From e5e59fdcbf82e99ef1776829c47c59f0e313884a Mon Sep 17 00:00:00 2001 From: Evan Jarrett Date: Sun, 4 Jan 2026 23:12:14 -0600 Subject: [PATCH] add tos and privacy policy --- cmd/appview/serve.go | 29 +-- pkg/appview/handlers/legal.go | 44 ++++ pkg/appview/routes/routes.go | 15 ++ pkg/appview/static/css/style.css | 131 +++++++++++ pkg/appview/templates/pages/privacy.html | 266 +++++++++++++++++++++++ pkg/appview/templates/pages/terms.html | 204 +++++++++++++++++ 6 files changed, 670 insertions(+), 19 deletions(-) create mode 100644 pkg/appview/handlers/legal.go create mode 100644 pkg/appview/templates/pages/privacy.html create mode 100644 pkg/appview/templates/pages/terms.html diff --git a/cmd/appview/serve.go b/cmd/appview/serve.go index 15b0006..68fa0c8 100644 --- a/cmd/appview/serve.go +++ b/cmd/appview/serve.go @@ -380,7 +380,16 @@ func serveRegistry(cmd *cobra.Command, args []string) error { // OAuth client metadata endpoint mainRouter.Get("/oauth-client-metadata.json", func(w http.ResponseWriter, r *http.Request) { config := oauthClientApp.Config + logoURI := cfg.Server.BaseURL + "/web-app-manifest-192x192.png" + policyURI := cfg.Server.BaseURL + "/privacy" + tosURI := cfg.Server.BaseURL + "/terms" + metadata := config.ClientMetadata() + metadata.ClientName = &cfg.Server.ClientName + metadata.ClientURI = &cfg.Server.BaseURL + metadata.LogoURI = &logoURI + metadata.PolicyURI = &policyURI + metadata.TosURI = &tosURI // For confidential clients, ensure JWKS is included // The indigo library should populate this automatically, but we explicitly set it here @@ -390,30 +399,12 @@ func serveRegistry(cmd *cobra.Command, args []string) error { metadata.JWKS = &jwks } - // Convert indigo's metadata to map so we can add custom fields - metadataBytes, err := json.Marshal(metadata) - if err != nil { - http.Error(w, "Failed to marshal metadata", http.StatusInternalServerError) - return - } - - var metadataMap map[string]any - if err := json.Unmarshal(metadataBytes, &metadataMap); err != nil { - http.Error(w, "Failed to unmarshal metadata", http.StatusInternalServerError) - return - } - - // Add custom fields - metadataMap["client_name"] = cfg.Server.ClientName - metadataMap["client_uri"] = cfg.Server.BaseURL - metadataMap["logo_uri"] = cfg.Server.BaseURL + "/web-app-manifest-192x192.png" - w.Header().Set("Content-Type", "application/json") w.Header().Set("Access-Control-Allow-Origin", "*") // Limit caching to allow scope changes to propagate quickly // PDS servers cache client metadata, so short max-age helps with updates w.Header().Set("Cache-Control", "public, max-age=300") - if err := json.NewEncoder(w).Encode(metadataMap); err != nil { + if err := json.NewEncoder(w).Encode(metadata); err != nil { http.Error(w, "Failed to encode metadata", http.StatusInternalServerError) } }) diff --git a/pkg/appview/handlers/legal.go b/pkg/appview/handlers/legal.go new file mode 100644 index 0000000..51722c0 --- /dev/null +++ b/pkg/appview/handlers/legal.go @@ -0,0 +1,44 @@ +package handlers + +import ( + "html/template" + "net/http" +) + +// PrivacyPolicyHandler handles the /privacy page +type PrivacyPolicyHandler struct { + Templates *template.Template + RegistryURL string +} + +func (h *PrivacyPolicyHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) { + data := struct { + PageData + }{ + PageData: NewPageData(r, h.RegistryURL), + } + + if err := h.Templates.ExecuteTemplate(w, "privacy", data); err != nil { + http.Error(w, err.Error(), http.StatusInternalServerError) + return + } +} + +// TermsOfServiceHandler handles the /terms page +type TermsOfServiceHandler struct { + Templates *template.Template + RegistryURL string +} + +func (h *TermsOfServiceHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) { + data := struct { + PageData + }{ + PageData: NewPageData(r, h.RegistryURL), + } + + if err := h.Templates.ExecuteTemplate(w, "terms", data); err != nil { + http.Error(w, err.Error(), http.StatusInternalServerError) + return + } +} diff --git a/pkg/appview/routes/routes.go b/pkg/appview/routes/routes.go index 89a59cf..d56efec 100644 --- a/pkg/appview/routes/routes.go +++ b/pkg/appview/routes/routes.go @@ -87,6 +87,21 @@ func RegisterUIRoutes(router chi.Router, deps UIDependencies) { }, ).ServeHTTP) + // Legal pages (public) + router.Get("/privacy", middleware.OptionalAuth(deps.SessionStore, deps.Database)( + &uihandlers.PrivacyPolicyHandler{ + Templates: deps.Templates, + RegistryURL: registryURL, + }, + ).ServeHTTP) + + router.Get("/terms", middleware.OptionalAuth(deps.SessionStore, deps.Database)( + &uihandlers.TermsOfServiceHandler{ + Templates: deps.Templates, + RegistryURL: registryURL, + }, + ).ServeHTTP) + // API route for repository stats (public, read-only) router.Get("/api/stats/{handle}/{repository}", middleware.OptionalAuth(deps.SessionStore, deps.Database)( &uihandlers.GetStatsHandler{ diff --git a/pkg/appview/static/css/style.css b/pkg/appview/static/css/style.css index 9bf79c7..fcfff11 100644 --- a/pkg/appview/static/css/style.css +++ b/pkg/appview/static/css/style.css @@ -2477,3 +2477,134 @@ a.license-badge:hover { background-color: rgba(13, 108, 191, 0.15); color: #0d6cbf; } + +/* Legal Pages (Privacy Policy, Terms of Service) */ +.legal-page { + max-width: 800px; + margin: 0 auto; + padding: 2rem 1rem; +} + +.legal-page h1 { + font-size: 2rem; + margin-bottom: 0.5rem; + color: var(--fg); +} + +.legal-updated { + color: var(--secondary); + margin-bottom: 2rem; +} + +.legal-section { + margin: 2rem 0; + padding-bottom: 1.5rem; + border-bottom: 1px solid var(--border); +} + +.legal-section:last-child { + border-bottom: none; +} + +.legal-section h2 { + font-size: 1.5rem; + margin-bottom: 1rem; + color: var(--fg); +} + +.legal-section h3 { + font-size: 1.15rem; + margin: 1.5rem 0 0.75rem; + color: var(--fg); +} + +.legal-section p { + margin-bottom: 1rem; + line-height: 1.7; +} + +.legal-section ul, +.legal-section ol { + margin-bottom: 1rem; + padding-left: 2rem; +} + +.legal-section li { + margin-bottom: 0.5rem; + line-height: 1.6; +} + +.legal-section ul ul { + margin-top: 0.5rem; + margin-bottom: 0.5rem; +} + +.legal-section code { + background: var(--code-bg); + padding: 0.2rem 0.4rem; + border-radius: 3px; + font-family: "Monaco", "Menlo", monospace; + font-size: 0.9em; +} + +.legal-section a { + color: var(--primary); + text-decoration: underline; +} + +.legal-section a:hover { + color: var(--primary-dark); +} + +.legal-section table { + width: 100%; + border-collapse: collapse; + margin: 1rem 0; +} + +.legal-section table th, +.legal-section table td { + padding: 0.75rem 1rem; + border: 1px solid var(--border); + text-align: left; +} + +.legal-section table th { + background: var(--code-bg); + font-weight: 600; +} + +.legal-section table tr:nth-child(even) { + background: var(--hover-bg); +} + +.legal-disclaimer { + background: var(--code-bg); + padding: 1rem; + border-radius: 4px; + font-size: 0.95rem; + margin: 1rem 0; +} + +@media (max-width: 768px) { + .legal-page { + padding: 1rem 0.5rem; + } + + .legal-page h1 { + font-size: 1.5rem; + } + + .legal-section h2 { + font-size: 1.25rem; + } + + .legal-section table { + font-size: 0.85rem; + } + + .legal-section table th, + .legal-section table td { + padding: 0.5rem; + } +} diff --git a/pkg/appview/templates/pages/privacy.html b/pkg/appview/templates/pages/privacy.html new file mode 100644 index 0000000..12dfcd9 --- /dev/null +++ b/pkg/appview/templates/pages/privacy.html @@ -0,0 +1,266 @@ +{{ define "privacy" }} + + + + Privacy Policy - ATCR + {{ template "head" . }} + + + {{ template "nav" . }} + +
+
+

