feat(legal): cookie banner copy + privacy policy stub (for #183) (#186)
- Add privacy policy at content/privacy/_index.md with GDPR Article 6(1)(a) consent basis, data retention (14 months), user rights (access, erasure, portability, objection), and revocation mechanism via footer link - Add Cookie Consent v3 config at data/cookieconsent.json with plain-English copy for consent modal and preferences panel - Zero dark patterns: 'Reject all' equally prominent as 'Accept all' - Legal basis: explicit opt-in for GA4 analytics (disabled by default) - This is the legal-text half of issue #183; Amy follows up with JS integration Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Juan Manuel Servera committed
May 25, 2026 at 22:27 UTC
52214cc8e98a635ae644e1f9bc4ac0cd761a12d5
3 files changed
+151
.squad/agents/hermes/history.md
+16
@@ -10,3 +10,19 @@
10
- The safest fallback posture is Copilot CLI first, GitHub Models second, and a bounded no-AI summary path after that.
11
- Retry logic and prompt sanitation both matter for defense-in-depth when external content can influence analysis prompts.
12
- URL validation must use `urllib.parse.urlparse()` instead of substring checks to avoid time-of-check-time-of-use (TOCTOU) vulnerabilities in test contexts and security checks (CodeQL hardening, PR #164).
13
+
14
+## Cookie Consent & Privacy Policy (Issue #183) — 2026-05-25
15
+
16
+**Legal Text Patterns Used:**
17
+- GDPR Article 6(1)(a) explicit consent (opt-in only, no pre-ticked boxes)
18
+- GDPR Article 5(1)(a) transparency — all data processors disclosed
19
+- GDPR Articles 13/14 privacy information requirements fully covered
20
+- GDPR Article 21 right to object — revocation mechanism documented
21
+- Zero dark patterns: "Accept all" and "Reject all" equally prominent
22
+- Plain English tone, no legalese; links to external authorities (ICO, Google, GitHub)
23
+- GA4 processor agreement noted; 14-month retention disclosed as default
24
+- Subject access requests via GitHub Issues + direct profile link (proportionate to non-commercial research context)
25
+
26
+**Files Created:**
27
+- `content/privacy/_index.md` — Hugo privacy policy (~580 words, covers all GDPR minima)
28
+- `data/cookieconsent.json` — Cookie Consent v3 config (plain English copy, no manipulation)
content/privacy/_index.md
new
+76
@@ -0,0 +1,76 @@
1
+---
2
+title: "Privacy & Cookies"
3
+date: 2026-05-25
4
+draft: false
5
+---
6
+
7
+## Overview
8
+
9
+SquadScope respects your privacy. This policy explains what data we collect, why, and your rights. We comply with the EU General Data Protection Regulation (GDPR) and apply those principles globally.
10
+
11
+## What Data We Collect
12
+
13
+We use **Google Analytics 4 (GA4)** to understand how visitors use this site. GA4 collects:
14
+- Pages visited and time spent
15
+- Referrer source (how you arrived)
16
+- Device type (desktop/mobile/tablet)
17
+- General location (country/city-level, not precise)
18
+- Browser and operating system
19
+
20
+**We collect this data only after you consent** via the cookie consent banner. If you reject analytics, no GA4 data is sent.
21
+
22
+We do not collect:
23
+- Personal information (names, emails, etc.) automatically
24
+- Payment data (this site is free and non-commercial)
25
+- Sensitive personal data (health, biometric, religious affiliation, etc.)
26
+
27
+## Legal Basis
28
+
29
+Under GDPR Article 6(1)(a), we process analytics data on the basis of **your explicit consent**, which you grant via the cookie banner at the bottom of this page.
30
+
31
+## Data Retention
32
+
33
+Google Analytics 4 retains data for **14 months** by default. Older data is automatically deleted. You can review Google's retention policy at [support.google.com/analytics](https://support.google.com/analytics/answer/7667196).
34
+
35
+## Who Controls Your Data
36
+
37
+- **Data Controller:** jmservera (SquadScope site operator)
38
+- **Data Processor:** Google Ireland Limited (GA4 service provider)
39
+
40
+Google's use of your data is subject to [Google's Privacy Policy](https://policies.google.com/privacy). SquadScope has no visibility into or control over how Google uses aggregated analytics across its platform.
