Add privacy policy (cont.) #27

Hans5958 · 2020-09-30T15:22:43Z

Continuation of #26, resolves #24.

@WorldLanguages, you do the merge as you are the project leader.

…r, edits on privacy, etc

privacy.md

WorldLanguages · 2020-09-30T15:31:36Z

privacy.md

+
+## Information we collect
+
+We collect a few different kinds of information about you, like what part of the world you are in, what pages you come to our website from, and what device and software you use. We also collect information about how you use our website. We might collect your Scratch username.


We might collect your Scratch username.

Any specific reason for this to not be specific enough? We don't collect usernames unless explicitly given by users, in the feedback page.

…uotes

Explosion-Scratch

Grammar fixes

Explosion-Scratch · 2020-09-30T19:14:00Z

privacy.md

+
+## Information we collect
+
+We collect a few different kinds of information about you, like what part of the world you are in, what pages you come to our website from, and what device and software you use. We also collect information about how you use our website. We might collect your Scratch username.


maybe change this We also collect information about how you use our website. We might collect your Scratch username. to this: We also collect your Scratch username (if you have one) and data about how you use ScratchAddons.com

Sounds good, but this isn't my pr anymore.

@Explosion-Scratch I think it is "might" because it is an optional thing. Also, don't refer it as ScratchAddons.com. You can refer it as "our website" as stated on the first paragraph.

@easrng Just so you know, you can do a pull request that is directly to the privacy branch.

…ansition.html

GrahamSH-LLK · 2020-10-27T18:23:23Z

Up to date version (without merge conflicts): #41

# Conflicts: # assets/css/base.scss # site/faq.md # site/farewell.html # site/feedback.html # site/index.html # site/scratch-messaging-transition.html # site/welcome.html

williamhorning

Why did you delete the Welcome and Farewell pages? This makes no sense, otherwise, this is all good.

Hans5958 · 2020-11-09T13:50:28Z

That is really weird. Will try to resolve this.

Also revert unnecessary changes

Hans5958 · 2020-11-09T14:20:05Z

@wgyt735yt Fixed it. You can check it again if you want.

williamhorning · 2020-11-24T22:19:54Z

@wgyt735yt Fixed it. You can check it again if you want.

Thanks for doing it, can we merge this?

williamhorning

Can we merge this already? It works now, and is good.

WorldLanguages · 2021-04-30T15:28:04Z

I'll work on this after v1.14.0 release

WorldLanguages · 2021-04-30T15:29:57Z

Related: does anyone know of an analytics service that does not require us to ask for opt-in, unlike Google Analytics? That way, we could avoid the banner altogether. I believe GitHub recently did some changes like that as well - they only kept necessary cookies and removed the banner.

cobaltt7 · 2021-04-30T15:31:40Z

Related: does anyone know of an analytics service that does not require us to ask for opt-in, unlike Google Analytics? That way, we could avoid the banner altogether. I believe GitHub recently did some changes like that as well - they only kept necessary cookies and removed the banner.

Ocular uses Plausible, and they don't have a banner.

WorldLanguages · 2021-04-30T16:15:10Z

I plan to remove all cookies from the website by the second half of May.
Cloudflare will be removing the only cookie it adds on May 10th: __cfduid
And all other cookies are related to Google Analytics.

We'll probably move to a self-hosted instance of Plausible, which does not use cookies. Possibly hosted by @jeffalo. And we'll have a page that will display at least some of the data Plausible collected publicly (not sure if we want everything public yet).

We'll continue to use Cloudflare for now, so there's no other option but to let it "see" the IP addresses of our visitors (at some point of the chain, someone has to be able to do that of course). But using Cloudflare infrastructure, we could make it so other 3rd parties (GitHub Pages, Plausible, let me know if we can think of any other) don't get the full IP addresses of our visitors (or don't get them at all).

GrahamSH-LLK · 2021-04-30T16:30:00Z

AFAIK plausible doesn't touch IPs. __cfduid doesn't show up on my site, so I think there's a way to disable it. Jeffalo should be able to add plausible easily, but if we want to use a cloud version, we'll have to pay. #65 would have worked for this purpose.

WorldLanguages · 2021-04-30T16:34:48Z

AFAIK plausible doesn't touch IPs

It doesn't. But the server hosting Plausible can still get it. "Never trust the client" and "never trust the server", they say.

GrahamSH-LLK · 2021-04-30T17:14:53Z

AFAIK plausible doesn't touch IPs

It doesn't. But the server hosting Plausible can still get it. "Never trust the client" and "never trust the server", they say.

I think we can trust Jeffalo not to log IPs?
I mean, we already have an Ocular addon, so we're screwed if he does.

