diff --git a/CHANGELOG.md b/CHANGELOG.md index 6875a94..c931f78 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 +## [Unreleased] + +### Added + +- **English Privacy Policy** (`/privacy`): comprehensive public privacy policy in English including a Google API Services Limited Use Disclosure, explaining how `gmail.insert`, `gmail.labels`, and `gmail.readonly` scopes are used. Required for Google OAuth consent screen verification. +- **Terms of Service** (`/terms`): full English terms of service covering acceptable use, Google API compliance, data, liability, and governing law. +- **Home page footer legal links**: Privacy Policy, Terms of Service, Impressum, and Datenschutz links added to the public landing page footer — directly resolves the Google verification rejection ("homepage does not contain a link to your privacy policy"). +- **Login page footer**: now includes Privacy Policy and Terms of Service links alongside the existing Impressum / Datenschutz links. +- **Register page consent text**: "By creating an account you agree to our Terms of Service and Privacy Policy" notice added below the sign-up form. +- **Datenschutz cross-link**: German privacy page now links to the English `/privacy` page in section 2 and the bottom footer bar. + ## v0.6.5 (2026-04-07) ### Bug Fixes diff --git a/docs/TODO.md b/docs/TODO.md index d437241..f19c0fd 100644 --- a/docs/TODO.md +++ b/docs/TODO.md @@ -4,6 +4,8 @@ Comprehensive task breakdown for repository improvements and production readines ## ✅ Recently Completed +- [x] **Google OAuth consent screen legal compliance**: Added English Privacy Policy (`/privacy`) with Google API Limited Use Disclosure, Terms of Service (`/terms`), legal footer links on the home page (resolves Google's "homepage has no privacy policy link" verification rejection), login page, and register page (consent text). Cross-link from `/datenschutz` to `/privacy` added. + - [x] **Fix Pydantic V2 deprecation warnings**: Replaced `.dict()` with `.model_dump()` in `admin.py` and `notifications.py`. Fixed `RuntimeWarning: coroutine never awaited` for `db.add()` in test mocks (`test_tasks.py`, `test_config_service.py`). - [x] **Expanded backend test coverage**: Added 150 new unit tests across 10 new test files, increasing the backend test count from 361 to 511. New coverage includes `core/gdpr.py`, `utils/gmail_labels.py`, `services/notification_service.py`, `services/auth_service.py`, and API endpoints for auth, users, notifications, processing-runs/logs, app-settings, and version. diff --git a/frontend/src/app/datenschutz/page.tsx b/frontend/src/app/datenschutz/page.tsx index 270956a..8cab76a 100644 --- a/frontend/src/app/datenschutz/page.tsx +++ b/frontend/src/app/datenschutz/page.tsx @@ -83,7 +83,7 @@ export default function DatenschutzPage() {

2. Geltungsbereich dieser Datenschutzerklärung

-

+

Dieser Hinweis gilt für die {APP_NAME}-Webanwendung. Er gilt für alle Nutzer weltweit, einschließlich derjenigen in der Europäischen Union (EU), dem Europäischen Wirtschaftsraum (EWR), @@ -91,6 +91,14 @@ export default function DatenschutzPage() { Ukraine, den Vereinigten Staaten (US), Kanada, Lateinamerika, dem asiatisch-pazifischen Raum und Japan.

+

+ Eine englischsprachige Fassung dieser Datenschutzerklärung ist + verfügbar unter:{' '} + + /privacy + + . +

@@ -372,7 +380,13 @@ export default function DatenschutzPage() {

-
+
+ + Privacy Policy (EN) + + + Terms of Service + Impressum diff --git a/frontend/src/app/login/page.tsx b/frontend/src/app/login/page.tsx index cdb6fb4..6d5a838 100644 --- a/frontend/src/app/login/page.tsx +++ b/frontend/src/app/login/page.tsx @@ -151,6 +151,12 @@ export default function LoginPage() {
+ + Privacy Policy + + + Terms + Impressum diff --git a/frontend/src/app/page.tsx b/frontend/src/app/page.tsx index dfeab1a..93c678c 100644 --- a/frontend/src/app/page.tsx +++ b/frontend/src/app/page.tsx @@ -269,9 +269,23 @@ export default function Home() { {/* Footer */}
-

+

© {new Date().getFullYear()} InboxConverge — made for people, not enterprises.

