GDPR compliance ticket

[Terkwood]

Goals

• Link to our privacy policy on the front page.
• Document our policy in a github-hosted markdown file.

Resource: GDPR compliance for US companies

Read more here.

Detail: Client ID

We store a Client ID (large, random number) in the user's browser, which the user can delete by clearing all their browser data (local storage). The ID contains no personally identifiable information. We should make sure the user understands this.

Detail: IP logging by Caddy

We have a very minimal caddy configuration which acts as a reverse proxy for gateway & botlink. It sometimes logs IP addresses. This data is ephemeral.

According to the following article, we don't explicitly need to ask for consent for this. Let's just point out that we log and eventually destroy IP addresses as a standard security practice.