From 248849318fde0f414996aba034ac4a3db432ac24 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ullrich=20Sch=C3=A4fer?= Date: Sat, 18 Apr 2026 02:32:48 +0200 Subject: [PATCH] Align privacy manifest with Sentry + Overpass hardening MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Three sections drifted from the actual behaviour of the deployed apps: Planner section: - Spells out no cookies / no localStorage / no sessionStorage (we removed i18n localStorage caching and alpha-banner sessionStorage). - Notes the browser-side Planner does not load Sentry at all. Sentry section: - Drops the "session replays on error" claim — replay integration is not installed and replaysSessionSampleRate / replaysOnErrorSampleRate are both 0. - Documents the actual scope: Journal server-side always; Journal client-side only after login; Planner server-side only. - Documents that IPs/cookies/headers are not sent (sendDefaultPii=false) and that only the user ID is attached to logged-in Journal errors. Third Parties section: - Adds Overpass API with an explicit note that queries are proxied through our own /api/overpass so the upstream host sees our server, not end users. Also bumps "Last updated" to today. Co-Authored-By: Claude Opus 4.7 (1M context) --- apps/journal/app/routes/legal.privacy.tsx | 32 ++++++++++++++++------- 1 file changed, 23 insertions(+), 9 deletions(-) diff --git a/apps/journal/app/routes/legal.privacy.tsx b/apps/journal/app/routes/legal.privacy.tsx index c8c758d..70fcef7 100644 --- a/apps/journal/app/routes/legal.privacy.tsx +++ b/apps/journal/app/routes/legal.privacy.tsx @@ -13,7 +13,7 @@ export default function PrivacyPage() {

Datenschutzerklärung / Privacy Policy

-

Last updated: 2026-04-17

+

Last updated: 2026-04-18

{/* GDPR formal sections */}
@@ -134,8 +134,9 @@ export default function PrivacyPage() { there are no user accounts, no tracking, and no analytics on your routes.

    -
  • No cookies (except ephemeral session state)
    • +
  • No cookies, no localStorage, no sessionStorage
  • No user accounts or login
    • +
  • No browser-side error tracking (Sentry is not loaded in the Planner)
  • No route data is stored permanently without your action
  • Session data is automatically deleted after 7 days of inactivity
@@ -160,22 +161,28 @@ export default function PrivacyPage() {

Error Tracking (Sentry)

- Both apps use Sentry for - error monitoring. This helps us find and fix bugs quickly. + We use Sentry for + error monitoring, scoped narrowly by design.

+

Where Sentry runs:

+
    +
  • Journal, logged-out: server-side only. The browser-side Sentry SDK is not loaded until you log in.
    • +
  • Journal, logged-in: Sentry initialises in the browser after login and is torn down on logout.
    • +
  • Planner: server-side only. The browser-side Planner does not load Sentry at all.
    • +

What Sentry collects:

    -
  • Error details: stack traces, error messages, browser/OS info
    • +
  • Error details: stack traces, error messages, browser/OS info derived from the User-Agent
  • Performance traces: page load times, route navigation timing
    • -
  • Session replays on error: a recording of the session leading up to an error (DOM snapshots, not video)
    • -
  • User context (Journal only): only the user ID (not username or email) is attached to errors for debugging
    • -
  • Session ID (Planner only): the anonymous session ID is attached to errors
    • +
  • User ID (Journal, logged-in only): just the user ID — not username, email, or IP

What Sentry does NOT collect:

    +
  • Session replays or DOM recordings — replay integration is not installed and sample rates are 0
    • +
  • IP addresses, cookies, or full HTTP headers — sendDefaultPii is set to false everywhere
  • Route or GPX data
  • Passwords or passkey credentials
    • -
  • Form input contents (masked in replays)
    • +
  • Form input contents

Data retention:

@@ -207,6 +214,13 @@ export default function PrivacyPage() {

  • Sentry (Functional Software Inc.) — error tracking, as described above
  • OpenStreetMap — map tiles are loaded from OSM tile servers. OSM's privacy policy applies to tile requests.
  • BRouter — routing requests are processed by our self-hosted BRouter instance. No data is sent to third parties for routing.
    • +
  • + Overpass API — POI overlay data is fetched via the Overpass API. Requests are proxied + through our own server (/api/overpass), so the upstream Overpass host sees our server rather + than end users' IP addresses or browsers. The current upstream is{" "} + overpass.private.coffee, + which operates without query logging. A self-hosted Overpass instance is planned. +
  • SMTP provider — transactional emails (magic link, welcome) are delivered via SMTP. Self-hosters configure their own provider.