docs/GDPR_COMPLIANCE_WEBSITE.md

Rama main · réplica de lectura del repositorio original.

# GDPR Compliance Assessment - ActaLog Static Website

**Assessment Date:** December 2025
**Website Location:** `site/` directory
**Assessor:** Automated Code Analysis

---

## Executive Summary

The ActaLog static marketing website is **highly GDPR compliant** with minimal data processing. The site does not use cookies, tracking scripts, or collect personal data directly. The primary gap is the absence of privacy policy documentation.

### Overall Status: COMPLIANT (with recommendations)

| Area | Status | Risk |
|------|--------|------|
| Analytics/Tracking | COMPLIANT | None |
| Cookies | COMPLIANT | None |
| Forms/Data Collection | COMPLIANT | None |
| Privacy Policy | MISSING | Medium |
| External Resources | COMPLIANT | Low |
| Third-Party Integration | COMPLIANT | None |

---

## 1. Analytics and Tracking

### 1.1 Assessment

**Files Analyzed:** `site/index.html`, `site/features.html`, `site/script.js`

**Finding:** No analytics or tracking scripts detected.

**Specifically verified absence of:**
- Google Analytics (gtag.js, analytics.js, ga.js)
- Google Tag Manager
- Facebook Pixel
- LinkedIn Insight Tag
- Hotjar, Mixpanel, Amplitude
- Any tracking pixels or beacons
- Server-side tracking code

### 1.2 JavaScript Analysis

**File:** `site/script.js`

The site's JavaScript contains only:
- Counter animations for statistics display
- Scroll animations and parallax effects
- Smooth scroll navigation
- Button ripple effects
- Mobile menu toggle
- Image lazy loading
- Screenshot gallery interactions

**No telemetry, tracking, or data collection code.**

**Status:** COMPLIANT

---

## 2. Cookies

### 2.1 Assessment

**Finding:** No cookies are set by the website.

**Verified:**
- No `document.cookie` usage in JavaScript
- No cookie consent banner (not needed)
- No third-party cookie-setting scripts
- No session persistence mechanisms

### 2.2 First-Party Cookies

None set.

### 2.3 Third-Party Cookies

None loaded (Google Fonts does not set cookies).

**Status:** COMPLIANT

---

## 3. Forms and Data Collection

### 3.1 Assessment

**Finding:** No data collection forms exist on the marketing website.

**Verified absence of:**
- Contact forms
- Newsletter signup forms
- Email collection fields
- Any input/textarea elements for user data
- Lead capture mechanisms

### 3.2 External Links

The site links to external resources clearly:
- GitHub repository (for source code)
- GitHub Issues (for support)
- Markdown Guide (for documentation reference)

All external links use `target="_blank"` attribute.

**Status:** COMPLIANT

---

## 4. Privacy Policy

### 4.1 Assessment

**Finding:** No dedicated privacy policy page exists.

**Current state:**
- No `privacy.html` file
- No privacy policy link in footers
- No cookie policy page

### 4.2 GDPR Claim on Site

**File:** `site/features.html:379`

```html
<h4>GDPR & Privacy Ready</h4>
<p>Export member data on request, delete records completely,
   maintain audit trails for compliance.</p>
```

This refers to application features, not website privacy practices.

### 4.3 Recommendation

Even though the site collects no data, best practices recommend a privacy policy that states:
- What data is NOT collected
- Google Fonts usage (IP addresses transmitted to Google for font loading)
- Link to application privacy policy
- Contact information for privacy inquiries

**Status:** RECOMMENDED IMPROVEMENT

---

## 5. External Resources

### 5.1 Resources Loaded

| Resource | Domain | Purpose | Data Transmitted |
|----------|--------|---------|------------------|
| Google Fonts | fonts.googleapis.com | Typography | IP address only |
| Schema.org | schema.org (JSON-LD only) | Structured data | None (no request) |

### 5.2 Google Fonts Analysis

**Files:** `site/index.html`, `site/features.html`

```html
<link rel="preconnect" href="https://fonts.googleapis.com">
<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
<link href="https://fonts.googleapis.com/css2?family=Bebas+Neue&family=JetBrains+Mono:wght@400;700" rel="stylesheet">
```

**Privacy Implications:**
- User's IP address is sent to Google servers
- Google's privacy policy applies
- No personal data beyond IP address

**Mitigation Options:**
1. Self-host fonts (eliminates Google requests)
2. Document Google Fonts usage in privacy policy
3. Use `font-display: swap` for performance (already implemented)

**Status:** COMPLIANT (with documentation recommendation)

### 5.3 Local Assets

All images, logos, and screenshots are served locally from:
- `assets/logo.svg`
- `assets/hero-screenshot.svg`
- `assets/*.png` (screenshot galleries)

**Status:** COMPLIANT

---

## 6. Third-Party Integrations

### 6.1 Assessment

**Finding:** No third-party integrations that process user data.

**Verified absence of:**
- Social media embeds (Facebook, Twitter, Instagram)
- Chat widgets (Intercom, Drift, etc.)
- Comment systems (Disqus, etc.)
- Video embeds (YouTube, Vimeo)
- Maps (Google Maps, OpenStreetMap)
- Payment forms
- Advertising networks

### 6.2 External Links (Information Only)

| Destination | Purpose |
|-------------|---------|
| GitHub Repository | Source code access |
| GitHub Issues | Support requests |
| Markdown Guide | Documentation reference |

These are simple hyperlinks with no tracking or data sharing.

