From 78610ef09da6fa21db8c9c82190f85c400de541f Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Sat, 18 Apr 2026 17:22:50 +0000 Subject: [PATCH] feat: add English privacy policy, ToS, and legal footer links for Google OAuth verification - Add /privacy (English privacy policy with Google API Limited Use Disclosure) - Add /terms (English Terms of Service) - Fix home page footer: add Privacy Policy, Terms, Impressum, Datenschutz links (directly resolves Google verification rejection: "homepage has no privacy link") - Update login page footer to include /privacy and /terms - Add register page consent text linking to /privacy and /terms - Add /privacy cross-link in German /datenschutz page (section 2 + footer) - Update CHANGELOG.md and docs/TODO.md Agent-Logs-Url: https://github.com/christianlouis/InboxConverge/sessions/6800713f-ba49-421c-9e96-08d8ed6e48e4 Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com> --- CHANGELOG.md | 11 + docs/TODO.md | 2 + frontend/src/app/datenschutz/page.tsx | 18 +- frontend/src/app/login/page.tsx | 6 + frontend/src/app/page.tsx | 16 +- frontend/src/app/privacy/page.tsx | 542 ++++++++++++++++++++++++++ frontend/src/app/register/page.tsx | 27 ++ frontend/src/app/terms/page.tsx | 412 ++++++++++++++++++++ 8 files changed, 1031 insertions(+), 3 deletions(-) create mode 100644 frontend/src/app/privacy/page.tsx create mode 100644 frontend/src/app/terms/page.tsx diff --git a/CHANGELOG.md b/CHANGELOG.md index 6875a94..c931f78 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 +## [Unreleased] + +### Added + +- **English Privacy Policy** (`/privacy`): comprehensive public privacy policy in English including a Google API Services Limited Use Disclosure, explaining how `gmail.insert`, `gmail.labels`, and `gmail.readonly` scopes are used. Required for Google OAuth consent screen verification. +- **Terms of Service** (`/terms`): full English terms of service covering acceptable use, Google API compliance, data, liability, and governing law. +- **Home page footer legal links**: Privacy Policy, Terms of Service, Impressum, and Datenschutz links added to the public landing page footer — directly resolves the Google verification rejection ("homepage does not contain a link to your privacy policy"). +- **Login page footer**: now includes Privacy Policy and Terms of Service links alongside the existing Impressum / Datenschutz links. +- **Register page consent text**: "By creating an account you agree to our Terms of Service and Privacy Policy" notice added below the sign-up form. +- **Datenschutz cross-link**: German privacy page now links to the English `/privacy` page in section 2 and the bottom footer bar. + ## v0.6.5 (2026-04-07) ### Bug Fixes diff --git a/docs/TODO.md b/docs/TODO.md index d437241..f19c0fd 100644 --- a/docs/TODO.md +++ b/docs/TODO.md @@ -4,6 +4,8 @@ Comprehensive task breakdown for repository improvements and production readines ## ✅ Recently Completed +- [x] **Google OAuth consent screen legal compliance**: Added English Privacy Policy (`/privacy`) with Google API Limited Use Disclosure, Terms of Service (`/terms`), legal footer links on the home page (resolves Google's "homepage has no privacy policy link" verification rejection), login page, and register page (consent text). Cross-link from `/datenschutz` to `/privacy` added. + - [x] **Fix Pydantic V2 deprecation warnings**: Replaced `.dict()` with `.model_dump()` in `admin.py` and `notifications.py`. Fixed `RuntimeWarning: coroutine never awaited` for `db.add()` in test mocks (`test_tasks.py`, `test_config_service.py`). - [x] **Expanded backend test coverage**: Added 150 new unit tests across 10 new test files, increasing the backend test count from 361 to 511. New coverage includes `core/gdpr.py`, `utils/gmail_labels.py`, `services/notification_service.py`, `services/auth_service.py`, and API endpoints for auth, users, notifications, processing-runs/logs, app-settings, and version. diff --git a/frontend/src/app/datenschutz/page.tsx b/frontend/src/app/datenschutz/page.tsx index 270956a..8cab76a 100644 --- a/frontend/src/app/datenschutz/page.tsx +++ b/frontend/src/app/datenschutz/page.tsx @@ -83,7 +83,7 @@ export default function DatenschutzPage() {
+
Dieser Hinweis gilt für die {APP_NAME}-Webanwendung. Er gilt für alle Nutzer weltweit, einschließlich derjenigen in der Europäischen Union (EU), dem Europäischen Wirtschaftsraum (EWR), @@ -91,6 +91,14 @@ export default function DatenschutzPage() { Ukraine, den Vereinigten Staaten (US), Kanada, Lateinamerika, dem asiatisch-pazifischen Raum und Japan.