WorldLanguages · 2021-04-30T23:13:27Z

I think we can trust Jeffalo not to log IPs?
I mean, we already have an Ocular addon, so we're screwed if he does.

You have to optin into enabling the Ocular addon - but the moment the extension is installed, we immediately open ScratchAddons.com without explicit consent. Not the same.
Also, why not anonymize IP addresses if we can. We're going to use Cloudflare as a proxy anyway.

williamhorning · 2021-04-30T23:29:22Z

@WorldLanguages Cloudflare's proxy doesn't pass the real IP unless you tell it to
unless you enable the setting "True-Client-IP Header" under Network, even then you need the enterprise plan
or
you check the headers 'X-Forwarded-For' and 'CF-Connecting-IP'

WorldLanguages · 2021-04-30T23:34:06Z

@wgyt Are you sure they can be disabled from settings? I was thinking of using a Cloudflare Worker
Also, completely removing the IP is unideal for analytics. We'd miss geolocation analytics, like how many % of our visitors are from the US (spoiler: a lot)

williamhorning · 2021-04-30T23:35:59Z

@wgyt Are you sure they can be disabled from settings? I was thinking of using a Cloudflare Worker
Also, completely removing the IP is unideal for analytics. We'd miss geolocation analytics, like how many % of our visitors are from the US (spoiler: a lot)

AFAIK 'X-Forwarded-For' and 'CF-Connecting-IP' are always on.

GrahamSH-LLK · 2021-05-01T11:30:20Z

@wgyt Are you sure they can be disabled from settings? I was thinking of using a Cloudflare Worker
Also, completely removing the IP is unideal for analytics. We'd miss geolocation analytics, like how many % of our visitors are from the US (spoiler: a lot)

AFAIK 'X-Forwarded-For' and 'CF-Connecting-IP' are always on.

Spoiler alert: you can easily set up Nginx to de-obfuscate ips from behind cloudflare, so we have to trust whoever is hosting our server.

williamhorning · 2021-05-01T11:35:50Z

On my website, I use Cloudflare analytics and it works well. It uses 0 cookies, and gives a decent amount of data, including visits, page views, page load time, country data, the referer, host, path, and browser.

WorldLanguages · 2021-05-01T14:37:26Z

Spoiler alert: you can easily set up Nginx to de-obfuscate ips from behind cloudflare, so we have to trust whoever is hosting our server.

I don't think anything is stopping us from setting up a Cloudflare Worker that anonymizes the X-Forwarded-For and CF-Connecting-IP headers. Those are what's used by Nginx to de-obfuscate IPs.

williamhorning · 2021-05-01T14:47:54Z

Spoiler alert: you can easily set up Nginx to de-obfuscate ips from behind cloudflare, so we have to trust whoever is hosting our server.

I don't think anything is stopping us from setting up a Cloudflare Worker that anonymizes the X-Forwarded-For and CF-Connecting-IP headers. Those are what's used by Nginx to de-obfuscate IPs.

I think you could anonymize those headers, but I have no experience with CF workers so 🤷🏻‍♂️

easrng and others added 7 commits September 29, 2020 14:35

Create privacy.md

5cebd7c

Update footer.html

c3205cb

Update head.html

5380a2b

Update faq.md

1f40a92

Update head.html

63c65f6

Merge pull request #26 from easrng/master

93c46a5

Change into cookies-eu-banner, bring back the pages category on foote…

b8a84fb

…r, edits on privacy, etc

Hans5958 requested a review from WorldLanguages September 30, 2020 15:22

Hans5958 changed the title ~~Add privacy policy~~ Add privacy policy (cont.) Sep 30, 2020

WorldLanguages reviewed Sep 30, 2020

View reviewed changes

privacy.md Outdated Show resolved Hide resolved

WorldLanguages reviewed Sep 30, 2020

View reviewed changes

Fix black color for extension-styled banner, change ' to single q…

3903313

…uotes

Explosion-Scratch self-requested a review September 30, 2020 19:12

Explosion-Scratch suggested changes Sep 30, 2020

View reviewed changes

Hans5958 force-pushed the master branch 2 times, most recently from 662c251 to b4acd86 Compare October 20, 2020 13:10

