commit 1d51eb9091edd4cdbb8a6c07e54de22aea069891 equwal <truex@equwal.com> 2026-09-24 12:49:29 -0700 Add privacy points to the home page The home page now says what the server does with the data. It also says that the server operator can read the bookmark file. A test checks the text.
pages.html | 14 ++++++++++++-- server_test.go | 12 ++++++++++++ 2 files changed, 24 insertions(+), 2 deletions(-)
diff --git a/pages.html b/pages.html index 14b3dab..9e4d4d4 100644 --- a/pages.html +++ b/pages.html @@ -67,8 +67,18 @@ Chrome. You can also use your bookmarks on this site, in any browser.</p> file, and sync it on each of their devices. Pre-order the founding plan: <a href="{{.}}">for up to 10 people</a>{{with $.TeamsLarge}}, or <a href="{{.}}">for 11 people or more</a>{{end}}.</p>{{end}} {{template "support" .}} -<p class="note">sbm Sync is free software under the AGPL-3.0. You can -<a href="https://github.com/equwal/sbm-sync">run your own server</a>.</p> +<h2 id="privacy">Your bookmarks stay yours</h2> +<ul> +<li>No ads, no analytics and no trackers. The only cookie keeps you signed in.</li> +<li>We do not sell or share your data.</li> +<li>Your bookmarks are one plain text file. You can read it, copy it and leave at any time.</li> +<li>You can delete your account and all copies on the server at once.</li> +<li>The source code is open. Anyone can check what the server does.</li> +</ul> +<p>The server does not encrypt your bookmark file. The operator of the server +can read it. If that is not acceptable, <a href="https://github.com/equwal/sbm-sync">run +your own server</a>. See the <a href="/privacy">privacy policy</a>.</p> +<p class="note">sbm Sync is free software under the AGPL-3.0.</p> {{template "foot" .}}{{end}} {{define "signup"}}{{template "head" .}} diff --git a/server_test.go b/server_test.go index 33bc17b..be1ea31 100644 --- a/server_test.go +++ b/server_test.go @@ -555,6 +555,18 @@ func TestPreviewImage(t *testing.T) { } } +// The home page states what the server does with the data, and that the +// operator can read it. A visitor must see this before signing up. +func TestHomePrivacy(t *testing.T) { + e := newEnv(t, false) + home := e.body(http.DefaultClient, "/") + for _, want := range []string{"No ads, no analytics and no trackers", "The operator of the server", `<a href="/privacy">privacy policy</a>`} { + if !strings.Contains(home, want) { + t.Errorf("the home page lacks %q", want) + } + } +} + // api sends a request with the token of a device, as the add-on does, and // gives the status and the body of the answer. func (e *harness) api(method, token, path string, form url.Values) (int, string) {