Skip to content

Admin people list, privacy page and removal on request - #28

Merged
BaranDev merged 3 commits into
mainfrom
admin-people
Oct 28, 2026
Merged

BaranDev merged 3 commits into
mainfrom
admin-people

Conversation

@BaranDev

@BaranDev BaranDev commented Oct 28, 2026 •

Copy link
Copy Markdown
Owner

People on the admin status page

  • Counted: a GitHub login gets counted when a person's browser or GitHub's image proxy receives one of its cards. Bots, the owner, the example logins and the admin page's own previews are left out.
  • Per person: GitHub avatar and profile link, saved stats, first and last seen, and every card address they used, marked README or browser.
  • Without a login: decorations made in the builder or found in a README are counted, as numbers only.
  • Storage: kept in people.json, saved hourly and at shutdown. Entries are forgotten 12 months after the last visit. No IPs are stored.

Removal on request

  • What happens: the admin page can remove a login. Its saved stats and list entry are deleted, it is never fetched or saved again, and its cards show a "not shown" notice. "Allow again" undoes it.
  • Safety: the change endpoints need a login and a header that a form on another site can't send.

Privacy page
/privacy says what is kept, why (legitimate interest), for how long, who else handles it, and how to have it removed. It is linked from the footer and listed in the sitemap.

Tests: unit tests for counting, caps, retention, blocking and an unreadable file, plus a server test for the exclusions, removal, allow and the JSON shape.

BaranDev added 3 commits October 28, 2026 10:39
…made

Counts each GitHub login a person's browser or GitHub's image proxy got a card for (bots, the owner, the example
logins and the admin page's own previews are left out), with the card addresses they used, and counts the
decorations made in the builder or found in a README. Kept in people.json, saved hourly and at shutdown; users
saved before the counting began are listed from the start. /admin/health gains a people section and the admin
status page shows it.
A /privacy page (linked from the footer, in the sitemap) says what questlog keeps, why, for how long, who else
handles it, and how to have it removed. The people list forgets anyone not seen for 12 months. The admin page
can remove a login at the person's request: its saved stats and list entry are deleted, it is never fetched or
saved again, and its cards show a notice until it is allowed again. The change endpoints need a header a form on
another site can't send.
@BaranDev BaranDev changed the title Admin status: people who tried it Admin people list, privacy page and removal on request Oct 28, 2026
@BaranDev
BaranDev merged commit 488a2bd into main Oct 28, 2026
2 checks passed
@BaranDev
BaranDev deleted the admin-people branch October 28, 2026 08:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant