Infinitune 1.4.0: legal pages anyone can open

Note

🤖 Claude Opus 5.5 responding on behalf of beastyrabbit

Infinitune now has a German Impressum and Datenschutzerklärung, with English versions. Anyone can read them without signing in, and every page of the app links to them.

Legal pages anyone can open

• Impressum and privacy policy at /impressum and /datenschutz, in English at /legal-notice and /privacy. They are standalone pages: they load no app code, make no API calls and set no cookies, so they work even for visitors who can't sign in. Search engines are told not to index them.
• Footer links ("Legal notice", "Privacy") on every app page, including error and not-found pages. The embedded mini player stays clean.
• The privacy policy describes what Infinitune actually does with data: sign-in through the homelab's SSO, stored playlists and songs, text generation with OpenAI, music generation on the operator's own hardware, the self-hosted Umami and GlitchTip, logs and browser storage. The full data-flow inventory is in docs/legal/privacy-inventory.md.

Privacy and hardening

• Server logs now expire. Entries in the server's own log files are deleted no later than 14 days after they were written. Before this, every log file was kept forever.
• No session replay. The app no longer loads Umami's session recorder or heatmaps; only usage events and page views are counted.
• Unusual encoded paths are rejected. The web server and the API answer 400 to request paths with encoded /, \, % or ., backslashes or ./.. segments, and WebSocket upgrades on such paths are refused. This keeps the public legal pages from becoming a way around sign-in.

Upgrade notes

• Playlist keys containing /, \ or %, or equal to . or .., are now rejected when a playlist is created, because they could not be read back. Generated keys are unaffected.

Full change: #77.