🔏 Adds link to all requests made, in Privacy docs

2024-11-24 14:08:30 +03:00 · 2022-03-02 17:59:22 +00:00 · 2022-03-02 17:59:22 +00:00 · 4b7e49e8ab
commit 4b7e49e8ab
parent 7ba5cc23b7
1 changed files with 233 additions and 144 deletions
--- a/docs/privacy.md
+++ b/docs/privacy.md
@ -7,37 +7,64 @@ It's fully open source, and I've tried to keep to code as clear and thoroughly d

 For privacy and security tips, check out another project of mine: **[Personal Security Checklist](https://github.com/Lissy93/personal-security-checklist)**.

+- [External Requests](#external-requests)
+  - [Themes](#themes)
+  - [Icons](#icons)
+  - [Features](#features)
+  - [Widgets](#widgets)
+- [Browser Storage](#browser-storage)
+- [App Dependencies](#dependencies)
+- [Security Features](#security-features)
+- [Securing your Environment](#securing-your-environment)
+- [Reporting a Security Issue](#reporting-a-security-issue)
+
 ---

 ## External Requests
 By default, Dashy will not make any external requests, unless you configure it to. Some features (which are off by default) do require internat access, and this section outlines those features, the services used, and links to their privacy policies.

-### Font Awesome
-If either any of your sections or items are using font-awesome icons, then these will be fetched directly from font-awesome on page load. See the [Font Awesome Privacy Policy](https://fontawesome.com/privacy) for more info.
+The following section outlines all network requests that are made when certain features are enabled.

-### Favicon Fetching
+### Themes
+
+### Icons
+
+#### Font Awesome
+If either any of your sections, items or themes are using icons from font-awesome, then it will be automatically enabled. But you can also manually enable or disable it by setting `appConfig.enableFontAwesome` to `true` / `false`. Requests are made directly to Font-Awesome CDN, for more info, see the [Font Awesome Privacy Policy](https://fontawesome.com/privacy).
+
+#### Material Design Icons
+If either any of your sections, items or themes are mdi icons, then it will be automatically enabled. But you can also manually enable or disable it by setting `appConfig.enableMaterialDesignIcons` to `true` / `false`. Requests are made directly to Material-Design-Icons CDN, for more info, see the [Material Design Icons Website](https://materialdesignicons.com/).
+
+
+#### Favicon Fetching
 If an item's icon is set to `favicon`, then it will be auto-fetched from the corresponding URL. Since not all websites have their icon located at `/favicon.ico`, and if they do, it's often very low resolution (like `16 x 16 px`). Therefore, the default behavior is for Dashy to check if the URL is public, and if so will use an API to fetch the favicon. For self-hosted services, the favion will be fetched from the default path, and no external requests will be made.

-The default favicon API is [Favicon Kit](https://faviconkit.com/), but this can be changed by setting `appConfig.faviconApi` to an alternate source (`google`, `clearbit`, `webmasterapi` and `allesedv` are supported). If you do not want to use any API, then you can set this property to `local`, and the favicon will be fetched from the default path. For hosted services, this will still incur an external request.
+The default favicon API is [allesedv.com](https://favicon.allesedv.com/), but this can be changed by setting `appConfig.faviconApi` to an alternate source (`iconhorse`, `clearbit`, `faviconkit`, `besticon`, `duckduckgo`, `google` and `allesedv` are supported). If you do not want to use any API, then you can set this property to `local`, and the favicon will be fetched from the default path. For hosted services, this will still incur an external request.

-### Generative Icons
+#### Generative Icons
 If an item has the icon set to `generative`, then an external request it made to [Dice Bear](https://dicebear.com/) to fetch the uniquely generated icon. The URL of a given service is used as the key for generating the icon, but it is first hashed and encoded for basic privacy. For more info, please reference the [Dicebear Privacy Policy](https://avatars.dicebear.com/legal/privacy-policy)

+As a fallback, if Dicebear fails, then [Evatar](https://evatar.io/) is used.

-### Other Icons
+
+#### Other Icons
 Section icons, item icons and app icons are able to accept a URL to a raw image, if the image is hosted online then an external request will be made. To avoid the need to make external requests for icon assets, you can either use a self-hosted CDN, or store your images within `./public/item-icons` (which can be mounted as a volume if you're using Docker).

-### Web Assets
+#### Web Assets
 By default, all assets required by Dashy come bundled within the source, and so no external requests are made. If you add an additional font, which is imported from a CDN, then that will incur an external request. The same applies for other web assets, like external images, scripts or styles.

