Repository navigation
Disclose the signup form's Cloudflare Turnstile check in the legal pages - #4
Merged
Merged
Conversation
opendlp PR #316 adds a Cloudflare Turnstile bot check to the account signup form. The widget runs in non-pre-clearance mode, so it sets no cookies and the no-cookie-banner position still holds - but the signup page now loads a script and challenge iframe from Cloudflare, and the visitor's IP address and browser characteristics reach a US company. Two public pages claimed neither of those things happens. The cookies page gets a section describing the check (no cookies, what is sent to Cloudflare, signup page only) and its "Cookies from other companies" section now also covers the privacy-enhanced YouTube embeds on registration pages, which predate this change but were likewise undisclosed. The user data agreement names Cloudflare as a processor in section 4.5, extends the legitimate-interest basis in 4.4 to the bot check, and qualifies the section 6 claim that no data leaves the EEA, citing Cloudflare's EU-US Data Privacy Framework certification. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CV1KJkfe2FGmDg6dJkCnou
Changed references to "signup page" to "assembly manager's signup page".
Changed "account signup form" to "assembly manager's account signup form".
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
sortitionfoundation/opendlp#316 adds a Cloudflare Turnstile bot check to the account signup form (
/auth/register). The widget runs in non-pre-clearance mode, so it sets no cookies — the no-consent-banner position still holds and the cookie table on the cookies page stays correct as is. But the signup page now loads a script and challenge iframe fromchallenges.cloudflare.com, and the visitor's IP address and browser characteristics reach Cloudflare, a US company. Two public pages claimed neither of those things happens; this PR brings them in line with the analysis in opendlp'sbackend/docs/personal-data.md.Cookies page
User data agreement
🤖 Generated with Claude Code
https://claude.ai/code/session_01CV1KJkfe2FGmDg6dJkCnou