++ Eine englischsprachige Fassung dieser Datenschutzerklärung ist + verfügbar unter:{' '} + + /privacy + + . +
Last updated: {LAST_UPDATED}
+ + {/* TOC */} + + + {/* 1 */} ++ The data controller responsible for processing your personal data in + accordance with the EU General Data Protection Regulation (GDPR) and + equivalent data-protection laws worldwide is: +
+
+ Christian Louis IT Beratung
+ Alter Steinweg 3, 20459 Hamburg, Germany
+
+ Contact:{' '} + + {CONTACT_EMAIL} + +
++ For all data-protection enquiries (access, erasure, correction, + objection or complaints) please use the email address above. We + respond within 30 days (or the period required by applicable law). +
++ This policy applies to the {APP_NAME} web application and all + associated services. It covers all users worldwide, including those + in the European Union (EU), European Economic Area (EEA), United + Kingdom, Switzerland, and the United States. +
++ A German-language version of this policy is available at{' '} + + /datenschutz + + . +
++ When you create an account or sign in with Google we may receive + your name, email address, and profile picture from Google OAuth 2.0. + We use this data solely to authenticate you and identify your + account within {APP_NAME}. +
++ Legal basis (GDPR Art. 6): (b) contract performance. +
+ ++ To fetch email from your legacy POP3 / IMAP accounts you provide + server details and credentials. These are stored encrypted at rest + using AES-256 and are never transmitted to any third party. +
++ Legal basis (GDPR Art. 6): (b) contract performance. +
+ ++ To inject email into your Gmail account, {APP_NAME} requests the + following Google OAuth 2.0 scopes: +
+
+ https://www.googleapis.com/auth/gmail.insert
+ {' '}
+ — inserts messages directly into your Gmail mailbox without
+ sending them through SMTP.
+
+ https://www.googleapis.com/auth/gmail.labels
+ {' '}
+ — creates and manages Gmail labels so imported messages can be
+ tagged (e.g. “imported”).
+
+ https://www.googleapis.com/auth/gmail.readonly
+ {' '}
+ — reads your Gmail profile (email address) to confirm the
+ connection is working.
+ + The resulting access and refresh tokens are stored encrypted at + rest. Tokens are refreshed automatically by the service when they + expire and the refreshed token is persisted back to the database. + You can revoke access at any time from your{' '} + + Google Account permissions + {' '} + page. +
++ Legal basis (GDPR Art. 6): (b) contract performance. +
+ ++ Email bodies and attachments are read from your source accounts and + written to your Gmail account. They are processed in memory only; + no email content is written to persistent storage other than within + your own Gmail account. +
++ Legal basis (GDPR Art. 6): (b) contract performance. +
+ ++ We retain limited operational logs (message subject line, sender + address, timestamp, success/failure flag) for up to 90 days. These + are used to diagnose delivery problems and are accessible only to + you and our operations team. +
++ Legal basis (GDPR Art. 6): (f) legitimate interests. +
++ Limited Use Policy Compliance +
++ {APP_NAME}’s use of information received from Google APIs + adheres to the{' '} + + Google API Services User Data Policy + + , including the Limited Use requirements. +
++ Specifically, {APP_NAME} commits to the following with respect to + data obtained via Google APIs: +
++ The service uses only strictly necessary session cookies to + maintain your authenticated session. These cookies are essential + for the service to function and are exempt from prior-consent + requirements under the EU ePrivacy Directive (Art. 5(3)). We do + not use analytics cookies, advertising cookies, or tracking pixels. +
++ Google OAuth / Gmail API: Authentication and Gmail + delivery are handled via Google’s APIs. Google processes your + credentials according to its own{' '} + + Privacy Policy + + . +
++ No sale or sharing for advertising: We do not + sell, rent, or share your personal data with third parties for + advertising or marketing purposes. +
++ Where personal data is transferred outside the EEA we rely on + appropriate safeguards, including Standard Contractual Clauses + (SCCs) pursuant to EU Decision 2021/914/EU and European Commission + adequacy decisions. +
++ To exercise any of these rights, contact us at{' '} + + {CONTACT_EMAIL} + + . Complaints may be directed to the relevant supervisory authority + (in Germany: BfDI). +
++ If you are a California resident or resident of another US state + with applicable privacy legislation, you have the right to know, + delete, correct, and opt out of the sale of personal information. + We do not sell or share personal information. Contact:{' '} + + {CONTACT_EMAIL} + + . +
++ If you are in Canada, you have the right to access, correct, and + withdraw consent under PIPEDA and provincial privacy laws. Contact:{' '} + + {CONTACT_EMAIL} + + . +
++ Users in Brazil (LGPD), Japan (APPI), Australia (Privacy Act 1988), + South Korea (PIPA), Singapore (PDPA), and other markets may exercise + equivalent data-protection rights under applicable national law. + Contact:{' '} + + {CONTACT_EMAIL} + + . +
++ We may update this policy from time to time. The “Last + updated” date at the top of this page indicates when it was + last revised. For material changes we will notify users via an + in-app notice or email. +
