|
|
KI-Assistenten), wird nur ein Hash des Tokens gespeichert. Zugriffe über
|
|
Tokens unterliegen deinen eigenen Berechtigungen; schreibende Zugriffe
|
|
werden im Admin-Protokoll festgehalten.
|
|
|
|
## Keine Anfragen an Dritte
|
|
|
|
Dein Browser kommuniziert ausschließlich mit dieser Instanz: Schriften
|
|
sind selbst gehostet, es gibt keine CDNs, keine Analyse-Dienste und
|
|
keine eingebetteten Drittanbieter.
|
|
|
|
## Deine Rechte
|
|
|
|
Du kannst deine eigenen Daten (Profil und die dir gehörenden Teiche)
|
|
jederzeit in den Konto-Einstellungen als ZIP-Archiv exportieren
|
|
(Auskunft und Datenübertragbarkeit). Bei der Löschung deines Kontos
|
|
werden dein persönlicher Teich und die dir gehörenden Teiche über den
|
|
Papierkorb-Prozess gelöscht; deine Autorenschaft an geteilten Inhalten
|
|
wird durch „gelöschte Nutzerin/gelöschter Nutzer" ersetzt
|
|
(Pseudonymisierung). Darüber hinaus hast du das Recht auf Berichtigung,
|
|
Löschung, Einschränkung der Verarbeitung und auf Beschwerde bei einer
|
|
Aufsichtsbehörde. Wende dich dazu an [Kontakt aus dem Impressum].
|
|
|
|
## Hosting und Backups
|
|
|
|
Diese Instanz wird gehostet bei [Anbieter, Standort]. Backups werden
|
|
[Aufbewahrung] aufbewahrt und liegen [Ort/Anbieter]. [Falls
|
|
konfiguriert: Eine Kopie der Sicherungen wird zu [Ziel, z. B. eine
|
|
Nextcloud / ein privater Server] übertragen und dort [Aufbewahrung]
|
|
aufbewahrt.]
|
|
```
|