diff --git a/CHANGELOG.md b/CHANGELOG.md index 6bd7e47..34d5149 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -20,6 +20,10 @@ extension (`extension/manifest.json`). - Changing or resetting your password signs out other devices. The device you changed it on stays signed in. - Session cookies are `secure` and `SameSite=Lax` in production; the server refuses to start in production without its secrets +### Fixed + +- One privacy policy instead of three copies, now covering the short-lived rate-limit counters + ### Removed - The old website library (`/bookmark`, `/collections`, `/login`, `/signup`, `/user/*`). It was unlinked; the library lives in the extension. Password reset pages stay. diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 4d76452..fc5d1c6 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -93,7 +93,7 @@ you touch the popup, options page, or landing site: - Reload the unpacked extension. - Sign in against your local API. - Confirm the popup (and options page, if you touched it) still work. -- If you changed the landing site, check `landing/index.html` and `landing/privacy.html`. +- If you changed the landing site, check `landing/index.html`. The privacy policy lives only in `views/privacy.ejs`. If you add or change API behavior, add or update a test under `tests/api/` or `tests/unit/` rather than relying on manual checks alone. diff --git a/PRIVACY.md b/PRIVACY.md index f2c1a77..0c51302 100644 --- a/PRIVACY.md +++ b/PRIVACY.md @@ -1,47 +1,5 @@ # Curate Privacy Policy -**Last updated:** September 1, 2026 +The privacy policy lives at **https://curate-eight-omega.vercel.app/privacy**. -This policy describes the Curate website and the Curate API. The website is a product landing page. Accounts, bookmarks, and collections live on the Curate server when you use the product. - -The hosted version is at `/privacy` on the Curate site. - -## This website - -The public site does not ask you to sign up or save bookmarks. It stores only your theme choice (light or dark) in your browser. - -Pages load fonts from Google Fonts. Password-reset pages on the Curate app also load styles from public CDNs. - -## What the service stores - -When you create an account, Curate stores: - -- Name, username, email, and a hashed password -- Bookmarks you save (title, URL, category, tags, and notes) -- Collection names and descriptions -- A short-lived reset token if you ask to change a forgotten password - -## How it is used - -That data is used only to run your account, keep your library, send a password-reset email when you ask for one, and return your bookmarks to the client you signed in with. - -## Where it lives - -Account and library data sit in the MongoDB database for the Curate instance you use. Password-reset email is sent through Brevo. Session cookies are used on the password-reset pages so those forms can work. - -## What we do not do - -- We do not sell your data. -- We do not run ads on Curate. -- We do not include analytics SDKs on this site. -- Your library is private. There is no public feed. - -## Deleting your data - -You can delete individual bookmarks and collections from your library. Deleting your account removes the account, bookmarks, and collections stored for you on this server. - -## Contact - - For privacy questions, contact the developer at [email](mailto:solabode223@gmail.com). - -If this policy changes, the date at the top of this page will change. +Its source is [`views/privacy.ejs`](views/privacy.ejs). Edit it there; there is no other copy. diff --git a/docs/phases/Phase_0.md b/docs/phases/Phase_0.md index 0fd8222..84b7e67 100644 --- a/docs/phases/Phase_0.md +++ b/docs/phases/Phase_0.md @@ -39,7 +39,7 @@ These are the honest "before" numbers for [metrics.md](../metrics.md). They are - **Delete the unlinked EJS library:** `/bookmark`, `/collections`, `/collections/:id/bookmarks`, `/login`, `/signup`, `/logout`, `/user/*`, with their controllers and views. This removes the CSRF exposure, the duplicated controllers and the bugs in `controllers/user.js`. - **Keep** `/`, `/privacy`, `/forgot-password` and `/reset-password/:token` (reset emails link to these). -- Keep one privacy policy (`landing/privacy.html`). `PRIVACY.md` and `/privacy` link or redirect to it. +- Keep one privacy policy: `views/privacy.ejs`, served at https://curate-eight-omega.vercel.app/privacy. `PRIVACY.md` links to it and `landing/` redirects `/privacy` to it. ### Extension diff --git a/landing/README.md b/landing/README.md index da3bae7..1b21e43 100644 --- a/landing/README.md +++ b/landing/README.md @@ -24,4 +24,4 @@ Or from this folder: npx vercel ``` -Do not set a start command like `node index.js`. This folder is HTML, CSS, JS, the logo, and the privacy page. +Do not set a start command like `node index.js`. This folder is HTML, CSS, JS and the logo. `/privacy` redirects to the single privacy policy at https://curate-eight-omega.vercel.app/privacy (rendered from `views/privacy.ejs`). diff --git a/landing/privacy.html b/landing/privacy.html deleted file mode 100644 index 8f8d06b..0000000 --- a/landing/privacy.html +++ /dev/null @@ -1,155 +0,0 @@ - - - - - - Privacy ยท Curate - - - - - - - -
- - - Curate - -
- About - Features - Privacy - Chrome - Edge - -
-
- -
-
-

Policy

-

Privacy

-

Last updated September 1, 2026

-
- -
-
-

Who this covers

-
-
-

- This policy describes the Curate website and the Curate API. The website is a product landing page. Accounts, bookmarks, and collections live on the Curate server when you use the product. -

-
-
- -
-
-

This website

-
-
-

- The public site does not ask you to sign up or save bookmarks. It stores only your theme choice (light or dark) in your browser. -

-

- Pages load fonts from Google Fonts. Password-reset pages on the Curate app also load styles from public CDNs. -

-
-
- -
-
-

What the service stores

-
-
-

When you create an account, Curate stores:

-
    -
  • Name, username, email, and a hashed password
    • -
  • Bookmarks you save (title, URL, category, tags, and notes)
    • -
  • Collection names and descriptions
    • -
  • A short-lived reset token if you ask to change a forgotten password
    • -
-
-
- -
-
-

How it is used

-
-
-

- That data is used only to run your account, keep your library, send a password-reset email when you ask for one, and return your bookmarks to the client you signed in with. -

-
-
- -
-
-

Where it lives

-
-
-

- Account and library data sit in the MongoDB database for the Curate instance you use. Password-reset email is sent through Brevo. Session cookies are used on the password-reset pages so those forms can work. -

-
-
- -
-
-

What we do not do

-
-
-
    -
  • We do not sell your data.
    • -
  • We do not run ads on Curate.
    • -
  • We do not include analytics SDKs on this site.
    • -
  • Your library is private. There is no public feed.
    • -
-
-
- -
-
-

Deleting your data

-
-
-

- You can delete individual bookmarks and collections from your library. Deleting your account removes the account, bookmarks, and collections stored for you on this server. -

-
-
- -
-
-

Contact

-
-
-

- For privacy questions, contact the developer at email. -

-

- If this policy changes, the date at the top of this page will change. -

-
-
-
- - - - - - diff --git a/landing/vercel.json b/landing/vercel.json index bd6fd8f..93c5f4c 100644 --- a/landing/vercel.json +++ b/landing/vercel.json @@ -1,3 +1,6 @@ { - "cleanUrls": true + "cleanUrls": true, + "redirects": [ + { "source": "/privacy", "destination": "https://curate-eight-omega.vercel.app/privacy", "permanent": true } + ] } diff --git a/views/privacy.ejs b/views/privacy.ejs index 5d5b3db..9ffae27 100644 --- a/views/privacy.ejs +++ b/views/privacy.ejs @@ -21,7 +21,7 @@

Policy

Privacy

-

Last updated September 1, 2026

+

Last updated October 24, 2026

@@ -61,6 +61,7 @@
  • Collection names and descriptions
  • A short-lived reset token if you ask to change a forgotten password
    • +

    To block abuse, the server counts sign-in, registration and password-reset attempts. Each counter is keyed by your IP address, or by the username or email you typed, and is deleted automatically within one hour.