++ For questions or concerns about this policy or your data, please + contact:{' '} + + {CONTACT_EMAIL} + +
+
+ Christian Louis IT Beratung
+ Alter Steinweg 3, 20459 Hamburg, Germany
+
+ By creating an account you agree to our{' '} + + Terms of Service + {' '} + and{' '} + + Privacy Policy + + . +
+ +Last updated: {LAST_UPDATED}
+ + {/* TOC */} + + + {/* 1 */} ++ By accessing or using {APP_NAME} (“the Service”), you agree + to be bound by these Terms of Service (“Terms”). If you do + not agree, do not use the Service. +
++ The Service is provided by Christian Louis IT Beratung, Alter + Steinweg 3, 20459 Hamburg, Germany (“we”, “us”, + “our”). +
++ {APP_NAME} is an email consolidation service that polls legacy + POP3 and IMAP mailboxes on your behalf and delivers the retrieved + messages directly into your Gmail inbox via the Gmail API. The + Service is designed for personal and small-business use. +
++ The Service is not affiliated with, endorsed by, or sponsored by + Google LLC. Gmail and Google are trademarks of Google LLC. +
+You agree not to use the Service to:
++ We reserve the right to suspend or terminate accounts that violate + this policy. +
++ The Service uses the Google Gmail API to insert messages into your + Gmail account. By connecting your Google account you also agree to + Google’s{' '} + + Terms of Service + {' '} + and{' '} + + Privacy Policy + + . +
++ Our use of data obtained via Google APIs complies with the{' '} + + Google API Services User Data Policy + + , including the Limited Use requirements. In particular, we use + Google user data only to provide the email-import service described + in these Terms and never for advertising or unrelated purposes. +
++ You can revoke {APP_NAME}’s access to your Google account at + any time from your{' '} + + Google Account permissions + {' '} + page. +
++ The {APP_NAME} software is open-source and licensed under the + terms of the project’s{' '} + + LICENSE + {' '} + file. Nothing in these Terms grants you a licence to use the + {' '}{APP_NAME} name or logo for purposes outside of the permitted + open-source licence. +
++ You retain all rights to your own email content. We claim no + ownership over any messages processed by the Service. +
++ Our collection and use of personal data is described in our{' '} + + Privacy Policy + + , which forms part of these Terms. By using the Service you + acknowledge and agree to the Privacy Policy. +
++ We aim to provide a reliable service but do not guarantee + uninterrupted availability. We may modify, suspend, or discontinue + the Service (or any part of it) at any time with reasonable notice + where practicable. +
++ We may update these Terms from time to time. Material changes will + be communicated via in-app notice or email. Continued use of the + Service after changes take effect constitutes acceptance of the + revised Terms. +
++ The Service is provided “as is” and “as + available” without warranties of any kind, express or implied, + including but not limited to warranties of merchantability, fitness + for a particular purpose, or non-infringement. +
++ We do not warrant that the Service will be error-free, that defects + will be corrected, or that the Service or its infrastructure are + free of viruses or other harmful components. +
++ To the maximum extent permitted by applicable law, Christian Louis + IT Beratung and its representatives shall not be liable for any + indirect, incidental, special, consequential, or punitive damages, + or any loss of profits, data, goodwill, or business opportunities + arising out of or in connection with your use of the Service. +
++ Our aggregate liability for any claim relating to the Service is + limited to the greater of (a) the amount you paid us in the 12 + months preceding the claim, or (b) €50. +
++ You agree to indemnify and hold harmless Christian Louis IT Beratung + and its representatives from and against any claims, damages, + losses, and expenses (including reasonable legal fees) arising out + of your use of the Service, your violation of these Terms, or your + violation of any third-party rights. +
++ You may close your account at any time by contacting us at{' '} + + {CONTACT_EMAIL} + + . Upon closure, all your data will be permanently deleted within + 30 days. +
++ We may suspend or terminate your account immediately if you breach + these Terms or if we are required to do so by law. +
++ These Terms are governed by the laws of the Federal Republic of + Germany, excluding its conflict-of-law provisions. The courts of + Hamburg, Germany shall have exclusive jurisdiction over any dispute + arising out of or in connection with these Terms, except where + mandatory consumer-protection laws in your jurisdiction provide + otherwise. +
++ EU consumers may also use the European Commission’s Online + Dispute Resolution platform:{' '} + + https://ec.europa.eu/consumers/odr + + . We are not obliged to participate in alternative dispute + resolution procedures but will consider reasonable requests. +
++ We reserve the right to modify these Terms at any time. We will + provide at least 14 days’ notice of material changes via + in-app notification or email. Your continued use of the Service + after the effective date of revised Terms constitutes your + acceptance of those Terms. +
++ For questions about these Terms, please contact: +
+
+ Christian Louis IT Beratung
+ Alter Steinweg 3, 20459 Hamburg, Germany
+
+ {CONTACT_EMAIL}
+
+