GrahamSH-LLK added 10 commits October 27, 2020 13:54

Update faq.md

c184294

Rename faq.md to site/faq.md

ad32639

Rename welcome.html to site/welcome.html

7bc9b4d

Rename scratch-messaging-transition.html to site/scratch-messaging-tr…

753b973

…ansition.html

Rename privacy.md to site/privacy.md

b55db9d

Rename index.html to site/index.html

601b39d

Rename feedback.html to site/feedback.html

daab16f

Rename farewell.html to site/farewell.html

3dcec58

Rename contributors.html to site/contributors.html

2946b9a

Rename 404.html to site/404.html

4211b1e

GrahamSH-LLK mentioned this pull request Oct 27, 2020

Privacy Policy (cont.) up2date #41

Closed

GrahamSH-LLK closed this Oct 27, 2020

Merge branch 'master' into privacy

3a333c3

# Conflicts: # assets/css/base.scss # site/faq.md # site/farewell.html # site/feedback.html # site/index.html # site/scratch-messaging-transition.html # site/welcome.html

williamhorning reviewed Nov 9, 2020

View reviewed changes

Hans5958 added 3 commits November 9, 2020 20:19

Merge branch 'master' into privacy

a8f417a

Resolve empty files 1

dcc4edf

Resolve empty files 2

33a8b04

Hans5958 added 3 commits November 9, 2020 14:07

Resolve empty files 3

ee92b75

Also revert unnecessary changes

Revert unnecessary changes

3013116

Fix tabs

062d589

Merge pull request #66 from ScratchAddons/master

9af58d3

Hans5958 force-pushed the master branch from 1c8a0ce to 13d4278 Compare January 12, 2021 15:02

williamhorning approved these changes Apr 6, 2021

View reviewed changes

Merge branch 'master' into privacy

ab94e24

williamhorning approved these changes Apr 30, 2021

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add privacy policy (cont.) #27

Add privacy policy (cont.) #27

Hans5958 commented Sep 30, 2020

WorldLanguages Sep 30, 2020

Hans5958 Sep 30, 2020

Explosion-Scratch left a comment

Explosion-Scratch Sep 30, 2020

Hans5958 Oct 1, 2020

easrng Oct 2, 2020

Hans5958 Oct 2, 2020

GrahamSH-LLK commented Oct 27, 2020 •

edited

Loading

williamhorning left a comment

Hans5958 commented Nov 9, 2020

Hans5958 commented Nov 9, 2020

williamhorning commented Nov 24, 2020

williamhorning left a comment

WorldLanguages commented Apr 30, 2021

WorldLanguages commented Apr 30, 2021

cobaltt7 commented Apr 30, 2021

WorldLanguages commented Apr 30, 2021

GrahamSH-LLK commented Apr 30, 2021

WorldLanguages commented Apr 30, 2021

GrahamSH-LLK commented Apr 30, 2021 •

edited

Loading

WorldLanguages commented Apr 30, 2021

williamhorning commented Apr 30, 2021

WorldLanguages commented Apr 30, 2021

williamhorning commented Apr 30, 2021

GrahamSH-LLK commented May 1, 2021

williamhorning commented May 1, 2021

WorldLanguages commented May 1, 2021

williamhorning commented May 1, 2021


		## Information we collect

		We collect a few different kinds of information about you, like what part of the world you are in, what pages you come to our website from, and what device and software you use. We also collect information about how you use our website. We might collect your Scratch username.

Add privacy policy (cont.) #27

Are you sure you want to change the base?

Add privacy policy (cont.) #27

Conversation

Hans5958 commented Sep 30, 2020

WorldLanguages Sep 30, 2020

Choose a reason for hiding this comment

Hans5958 Sep 30, 2020

Choose a reason for hiding this comment

Explosion-Scratch left a comment

Choose a reason for hiding this comment

Explosion-Scratch Sep 30, 2020

Choose a reason for hiding this comment

Hans5958 Oct 1, 2020

Choose a reason for hiding this comment

easrng Oct 2, 2020

Choose a reason for hiding this comment

Hans5958 Oct 2, 2020

Choose a reason for hiding this comment

GrahamSH-LLK commented Oct 27, 2020 • edited Loading

williamhorning left a comment

Choose a reason for hiding this comment

Hans5958 commented Nov 9, 2020

Hans5958 commented Nov 9, 2020

williamhorning commented Nov 24, 2020

williamhorning left a comment

Choose a reason for hiding this comment

WorldLanguages commented Apr 30, 2021

WorldLanguages commented Apr 30, 2021

cobaltt7 commented Apr 30, 2021

WorldLanguages commented Apr 30, 2021

GrahamSH-LLK commented Apr 30, 2021

WorldLanguages commented Apr 30, 2021

GrahamSH-LLK commented Apr 30, 2021 • edited Loading

WorldLanguages commented Apr 30, 2021

williamhorning commented Apr 30, 2021

WorldLanguages commented Apr 30, 2021

williamhorning commented Apr 30, 2021

GrahamSH-LLK commented May 1, 2021

williamhorning commented May 1, 2021

WorldLanguages commented May 1, 2021

williamhorning commented May 1, 2021

GrahamSH-LLK commented Oct 27, 2020 •

edited

Loading

GrahamSH-LLK commented Apr 30, 2021 •

edited

Loading