+
+ + Privacy Policy + + + Terms of Service + + + Impressum + + + Datenschutz + +
diff --git a/frontend/src/app/privacy/page.tsx b/frontend/src/app/privacy/page.tsx new file mode 100644 index 0000000..1480dc3 --- /dev/null +++ b/frontend/src/app/privacy/page.tsx @@ -0,0 +1,542 @@ +import Link from 'next/link'; +import type { Metadata } from 'next'; + +const APP_NAME = process.env.APP_NAME ?? 'InboxConverge'; + +export const metadata: Metadata = { + title: `Privacy Policy – ${APP_NAME}`, +}; + +const LAST_UPDATED = 'April 18, 2026'; +const CONTACT_EMAIL = process.env.CONTACT_EMAIL ?? 'christian@inboxconverge.com'; + +export default function PrivacyPage() { + return ( +
+
+

Privacy Policy

+

Last updated: {LAST_UPDATED}

+ + {/* TOC */} + + + {/* 1 */} +
+

1. Who We Are

+

+ The data controller responsible for processing your personal data in + accordance with the EU General Data Protection Regulation (GDPR) and + equivalent data-protection laws worldwide is: +

+

+ Christian Louis IT Beratung
+ Alter Steinweg 3, 20459 Hamburg, Germany +

+

+ Contact:{' '} + + {CONTACT_EMAIL} + +

+

+ For all data-protection enquiries (access, erasure, correction, + objection or complaints) please use the email address above. We + respond within 30 days (or the period required by applicable law). +

+
+ + {/* 2 */} +
+

+ 2. Scope of This Policy +

+

+ This policy applies to the {APP_NAME} web application and all + associated services. It covers all users worldwide, including those + in the European Union (EU), European Economic Area (EEA), United + Kingdom, Switzerland, and the United States. +

+

+ A German-language version of this policy is available at{' '} + + /datenschutz + + . +

+
+ + {/* 3 */} +
+

+ 3. What Data We Collect and Why +

+ +

+ 3.1 Account and Authentication Data +

+

+ When you create an account or sign in with Google we may receive + your name, email address, and profile picture from Google OAuth 2.0. + We use this data solely to authenticate you and identify your + account within {APP_NAME}. +

+

+ Legal basis (GDPR Art. 6): (b) contract performance. +

+ +

+ 3.2 Source Mailbox Credentials +

+

+ To fetch email from your legacy POP3 / IMAP accounts you provide + server details and credentials. These are stored encrypted at rest + using AES-256 and are never transmitted to any third party. +

+

+ Legal basis (GDPR Art. 6): (b) contract performance. +

+ +

+ 3.3 Gmail API OAuth Tokens +

+

+ To inject email into your Gmail account, {APP_NAME} requests the + following Google OAuth 2.0 scopes: +

+
    +
  • + + https://www.googleapis.com/auth/gmail.insert + {' '} + — inserts messages directly into your Gmail mailbox without + sending them through SMTP. +
  • +
  • + + https://www.googleapis.com/auth/gmail.labels + {' '} + — creates and manages Gmail labels so imported messages can be + tagged (e.g. “imported”). +
  • +
  • + + https://www.googleapis.com/auth/gmail.readonly + {' '} + — reads your Gmail profile (email address) to confirm the + connection is working. +
  • +
+

+ The resulting access and refresh tokens are stored encrypted at + rest. Tokens are refreshed automatically by the service when they + expire and the refreshed token is persisted back to the database. + You can revoke access at any time from your{' '} + + Google Account permissions + {' '} + page. +

+

+ Legal basis (GDPR Art. 6): (b) contract performance. +

+ +

+ 3.4 Email Content +

+

+ Email bodies and attachments are read from your source accounts and + written to your Gmail account. They are processed in memory only; + no email content is written to persistent storage other than within + your own Gmail account. +

+

+ Legal basis (GDPR Art. 6): (b) contract performance. +

+ +

+ 3.5 Processing Logs +

+

+ We retain limited operational logs (message subject line, sender + address, timestamp, success/failure flag) for up to 90 days. These + are used to diagnose delivery problems and are accessible only to + you and our operations team. +

+

+ Legal basis (GDPR Art. 6): (f) legitimate interests. +

+
+ + {/* 4 — the critical Google Limited Use Disclosure */} +
+

+ 4. Google API Services — Limited Use Disclosure +

+
+

+ Limited Use Policy Compliance +

+

+ {APP_NAME}’s use of information received from Google APIs + adheres to the{' '} + + Google API Services User Data Policy + + , including the Limited Use requirements. +

+
+

+ Specifically, {APP_NAME} commits to the following with respect to + data obtained via Google APIs: +

