Added user counter and analytics to the kst4contest page

website/src/privacy/index.njk

@@ -7,7 +7,7 @@ description: Privacy policy for the KST4Contest website.
 <section class="hero">
   <p class="badge">Privacy</p>
   <h1>Privacy Policy</h1>
-  <p class="lead">Information about data processing on this static website.</p>
+  <p class="lead">Information about data processing on this website.</p>
 </section>
 
 <section class="section narrow">
@@ -30,12 +30,46 @@ description: Privacy policy for the KST4Contest website.
     <h2>Legal basis</h2>
     <p>
       The legal basis is Art. 6(1)(f) GDPR: legitimate interest in secure and reliable operation
-      of the website.
+      of the website and in understanding the approximate use of its project pages.
     </p>
 
-    <h2>Cookies and tracking</h2>
+    <h2>Server-side reach statistics</h2>
     <p>
-      This website currently does not use cookies, analytics tracking, advertising pixels or user profiling.
+      The website uses server-side reach statistics to understand approximate demand and which
+      project pages are used. Measurement is based on a dedicated, reduced server access log. It
+      does not use cookies, an analytics or tracking script, advertising pixels, local storage,
+      third-party requests or user profiles.
+    </p>
+    <p>
+      The analytics log contains the server name, IP address, time, HTTP method, normalised path
+      without a query string, protocol, response status, transferred size and user agent. It does
+      not contain a referrer or authenticated user name. Known crawlers are filtered, and unknown
+      browsers or operating systems are treated as crawlers.
+    </p>
+    <p>
+      IP addresses are anonymised before data is stored in the statistics aggregates. The dedicated
+      analytics raw logs are retained for 14 days. Anonymised detailed aggregates are retained on a
+      rolling basis for 395 days. They include countries, but no city or host statistics. Countries
+      are derived with a Country database only.
+    </p>
+    <p>
+      A visit is an approximate daily value based on the combination of IP address, date and user
+      agent used by GoAccess. It must not be read as a number of unique people. Page views and visits
+      remain separate measures. Bots, monitoring requests, software update checks and static assets
+      are excluded as far as they can be identified.
+    </p>
+
+    <h2>Public visitor count</h2>
+    <p>
+      The home page displays an element containing the total number of these approximate daily visits
+      since the stated activation date. The display loads a same-origin JSON file and remains hidden
+      if that file is unavailable or invalid. This request is not included in the statistic.
+    </p>
+    <p>
+      The public file contains only the counter value, activation date, schema version and update time.
+      It contains no personal data or daily breakdown. The non-personal daily counter values are kept
+      permanently so that the total does not decrease when detailed aggregates reach the end of their
+      395-day retention period.
     </p>
 
     <h2>External links</h2>
@@ -71,4 +105,4 @@ description: Privacy policy for the KST4Contest website.
       You have the right to lodge a complaint with a competent data protection supervisory authority.
     </p>
   </article>
-</section>
+</section>