Privacy Policy - AT Container Registry (atcr.io)

+

Last updated: January 2025

+ +
+

Data We Collect and Store

+ +

Data Stored on Your PDS (Controlled by You)

+

When you use AT Container Registry, records are written to your Personal Data Server (PDS) under the io.atcr.* namespace. This data is stored on infrastructure you or your PDS hosting provider controls. We do not control this data, and its retention and deletion is governed by your PDS provider's policies.

+ +

Data Stored on Our Infrastructure

+ +

Layer Records: We maintain records on our own PDS that reference container image layers you publish. These records are public and link your AT Protocol identity (DID) to content-addressed SHA identifiers.

+ +

OCI Blobs: Container image layers are stored in our object storage (S3). These blobs are content-addressed and deduplicated—meaning identical layers uploaded by different users are stored only once.

+ +

Authentication Data:

+
    +
  • OAuth tokens obtained during sign-in
    • +
  • Web UI session tokens
    • +
  • Docker credential helper device tokens, including: +
      +
    • IP address
      • +
    • Device name
      • +
    • Token creation and last-used timestamps
      • +
    +
    • +
+ +

Cached PDS Data: We may cache data from your PDS in our database to improve performance and reduce load on your PDS. This cached data mirrors public information already stored on your PDS.

+ +

Server Logs: Our logs may include your handle, DID, IP address, timestamps, and actions performed. Logs are currently ephemeral but may be retained in the future for security and debugging purposes.

+
+ +
+

Data Sharing and Deduplication

+ +

OCI container images use content-addressable storage. When you push an image layer, it is identified by its cryptographic hash (SHA256). If another user pushes an identical layer, both users reference the same underlying blob. This is standard practice for container registries and enables efficient storage and distribution.

+ +

What this means for your data:

+
    +
  • Layer content is not uniquely "yours" if other users have pushed identical content
    • +
  • Public SHA references may be associated with your AT Protocol identity
    • +
  • Deleting your records does not delete blob data that other users also reference
    • +
+
+ +
+

Your Rights Under GDPR

+ +

If you are located in the European Economic Area (EEA), you have the following rights:

+ +

Right to Access

+

You may request a copy of all personal data we store about you. This includes:

+
    +
  • Layer records associated with your DID on our PDS
    • +
  • Server logs containing your handle, DID, IP address, or actions (if retained)
    • +
  • OAuth tokens, web UI sessions, and device tokens
    • +
  • Cached PDS data
    • +
  • List of registered devices (credential helper)
    • +
+

Note: Data stored on your own PDS is already under your control and accessible to you directly.

+ +

Right to Erasure ("Right to be Forgotten")

+

You may request deletion of your data via the account settings page. Due to our technical architecture, deletion works as follows:

+ +

Immediately deleted:

+
    +
  • Layer records on our PDS that reference your DID
    • +
  • OAuth tokens, web UI sessions, and device tokens
    • +
  • Cached PDS data
    • +
  • Server logs containing your identifiers (deleted or anonymized, if retained)
    • +
+ +

Deleted within 30 days:

+
    +
  • OCI blobs in our object storage that are no longer referenced by any user after your records are removed (via our orphan blob pruning process)
    • +
+ +

Cannot be deleted by us:

+
    +
  • Records stored on your own PDS (you control these, or your PDS provider does)
    • +
  • Blob data that is also referenced by other users (deduplicated content)
    • +
+ +

Optional: Delete AT Protocol Records

+

When deleting your account, you may optionally authorize us to delete io.atcr.* records from your PDS. This requires an active OAuth session and is optional because:

+
    +
  • Your PDS is controlled by you or your hosting provider, not us
    • +
  • You may delete these records yourself at any time
    • +
  • We have no ongoing obligation to manage data on infrastructure we do not control
    • +
+ +

Right to Rectification

+

You may update your data through normal use of the service. Data stored on your PDS is under your direct control.

