[fleizean]

Summary

Removes Google Analytics, leaves Cloudflare Web Analytics (cookieless) as the only traffic measurement, and rewrites the privacy, cookie and terms pages so they describe what pkgdiff actually processes.

Why

GA4 was loaded on every page before the visitor made any choice, and "Decline" on the banner did not stop it. It set _ga cookies and sent IP addresses to Google, while the banner said "No third-party cookies or tracking" and the cookie policy said "We do not use analytics". For EU visitors that is tracking without consent (ePrivacy/GDPR) and a misleading statement; under KVKK it is an undisclosed transfer abroad.

The privacy policy also lacked what GDPR Art. 13 and the KVKK disclosure duty require: who the controller is, the legal basis, concrete retention periods, and the recipients of the data.

Changes

• Delete AnalyticsService, the gaId environment setting and the Google domains in the CSP; the Cloudflare Web Analytics beacon was already allowed.
• Privacy policy: controller, per-purpose data description (request logs with IP + user agent, search data with IP, rate-limit counters, IP blocks, analytics, admin accounts, email), legal basis (GDPR Art. 6(1)(f), KVKK Art. 5(2)(f)), a retention table matching the code (request logs 30 days, search data 90 days, backups 14 days, temporary blocks until expiry), processors (Cloudflare, hosting, Google Fonts, GitHub) and transfers, the full rights list including a complaint to the KVKK Authority or an EU DPA, security, children.
• Cookie policy: lists every browser storage key (adds lastSelectedRegistry and the admin-only LinkedIn OAuth state), explains that Cloudflare Web Analytics is cookieless.
• Consent banner becomes a one-button notice: nothing left on the site needs consent, so Accept/Decline offered a choice that did nothing. The storage key is unchanged, so visitors who already answered do not see it again.
• Terms: lists PyPI and pub.dev, names the MIT License, adds a contact path for content owners who want something corrected or removed.

Notes for reviewers

• Confirm that Cloudflare Web Analytics is enabled for pkgdiff.dev (Cloudflare dashboard > Analytics & Logs > Web Analytics, automatic setup). Without it, the site now has no traffic analytics at all.
• The Google Analytics property can be deleted once this is deployed.
• The privacy policy names the controller as "Enes Yağız, based in Türkiye" (privacy.ts). Adjust if that is not right.
• Google Fonts is disclosed rather than removed. Self-hosting the fonts would take one more third party out of the picture; left for a follow-up.
• Not built or tested locally; CI is the check.

Checklist

• The pull request targets develop and is about one thing
• Commit messages follow Conventional Commits (feat(scope): ..., fix(scope): ...)
• CI is green (backend tests, frontend build and tests, dependency gate)
• Schema changes are EF Core migrations generated by the tool, not hand-edited
• A changed backend DTO has its TypeScript twin updated in src/frontend/src/app/core/models
• New dependencies are justified and their lock files are updated in the same commit
• No secrets, tokens or personal data in code, logs or this description
• Code comments are kept to a minimum; the reasoning lives in this description