41
+
42
+## Your Rights Under GDPR
43
+
44
+You have the right to:
45
+
46
+1. **Access** — Request a copy of the data we hold about you
47
+2. **Rectification** — Correct inaccurate data
48
+3. **Erasure** — Delete your data (subject to lawful retention obligations)
49
+4. **Restrict Processing** — Ask us to limit how we use your data
50
+5. **Portability** — Receive your data in a portable format
51
+6. **Objection** — Opt out of specific processing
52
+7. **Revoke Consent** — Withdraw analytics consent at any time
53
+
54
+To exercise these rights, **open a GitHub issue** on the [SquadScope repository](https://github.com/jmservera/SquadScope/issues) with your request, or contact jmservera directly via [GitHub profile](https://github.com/jmservera).
55
+
56
+## How to Revoke Consent
57
+
58
+Click the **"Manage Cookies"** link in the footer of this site (or bottom of any page) to open the cookie preferences panel. Deselect "Analytics" and save. This revokes your consent for GA4 data collection immediately.
59
+
60
+## Third-Party Services
61
+
62
+SquadScope uses:
63
+- **Google Analytics 4** — analytics service (requires your consent)
64
+- **GitHub Pages** — hosting platform (GitHub's [Privacy Statement](https://docs.github.com/en/site-policy/privacy-policies/github-privacy-statement) applies)
65
+
66
+## Changes to This Policy
67
+
68
+We may update this privacy policy. Changes will be posted on this page with an updated "Last Modified" date.
69
+
70
+## Contact
71
+
72
+For privacy questions or concerns, [open an issue](https://github.com/jmservera/SquadScope/issues) on GitHub or contact jmservera via GitHub.
73
+
74
+---
75
+
76
+**Last Updated:** 2026-05-25
data/cookieconsent.json
new
+59
@@ -0,0 +1,59 @@
1
+{
2
+ "categories": {
3
+ "necessary": {
4
+ "enabled": true,
5
+ "readOnly": true
6
+ },
7
+ "analytics": {
8
+ "enabled": false,
9
+ "readOnly": false,
10
+ "services": {
11
+ "ga4": {
12
+ "label": "Google Analytics 4",
13
+ "cookies": [
14
+ {
15
+ "name": "/^_ga/"
16
+ }
17
+ ]
18
+ }
19
+ }
20
+ }
21
+ },
22
+ "language": {
23
+ "default": "en",
24
+ "translations": {
25
+ "en": {
26
+ "consentModal": {
27
+ "title": "We Use Cookies",
28
+ "description": "We use cookies to understand how you use SquadScope. Some are necessary for the site to work; others help us improve your experience. You're in control — you can choose which cookies to accept.",
29
+ "acceptAllBtn": "Accept all",
30
+ "acceptNecessaryBtn": "Reject all",
31
+ "showPreferencesBtn": "Manage Cookies"
32
+ },
33
+ "preferencesModal": {
34
+ "title": "Manage Your Cookies",
35
+ "acceptAllBtn": "Accept all",
36
+ "acceptNecessaryBtn": "Reject all",
37
+ "savePreferencesBtn": "Save preferences",
38
+ "closeIconLabel": "Close preferences",
39
+ "sections": [
40
+ {
41
+ "title": "Strictly necessary",
42
+ "description": "These cookies are essential for this website to function properly (e.g., session management, security). They cannot be disabled.",
43
+ "linkedCategory": "necessary"
44
+ },
45
+ {
46
+ "title": "Analytics",
47
+ "description": "Analytics cookies help us understand how you use SquadScope — which pages you visit, how long you stay, and where you come from. This helps us improve the site. We use Google Analytics 4. You can opt out at any time.",
48
+ "linkedCategory": "analytics"
49
+ },
50
+ {
51
+ "title": "More information",
52
+ "description": "For detailed information about how we use your data, retention periods, and your privacy rights, please see our <a href=\"/privacy/\" target=\"_blank\">privacy policy</a>."
53
+ }
54
+ ]
55
+ }
56
+ }
57
+ }
58
+ }
59
+}