docs: add imprint, privacy policy and consent-gated analytics - #53
Merged
Conversation
There was a problem hiding this comment.
🟡 Changes recommended
Declining consent after previously accepting does not currently unload Umami, leaving analytics running until reload.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
This PR prepares the DocFX documentation site to act as the public homepage by adding required legal pages (imprint + privacy policy) and implementing consent-gated Umami analytics that only loads after explicit acceptance, with footer links available site-wide.
Changes:
- Add a consent banner and consent persistence/withdrawal logic to gate loading Umami analytics.
- Add and style a site-wide footer with legal links and a “Cookie settings” entry point to re-open the banner.
- Add new legal pages (
Imprint,Privacy policy) and suppress “Edit this page” onlegal/**.
File summaries
| File | Description |
|---|---|
| docs/templates/stratara/public/main.js | Implements consent storage + conditional injection/removal of the Umami script and banner UI behavior. |
| docs/templates/stratara/public/main.css | Adds styling for the footer legal links and the fixed consent banner. |
| docs/legal/privacy.md | Introduces a privacy policy page, including a consent withdrawal control. |
| docs/legal/imprint.md | Introduces an imprint page for provider identification and related disclosures. |
| docs/docfx.json | Adds a global footer, updates the title string, and disables contribution links for legal/**. |
Review details
- Files reviewed: 5/5 changed files
- Comments generated: 1
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this changes
The documentation site is about to become the public homepage, so it needs the legal pages a German-operated site owes its visitors — and analytics that do not start collecting before anyone has agreed.
docs/legal/imprint.md— provider identification under § 5 DDG and § 18 (2) MStV, adapted from the LoomWeaver site.docs/legal/privacy.md— controller, data-subject rights, hosting, browser storage, analytics and third-party requests. Adapted rather than copied: this site is on GitHub Pages, not the hosting provider the other site names, so the log-file section names GitHub and links its own statement.stratara-consentin localStorage; Decline stores the refusal so the notice does not ask again; the footer's Cookie settings re-opens it and the button in the privacy policy withdraws consent, removes the script and reloads. Nothing is requested fromcloud.umami.isbefore that._appFooter.One disclosure worth reading
The landing page loads status badges as images from
img.shields.ioandgithub.com. Those are direct requests from the visitor's browser, so the visitor's IP reaches both providers on page load — before any consent, because the badges are page content rather than analytics. The privacy policy says so under Status badges from third parties, on a legitimate-interest basis. The alternative is caching the badge images at build time, which costs their liveness; that is a decision for the owner, not something to decide silently here.How it was verified
./scripts/local-gauntlet.sh)docfx build --warningsAsErrors— 0 warnings, 0 errorscloud.umami.is, and does contain the noticelegal/**