+
    +
  • + Single purpose: Google user data is used only to + deliver the core service — importing email from legacy mailboxes + into your Gmail account. +
  • +
  • + No transfer to third parties: We do not sell, + rent, transfer, or disclose Google user data to third parties, + except as necessary to provide the service (e.g. the Gmail API + call itself) or as required by law. +
  • +
  • + No advertising: We do not use Google user data + to serve advertisements or for advertising-related purposes. +
  • +
  • + No human reading: We do not allow humans to read + your Gmail data unless you have given us explicit permission to do + so (e.g. for diagnosing a reported technical problem), or it is + required by law. +
  • +
  • + No profiling: We do not use Google user data to + build profiles, perform analytics, or engage in behavioural + tracking beyond what is strictly necessary to operate the service. +
  • +
  • + Security: All data obtained from Google APIs is + stored with AES-256 encryption at rest and transmitted only over + TLS-encrypted connections. +
  • +
+
+ + {/* 5 */} +
+

+ 5. Data Minimisation and Purpose Limitation +

+
    +
  • + We collect only the minimum personal data needed to operate the + service. +
  • +
  • + Email content is processed solely for the forwarding purpose you + initiate. +
  • +
  • + No advertising, behavioural tracking, or profiling is performed. +
  • +
  • No tracking cookies or analytics scripts are loaded.
  • +
+
+ + {/* 6 */} +
+

+ 6. Cookies and Similar Technologies +

+

+ The service uses only strictly necessary session cookies to + maintain your authenticated session. These cookies are essential + for the service to function and are exempt from prior-consent + requirements under the EU ePrivacy Directive (Art. 5(3)). We do + not use analytics cookies, advertising cookies, or tracking pixels. +

+
+ + {/* 7 */} +
+

+ 7. Third-Party Services +

+

+ Google OAuth / Gmail API: Authentication and Gmail + delivery are handled via Google’s APIs. Google processes your + credentials according to its own{' '} + + Privacy Policy + + . +

+

+ No sale or sharing for advertising: We do not + sell, rent, or share your personal data with third parties for + advertising or marketing purposes. +

+
+ + {/* 8 */} +
+

+ 8. International Data Transfers +

+

+ Where personal data is transferred outside the EEA we rely on + appropriate safeguards, including Standard Contractual Clauses + (SCCs) pursuant to EU Decision 2021/914/EU and European Commission + adequacy decisions. +

+
+ + {/* 9 */} +
+

+ 9. Data Retention +

+
    +
  • + Session data: deleted on logout or session + expiry. +
  • +
  • + Account configuration and metadata: retained for + the duration of your use of the service. +
  • +
  • + Processing logs: retained for up to 90 days. +
  • +
  • + OAuth tokens: stored encrypted and revocable at + any time via your Google Account. +
  • +
  • + Account deletion: all data associated with your + account is permanently deleted within 30 days of account closure. + You can request deletion by emailing{' '} + + {CONTACT_EMAIL} + + . +
  • +
+
+ + {/* 10 */} +
+

+ 10. Data Security +

+
    +
  • AES-256 encryption of credentials at rest.
  • +
  • TLS / HTTPS for all communications.
  • +
  • Role-based access controls to protect personal data.
  • +
  • CSRF protection for all state-changing requests.
  • +
+
+ + {/* 11 */} +
+

+ 11. Your Rights (EU / EEA / UK / Switzerland) +

+
    +
  • + Right of access (Art. 15): a copy of the data + held about you. +
  • +
  • + Right to rectification (Art. 16): correction of + inaccurate data. +
  • +
  • + Right to erasure (Art. 17): deletion of your + personal data. +
  • +
  • + Right to restriction (Art. 18): temporary + suspension of processing. +
  • +
  • + Right to portability (Art. 20): data in a + machine-readable format. +
  • +
  • + Right to object (Art. 21): objection to + processing based on legitimate interests. +
  • +
+

+ To exercise any of these rights, contact us at{' '} + + {CONTACT_EMAIL} + + . Complaints may be directed to the relevant supervisory authority + (in Germany: BfDI). +

+
+ + {/* 12 */} +
+

+ 12. Additional Rights — United States (CCPA / CPRA) +

+

+ If you are a California resident or resident of another US state + with applicable privacy legislation, you have the right to know, + delete, correct, and opt out of the sale of personal information. + We do not sell or share personal information. Contact:{' '} + + {CONTACT_EMAIL} + + . +

+
+ + {/* 13 */} +
+

+ 13. Additional Rights — Canada (PIPEDA / Law 25) +

+

+ If you are in Canada, you have the right to access, correct, and + withdraw consent under PIPEDA and provincial privacy laws. Contact:{' '} + + {CONTACT_EMAIL} + + . +

