Turning on analytics starts collecting visitor data, and this site has no privacy notice to disclose it. That is a legal exposure, not a polish item, and the pull request that enables analytics is what creates it.
Until now this was moot. The site loaded no tracker at all, so it collected nothing and had nothing to disclose. PR #32 changes that: it points the site at a self-hosted Umami installation and loads the tracker on every page. Umami is a web analytics product — it records which pages visitors open and which links they click, and reports them to a dashboard. From the moment that pull request is deployed, the site is processing visitor data.
Two things make this more than a formality:
- The site presents itself as operated from Germany. The footer reads "Built with intention in Germany." That puts it squarely under the GDPR and German law.
- The analytics installation geolocates visitors by IP address. The Umami image the infrastructure pins ships a
GeoLite2-City.mmdb database and resolves each visitor's IP to a city. The visitor's browser never sends a location; the server derives one. This is more than a page counter.
Umami is genuinely privacy-friendly in the ways that matter most — it sets no cookies, and it does not store raw IP addresses. That is why no cookie banner is needed. It is not why a privacy notice can be skipped. Article 13 of the GDPR requires telling visitors what is collected and why at the point of collection, regardless of cookies. Separately, German law (§5 DDG) requires business websites to publish an Impressum with operator contact details, which this site also lacks.
Today the site serves no privacy page at all. /privacy, /datenschutz, and /impressum all return 404.
What is at stake if this is left alone: a portfolio site whose entire pitch is engineering rigor is publicly out of compliance with the basic disclosure rules of the country it advertises operating from. The audience for this site includes prospective clients and employers. The cost of fixing it is a short static page and a footer link.
This needs a decision from the maintainer rather than an agent guessing, because it is legal and product content, not code:
- Whether to publish a combined privacy notice and Impressum, or separate pages.
- What contact address to publish. An Impressum requires a real one.
- Whether to keep IP geolocation on at all. Turning it off in the Umami deployment shrinks what has to be disclosed and is a one-setting change in
personal-infra.
- Whether to set
data-do-not-track="true" on the tracker, which makes Umami honour a visitor's browser "do not track" signal. It costs some measured traffic; it is a posture choice, not a correctness one.
Filed from the review-fix cycle on PR #32. The finding was raised by the security and privacy review lens, which confirmed the geolocation database in the pinned image and confirmed live that no privacy route exists. It was deliberately not fixed inside that pull request: writing legal disclosure text and choosing what to collect are product decisions, and PR #32's own scope is the analytics wiring.
Turning on analytics starts collecting visitor data, and this site has no privacy notice to disclose it. That is a legal exposure, not a polish item, and the pull request that enables analytics is what creates it.
Until now this was moot. The site loaded no tracker at all, so it collected nothing and had nothing to disclose. PR #32 changes that: it points the site at a self-hosted Umami installation and loads the tracker on every page. Umami is a web analytics product — it records which pages visitors open and which links they click, and reports them to a dashboard. From the moment that pull request is deployed, the site is processing visitor data.
Two things make this more than a formality:
GeoLite2-City.mmdbdatabase and resolves each visitor's IP to a city. The visitor's browser never sends a location; the server derives one. This is more than a page counter.Umami is genuinely privacy-friendly in the ways that matter most — it sets no cookies, and it does not store raw IP addresses. That is why no cookie banner is needed. It is not why a privacy notice can be skipped. Article 13 of the GDPR requires telling visitors what is collected and why at the point of collection, regardless of cookies. Separately, German law (§5 DDG) requires business websites to publish an Impressum with operator contact details, which this site also lacks.
Today the site serves no privacy page at all.
/privacy,/datenschutz, and/impressumall return 404.What is at stake if this is left alone: a portfolio site whose entire pitch is engineering rigor is publicly out of compliance with the basic disclosure rules of the country it advertises operating from. The audience for this site includes prospective clients and employers. The cost of fixing it is a short static page and a footer link.
This needs a decision from the maintainer rather than an agent guessing, because it is legal and product content, not code:
personal-infra.data-do-not-track="true"on the tracker, which makes Umami honour a visitor's browser "do not track" signal. It costs some measured traffic; it is a posture choice, not a correctness one.Filed from the review-fix cycle on PR #32. The finding was raised by the security and privacy review lens, which confirmed the geolocation database in the pinned image and confirmed live that no privacy route exists. It was deliberately not fixed inside that pull request: writing legal disclosure text and choosing what to collect are product decisions, and PR #32's own scope is the analytics wiring.