Privacy policy changes (#326)

* Mention list of currently enabled addons on privacy policy

* Use "of" instead of "for"

* Generalize to collecting interactions instead of specifically downloads

* Wrap X-Token with code blocks

* Remove mention of Google Fonts since it is no longer used

* Update text regarding sending extension settings

* Remove mention of Skypack since it is no longer used

* Use jsDeliver as the name of the CDN

* Update naming and link to jsDelivr CDN to reflect the changes on the policy

* Replace Glitch with Napkin.io

Co-authored-by: Samuel Q. <81489795+Samq64@users.noreply.github.com>

* Napkin.io -> Napkin

* Napkin suggestion by Samq

Co-authored-by: Samq64 <81489795+Samq64@users.noreply.github.com>

* Fix "sending a feedback"

Co-authored-by: David <mundofinky@gmail.com>

* Set policy date

* Add description about list of enabled addons (not just in summary)

* Fix "sending a feedback" 2

Co-authored-by: WorldLanguages <mundofinky@gmail.com>

* Add changelog

---------

Co-authored-by: Samuel Q. <81489795+Samq64@users.noreply.github.com>
Co-authored-by: David <mundofinky@gmail.com>

Author: 3 people

content/docs/policies/privacy/extension.md

@@ -8,7 +8,7 @@ aliases:
 no_comments: true
 ---
 
-> Last updated: 26 July 2022
+> Last updated: 17 August 2025
 
 This page informs you of our policies regarding the collection, use, and disclosure of personal data when using the Scratch Addons extension and the choices you have associated with that data.
 
@@ -24,9 +24,9 @@ We use your data to provide and improve the service. By using the service, you a
 
   We don't know how many users have enabled the pause button or turned on light mode.
 
-- **We never send Scratch account information or extension settings outside of your browser.**
+- **We never send Scratch account information or extension settings outside of your browser without your permission.**
 
-  Extension settings only leave your device if you've enabled Chrome/Firefox/Edge Sync.
+  Extension settings only leave your device if you've enabled Chrome/Firefox/Edge Sync or when you share your list of enabled addons upon sending feedback.
 
 - **By default, the extension only interacts with the Scratch website and this website.**
 
@@ -42,7 +42,7 @@ Temporarily-stored information might include:
 
 - Your Scratch account's username and user ID.
 - Values of the `scratchcsrftoken` and `scratchlanguage` cookies.
-- Value of your Scratch authentication token "X-Token".
+- Value of your Scratch authentication token, `X-Token`.
 - Your most recent Scratch messages.
 
 ## Permanently-Stored Information
@@ -58,9 +58,11 @@ Permanently-stored information might include:
 - Whether the Scratch Addons update notification was shown.
 - Whether the extension was muted through the context menu.
 
-The extension by itself does not send any of this information outside of your device. 
+If you enable Chrome Sync, Firefox Sync, Edge Sync, or any other compatible browser data synchronization feature, this information might be sent to that service by your browser.
 
-However, if you enable Chrome Sync, Firefox Sync, Edge Sync, or any other compatible browser data synchronization feature, this information might be sent to that service by your browser.
+When sending feedback through <https://scratchaddons.com/feedback>, an option is provided to include the list of currently enabled addons of your Scratch Addons instance. This list is attached locally for your convenience and is not sent automatically. You may choose whether to attach this information on your provided feedback. The processing of the feedback data is subject to the [Website Privacy Policy](/docs/privacy/policies/website#feedback).
+
+Other than the described information, the extension by itself does not send any of this information outside of your device. 
 
 ## Third Parties
 
@@ -90,5 +92,6 @@ If you have any questions, please contact us through our feedback page at <https
 
 ## Extension Privacy Policy Changelog
 
+- **17 August 2025:** add mention of the feedback page, minor style adjustments ([diff](https://github.com/ScratchAddons/website-v2/pull/326/files))
 - **26 July 2022:** reference Microsoft Edge browser ([diff](https://github.com/ScratchAddons/website-v2/commit/610c656bd30fd394bd6dbff98bfad677ce99e7f0))
 - **28 May 2021:** created

content/docs/policies/privacy/website.md

@@ -8,7 +8,7 @@ aliases:
 no_comments: true
 ---
 
-> Last updated: 28 May 2021
+> Last updated: 17 August 2025
 
 This page informs you of our policies regarding the collection, use, and disclosure of personal data when using the Scratch Addons website (<https://scratchaddons.com>) and the choices you have associated with that data.
 
@@ -37,28 +37,28 @@ We might, however, use local storage capabilities to store basic preferences, su
 
 ## Analytics
 
-We use a self-hosted Plausible Analytics instance routed through our analytics subdomain to count website visits, downloads, etc. Plausible works without collecting any personal data or personally identifiable information, and without using cookies. You can see the same data we can see on the [public analytics dashboard](https://analytics.scratchaddons.com).
+We use a self-hosted Plausible Analytics instance routed through our analytics subdomain to count website visits, interactions, etc. Plausible works without collecting any personal data or personally identifiable information, and without using cookies. You can see the same data we can see on the [public analytics dashboard](https://analytics.scratchaddons.com).
 
 ## Feedback
 
 When sending feedback through <https://scratchaddons.com/feedback>, some data included in the request is:
 
 - Text written in the "identifiers" field, if any.
 - Text written in "feedback" field.
-- The version number for your Scratch Addons instance.
+- The version number of your Scratch Addons instance.
 - Your browser's user agent string (which often includes your browser's and operating system's names and version numbers).
+- Optionally, the list of currently enabled addons of your Scratch Addons instance.
 
-Feedback is sent to a public open source [Glitch.com Node.js server instance](https://glitch.com/edit/#!/scratchaddons-feedback) which then redirects the information to a [Discord](https://discord.com) server. We do not log the IP addresses of the users that send feedback. You can verify this by looking at the Glitch server source code linked above.
+Feedback is sent to a public open source [Napkin Node.js server instance](https://scratchaddons.npkn.net/feedback/) which then redirects the information to a [Discord](https://discord.com) server and an internal GitHub repository. We do not log the IP addresses of the users that send feedback. You can verify this by looking at the Napkin server source code linked above.
 
 ## Third Parties
 
 When using our website, third party services might be reached, such as:
 - [Cloudflare](https://www.cloudflare.com/privacypolicy/) for website hosting
 - [GitHub](https://docs.github.com/en/github/site-policy/github-privacy-statement) for website hosting
-- [cdn.jsdelivr.net](https://www.jsdelivr.com/terms/privacy-policy-jsdelivr-net) for library CDN
-- [Skypack](https://www.skypack.dev/legal/privacy-policy) for library CDN
-- [Google services](https://policies.google.com/privacy) such as YouTube and Google Fonts
-- [Glitch](https://glitch.com/legal/privacy) for sending feedback
+- [jsDelivr CDN](https://www.jsdelivr.com/terms/privacy-policy) for library CDN
+- [Google services](https://policies.google.com/privacy) such as YouTube
+- [Napkin](https://app.termly.io/document/privacy-policy/652a111f-c37d-4094-906f-591414c28205) for sending feedback
 
 ## Links to Other Websites
 
@@ -70,4 +70,5 @@ If you have any questions, please contact us through our feedback page at <https
 
 ## Website Privacy Policy Changelog
 
+- **17 August 2025:** move host from Glitch to Napkin, clarify analytics data collection, minor style adjustments ([diff](https://github.com/ScratchAddons/website-v2/pull/326/files))
 - **28 May 2021:** created