Claude Fable 5
fd2bdb3fb8
All checks were successful
CI / Lint, typecheck, test (push) Successful in 3m7s
CI / Build container images (push) Has been skipped
CD / Build and push images (push) Successful in 3m14s
CD / Deploy to Test (push) Successful in 12s
CD / Smoke tests against Test (push) Successful in 1m16s
CD / Promote to Int (push) Successful in 9s
CI / Auth e2e pack (push) Successful in 5m9s
CI / Import/export fidelity gate (push) Successful in 45s
Imprint and privacy policy are two new Markdown instance settings (legal.imprint, legal.privacyPolicy), edited by Site Admins in a new "Legal pages" admin section with a toggleable rendered preview. The preview uses the same shared pipeline the server renders with (markdown → schema doc → escaped HTML), so stored markup can never smuggle script to visitors. The pages render publicly at /legal/imprint and /legal/privacy — as an SPA route plus, like #56, a self-contained server-rendered HTML document under /api/v1/legal/:kind. The endpoints are setup-exempt: legal information stays reachable even while the first-run wizard is pending. Unconfigured pages show a localized notice instead of 404ing, and Site Admins additionally get a warning banner linking to the settings. A new footer with both links appears on every SPA view (editor, auth screens, public pages) and in the server-rendered documents, whose shared shell moved to public/html-shell.ts and now renders its chrome in the instance default locale (ADR 0012). docs/self-hosting/legal-template.md ships imprint and privacy-policy templates in English and German whose sections mirror Dorfteich's actual processing activities (accounts, sessions, rate-limit IPs, proxy logs, transactional mail, content, export, deletion, no third-party requests), with a review checklist tied to security.md §Privacy. New `legal` i18n namespace (de+en); api and web e2e coverage including a new CI legal pack (footer navigation, notice vs. admin banner, and the admin form publishing a text end to end). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1
212 lines
9.2 KiB
Markdown
212 lines
9.2 KiB
Markdown
# Legal page templates (imprint & privacy policy)
|
|
|
|
Dorfteich ships legal pages as a product feature (issue #82, security.md
|
|
§Privacy): Site Admins paste Markdown into **Administration → Legal pages**,
|
|
and the texts render publicly at `/legal/imprint` and `/legal/privacy` —
|
|
linked from the footer on every view. This document provides starting
|
|
templates whose privacy section matches **what Dorfteich actually
|
|
processes**; keep it in sync when a change adds or removes a processing
|
|
activity (review anchor: security.md §Privacy).
|
|
|
|
> **Not legal advice.** These templates are a technically accurate starting
|
|
> point, not a substitute for a lawyer. Operator-specific parts (identity,
|
|
> hosting provider, log retention, backups) are marked with `[…]`
|
|
> placeholders and MUST be filled in. dorfteich.online uses the operator's
|
|
> own standard texts, applied at go-live (#89) — not these templates.
|
|
|
|
## What Dorfteich processes (review checklist)
|
|
|
|
The privacy templates below cover exactly these activities. When one of
|
|
them changes, update the templates in the same change:
|
|
|
|
| Activity | Data | Where implemented |
|
|
| ----------------------- | ------------------------------------------------------------------ | ---------------------------------------------------------------------------- |
|
|
| Accounts | username, e-mail, password hash, display name, locale | `users` table; signup/verification (ADR 0007) |
|
|
| Sessions | session cookie (`dt_session`), user agent, expiry | `sessions` table |
|
|
| Rate limiting | IP address in short-lived counters | `rate_limits` table (short TTL, operations.md) |
|
|
| Reverse-proxy logs | IP address, requested URL | host level (Caddy/nginx), operator-managed rotation |
|
|
| Transactional e-mail | recipient address, mail content | SMTP relay (wizard/secret store, #80); verification, password reset |
|
|
| Content & uploads | pages, attachments authored by users | ponds/pages/files; server sees plaintext (no E2E, security.md §Out of scope) |
|
|
| Data export | self-service ZIP (profile + own ponds) | `POST /users/me/data-export` (#68) |
|
|
| Deletion | trash/purge for content; pseudonymized authorship ("deleted user") | PseudonymizationService (#59), trash retention (ADR 0013) |
|
|
| No third-party requests | fonts self-hosted, no CDNs, no analytics | ADR 0016, CSP in nginx.conf |
|
|
|
|
## Imprint template (fill in and paste into Administration → Legal pages)
|
|
|
|
The legal pages render their own localized heading (Imprint/Impressum,
|
|
Privacy policy/Datenschutzerklärung), so the templates start straight with
|
|
the content — do not add a top-level `#` heading of your own.
