From 8e4ef0c3f43ef6fbbbf590349ef5ce73be7ee71f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Nicol=C3=A1s=20Ech=C3=A1niz?= <nicoechaniz@altermundi.net>
Date: Sat, 29 Aug 2026 06:05:34 -0300
Subject: [PATCH] fix(analytics): honor opt-out across Beacon subdomains

---
 analitica-y-privacidad/index.html |  2 +-
 tests/analytics-privacy.test.js   | 13 +++++++++++++
 2 files changed, 14 insertions(+), 1 deletion(-)
 create mode 100644 tests/analytics-privacy.test.js

diff --git a/analitica-y-privacidad/index.html b/analitica-y-privacidad/index.html
index 47cd52c..9b8b510 100644
--- a/analitica-y-privacidad/index.html
+++ b/analitica-y-privacidad/index.html
@@ -9,4 +9,4 @@
 <button id="disable">Desactivar analítica en este navegador</button><p class="muted" id="status" aria-live="polite"></p>
 <hr><h2>Analytics and privacy</h2><p>Harmonic Beacon uses first-party analytics hosted by AlterMundi to understand visits, campaigns, listening, event attendance and conversions. We record general pages/actions, referrer, UTM and advertising click identifiers present in the URL, approximate country/region, browser and device. After sign-in, opaque technical identifiers are linked to the account to prevent duplicate people and conversions.</p>
 <p>We do not collect passwords, authentication tokens, secrets, signed URLs, payment numbers, form contents, audio, video or chat. Payment, membership and authoritative duration facts come only from their owning servers. Contact <a href="mailto:info@harmonicbeacon.com">info@harmonicbeacon.com</a> for applicable access, correction, export or deletion requests.</p>
-<script>document.getElementById('disable').addEventListener('click',()=>{try{for(const k of ['hb_analytics_visitor','hb_analytics_first_touch','hb_analytics_last_touch'])localStorage.removeItem(k);sessionStorage.removeItem('hb_analytics_session');localStorage.setItem('hb_analytics_disabled','1');document.getElementById('status').textContent='Analítica desactivada para este navegador / Analytics disabled for this browser.'}catch{document.getElementById('status').textContent='No pudimos guardar la preferencia. Escribinos para recibir ayuda.'}})</script></main></body></html>
+<script>document.getElementById('disable').addEventListener('click',()=>{try{for(const k of ['hb_analytics_visitor','hb_analytics_first_touch','hb_analytics_last_touch'])localStorage.removeItem(k);sessionStorage.removeItem('hb_analytics_session');localStorage.setItem('hb_analytics_disabled','1');document.cookie='hb_analytics_disabled=1; Max-Age=31536000; Path=/; Domain=.harmonicbeacon.com; Secure; SameSite=Lax';document.getElementById('status').textContent='Analítica desactivada en Home, Account, Listen y Live para este navegador / Analytics disabled across Harmonic Beacon for this browser.'}catch{document.getElementById('status').textContent='No pudimos guardar la preferencia. Escribinos para recibir ayuda.'}})</script></main></body></html>
diff --git a/tests/analytics-privacy.test.js b/tests/analytics-privacy.test.js
new file mode 100644
index 0000000..eebc619
--- /dev/null
+++ b/tests/analytics-privacy.test.js
@@ -0,0 +1,13 @@
+const assert = require('node:assert/strict');
+const { readFileSync } = require('node:fs');
+const test = require('node:test');
+
+test('first-party analytics opt-out covers every Harmonic Beacon subdomain', () => {
+  const page = readFileSync('analitica-y-privacidad/index.html', 'utf8');
+  assert.match(page, /hb_analytics_disabled=1/);
+  assert.match(page, /Domain=\.harmonicbeacon\.com/);
+  assert.match(page, /Max-Age=31536000/);
+  assert.match(page, /Home, Account, Listen y Live/);
+  assert.doesNotMatch(page, /hb-meta-consent|fbq\(/);
+});
+