-### Status Checking
-The status check util will ping your services directly, and does not rely on any third party. If you are checking the uptime status of a public/ hosted application, then please refer to that services privacy policy. For all self-hosted services, requests happen locally within your network, and are not external.
+### Features

-### Update Checks
+#### Status Checking
+The status checking feature allows you to ping your apps/ services to check if they are currently operational.
+
+Dashy will ping your services directly, and does not rely on any third party. If you are checking the uptime status of a public/ hosted application, then please refer to that services privacy policy. For all self-hosted services, requests happen locally within your network, and are not external.
+
+#### Update Checks
 When the application loads, it checks for updates. The results of which are displayed in the config menu of the UI. This was implemented because using a very outdated version of Dashy may have unfixed issues. Your version is fetched from the source (local request), but the latest version is fetched from GitHub, which is an external request. This can be disabled by setting `appConfig.disableUpdateChecks: true`

-### Anonymous Error Reporting
-Error reporting is disabled by default, and no data will ever be sent without your explicit consent. In fact, the error tracking method will not even be imported unless you have actively enabled it. [Sentry](https://github.com/getsentry/sentry) is used for this, it's an open source error tracking and performance monitoring tool, which is used to identify any issues which occur in the production app (if you enable it). 
+#### Anonymous Error Reporting
+Error reporting is disabled by default, and no data will ever be sent without your explicit consent. In fact, the error tracking code isn't even imported unless you have actively enabled it. [Sentry](https://github.com/getsentry/sentry) is used for this, it's an open source error tracking and performance monitoring tool, used to identify any issues which occur in the production app (if you enable it). 

 The crash report includes the file or line of code that triggered the error, and a 2-layer deep stack trace. Reoccurring errors will also include the following user information: OS type (Mac, Windows, Linux, Android or iOS) and browser type (Firefox, Chrome, IE, Safari). Data scrubbing is enabled. IP address will not be stored. If any potentially identifiable data ever finds its way into a crash report, it will be automatically and permanently erased. All statistics collected are anonomized and stored securely, and ae automatically deleted after 14 days. For more about privacy and security, see the [Sentry Docs](https://sentry.io/security/).

@ -47,18 +74,74 @@ If you need to monitor bugs yourself, then you can [self-host your own Sentry Se

 ### Widgets

+Dashy supports [Widgets](/docs/widgets.md) for displaying dynamic content. The following widgets make external data requests:
+
+- **[Weather](/docs/widgets.md#weather)** and **[Weather Forecast](/docs/widgets.md#weather-forecast)**: `https://api.openweathermap.org`
+    - [OWM Privacy Policy](https://openweather.co.uk/privacy-policy)
+- **[RSS Feed](/docs/widgets.md#rss-feed)**: `https://api.rss2json.com/v1/api.json`
+    - [Rss2Json Privacy Policy](https://rss2json.com/privacy-policy)
+- **[IP Address](/docs/widgets.md#public-ip)**: `https://ipapi.co/json` or `http://ip-api.com/json`
+    - [IPGeoLocation Privacy Policy](https://ipgeolocation.io/privacy.html)
+    - [IP-API Privacy Policy](https://ip-api.com/docs/legal)
+- **[Crypto Watch List](/docs/widgets.md#crypto-watch-list)** and **[Token Price History](/docs/widgets.md#crypto-token-price-history)**: `https://api.coingecko.com`
+    - [CoinGecko Privacy Policy](https://www.coingecko.com/en/privacy)
+- **[Wallet Balance](/docs/widgets.md#wallet-balance)**: `https://api.blockcypher.com/`
+    - BlockCypher Privacy Policy](https://www.blockcypher.com/privacy.html)
+- **[Code::Stats](/docs/widgets.md#code-stats)**: `https://codestats.net`
+    - [Code::Stats Privacy Policy](https://codestats.net/tos#privacy)
+- **[AnonAddy](/docs/widgets.md#anonaddy)**: `https://app.anonaddy.com`
+    - [AnonAddy Privacy Policy](https://anonaddy.com/privacy/)
+- **[Vulnerability Feed](/docs/widgets.md#vulnerability-feed)**: `https://www.cvedetails.com`
+    - [CVE Details Privacy Policy](https://www.cvedetails.com/privacy.php)
+- **[Exchange Rate](/docs/widgets.md#exchange-rates)**: `https://v6.exchangerate-api.com`
+    - [ExchangeRateAPI Privacy Policy](https://www.exchangerate-api.com/terms)
+- **[Public Holidays](/docs/widgets.md#public-holidays)**: `https://kayaposoft.com`
+    - [jurajmajer/enrico](https://github.com/jurajmajer/enrico)
+- **[Covid-19 Status](/docs/widgets.md#covid-19-status)**: `https://codestats.net`
+    - [disease-sh/api](https://github.com/disease-sh/api)
+- **[Sports Scores](/docs/widgets.md#sports-scores)**: `https://thesportsdb.com`
+    - No Policy Availible
+- **[News Headlines](/docs/widgets.md#news-headlines)**: `https://api.currentsapi.services`
+    - [CurrentsAPI Privacy Policy](https://currentsapi.services/privacy)
+- **[TFL Status](/docs/widgets.md#tfl-status)**: `https://api.tfl.gov.uk`
+    - [TFL Privacy Policy](https://tfl.gov.uk/corporate/privacy-and-cookies/)
+- **[Stock Price History](/docs/widgets.md#stock-price-history)**: `https://alphavantage.co`
+    - [AlphaVantage Privacy Policy](https://www.alphavantage.co/privacy/)
+- **[ETH Gas Prices](/docs/widgets.md#eth-gas-prices)**: `https://ethgas.watch`
+    - [wslyvh/ethgaswatch](https://github.com/wslyvh/ethgaswatch)
+- **[Joke](/docs/widgets.md#joke)**: `https://v2.jokeapi.dev`
+    - [SV443's Privacy Policy](https://sv443.net/privacypolicy/en)
+- **[Flight Data](/docs/widgets.md#flight-data)**: `https://aerodatabox.p.rapidapi.com`
+    - [AeroDataBox](https://www.aerodatabox.com/#h.p_CXtIYZWF_WQd)
+- **[Astronomy Picture of the Day](/docs/widgets.md#astronomy-picture-of-the-day)**: `https://apodapi.herokuapp.com`
+    - [NASA's Privacy Policy](https://www.nasa.gov/about/highlights/HP_Privacy.html)
+- **[GitHub Trending](/docs/widgets.md#github-trending)** and **[GitHub Profile Stats](/docs/widgets.md#github-profile-stats)**: `https://api.github.com`
+    - [GitHub's Privacy Policy](https://docs.github.com/en/github/site-policy/github-privacy-statement)
+- **[Cron Monitoring (Health Checks)](/docs/widgets.md#cron-monitoring-health-checks)**: `https://healthchecks.io`
+    - [Health-Checks Privacy Policy](https://healthchecks.io/privacy/)
+
 ---