|
|
|
|
```markdown
|
|
**Operator of this instance**
|
|
|
|
[Name]
|
|
[Street and number]
|
|
[Postal code, city]
|
|
[Country]
|
|
|
|
**Contact**
|
|
|
|
E-mail: [address]
|
|
[Phone: optional]
|
|
|
|
[If applicable: register entries, VAT ID, persons responsible for content.]
|
|
```
|
|
|
|
German version:
|
|
|
|
```markdown
|
|
**Betreiberin/Betreiber dieser Instanz**
|
|
|
|
[Name]
|
|
[Straße und Hausnummer]
|
|
[PLZ, Ort]
|
|
[Land]
|
|
|
|
**Kontakt**
|
|
|
|
E-Mail: [Adresse]
|
|
[Telefon: optional]
|
|
|
|
[Falls zutreffend: Registereinträge, USt-IdNr., inhaltlich Verantwortliche.]
|
|
```
|
|
|
|
## Privacy policy template (English)
|
|
|
|
```markdown
|
|
This instance of Dorfteich is operated by [operator, see imprint]. We
|
|
process personal data only as far as running this service requires
|
|
(Art. 6 (1) (b) GDPR for accounts, Art. 6 (1) (f) GDPR for abuse
|
|
protection and operational logs).
|
|
|
|
## Accounts
|
|
|
|
When you register, we store your username, e-mail address, a password
|
|
hash (never the password itself), your display name, and your language
|
|
preference. The e-mail address is used to verify your account and for
|
|
password resets. Accounts are visible to other members through the names
|
|
you choose.
|
|
|
|
## Sessions and cookies
|
|
|
|
After signing in, a session cookie (`dt_session`) keeps you signed in.
|
|
We store the session together with the browser identification (user
|
|
agent) your client sends and an expiry time. There are no tracking or
|
|
third-party cookies.
|
|
|
|
## Abuse protection and server logs
|
|
|
|
To protect the service against abuse, IP addresses are counted in
|
|
short-lived rate-limit records that expire automatically. The web server
|
|
in front of this instance additionally writes access logs containing IP
|
|
addresses; these are rotated and deleted after [retention, e.g. 14 days].
|
|
|
|
## E-mail
|
|
|
|
Transactional e-mails (account verification, password reset) are sent
|
|
through the SMTP relay [relay provider]. Your e-mail address and the
|
|
message content are transmitted to that relay for delivery.
|
|
|
|
## Content you create
|
|
|
|
Pages and uploaded files you create are stored on the server and are
|
|
visible to the people your ponds' permissions allow. Content is not
|
|
end-to-end encrypted — the server processes it in plaintext to provide
|
|
search, export, and rendering. Deleted pages remain restorable from the
|
|
trash for [trash retention, default 30] days before they are permanently
|
|
removed.
|
|
|
|
## No third-party requests
|
|
|
|
Your browser talks only to this instance: fonts are self-hosted, and
|
|
there are no CDNs, no analytics, and no embedded third-party services.
|
|
|
|
## Your rights
|
|
|
|
You can export your own data (profile and the ponds you own) as a ZIP
|
|
archive at any time from your account settings (right of access and data
|
|
portability). When your account is deleted, your personal pond and the
|
|
ponds you own are deleted through the trash process, and your authorship
|
|
on shared content is replaced with "deleted user" (pseudonymization).
|
|
You further have the right to rectification, erasure, restriction of
|
|
processing, and to lodge a complaint with a supervisory authority. To
|
|
exercise your rights, contact [address from the imprint].
|
|
|
|
## Hosting and backups
|
|
|
|
This instance is hosted at [provider, location]. Backups are kept for
|
|
[retention] and stored [location/provider].
