From 553a723aae0669e118500446f22720678be20080 Mon Sep 17 00:00:00 2001 From: erseco Date: Fri, 18 Sep 2026 20:05:22 +0100 Subject: [PATCH 1/2] docs: document the external services the bundled editor can reach WordPress.org requires every third-party service a plugin can contact to be named in the readme, with what is sent, when, and links to its terms and privacy policy. The plugin itself contacts nothing; the bundled editor can, but only for content the author deliberately builds with it -- a YouTube video, a GeoGebra activity, an H5P embed, a molecule loaded from the RCSB PDB. Each entry says which iDevice triggers it and what leaves the browser. --- readme.txt | 70 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 70 insertions(+) diff --git a/readme.txt b/readme.txt index 99c46b7..5814dcf 100644 --- a/readme.txt +++ b/readme.txt @@ -43,6 +43,69 @@ Use `screenshot="poster"` to show the screenshot as a clickable poster that load Yes. The plugin exposes actions and filters (all prefixed with `exelearning_`) for ELPX extraction, metadata, REST saves, shortcode rendering and styles. See https://github.com/exelearning/wp-exelearning/blob/main/docs/HOOKS.md. +== External services == + +The plugin itself contacts no external service. Uploading, storing, extracting, +editing and embedding an ELPX package all happen on your own site: the bundled +eXeLearning editor is a static application served from the plugin directory and +runs entirely in the browser. + +The editor does let an author build content that uses third-party services. Those +requests are made by the browser, only when the author picks the corresponding +iDevice or embeds that kind of content, and again by any visitor who later views +a page containing it. No account is required for any of them, and the plugin +sends no site or user data of its own to any of them. + +* **YouTube** — used by the media and video iDevices. When an author embeds a +YouTube video, the editor loads the YouTube iframe player API and the video is +played from youtube.com; the visitor's browser and IP address reach YouTube like +they would on any page with a YouTube embed. Terms: https://www.youtube.com/t/terms +Privacy: https://policies.google.com/privacy + +* **Vimeo** — same as above for videos hosted on Vimeo, played from +player.vimeo.com. Terms: https://vimeo.com/terms +Privacy: https://vimeo.com/privacy + +* **GeoGebra** — used by the GeoGebra iDevice. When an author searches for or +inserts a GeoGebra activity, the search term and the material identifier are sent +to https://www.geogebra.org/api/json.php, and the applet is then loaded from +geogebra.org for the visitor. Terms: https://www.geogebra.org/tos +Privacy: https://www.geogebra.org/privacy + +* **H5P** — when an author embeds an H5P activity, the activity is loaded from +the site that hosts it (h5p.org, or the WordPress site the author copied the +embed code from). Terms: https://h5p.org/terms-of-use +Privacy: https://h5p.org/privacy-policy + +* **RCSB Protein Data Bank and PubChem** — used by the 3D molecule iDevice. When +an author or a visitor loads a structure by its identifier, that identifier is +requested from https://files.rcsb.org or https://pubchem.ncbi.nlm.nih.gov. +RCSB PDB policies: https://www.rcsb.org/pages/policies +PubChem (NCBI) policies: https://www.ncbi.nlm.nih.gov/home/about/policies/ + +* **Google (gstatic.com)** — the 3D model viewer iDevice loads the Draco and +KTX2 decoders from https://www.gstatic.com when, and only when, the 3D model the +author added uses those compression formats. +Terms: https://policies.google.com/terms +Privacy: https://policies.google.com/privacy + +* **jsDelivr** — the bundled MathJax loads its speech-rule engine from +https://cdn.jsdelivr.net when a reader turns on the math accessibility (speech) +features of a formula. Terms and privacy: https://www.jsdelivr.com/terms +https://www.jsdelivr.com/terms/privacy-policy + +* **EducaMadrid Mediateca** — the interactive video iDevice loads the JW Player +script from https://mediateca.educa.madrid.org while the author edits that +iDevice. Terms: https://www.educa2.madrid.org/web/educamadrid/principal/avisolegal +Privacy: https://www.educa2.madrid.org/web/educamadrid/principal/proteccion-de-datos + +* **X (Twitter) and Facebook** — the image lightbox offers share buttons that +load the sharing widgets from platform.twitter.com and www.facebook.com when a +visitor opens an image that has sharing enabled. +X terms: https://x.com/en/tos Privacy: https://x.com/en/privacy +Facebook terms: https://www.facebook.com/terms.php +Privacy: https://www.facebook.com/privacy/policy/ + == Source Code == The plugin's own PHP and JavaScript ship as human-readable source in this package. @@ -59,6 +122,13 @@ The plugin itself is developed at https://github.com/exelearning/wp-exelearning. = 0.0.0 = * Initial release +* Document every third-party service the bundled editor can reach, and under + which conditions, in the new "External services" section of this readme. +* Ship the shortcode and block embed behavior (fullscreen button, click-to-load + poster) as an enqueued script instead of an inline