Updated privacy policy to reflect current situation...

content/pages/articles/privacy_policy.md

@@ -1,37 +1,36 @@
 %%-
-title: qwik - privacy policy
+title: qwik - Privacy Policy
 header: Privacy Policy
-date: Last updated 12th August 2021
+date: Last updated 26th April 2022
 -%%
 
 # Introduction
 We want to keep this short but informative, but a *tl;dr:*
 
-We do not want to collect data, and all data collected *should be logical*. (i.e. emails for a [gitea](https://git.qwik.space/) account or so).
+We try to collect as little data as possible. We do this by, for example, keeping logs of sensitive data (such as IPs and user agents) to a minimum. We collect a username and a password (which is *salted* and *hashed*), and then any data published or uploaded to any of the services we provide.
 
-We will change this Privacy Policy from time to time to reflect the current situation. Please keep an eye out.
+We will change this Privacy Policy from time to time to reflect the current situation. Please keep an eye out. For bigger changes we **might** send out some form of notice.
-Some extra words
 
-This notice is very general and there might be exceptions for each individual service we offer. Consider reading
+This policy is somewhat general, so there might be exceptions for individual services. We will list said exceptions further down the privacy policy.
-about the services before you use them, but they are all doing their best to be privacy friendly.
-
-We will list some exceptions further down the privacy policy.
 
 
 
 # Data collection
 ## IP Addresses and User Agents
-We do not keep nginx access logs - so we can't see who has connected. However, our main server uses modsecurity
+We do not keep access logs - so we can't see who has connected. However, our server uses modsecurity to protect against different types of attacks. Most of the time the modsecurity audit log is disabled, meaning it doesn't log anything. However, we might enable it for short periods of time for debugging purposes, after which we would disable and clear the log. Modsecurity logs may contain IP addesses or user agents!
-to protect against different types of attacks. If one of your requests is flagged as an attack, modsecurity will
-write to an audit log. **This will log your User Agent**.
 
 ## Cookies
 Our main page ([qwik.space](https://qwik.space/)) does not have any cookies.
 
+## Username and password
+We will require a username (which could be considered sensitive and/or private and/or personally identfiable). Other users will be able to see your username.
+
+Your password is salted and hashed. (This generally means your password is safe, as long as it is strong enough.)
+
 
 
 # Data retention
-The modsecurity log is kept until we clear it from time to time.
+The modsecurity log, when enabled, should be cleared after any debugging is done. We also keep your registration details (username) and published content until you either delete what you can yourself and/or tell us to remove it. (If you want to delete your **entire account** please ask for help, since you can't do that by yourself.)
 
 
 
@@ -43,22 +42,18 @@ We do not share any data with third parties unless we have to by law or state ot
 # Exceptions
 Here are some services that make exceptions to the above statements:
 
+## qam - qwik account manager
+Our account manager, *qam (qwik account manager)* uses a cookie when signing in that keeps an API-token.
+
+All services we provide use the same username and password as you specify in *qam*. All services that we provide will use a *mock/fake email address* (`username`@qwik.space or `username`@localhost) if they require one.
+
 ## XMPP
-Our XMPP server caches messages and uploads for up to seven days. If your client uses encryption (such as OMEMO)
+Our XMPP server caches messages and uploads for up to seven days. If your client uses encryption (such as OMEMO) the cached messages and uploads will be encrypted. We **strongly** advise using encryption.
-the cached messages and uploads will be encrypted. We **strongly** advise using encryption.
 
 ## Gitea
-Gitea will collect your email upon registration. (Sadly we don't know any way to disable this.) However, the email
-isn't used for anything so it can be whatever. We would maybe even advise you to use a temporary or throwaway email.
-
-Gitea will require a username on signup, which you might consider personal. We would advise you to not use your real
-name and instead use an alias.
-
 Gitea also uses some cookies, but this is for your comfort. For example keeping you signed in and remembering your settings or what not.
 
 ## Hedgedoc
-Hedgedoc will collect your email upon registration. This email will just be used for logging in.
-
 The documents you write will be stored unecrypted. This also applies to image uploads.
 
 Hedgedoc also uses some cookies, they will be used to keeping you signed in and remembering your settings.
@@ -69,8 +64,7 @@ These services all use cookies to remember your settings.
 
 
 # Recommendations
-**The internet is not a good place when it comes to privacy**. If you want to limit the risks of something or someone
+**The internet is not a good place when it comes to privacy**. If you want to limit the risks of something or someone invading your privacy online, we recommend:
-invading your privacy online, we recommend:
 
 * Use Tor (properly)
 * Use throwaway emails when signing up for stuff

content/pages/articles/terms_of_service.md

@@ -0,0 +1,16 @@
+%%-
+title: qwik - Terms of Service
+header: Terms of Service
+date: Last updated 26th April 2022
+-%%
+
+# Be nice.
+*Be nice* summarises our (qwik's) Terms of Service pretty well.
+
+In practice:
+* Do not harm any group or individual.
+* Don't do anything that is illegal in your residence or Sweden.
+* Use common sense.
+
+
+If we (qwik) believe you are breaking any of these three points, we will act on it. Either by deleting content or terminating your account.

index.js

@@ -46,7 +46,7 @@ Server.post('/gitea/pushEvent', (req, res) => {
 
 
 
-// Start the server 
+// Start the server
 Server.listen(
     Config.serverPort,
     () => {