|
|
```
|
|
|
|
## Privacy policy template (Deutsch)
|
|
|
|
```markdown
|
|
Diese Dorfteich-Instanz wird betrieben von [Betreiberin/Betreiber, siehe
|
|
Impressum]. Wir verarbeiten personenbezogene Daten nur, soweit der
|
|
Betrieb dieses Dienstes es erfordert (Art. 6 Abs. 1 lit. b DSGVO für
|
|
Konten, Art. 6 Abs. 1 lit. f DSGVO für Missbrauchsschutz und
|
|
Betriebs-Logs).
|
|
|
|
## Konten
|
|
|
|
Bei der Registrierung speichern wir Benutzername, E-Mail-Adresse, einen
|
|
Passwort-Hash (nie das Passwort selbst), den Anzeigenamen und die
|
|
Spracheinstellung. Die E-Mail-Adresse dient der Bestätigung des Kontos
|
|
und dem Zurücksetzen des Passworts. Konten sind für andere Mitglieder
|
|
unter den von dir gewählten Namen sichtbar.
|
|
|
|
## Sitzungen und Cookies
|
|
|
|
Nach der Anmeldung hält ein Sitzungs-Cookie (`dt_session`) dich
|
|
angemeldet. Wir speichern die Sitzung zusammen mit der von deinem
|
|
Browser übermittelten Kennung (User-Agent) und einem Ablaufzeitpunkt.
|
|
Es gibt keine Tracking- oder Drittanbieter-Cookies.
|
|
|
|
## Missbrauchsschutz und Server-Logs
|
|
|
|
Zum Schutz vor Missbrauch werden IP-Adressen in kurzlebigen
|
|
Rate-Limit-Einträgen gezählt, die automatisch verfallen. Der
|
|
vorgeschaltete Webserver schreibt zusätzlich Zugriffs-Logs mit
|
|
IP-Adressen; diese werden rotiert und nach [Aufbewahrung, z. B. 14
|
|
Tagen] gelöscht.
|
|
|
|
## E-Mail
|
|
|
|
Transaktions-E-Mails (Konto-Bestätigung, Passwort-Zurücksetzen) werden
|
|
über den SMTP-Server [Anbieter] versendet. Dafür werden deine
|
|
E-Mail-Adresse und der Nachrichteninhalt an diesen Server übermittelt.
|
|
|
|
## Von dir erstellte Inhalte
|
|
|
|
Von dir angelegte Seiten und hochgeladene Dateien liegen auf dem Server
|
|
und sind für die Personen sichtbar, die die Berechtigungen deiner Teiche
|
|
zulassen. Inhalte sind nicht Ende-zu-Ende-verschlüsselt — der Server
|
|
verarbeitet sie im Klartext, um Suche, Export und Darstellung
|
|
bereitzustellen. Gelöschte Seiten bleiben [Aufbewahrung, Standard 30]
|
|
Tage im Papierkorb wiederherstellbar, bevor sie endgültig entfernt
|
|
werden.
|
|
|
|
## Keine Anfragen an Dritte
|
|
|
|
Dein Browser kommuniziert ausschließlich mit dieser Instanz: Schriften
|
|
sind selbst gehostet, es gibt keine CDNs, keine Analyse-Dienste und
|
|
keine eingebetteten Drittanbieter.
|
|
|
|
## Deine Rechte
|
|
|
|
Du kannst deine eigenen Daten (Profil und die dir gehörenden Teiche)
|
|
jederzeit in den Konto-Einstellungen als ZIP-Archiv exportieren
|
|
(Auskunft und Datenübertragbarkeit). Bei der Löschung deines Kontos
|
|
werden dein persönlicher Teich und die dir gehörenden Teiche über den
|
|
Papierkorb-Prozess gelöscht; deine Autorenschaft an geteilten Inhalten
|
|
wird durch „gelöschte Nutzerin/gelöschter Nutzer" ersetzt
|
|
(Pseudonymisierung). Darüber hinaus hast du das Recht auf Berichtigung,
|
|
Löschung, Einschränkung der Verarbeitung und auf Beschwerde bei einer
|
|
Aufsichtsbehörde. Wende dich dazu an [Kontakt aus dem Impressum].
|
|
|
|
## Hosting und Backups
|
|
|
|
Diese Instanz wird gehostet bei [Anbieter, Standort]. Backups werden
|
|
[Aufbewahrung] aufbewahrt und liegen [Ort/Anbieter].
|
|
```
|