+
+ + {/* 14 */} +
+

+ 14. Additional Rights — Other Jurisdictions +

+

+ Users in Brazil (LGPD), Japan (APPI), Australia (Privacy Act 1988), + South Korea (PIPA), Singapore (PDPA), and other markets may exercise + equivalent data-protection rights under applicable national law. + Contact:{' '} + + {CONTACT_EMAIL} + + . +

+
+ + {/* 15 */} +
+

+ 15. Changes to This Policy +

+

+ We may update this policy from time to time. The “Last + updated” date at the top of this page indicates when it was + last revised. For material changes we will notify users via an + in-app notice or email. +

+
+ + {/* 16 */} +
+

+ 16. Contact Us +

+

+ For questions or concerns about this policy or your data, please + contact:{' '} + + {CONTACT_EMAIL} + +

+

+ Christian Louis IT Beratung
+ Alter Steinweg 3, 20459 Hamburg, Germany +

+
+ +
+ + Terms of Service + + + Datenschutz (DE) + + + Impressum + + + Back to Login + +
+
+
+ ); +} diff --git a/frontend/src/app/register/page.tsx b/frontend/src/app/register/page.tsx index b10feab..8c71ec4 100644 --- a/frontend/src/app/register/page.tsx +++ b/frontend/src/app/register/page.tsx @@ -156,7 +156,34 @@ export default function RegisterPage() {

+ +

+ By creating an account you agree to our{' '} + + Terms of Service + {' '} + and{' '} + + Privacy Policy + + . +

+ +
+ + Privacy Policy + + + Terms + + + Impressum + + + Datenschutz + +
); diff --git a/frontend/src/app/terms/page.tsx b/frontend/src/app/terms/page.tsx new file mode 100644 index 0000000..13280a9 --- /dev/null +++ b/frontend/src/app/terms/page.tsx @@ -0,0 +1,412 @@ +import Link from 'next/link'; +import type { Metadata } from 'next'; + +const APP_NAME = process.env.APP_NAME ?? 'InboxConverge'; + +export const metadata: Metadata = { + title: `Terms of Service – ${APP_NAME}`, +}; + +const LAST_UPDATED = 'April 18, 2026'; +const CONTACT_EMAIL = process.env.CONTACT_EMAIL ?? 'christian@inboxconverge.com'; + +export default function TermsPage() { + return ( +
+
+

Terms of Service

+

Last updated: {LAST_UPDATED}

+ + {/* TOC */} + + + {/* 1 */} +
+

+ 1. Acceptance of Terms +

+

+ By accessing or using {APP_NAME} (“the Service”), you agree + to be bound by these Terms of Service (“Terms”). If you do + not agree, do not use the Service. +

+

+ The Service is provided by Christian Louis IT Beratung, Alter + Steinweg 3, 20459 Hamburg, Germany (“we”, “us”, + “our”). +

+
+ + {/* 2 */} +
+

+ 2. Service Description +

+

+ {APP_NAME} is an email consolidation service that polls legacy + POP3 and IMAP mailboxes on your behalf and delivers the retrieved + messages directly into your Gmail inbox via the Gmail API. The + Service is designed for personal and small-business use. +

+

+ The Service is not affiliated with, endorsed by, or sponsored by + Google LLC. Gmail and Google are trademarks of Google LLC. +

+
+ + {/* 3 */} +
+

+ 3. Account Registration +

+
    +
  • + You must be at least 16 years old (or the minimum age of digital + consent in your jurisdiction) to create an account. +
  • +
  • + You are responsible for maintaining the security of your account + credentials and for all activity that occurs under your account. +
  • +
  • + You must provide accurate, current, and complete information + during registration and keep it up to date. +
  • +
  • + You may not share your account with others or create accounts for + the purpose of circumventing usage limits. +
  • +
+
+ + {/* 4 */} +
+

+ 4. Acceptable Use +

+

You agree not to use the Service to:

+
    +
  • + Violate any applicable law, regulation, or third-party rights. +
  • +
  • + Transmit unsolicited commercial messages (spam) or malicious + content. +
  • +
  • + Attempt to gain unauthorised access to any systems or networks. +
  • +
  • + Interfere with or disrupt the integrity or performance of the + Service. +
  • +
  • + Circumvent or reverse-engineer any technical protection measures. +
  • +
  • + Use the Service in a way that could impose an unreasonable load on + our infrastructure. +
  • +
+

+ We reserve the right to suspend or terminate accounts that violate + this policy. +

+
+ + {/* 5 */} +
+

+ 5. Google API Services +

+

+ The Service uses the Google Gmail API to insert messages into your + Gmail account. By connecting your Google account you also agree to + Google’s{' '} + + Terms of Service + {' '} + and{' '} + + Privacy Policy + + . +

