@cryptotaxi247 / SquadScope / commits / 1378551

feat(legal): expand privacy policy (#206)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Juan Manuel Servera committed May 25, 2026 at 23:22 UTC 137855198ae09bcf15ec21e5c65c68399be55d64
2 files changed +60 -46
.squad/decisions/inbox/hermes-privacy-policy-v1.md new
+19
@@ -0,0 +1,19 @@
1 +# Hermes Privacy Policy v1
2 +
3 +Date: 2026-05-25
4 +Author: Hermes (Security & Legal)
5 +Status: Proposed
6 +
7 +## Decision
8 +
9 +GA4 is our ONLY analytics; no first-party tracking.
10 +
11 +## Context
12 +
13 +SquadScope is a static editorial trend-analysis site with no accounts, signup, comments, contact form, or newsletter. The site is hosted on GitHub Pages and uses a cookie consent banner before analytics can run.
14 +
15 +## Consequences
16 +
17 +- SquadScope must not add first-party visitor profiling, server-side personal-data storage, or additional analytics tools without a new privacy review.
18 +- GA4 must remain consent-gated behind the analytics cookie category.
19 +- Privacy disclosures should continue to identify GitHub Pages hosting logs, GA4, Google Fonts if used, and the essential consent cookie.
content/privacy/_index.md
+41 -46
@@ -1,32 +1,37 @@
1 ---
2 -title: "Privacy & Cookies"
2 +title: "Privacy Policy"
3 +description: "What data SquadScope collects (almost none) and how third-party analytics work."
4 date: 2026-05-25
5 draft: false
6 ---
7
7 -## Overview
8 +## What we don't collect
9
9 -SquadScope respects your privacy. This policy explains what data we collect, why, and your rights. We comply with the EU General Data Protection Regulation (GDPR) and apply those principles globally.
10 +SquadScope is built to need almost no personal data. There are no accounts, no login, no signup, no comments, no contact form, and no newsletter.
11
11 -## What Data We Collect
12 +SquadScope itself does **not** collect, store, or process personal data on its own servers. We do not keep first-party visitor profiles, we do not run first-party tracking, and we do not store names, email addresses, payment details, or other personally identifying information. We do **not** sell data or share data with advertisers. Period.
13
13 -We use **Google Analytics 4 (GA4)** to understand how visitors use this site. GA4 collects:
14 -- Pages visited and time spent
15 -- Referrer source (how you arrived)
16 -- Device type (desktop/mobile/tablet)
17 -- General location (country/city-level, not precise)
18 -- Browser and operating system
14 +The editorial pipeline behind SquadScope analyzes public GitHub repository metadata and public press headlines to write weekly trend analysis. It does not ingest private user data.
15
20 -**We collect this data only after you consent** via the cookie consent banner. If you reject analytics, no GA4 data is sent.
16 +## Who we are
17
22 -We do not collect:
23 -- Personal information (names, emails, etc.) automatically
24 -- Payment data (this site is free and non-commercial)
25 -- Sensitive personal data (health, biometric, religious affiliation, etc.)
18 +SquadScope is an editorial trend-analysis site published from the [jmservera/SquadScope GitHub repository](https://github.com/jmservera/SquadScope). For privacy questions, use GitHub issues as the maintainer contact route: [open a SquadScope issue](https://github.com/jmservera/SquadScope/issues/new).
19
27 -## Legal Basis
20 +## What is collected by third parties
21
29 -Under GDPR Article 6(1)(a), we process analytics data on the basis of **your explicit consent**, which you grant via the cookie banner at the bottom of this page.
22 +### GitHub Pages hosting
23 +
24 +This site is hosted on GitHub Pages. When your browser loads any page, your IP address, user-agent, requested URL, timestamp, and similar server-log data may transit GitHub's CDN and infrastructure. GitHub controls that hosting data under the [GitHub Privacy Statement](https://docs.github.com/en/site-policy/privacy-policies/github-privacy-statement).
25 +
26 +### Google Analytics 4
27 +
28 +SquadScope uses Google Analytics 4 (GA4) **only if you accept the analytics category** in the cookie banner. If you reject analytics, SquadScope does not send GA4 events.
29 +
30 +After consent, GA4 helps us understand whether the site is useful: page views, referrers, session duration, device/browser information, and approximate location derived from network data. The GA4 measurement ID is configured per deployment through a repository secret, not hard-coded in this page. Google's processing is governed by [Google's Privacy Policy](https://policies.google.com/privacy). You can also use the [Google Analytics opt-out browser add-on](https://tools.google.com/dlpage/gaoptout).
31 +
32 +### Google Fonts
33 +
34 +SquadScope loads Inter and JetBrains Mono from Google Fonts. When your browser requests those font files, Google may receive request metadata such as your IP address and user-agent under [Google's Privacy Policy](https://policies.google.com/privacy).
35
36 ## Cookies we use
37
@@ -40,50 +45,40 @@ We do **not** use analytics cookies unless you accept analytics in the cookie ba
45
46 GA4 on this site uses Google Tag (`gtag.js`) with GA4 cookies (`_ga` and `_ga_<container_id>`). We do not configure or rely on the legacy `_gid` cookie.
