From 2f13b0a5c6b89ab7e5636d699a4e20d694ab7b13 Mon Sep 17 00:00:00 2001 From: simon Date: Wed, 15 Apr 2026 11:55:22 +0200 Subject: [PATCH] modified: web/app.py modified: web/templates/privacy_policy.html --- web/app.py | 5 +++-- web/templates/privacy_policy.html | 35 ++++++++++++++++++++++++++++++- 2 files changed, 37 insertions(+), 3 deletions(-) diff --git a/web/app.py b/web/app.py index b4ce931..ed2e217 100644 --- a/web/app.py +++ b/web/app.py @@ -118,7 +118,7 @@ def create_app() -> Flask: resp.headers.setdefault("X-Content-Type-Options", "nosniff") resp.headers.setdefault("X-Frame-Options", "DENY") resp.headers.setdefault("Referrer-Policy", "strict-origin-when-cross-origin") - resp.headers.setdefault("Content-Security-Policy", "default-src 'self'; script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; img-src 'self' data:; font-src 'self' https://cdn.jsdelivr.net; connect-src 'self'; frame-ancestors 'none';") + resp.headers.setdefault("Content-Security-Policy", "default-src 'self'; script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; img-src 'self' data: https://minotar.net; font-src 'self' https://cdn.jsdelivr.net; connect-src 'self'; frame-ancestors 'none';") return resp @app.route("/privacy-policy") @@ -126,8 +126,9 @@ def create_app() -> Flask: from config import Config return render_template( "privacy_policy.html", - last_updated="April 14, 2026", + last_updated="April 15, 2026", invite_expiry_hours=Config.INVITE_EXPIRY_HOURS, + audit_retention_days=Config.AUDIT_LOG_RETENTION_DAYS, ) @app.errorhandler(400) diff --git a/web/templates/privacy_policy.html b/web/templates/privacy_policy.html index b1e3209..87dbf13 100644 --- a/web/templates/privacy_policy.html +++ b/web/templates/privacy_policy.html @@ -91,7 +91,28 @@ session ends.

-

3.5 Server Log Files

+

3.5 Panel Audit Log

+

+ MCLogger maintains an internal audit log in the panel database that records + security-relevant and data-access events. Each entry contains: +

+ +

+ This includes access to pages that display Minecraft player data (player list, player detail, + chat history, commands, deaths, block events, sessions, proxy events). The log therefore + records who in the panel team accessed which player's data and when, + providing an accountable audit trail as required by Art. 32 GDPR. + Audit log entries are automatically deleted after {{ audit_retention_days }} days + (configurable by the operator). +

+ +

3.6 Server Log Files

The web server (gunicorn) may write standard HTTP access logs containing IP addresses, request paths, and timestamps. These logs are used for operational @@ -128,6 +149,11 @@ Security monitoring and error diagnosis Art. 6(1)(f) — legitimate interest + + Panel audit log (incl. IP addresses of panel users) + Accountability for access to personal data; security incident traceability + Art. 6(1)(c) — legal obligation / Art. 32 GDPR (security of processing) + @@ -136,6 +162,7 @@

  • Minecraft logs are retained as long as the server operator deems necessary for moderation purposes.
  • Panel accounts are retained until manually deleted by a site administrator.
  • Invite tokens expire after {{ invite_expiry_hours }} hours and are never sent to third parties beyond the intended recipient.
    • +
  • Panel audit log entries are automatically deleted after {{ audit_retention_days }} days. This includes IP address data logged on data-access events.
  • Server access logs are typically rotated within 30 days.
    • @@ -145,6 +172,12 @@ parties. All data remains within the infrastructure controlled by the server operator. No third-party analytics services, advertising networks, or tracking pixels are used.

    +

    + Player head images are loaded from minotar.net, a public Minecraft avatar service. + Minotar may process the Minecraft username and your IP address as part of serving the image. + Please consult minotar.net + for their privacy practices. If the image cannot be loaded, a local fallback placeholder is displayed. +

    External resources loaded by the web interface (Bootstrap CSS/JS and Bootstrap Icons) are served from the jsDelivr CDN (cdn.jsdelivr.net). jsDelivr may process