feat(legal): publish a privacy policy the ad and analytics stack requires - #30
Merged
Conversation
…ires The site has been running Google Analytics 4 and the AdSense loader since 4e1149e without disclosing either. /privacy, /privacy-policy and /terms all returned the same soft-404 shell as a nonexistent slug, so there was no disclosure anywhere on the site. That is an independent AdSense policy violation, separate from the "low value content" verdict the review actually returned: the program policies require a policy that names the third-party cookie use and links the opt-out. It is also required on its own merits, since GA4 is already collecting. The page discloses only what the site actually loads, verified against the code rather than assumed: GA4 (G-77H1KB1H05) and AdSense (ca-pub-3427879236190872) from layout.tsx, Vercel Analytics and Speed Insights alongside them, and giscus from Comments.tsx — which stores comments as GitHub Discussions in this public repo. Both required opt-out destinations are linked, not merely mentioned, because AdSense asks for the link. Reachability was the other half. The footer link covers every page in the app shell, but the home route is immersive and renders LedgerHome's own footer instead, so the link is repeated there. /play is immersive too and keeps its bare 3D chrome; it links home, which carries the policy. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LaydoxAZ4eaqqPNKrmWLbt
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
AdSense rejected the site with Low value content, and a separate Verify site ownership step is still listed. While checking whether re-review is worth requesting, a second, independent violation turned up: there is no privacy policy.
/privacy,/privacy-policyand/termsall returned the identical 8018-byte soft-404 shell as a nonexistent slug. The site has been running GA4 and the AdSense loader since4e1149e(2026-06-13) with zero disclosure. AdSense's program policies require a policy that discloses third-party cookie use and links the opt-out. GA4 alone makes it necessary regardless of AdSense.This does not fix the content verdict. It removes a violation that would fail the re-review on its own.
What the page says
Only what the site actually loads, read out of the code rather than assumed:
G-77H1KB1H05)layout.tsx→GoogleAnalyticsca-pub-3427879236190872)layout.tsx→GoogleAdSenselayout.tsxComments.tsxBoth opt-out destinations are real links, since that is the form AdSense asks for.
Reachability
The footer link covers every page in the app shell. The home route is immersive and renders
LedgerHome's own footer, so the link is repeated there./playis immersive too and keeps its bare 3D chrome; it links home, which carries the policy.Verified on a production build across
/,/en,/blog,/projects,/hire,/studio,/about,/graveyardand both/privacylocales.QA
type-check,lintclean/[locale]/privacyregistered and added tositemap.tsmessages/*.jsonverified canonicalJSON.stringify(obj, null, 2)+ pure CRLF after edit🤖 Generated with Claude Code
https://claude.ai/code/session_01LaydoxAZ4eaqqPNKrmWLbt