+ +

Right to Data Portability

+

AT Protocol is designed for data portability. Your records are stored in an open, documented format on your PDS and can be exported or migrated at any time.

+ +

Right to Object / Restrict Processing

+

You may revoke our OAuth access at any time through your PDS provider's settings. This will prevent us from reading or writing records to your PDS.

+
+ +
+

Your Rights Under CCPA

+ +

If you are a California resident, you have the following rights under the California Consumer Privacy Act:

+ +

Right to Know

+

You may request disclosure of:

+
    +
  • The categories of personal information we collect
    • +
  • The purposes for which we use your personal information
    • +
  • The categories of third parties with whom we share your personal information
    • +
+ +

Right to Delete

+

You may delete your personal information via the account settings page, subject to the same technical limitations described in the GDPR section above. For data not accessible through self-service, we will respond to requests within 45 days, except where retention is necessary for:

+
    +
  • Completing the transaction for which the data was collected
    • +
  • Security and fraud prevention
    • +
  • Legal compliance
    • +
+ +

Right to Non-Discrimination

+

We will not discriminate against you for exercising your CCPA rights.

+ +

Categories of Personal Information Collected

+ + + + + + + + + + + + + + + + + + + + + + + + + +
CategoryExamplesCollected
IdentifiersDID, handle, IP address, device nameYes
Internet activityAccess logs, usage data, actions performedYes
GeolocationApproximate location via IPYes
+ +

We do not sell or share your personal information for cross-context behavioral advertising.

+
+ +
+

Data Retention

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Data TypeRetention Period
OAuth tokensUntil revoked or logout
Web UI session tokensUntil logout or expiration
Device tokens (credential helper)Until revoked by user
Cached PDS dataRefreshed periodically; deleted on account deletion
Server logsCurrently ephemeral; this policy will be updated if log retention is implemented
Layer records (our PDS)Until you request deletion
OCI blobsUntil no longer referenced (pruned monthly)
+
+ +
+

Important Notes on AT Protocol Architecture

+ +

AT Container Registry is built on the AT Protocol, which has a unique data architecture:

+ +
    +
  1. You control your data. Most data associated with your use of AT Container Registry is stored on your Personal Data Server (PDS), which you or your chosen provider controls.
    2. +
  2. Public by design. AT Protocol data is designed to be public and distributed. Records you create, including container image references, are publicly visible and may be replicated across the network.
    3. +
  3. Content-addressed storage. OCI blobs are identified by their cryptographic hash. This means blob data is inherently pseudonymous—it cannot be attributed to you without the corresponding records that reference it.
    4. +
  4. Deletion limitations. Because AT Protocol is distributed, we cannot guarantee that copies of public records have not been made by other participants in the network. We can only delete data on infrastructure we control.
    5. +
+
+ +
+

How to Exercise Your Rights

+ +

Self-Service (via Settings)

+

Most data management can be done directly through your account settings at atcr.io:

+
    +
  • Delete your data: Use the "Delete Account" button in settings. This will remove your layer records, cached data, and authentication tokens. You may also choose to have us delete io.atcr.* records from your PDS (requires active OAuth session).
    • +
  • Revoke device tokens: Manage and revoke credential helper devices in settings.
    • +
  • Update your data: Corrections happen through normal use of the service.
    • +
+ +

Contact Us

+

For requests we cannot fulfill through self-service, such as:

+
    +
  • Copies of server logs containing your data
    • +
  • Database records not exposed in the UI
    • +
  • Questions about this policy
    • +
+ +

Email: privacy@atcr.io

+ +

Please include your AT Protocol DID or handle so we can verify your identity.

+ +

We will respond to requests within 30 days (GDPR) or 45 days (CCPA).

+
+ +
+

Contact

+ +

For questions about this privacy policy or to exercise your data rights, contact:

+ +

Email: privacy@atcr.io

+

Website: https://atcr.io

+
+
+
+ + + + +{{ end }} diff --git a/pkg/appview/templates/pages/terms.html b/pkg/appview/templates/pages/terms.html new file mode 100644 index 0000000..4af0771 --- /dev/null +++ b/pkg/appview/templates/pages/terms.html @@ -0,0 +1,204 @@ +{{ define "terms" }} + + + + Terms of Service - ATCR + {{ template "head" . }} + + + {{ template "nav" . }} + +
+
+

Terms of Service - AT Container Registry (atcr.io)

+

Last updated: January 2025

+ +

These Terms of Service ("Terms") govern your use of AT Container Registry ("atcr.io", "the Service", "we", "us", "our"). By using the Service, you agree to these Terms. If you do not agree, do not use the Service.

+ +
+

1. Description of Service

+

AT Container Registry is an OCI-compatible container registry built on the AT Protocol. The Service allows you to store, distribute, and manage container images using your AT Protocol identity.

+
+ +
+

2. Accounts and Access

+ +

2.1 AT Protocol Identity

+

Access to the Service requires an AT Protocol identity (DID). You are responsible for maintaining the security of your PDS credentials and any device tokens issued by the Service.

+ +

2.2 Account Responsibility

+

You are responsible for all activity under your account, whether authorized by you or not. Notify us immediately if you suspect unauthorized access.

+ +

2.3 Age Requirement

+

You must be at least 13 years old to use the Service. If you are under 18, you must have permission from a parent or legal guardian.

+
+ +
+

3. Acceptable Use

+ +

You agree NOT to use the Service to:

+
    +
  • Store or distribute malware, viruses, or malicious code
    • +
  • Store or distribute illegal content under applicable law
    • +
  • Infringe on intellectual property rights of others
    • +
  • Store content you do not have the right to distribute
    • +
  • Circumvent or abuse usage quotas or rate limits
    • +
  • Interfere with or disrupt the Service or its infrastructure
    • +
  • Use the Service for cryptocurrency mining or similarly resource-intensive activities unrelated to container distribution
    • +
  • Impersonate others or misrepresent your affiliation with any person or entity
    • +
+ +

We reserve the right to determine what constitutes a violation of these terms.

+
+ +
+

4. Content and Intellectual Property

+ +

4.1 Your Content

+

You retain ownership of container images and other content you upload to the Service. By uploading content, you grant us a license to store, cache, and distribute that content as necessary to operate the Service.

+ +

4.2 Content-Addressed Storage

+

The Service uses content-addressed, deduplicated storage. Identical image layers uploaded by different users are stored once and shared. This means:

+
    +
  • You cannot delete blob data that is also referenced by other users
    • +
  • Blob data alone cannot identify you; only the associated records link content to your identity
    • +
+ +

4.3 Public Data

+

AT Protocol records are public by design. Container image references, tags, and metadata associated with your identity are publicly visible. Do not store sensitive information in image tags, labels, or other public metadata.

+ +

4.4 Content Removal

+

We may remove content that violates these Terms or applicable law. We may also remove content in response to valid legal requests.

+
+ +
+

5. Usage Quotas and Limits

+ +

5.1 Free Tier

+

The Service offers a free tier subject to usage quotas. These quotas may include limits on storage, bandwidth, or number of repositories. Current quotas are published in your account settings.

+ +

5.2 Quota Changes

+

We may adjust free tier quotas at any time. We will make reasonable efforts to notify users of significant changes, but continued use after changes constitutes acceptance.

+ +

5.3 Paid Tiers

+

Paid tiers with higher quotas may be offered in the future. Paid tier terms will be provided at the time of purchase.

+
+ +
+

6. Service Availability

+ +

6.1 No SLA for Free Tier

+

The free tier is provided on a best-effort basis. We make no guarantees regarding uptime, availability, or performance. The Service may be unavailable due to maintenance, infrastructure issues, or resource constraints.

+ +

6.2 Service Changes

+

We may modify, suspend, or discontinue the Service (or any part of it) at any time, with or without notice. We are not liable to you or any third party for any modification, suspension, or discontinuation.

+ +

6.3 Data Durability

+

While we take reasonable measures to protect your data, we do not guarantee data durability. You are responsible for maintaining backups of your container images.

+
+ +
+

7. AT Protocol Considerations

+ +

7.1 Distributed Architecture

+

The Service operates on the AT Protocol, a distributed network. Data written to your PDS is controlled by you or your PDS hosting provider, not by us.

+ +

7.2 Records on Your PDS

+

When you use the Service, records are written to your PDS under the io.atcr.* namespace. We can create, update, and delete these records only while you have granted us OAuth access. Revoking access does not automatically delete existing records.

+ +

7.3 No Control Over Your PDS

+

We do not control your PDS. If your PDS is offline or your PDS provider terminates your account, we cannot restore your AT Protocol records.

+
+ +
+

8. Termination

+ +

8.1 By You

+

You may stop using the Service at any time. To delete your data, use the account deletion option in settings or contact us.

+ +

8.2 By Us

+

We may suspend or terminate your access to the Service at any time, for any reason, including but not limited to:

+
    +
  • Violation of these Terms
    • +
  • Abuse of the Service or its infrastructure
    • +
  • Extended inactivity
    • +
  • Legal requirements
    • +
+ +

8.3 Effect of Termination

+

Upon termination, we will delete your data in accordance with our Privacy Policy. Deduplicated blob data referenced by other users will not be deleted.

+
+ +
+

9. Disclaimer of Warranties

+ +

THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT.

+ +

WE DO NOT WARRANT THAT THE SERVICE WILL BE UNINTERRUPTED, ERROR-FREE, OR SECURE. WE DO NOT WARRANT THAT ANY DEFECTS WILL BE CORRECTED.

+
+ +
+

10. Limitation of Liability

+ +

TO THE MAXIMUM EXTENT PERMITTED BY LAW, WE SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, INCLUDING BUT NOT LIMITED TO LOSS OF PROFITS, DATA, OR GOODWILL, ARISING OUT OF OR RELATED TO YOUR USE OF THE SERVICE.

+ +

OUR TOTAL LIABILITY FOR ANY CLAIM ARISING OUT OF OR RELATED TO THESE TERMS OR THE SERVICE SHALL NOT EXCEED THE AMOUNT YOU PAID US IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM, OR $50 USD, WHICHEVER IS GREATER.

+
+ +
+

11. Indemnification

+ +

You agree to indemnify and hold harmless AT Container Registry, its operators, and affiliates from any claims, damages, losses, or expenses (including reasonable legal fees) arising out of:

+
    +
  • Your use of the Service
    • +
  • Your violation of these Terms
    • +
  • Your violation of any third-party rights
    • +
  • Content you upload to the Service
    • +
+
+ +
+

12. Changes to Terms

+ +

We may update these Terms from time to time. If we make material changes, we will notify you by posting the updated Terms and updating the "Last updated" date. Your continued use of the Service after changes constitutes acceptance of the new Terms.

+
+ +
+

13. Governing Law

+ +

These Terms shall be governed by and construed in accordance with the laws of the State of Texas, United States, without regard to conflict of law principles.

+
+ +
+

14. Dispute Resolution

+ +

Any disputes arising out of or relating to these Terms or the Service shall first be attempted to be resolved through good-faith negotiation. If negotiation fails, disputes shall be resolved through binding arbitration or in the courts of Texas, at our discretion.

+
+ +
+

15. Severability

+ +

If any provision of these Terms is found to be unenforceable, the remaining provisions shall remain in full force and effect.

+
+ +
+

16. Entire Agreement

+ +

These Terms, together with our Privacy Policy, constitute the entire agreement between you and AT Container Registry regarding your use of the Service.

+
+ +
+

Contact

+ +

For questions about these Terms, contact us at:

+ +

Email: legal@atcr.io

+

Website: https://atcr.io

+
+
+
+ + + + +{{ end }}