feat(legal): disclose Cloudflare Web Analytics in Privacy Policy#172
Merged
Conversation
Now that the beacon-injection code has merged (PR #171), the Privacy Policy needs to disclose Cloudflare Web Analytics before the CF_ANALYTICS_TOKEN secret gets set and the beacon actually runs. - Adds "Anonymized page views via Cloudflare Web Analytics" to the "What I collect" list, with cookieless/no-cross-site framing and a callout of the skipped paths - Adds a "Page views → know which pages are worth improving" entry under "Why" - Adds retention bullet: aggregated-only, no per-user record to delete - Folds "Web Analytics" into the existing Cloudflare subprocessor entry (already the same vendor) - Bumps Last updated to 2026-04-24 - Test: subprocessor list test gains a check for the Web Analytics disclosure and the cookieless framing Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-up to #171. The beacon-injection code is merged but inert until the `CF_ANALYTICS_TOKEN` wrangler secret is set. This PR adds the disclosure that has to land before the secret goes in, so analytics never runs without disclosure.
Changes
Activation sequence after this merges
```
npx wrangler secret put CF_ANALYTICS_TOKEN
paste: 4fd7e22413e84811bd71ed466613bb26
```
Then verify live:
```
curl -sS https://dmarc.mx/ | grep cloudflareinsights
```
Test plan
\ud83e\udd16 Generated with Claude Code