A privacy policy and terms of service for every platform review

Every platform this site reads from asks for a privacy policy and terms of service before it will approve an app: TikTok’s review would not accept its form without them, Meta asks for data deletion instructions, and YouTube’s API terms ask for links to its own terms and Google’s privacy policy. The site had neither page, so /privacy and /terms answered 404.

Written from the code, not from a template

Each statement in the privacy policy was checked against the code before it was written:

• Analytics. Meta’s pixel and Microsoft Clarity load only after a visitor’s first click, key press or tap, and not at all when the browser sends Global Privacy Control or Do Not Track. The server also refuses to forward an event to Meta when a request carries either signal.
• What Meta receives. The server-side events carry the visitor’s IP address, user agent, page, referrer and Meta’s own _fbp and _fbc cookies.
• Cookies. The site sets none for visitors; only the owner-only admin area sets sign-in cookies.
• Embeds. The Google Calendar and Discord widget make no request until a visitor opens them.
• Live features. The Discord presence card and server count connect to Lanyard and Discord.
• Platform data. For each of TikTok, Instagram, YouTube, Twitch, Kick, Discord, Bluesky, GitHub and X, exactly what is read and through which scopes, used only to show Sammy’s own public content and dated totals.
• Storage. Platform authorizations are encrypted with AES-GCM, and aggregate metric history is kept for up to 400 days, YouTube statistics for up to 30.

It also gives data deletion instructions for visitors, for connected platform accounts and for anyone shown in a cached post, and the YouTube API Services disclosure with links to YouTube’s terms, Google’s privacy policy and Google’s permission settings.

The terms of service cover use of the site, content ownership with a pointer to the press page’s existing media usage conditions, each platform’s own terms, Mello Zone’s separate rules, acceptable use, the accuracy of dated metrics, and a disclaimer.

Where they appear

Both pages are linked from the footer of every page except the error page, carry the site’s standard identity markup, and are listed in the sitemap. They share the press page’s stylesheet, with one rule added so their introduction stacks in a single column.

Verification

• The release audit passed across all 43 canonical pages, including both new ones, on the first build: one H1 each, self-canonical, complete robots directives, the identity graph, breadcrumbs and keywords.
• npm run test:delivery 190 of 190, npm run test:worker 85 of 85 and npm run test:built 324 of 324 after tools/indexing-surface.json was rewritten deliberately for the two new routes.
• Against npm run preview: both pages answered 200 with indexable robots headers, the addresses without a trailing slash redirected to them, and headless Chrome at 1280 and 390 pixels wide showed the footer links, no horizontal overflow and no console errors. npm run test:browser reported 0 failures across 43 routes and npm run test:a11y 0 failures across 96 checks.