-## Local Storage
+## Browser Storage
 In order for user preferences to be persisted between sessions, certain data needs to be stored in the browsers local storage. No personal info is kept here, none of this data can be accessed by other domains, and no data is ever sent to any server without your prior consent.
 You can view your browsers session storage by opening up the dev tools (F12) --> Application --> Storage.

 The following section outlines all data that is stored in the browsers, as cookies or local storage.

 #### Cookies
+> Cookies have a pre-defined lifetime
+
 - `AUTH_TOKEN` - A unique token, generated from a hash of users credentials, to verify they are authenticated. Only used when auth is enabled 

+#### Session Storage
+> [Session storage](https://developer.mozilla.org/en-US/docs/Web/API/Window/sessionStorage) is deleted when the current session ends (tab / window is closed)
+
+- `SW_STATUS` - The current status of any service workers
+- `ERROR_LOG` - List of recent errors
+
 #### Local Storage
+> [Local storage](https://developer.mozilla.org/en-US/docs/Web/API/Window/localStorage) is persisted between sessions, and only deleted when manually removed
+
 - `LANGUAGE` - The locale to show app text in
 - `HIDE_WELCOME_BANNER` - Set to true once user dismissed welcome message, so that it's not shown again
 - `LAYOUT_ORIENTATION` - Preferred section layout, either horizontal, vertical or auto
@ -76,6 +159,9 @@ The following section outlines all data that is stored in the browsers, as cooki
 - `MOST_USED` - If smart sort is used to order items by most used, store open count
 - `LAST_USED` - If smart sort is used to order items by last used, store timestamps

+#### Deleting Stored Data
+You can manually view and delete session storage, local storage and cookies at anytime. Fist [open](/docs/troubleshooting.md#how-to-open-browser-console) your browsers developer tools (usually <kbd>F12</kbd>), then under the Application tab select the storage category. Here you will see a list of stored data, and you can select any item and delete it.
+
 ---

 ## Dependencies
@ -112,6 +198,9 @@ This is covered in more detail in [App Management](/docs/management.md).

 Dashy supports SRI, and it is recommended to enable this if you are hosting your dashboard via a public CDN. To enable SRI, set the `INTEGRITY` environmental variable to `true`.

+#### SSL
+Native SSL support is enabled, for setup instructions, see the [Management Docs](/docs/management.md#ssl-certificates)
+
 #### Authentication
 Dashy supports both basic auth, as well as server-based SSO using Keycloak. Full details of which, along with alternate authentication methods can be found in the [Authentication Docs](/docs/authentication.md). If your dashboard is exposed to the internet and/ or contains any sensitive info it is strongly recommended to configure access control with Keycloak or another server-side method.