Fix/privacy policy

CHANGELOG.md

@@ -20,6 +20,10 @@ extension (`extension/manifest.json`).
 - Changing or resetting your password signs out other devices. The device you changed it on stays signed in.
 - Session cookies are `secure` and `SameSite=Lax` in production; the server refuses to start in production without its secrets
 
+### Fixed
+
+- One privacy policy instead of three copies, now covering the short-lived rate-limit counters
+
 ### Removed
 
 - The old website library (`/bookmark`, `/collections`, `/login`, `/signup`, `/user/*`). It was unlinked; the library lives in the extension. Password reset pages stay.

CONTRIBUTING.md

@@ -93,7 +93,7 @@ you touch the popup, options page, or landing site:
 - Reload the unpacked extension.
 - Sign in against your local API.
 - Confirm the popup (and options page, if you touched it) still work.
-- If you changed the landing site, check `landing/index.html` and `landing/privacy.html`.
+- If you changed the landing site, check `landing/index.html`. The privacy policy lives only in `views/privacy.ejs`.
 
 If you add or change API behavior, add or update a test under `tests/api/` or
 `tests/unit/` rather than relying on manual checks alone.

PRIVACY.md

@@ -1,47 +1,5 @@
 # Curate Privacy Policy
 
-**Last updated:** September 1, 2026
+The privacy policy lives at **https://curate-eight-omega.vercel.app/privacy**.
 
-This policy describes the Curate website and the Curate API. The website is a product landing page. Accounts, bookmarks, and collections live on the Curate server when you use the product.
-
-The hosted version is at `/privacy` on the Curate site.
-
-## This website
-
-The public site does not ask you to sign up or save bookmarks. It stores only your theme choice (light or dark) in your browser.
-
-Pages load fonts from Google Fonts. Password-reset pages on the Curate app also load styles from public CDNs.
-
-## What the service stores
-
-When you create an account, Curate stores:
-
-- Name, username, email, and a hashed password
-- Bookmarks you save (title, URL, category, tags, and notes)
-- Collection names and descriptions
-- A short-lived reset token if you ask to change a forgotten password
-
-## How it is used
-
-That data is used only to run your account, keep your library, send a password-reset email when you ask for one, and return your bookmarks to the client you signed in with.
-
-## Where it lives
-
-Account and library data sit in the MongoDB database for the Curate instance you use. Password-reset email is sent through Brevo. Session cookies are used on the password-reset pages so those forms can work.
-
-## What we do not do
-
-- We do not sell your data.
-- We do not run ads on Curate.
-- We do not include analytics SDKs on this site.
-- Your library is private. There is no public feed.
-
-## Deleting your data
-
-You can delete individual bookmarks and collections from your library. Deleting your account removes the account, bookmarks, and collections stored for you on this server.
-
-## Contact
-
- For privacy questions, contact the developer at [email](mailto:solabode223@gmail.com).
-
-If this policy changes, the date at the top of this page will change.
+Its source is [`views/privacy.ejs`](views/privacy.ejs). Edit it there; there is no other copy.

docs/phases/Phase_0.md

@@ -39,7 +39,7 @@ These are the honest "before" numbers for [metrics.md](../metrics.md). They are
 
 - **Delete the unlinked EJS library:** `/bookmark`, `/collections`, `/collections/:id/bookmarks`, `/login`, `/signup`, `/logout`, `/user/*`, with their controllers and views. This removes the CSRF exposure, the duplicated controllers and the bugs in `controllers/user.js`.
 - **Keep** `/`, `/privacy`, `/forgot-password` and `/reset-password/:token` (reset emails link to these).
-- Keep one privacy policy (`landing/privacy.html`). `PRIVACY.md` and `/privacy` link or redirect to it.
+- Keep one privacy policy: `views/privacy.ejs`, served at https://curate-eight-omega.vercel.app/privacy. `PRIVACY.md` links to it and `landing/` redirects `/privacy` to it.
 
 ### Extension
 

landing/README.md

@@ -24,4 +24,4 @@ Or from this folder:
 npx vercel
 ```
 
-Do not set a start command like `node index.js`. This folder is HTML, CSS, JS, the logo, and the privacy page.
+Do not set a start command like `node index.js`. This folder is HTML, CSS, JS and the logo. `/privacy` redirects to the single privacy policy at https://curate-eight-omega.vercel.app/privacy (rendered from `views/privacy.ejs`).

landing/vercel.json

@@ -1,3 +1,6 @@
 {
-  "cleanUrls": true
+  "cleanUrls": true,
+  "redirects": [
+    { "source": "/privacy", "destination": "https://curate-eight-omega.vercel.app/privacy", "permanent": true }
+  ]
 }

views/privacy.ejs

@@ -21,7 +21,7 @@
   <section class="soon-hero is-compact">
     <p class="soon-eyebrow">Policy</p>
     <h1>Privacy</h1>
-    <p class="soon-updated">Last updated September 1, 2026</p>
+    <p class="soon-updated">Last updated October 24, 2026</p>
   </section>
 
   <section class="soon-section">
@@ -61,6 +61,7 @@
         <li>Collection names and descriptions</li>
         <li>A short-lived reset token if you ask to change a forgotten password</li>
       </ul>
+      <p>To block abuse, the server counts sign-in, registration and password-reset attempts. Each counter is keyed by your IP address, or by the username or email you typed, and is deleted automatically within one hour.</p>
     </div>
   </section>