47
43 -## Data Retention
48 +## Legal basis
49
45 -Google Analytics 4 retains analytics data for **13 months** by default. Older data is automatically deleted. You can review Google's retention policy at [support.google.com/analytics](https://support.google.com/analytics/answer/7667196).
50 +For analytics, the legal basis is your consent under GDPR Article 6(1)(a). You can refuse analytics and still use the site.
51
47 -## Who Controls Your Data
52 +For the essential consent cookie, the legal basis is SquadScope's legitimate interest under GDPR Article 6(1)(f): remembering your cookie choice so we can respect it and avoid asking on every page.
53
49 -- **Data Controller:** jmservera (SquadScope site operator)
50 -- **Data Processor:** Google Ireland Limited (GA4 service provider)
54 +## Your rights
55
52 -Google's use of your data is subject to [Google's Privacy Policy](https://policies.google.com/privacy). SquadScope has no visibility into or control over how Google uses aggregated analytics across its platform.
56 +Under GDPR Articles 15–22, you may have rights to access, rectify, erase, restrict, port, or object to processing of your personal data. You can also withdraw analytics consent at any time.
57
54 -## Your Rights Under GDPR
58 +Because SquadScope holds no first-party visitor data, most practical data-subject requests need to be exercised directly with the third party that controls the data: [GitHub privacy requests](https://docs.github.com/en/site-policy/privacy-policies/github-privacy-statement) for hosting logs, and [Google privacy controls](https://policies.google.com/privacy#infocontrols) or [Google's privacy request tools](https://support.google.com/policies/troubleshooter/7575787) for GA4 or Fonts data. You can still [open a SquadScope issue](https://github.com/jmservera/SquadScope/issues/new) if you need help identifying the right route.
59
56 -You have the right to:
60 +## How to withdraw analytics consent
61
58 -1. **Access** — Request a copy of the data we hold about you
59 -2. **Rectification** — Correct inaccurate data
60 -3. **Erasure** — Delete your data (subject to lawful retention obligations)
61 -4. **Restrict Processing** — Ask us to limit how we use your data
62 -5. **Portability** — Receive your data in a portable format
63 -6. **Objection** — Opt out of specific processing
64 -7. **Revoke Consent** — Withdraw analytics consent at any time
62 +Use the **Manage cookies** button in the footer to reopen cookie preferences, turn off Analytics, and save. You can also delete SquadScope cookies in your browser settings. Withdrawal stops future GA4 events from this browser; it does not automatically delete data already controlled by Google.
63
66 -To exercise these rights, **open a GitHub issue** on the [SquadScope repository](https://github.com/jmservera/SquadScope/issues) with your request, or contact jmservera directly via [GitHub profile](https://github.com/jmservera).
64 +## Data retention
65
68 -## How to Revoke Consent
66 +SquadScope retains no first-party visitor data because it does not collect any. The consent cookie lasts 182 days so your choice is remembered.
67
70 -Click the **"Manage Cookies"** link in the footer of this site (or bottom of any page) to open the cookie preferences panel. Deselect "Analytics" and save. This revokes your consent for GA4 data collection immediately.
68 +GA4 data is retained by Google according to the deployment's Analytics settings and Google's defaults. See [Google Analytics data retention](https://support.google.com/analytics/answer/7667196) for details.
69
72 -## Third-Party Services
70 +## Children's privacy
71
74 -SquadScope uses:
75 -- **Google Analytics 4** — analytics service (requires your consent)
76 -- **Google Fonts** — font delivery service used for Inter and JetBrains Mono. When your browser requests these font files, Google may receive and log your IP address and request metadata under [Google's Privacy Policy](https://policies.google.com/privacy).
77 -- **GitHub Pages** — hosting platform (GitHub's [Privacy Statement](https://docs.github.com/en/site-policy/privacy-policies/github-privacy-statement) applies)
72 +SquadScope is not directed at children. The site has no accounts or first-party data collection, including for children.
73
79 -## Changes to This Policy
74 +## International transfers
75
81 -We may update this privacy policy. Changes will be posted on this page with an updated "Last Modified" date.
76 +GitHub and Google may process data in countries outside your own. GA4 data may be transferred to the United States. Google states that it relies on applicable transfer mechanisms, including the EU-US Data Privacy Framework and Standard Contractual Clauses where relevant.
77
83 -## Contact
78 +## Changes to this policy
79
85 -For privacy questions or concerns, [open an issue](https://github.com/jmservera/SquadScope/issues) on GitHub or contact jmservera via GitHub.
80 +Last updated: 2026-05-25. Changes are announced through the git history of this page in the public SquadScope repository, so you can review what changed and when.
81
87 ----
82 +## Contact
83
89 -**Last Updated:** 2026-05-25
84 +For privacy questions, [open a new issue in the SquadScope repository](https://github.com/jmservera/SquadScope/issues/new). Please do not include sensitive personal data in a public issue; describe the request briefly and the maintainer can suggest a safer follow-up route if needed.