Name the Cloudflare analytics that was already there - #163
Merged
Merged
Conversation
Both sites load a measurement script from static.cloudflareinsights.com. It is Cloudflare Web Analytics, switched on in the Cloudflare dashboard rather than by anything in this repository, and it predates the PostHog work by some time. Nothing here put it there and nothing here removed it, but the cookie policy said only two things were worth naming and listed neither of them as this, which made the section wrong the moment you opened the network tab. Section 3.3 now says there are two analytics rather than one, and describes what Cloudflare collects: the page, the referring link, the country, and the browser, operating system and device type. Section 3.4 counts three third-party connections instead of two, and says plainly that Cloudflare's script is the one exception to scripts being served from langx.io. Section 4 is unchanged in substance because the answer does not change: it writes nothing to the browser. That last part is measured rather than taken on faith — the site was opened and cookies, localStorage and sessionStorage all came back empty apart from SvelteKit's own scroll keys. The list of what it collects is from Cloudflare's dimensions documentation. The privacy policy gets the same treatment: a paragraph in 2.4, the "nothing records your screen" bullet in 4 widened to cover both, and section 6 saying that the Cloudflare already listed as our host also measures the traffic it delivers. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Both sites load
https://static.cloudflareinsights.com/beacon.min.js/...— Cloudflare Web Analytics, switched on in the Cloudflare dashboard rather than by anything in this repository, and predating the PostHog work by some time. Nothing here put it there and nothing here removes it. But cookie policy §3.4 said two things were worth naming and this was neither, which made the section wrong the moment you opened the network tab.What changed
Sourcing
The storage claim is measured, not taken on faith: langx.io was opened and
document.cookie,localStorageandsessionStorageall came back empty apart from SvelteKit's own scroll/snapshot keys. The list of collected fields is from Cloudflare's dimensions documentation.I deliberately did not write that it is "GDPR compliant" or "needs no banner" — Cloudflare's own FAQ and overview pages do not state the cookie/storage position in terms I could quote, so the text sticks to what was observed and what the dimensions page lists.
The alternative, not taken
Turning it off in the Cloudflare dashboard would have made the pages accurate as they were, and PostHog now covers the same ground. That was offered and naming it was chosen instead; it stays on.
🤖 Generated with Claude Code