RollNote/rollnote-website
Watch
1
0
Fork
You've already forked rollnote-website
 0
Code Issues Pull requests Projects Releases 3 Packages Wiki Activity Actions

feat(legal): rewrite privacy policy for accuracy, add mentions legales #14

Merged
eliott merged 2 commits from audit/legal-compliance into develop 2026-05-16 21:29:53 +02:00
Conversation 0 Commits 2 Files changed 5 +237 -11
eliott commented 2026-05-16 20:33:22 +02:00
Owner

Summary

  • Rewrite /privacy to match what the code actually does.
  • Add a new /legal route (mentions legales required by LCEN art. 6-III).
  • Link /legal from the footer and the sitemap.
  • Bump to 0.3.2.

Why - what the audit found wrong in /privacy

Claim Reality
"We do not use analytics trackers" Self-hosted Umami runs on both website and app.
"Account data: just your email" User table also stores name, username, displayUsername, image, isAdmin, twoFactorEnabled, lastSeenChangelogAt.
"Session data: authentication tokens" Session table also stores ipAddress and userAgent (encrypted at rest).
"Bcrypt-style hashes" Better-Auth uses scrypt.
"Send us an email via the contact page" No /contact route existed.
"If you delete your account, all associated data is permanently deleted" Was failing with an FK violation - fixed in rollnote-api 8.1.2.

The rewrite acknowledges Umami honestly (privacy-friendly, no cookies, no cross-site tracking, exempt from consent under CNIL guidance), discloses IP/UA in the session bullet, names scrypt, points at socials@eliottbidault.fr as the real contact, and adds a hosting + processors section.

Why - new /legal page

The site is published on a .fr domain with user accounts and analytics. LCEN art. 6-III makes mentions legales mandatory (editor identity, publication director, hosting provider). The new /legal page covers all eight required points: editor, publication director, hosting, IP, liability, personal data + CNIL, cookies, governing law.

Test plan

  • pnpm build - clean.
  • pnpm exec eslint . - clean.
  • Manual: hit /privacy and /legal once deployed, verify TOC anchors work and the footer Legal link shows on every page.
  • Manual: GET /sitemap.xml and confirm both URLs are listed.

Known issue (pre-existing, not from this PR)

svelte-check flags one error in the unused src/lib/components/Link.svelte because adding the new route grew the route literal union enough to break the unconstrained url: string prop on that dead component. vite build ignores it. Not addressing here to keep scope tight; happy to delete the dead component in a follow-up.

## Summary - Rewrite `/privacy` to match what the code actually does. - Add a new `/legal` route (mentions legales required by LCEN art. 6-III). - Link `/legal` from the footer and the sitemap. - Bump to 0.3.2. ## Why - what the audit found wrong in /privacy | Claim | Reality | |---|---| | "We do not use analytics trackers" | Self-hosted Umami runs on both website and app. | | "Account data: just your email" | User table also stores name, username, displayUsername, image, isAdmin, twoFactorEnabled, lastSeenChangelogAt. | | "Session data: authentication tokens" | Session table also stores ipAddress and userAgent (encrypted at rest). | | "Bcrypt-style hashes" | Better-Auth uses scrypt. | | "Send us an email via the contact page" | No `/contact` route existed. | | "If you delete your account, all associated data is permanently deleted" | Was failing with an FK violation - fixed in rollnote-api 8.1.2. | The rewrite acknowledges Umami honestly (privacy-friendly, no cookies, no cross-site tracking, exempt from consent under CNIL guidance), discloses IP/UA in the session bullet, names scrypt, points at `socials@eliottbidault.fr` as the real contact, and adds a hosting + processors section. ## Why - new /legal page The site is published on a `.fr` domain with user accounts and analytics. LCEN art. 6-III makes mentions legales mandatory (editor identity, publication director, hosting provider). The new `/legal` page covers all eight required points: editor, publication director, hosting, IP, liability, personal data + CNIL, cookies, governing law. ## Test plan - [x] `pnpm build` - clean. - [x] `pnpm exec eslint .` - clean. - [ ] Manual: hit `/privacy` and `/legal` once deployed, verify TOC anchors work and the footer Legal link shows on every page. - [ ] Manual: GET `/sitemap.xml` and confirm both URLs are listed. ## Known issue (pre-existing, not from this PR) `svelte-check` flags one error in the unused `src/lib/components/Link.svelte` because adding the new route grew the route literal union enough to break the unconstrained `url: string` prop on that dead component. `vite build` ignores it. Not addressing here to keep scope tight; happy to delete the dead component in a follow-up.
Audit of the existing privacy policy found several claims that did not
match the code:
- claimed no analytics while self-hosted Umami runs on the site
- claimed only email was stored while name, username and image are too
- said sessions only held tokens, omitting IP and user-agent
- pointed at a contact page that does not exist

Rewrite to be honest about all of the above (Umami is acknowledged,
session IP/user-agent disclosed, encrypted columns called out, scrypt
named instead of "bcrypt-style", deletion behaviour matches the API fix
in rollnote-api 8.1.2), add a real contact email, and add a hosting and
processors section.

Add a new /legal route (mentions legales required by LCEN art. 6-III)
covering publisher, hosting, IP, liability, data, cookies, governing
law. Link it from the footer and the sitemap.

Bump to 0.3.2.
Rewrite the Liability paragraph to (a) explicitly cover both
availability and data integrity, (b) acknowledge off-site backups, (c)
preserve user rights where French law forbids blanket exclusions, and
(d) point users at the in-app export feature so they can keep their own
copy. Discussed in PR #14 review.
eliott merged commit 4d4a319278 into develop 2026-05-16 21:29:53 +02:00
eliott deleted branch audit/legal-compliance 2026-05-16 21:29:53 +02:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
run-ci
Trigger the required CI run

No labels
run-ci
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
RollNote/rollnote-website!14
No description provided.