+

+ Our use of data obtained via Google APIs complies with the{' '} + + Google API Services User Data Policy + + , including the Limited Use requirements. In particular, we use + Google user data only to provide the email-import service described + in these Terms and never for advertising or unrelated purposes. +

+

+ You can revoke {APP_NAME}’s access to your Google account at + any time from your{' '} + + Google Account permissions + {' '} + page. +

+
+ + {/* 6 */} +
+

+ 6. Intellectual Property +

+

+ The {APP_NAME} software is open-source and licensed under the + terms of the project’s{' '} + + LICENSE + {' '} + file. Nothing in these Terms grants you a licence to use the + {' '}{APP_NAME} name or logo for purposes outside of the permitted + open-source licence. +

+

+ You retain all rights to your own email content. We claim no + ownership over any messages processed by the Service. +

+
+ + {/* 7 */} +
+

+ 7. Data and Privacy +

+

+ Our collection and use of personal data is described in our{' '} + + Privacy Policy + + , which forms part of these Terms. By using the Service you + acknowledge and agree to the Privacy Policy. +

+
+ + {/* 8 */} +
+

+ 8. Availability and Modifications +

+

+ We aim to provide a reliable service but do not guarantee + uninterrupted availability. We may modify, suspend, or discontinue + the Service (or any part of it) at any time with reasonable notice + where practicable. +

+

+ We may update these Terms from time to time. Material changes will + be communicated via in-app notice or email. Continued use of the + Service after changes take effect constitutes acceptance of the + revised Terms. +

+
+ + {/* 9 */} +
+

+ 9. Disclaimers +

+

+ The Service is provided “as is” and “as + available” without warranties of any kind, express or implied, + including but not limited to warranties of merchantability, fitness + for a particular purpose, or non-infringement. +

+

+ We do not warrant that the Service will be error-free, that defects + will be corrected, or that the Service or its infrastructure are + free of viruses or other harmful components. +

+
+ + {/* 10 */} +
+

+ 10. Limitation of Liability +

+

+ To the maximum extent permitted by applicable law, Christian Louis + IT Beratung and its representatives shall not be liable for any + indirect, incidental, special, consequential, or punitive damages, + or any loss of profits, data, goodwill, or business opportunities + arising out of or in connection with your use of the Service. +

+

+ Our aggregate liability for any claim relating to the Service is + limited to the greater of (a) the amount you paid us in the 12 + months preceding the claim, or (b) €50. +

+
+ + {/* 11 */} +
+

+ 11. Indemnification +

+

+ You agree to indemnify and hold harmless Christian Louis IT Beratung + and its representatives from and against any claims, damages, + losses, and expenses (including reasonable legal fees) arising out + of your use of the Service, your violation of these Terms, or your + violation of any third-party rights. +

+
+ + {/* 12 */} +
+

+ 12. Termination +

+

+ You may close your account at any time by contacting us at{' '} + + {CONTACT_EMAIL} + + . Upon closure, all your data will be permanently deleted within + 30 days. +

+

+ We may suspend or terminate your account immediately if you breach + these Terms or if we are required to do so by law. +

+
+ + {/* 13 */} +
+

+ 13. Governing Law and Dispute Resolution +

+

+ These Terms are governed by the laws of the Federal Republic of + Germany, excluding its conflict-of-law provisions. The courts of + Hamburg, Germany shall have exclusive jurisdiction over any dispute + arising out of or in connection with these Terms, except where + mandatory consumer-protection laws in your jurisdiction provide + otherwise. +

+

+ EU consumers may also use the European Commission’s Online + Dispute Resolution platform:{' '} + + https://ec.europa.eu/consumers/odr + + . We are not obliged to participate in alternative dispute + resolution procedures but will consider reasonable requests. +

+
+ + {/* 14 */} +
+

+ 14. Changes to These Terms +

+

+ We reserve the right to modify these Terms at any time. We will + provide at least 14 days’ notice of material changes via + in-app notification or email. Your continued use of the Service + after the effective date of revised Terms constitutes your + acceptance of those Terms. +

+
+ + {/* 15 */} +
+

+ 15. Contact +

+

+ For questions about these Terms, please contact: +

+

+ Christian Louis IT Beratung
+ Alter Steinweg 3, 20459 Hamburg, Germany
+ + {CONTACT_EMAIL} + +

+
+ +
+ + Privacy Policy + + + Datenschutz (DE) + + + Impressum + + + Back to Login + +
+
+
+ ); +}