**Status:** COMPLIANT

---

## 7. Structured Data and SEO

### 7.1 JSON-LD Schema

**Files:** `site/index.html`, `site/features.html`

```json
{
  "@context": "https://schema.org",
  "@type": "SoftwareApplication",
  "name": "ActaLog",
  ...
}
```

- Schema.org reference is URL only (no external request)
- No personal data in structured data
- Standard SEO practice

### 7.2 Meta Tags

**Open Graph and Twitter Cards:**
- Standard social sharing metadata
- No user data or tracking IDs
- Local image URLs only

**Status:** COMPLIANT

---

## 8. Compliance Summary Table

| GDPR Requirement | Applicability | Status |
|------------------|---------------|--------|
| Lawful Basis for Processing (Art. 6) | N/A - No processing | COMPLIANT |
| Consent (Art. 7) | N/A - No data collection | COMPLIANT |
| Transparency (Art. 12-14) | Recommended | PARTIAL |
| Right of Access (Art. 15) | N/A - No data stored | N/A |
| Right to Erasure (Art. 17) | N/A - No data stored | N/A |
| Cookie Consent (ePrivacy) | Not required - No cookies | COMPLIANT |
| Data Security (Art. 32) | Minimal risk | COMPLIANT |
| Third-Party Transfers (Art. 44-49) | Google Fonts only | COMPLIANT |

---

## 9. Recommendations

### 9.1 High Priority

**Create Privacy Policy Page** (`site/privacy.html`)

Suggested content:
```markdown
# Privacy Policy

## What We Collect
This marketing website does not collect personal data,
use cookies, or track your browsing behavior.

## External Services
We use Google Fonts to display typography. When you visit
this site, your browser requests font files from Google's
servers, which transmits your IP address to Google.
See Google's Privacy Policy for details.

## Application Privacy
For information about data handling in the ActaLog
application, see [Application Privacy Policy].

## Contact
For privacy inquiries, contact [email] or open an issue
at https://github.com/johnzastrow/actalog/issues
```

### 9.2 Medium Priority

**Add Footer Links**
- Privacy Policy link
- Terms of Service link (if applicable)
- Cookie Policy (can state "We don't use cookies")

### 9.3 Low Priority (Optional)

**Self-Host Google Fonts**
- Eliminates all external requests
- Improves privacy posture
- May improve performance

**Implementation:**
```bash
# Download fonts and serve locally
npx google-webfonts-helper --font "Bebas Neue" --font "JetBrains Mono"
```

---

## 10. Legal Considerations

### 10.1 ePrivacy Directive (Cookie Law)

**Requirement:** Consent required for non-essential cookies.

**Status:** COMPLIANT - No cookies are used.

### 10.2 GDPR Territorial Scope

**Requirement:** Applies if targeting EU users.

**Assessment:** Website targets global audience (English language, no geo-restrictions). Privacy policy recommended regardless of primary market.

### 10.3 CCPA (California)

**Requirement:** Notice of data collection practices.

**Status:** COMPLIANT - No personal information collected.

---

## 11. Comparison with Application

| Aspect | Static Website | Application |
|--------|----------------|-------------|
| Data Collection | None | User accounts, workouts |
| Cookies | None | JWT tokens (localStorage) |
| Analytics | None | Audit logging |
| Third-Party | Google Fonts only | None |
| Privacy Risk | Very Low | Medium |
| Action Required | Privacy policy page | Multiple compliance items |

---

## 12. Implementation Checklist

### Immediate Actions

- [ ] Create `site/privacy.html` with basic privacy statement
- [ ] Add privacy policy link to footer in `index.html`
- [ ] Add privacy policy link to footer in `features.html`

### Optional Enhancements

- [ ] Self-host Google Fonts to eliminate external requests
- [ ] Create `site/terms.html` for application terms of service
- [ ] Add structured data for organization with contact info

---

## Appendix: Files Analyzed

| File | Purpose | Privacy Relevant |
|------|---------|------------------|
| `site/index.html` | Main landing page | Google Fonts, external links |
| `site/features.html` | Features page | Google Fonts, GDPR claim |
| `site/script.js` | Interactivity | No tracking code |
| `site/styles.css` | Styling | No external references |
| `site/styles/vars.css` | CSS variables | No external references |

---

## Document History

| Date | Version | Changes |
|------|---------|---------|
| December 2025 | 1.0 | Initial assessment |