From a4faaf2fc1353b45bf1195c267e8d70dd308b370 Mon Sep 17 00:00:00 2001 From: Stefan Popp Date: Fri, 23 Oct 2026 13:05:02 +0200 Subject: [PATCH] Drop the review notes on the legal texts from the README The README carried the notes of the text review of 2026-10-19 under "Operational facts for the legal text update": what the operator confirmed, which questions an assessment still has to answer, and that the review published no release. They were working notes for that review, not a description of the repository, and part of them is out of date since 0.1.4 went out. The section goes; the legal pages themselves and the CHANGELOG stay as they are. Nothing on the website changes. --- README.md | 33 --------------------------------- 1 file changed, 33 deletions(-) diff --git a/README.md b/README.md index e21b446..4266628 100644 --- a/README.md +++ b/README.md @@ -68,39 +68,6 @@ gh attestation verify azentrius-website-VERSION.tar.gz --repo Azentrius/website `npm run pack` makes the same archive locally; the same `dist/` gives the same archive. -### Operational facts for the legal text update - -The text review of 2026-10-19 corrects the analytics description, email processing, objection rights -and product claims in both languages. - -The operator confirmed that email is hosted exclusively by Hetzner without forwarding to another -email provider. Both privacy pages now name that processing role. The operator also explicitly -chose to retain the existing email/postal contact details without adding another contact channel. -The legal notices are unchanged by that decision; this does not establish compliance with § 5 DDG. - -The operator confirmed the server changes on 2026-10-19. Both privacy pages now reflect the -implementation recorded in the shared operational notes: - -- Website and analytics access logs use truncated IP addresses and are retained for at most 14 days. -- Error and security logs can contain full IP addresses and are retained for at most 14 days. - The separate access logs used by fail2ban are retained for at most two days. -- Plausible event/session records expire after 24 months in the active database. Database backups - are retained for up to six months, so deleted records can remain in backups for that period. - -This closes the pending confirmation of the logging and retention configuration. The source is the -operator's confirmation and implementation record; this text update did not rerun the server audit. -The disclosure concerns the website and analytics service, not every application's logs or data. - -The email deletion criteria remain an operational responsibility. The concrete Plausible setup still -needs assessment under § 25 TDDDG and the GDPR, including scroll depth and active time measurement. -Cookie-free operation alone does not resolve this question. The existing Art. 6 (1) (f) GDPR basis -has not been independently approved by this text update. - -The review does not change server configuration or publish a release. Its source references are -[Plausible's data policy](https://plausible.io/data-policy), the -[DSK guidance on digital services](https://www.datenschutzkonferenz-online.de/media/oh/OH_Digitale_Dienste.pdf) -and [CJEU C-298/07](https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=celex%3A62007CJ0298). - ## License The code is licensed under the [Apache License 2.0](LICENSE). The texts of the website and the