diff --git a/readme.txt b/readme.txt index 99c46b7..e88310c 100644 --- a/readme.txt +++ b/readme.txt @@ -43,6 +43,80 @@ Use `screenshot="poster"` to show the screenshot as a clickable poster that load Yes. The plugin exposes actions and filters (all prefixed with `exelearning_`) for ELPX extraction, metadata, REST saves, shortcode rendering and styles. See https://github.com/exelearning/wp-exelearning/blob/main/docs/HOOKS.md. +== External services == + +ELPX uploads and storage are handled on your WordPress site. The bundled editor +runs locally in the browser, but some editor features and embedded content make +requests to external providers. Requests can occur while editing, previewing or +viewing published content, including content created by another author. + +For each browser request, the provider receives the requested resource or content +identifier, the user's IP address and browser request headers. Depending on browser +settings and the provider, requests may also include a referrer and cookies; embedded +services may collect interactions within their content. Account and access +requirements depend on the provider and the selected content. The plugin does not +require a third-party account for uploading or editing local ELPX files. + +The features below use external services or remote resources. Listing a resource +here describes its use; it does not make a CDN-hosted library an external service. + +* **YouTube** — used by the media and video iDevices. When an author embeds a +YouTube video, the editor loads the YouTube iframe player API and the video is +played from youtube.com; the visitor's browser and IP address reach YouTube like +they would on any page with a YouTube embed. Terms: https://www.youtube.com/t/terms +Privacy: https://policies.google.com/privacy + +* **Vimeo** — same as above for videos hosted on Vimeo, played from +player.vimeo.com. Terms: https://vimeo.com/terms +Privacy: https://vimeo.com/privacy + +* **GeoGebra** — used by the GeoGebra iDevice. When an author loads an +activity by URL or identifier, the material identifier is sent +to https://www.geogebra.org/api/json.php, and the applet is then loaded from +geogebra.org for the visitor. Terms: https://www.geogebra.org/tos +Privacy: https://www.geogebra.org/privacy + +* **H5P** — when an author embeds an H5P activity, the activity is loaded from +the site that hosts it (h5p.org, or the WordPress site the author copied the +embed code from), when the iframe is loaded. Activity identifiers and interactions +within the iframe go to that host. Its own access rules, terms and privacy policy +apply; H5P is a format, not a single hosting provider. +H5P.org content licensing: https://h5p.org/licensing +H5P Hub terms (for content hosted by that service): https://h5p.org/node/1075432 +H5P.org privacy: https://h5p.org/privacy + +* **RCSB Protein Data Bank and PubChem** — used by the 3D molecule iDevice. When +an author or a visitor loads a structure by its identifier, that identifier is +requested from https://files.rcsb.org or https://pubchem.ncbi.nlm.nih.gov. +RCSB PDB policies: https://www.rcsb.org/pages/policies +PubChem (NCBI) policies: https://www.ncbi.nlm.nih.gov/home/about/policies/ + +* **Google (gstatic.com)** — the 3D model viewer iDevice loads the Draco and +KTX2 decoders from https://www.gstatic.com when, and only when, the 3D model the +author added uses those compression formats. +Terms: https://policies.google.com/terms +Privacy: https://policies.google.com/privacy + +* **jsDelivr** — the bundled MathJax loads its speech-rule engine from +https://cdn.jsdelivr.net when a reader turns on the math accessibility (speech) +features of a formula. Terms and privacy: https://www.jsdelivr.com/terms +https://www.jsdelivr.com/terms/privacy-policy + +* **EducaMadrid Mediateca** — the interactive video iDevice loads the JW Player +script from https://mediateca.educa.madrid.org when its editing page is opened, +even before an EducaMadrid video is selected. Playing hosted media also requests +the selected media URL. Some hosted content requires an EducaMadrid account. +Terms, privacy and cookies: https://mediateca.educa.madrid.org/aviso-legal + +* **X (Twitter) and Facebook** — the bundled legacy lightbox includes optional share +widgets from platform.twitter.com and www.facebook.com. The editor's normal +lightbox initialization disables them (`social_tools: ""`). Content that enables +these widgets can send the page URL and browser request data to those providers +when the lightbox opens, before a visitor clicks a share button. +X terms: https://x.com/en/tos Privacy: https://x.com/en/privacy +Facebook terms: https://www.facebook.com/terms.php +Privacy: https://www.facebook.com/privacy/policy/ + == Source Code == The plugin's own PHP and JavaScript ship as human-readable source in this package. @@ -59,6 +133,13 @@ The plugin itself is developed at https://github.com/exelearning/wp-exelearning. = 0.0.0 = * Initial release +* Document external services and remote resources used by editor features, and under + which conditions, in the new "External services" section of this readme. +* Ship the shortcode and block embed behavior (fullscreen button, click-to-load + poster) as an enqueued script instead of an inline