Dissolve plan.md into docs/, move open work to Gitea issues

docs/recht.md

@@ -0,0 +1,36 @@
+# Legal — imprint, privacy, photos
+
+Not legal advice — but the points where school sites regularly get flagged. The
+actual imprint and privacy texts live in `Content/pages/impressum.md` and
+`Content/pages/datenschutz.md`; filling them in with released, real data is tracked
+in `tasks/003-echte-inhalte-vor-go-live.md`.
+
+## Imprint (§ 5 DDG)
+
+If the Elternbeirat has no legal form of its own, the operator is listed personally
+in the imprint with name and a valid postal address for service. This is a decision,
+not a formality — the private address becomes public. Alternative: the school's
+address, but only with its explicit consent and if the school is a co-operator.
+
+## Privacy policy
+
+With the move, Tom becomes the controller in the sense of the GDPR. Name the server
+logs with IP addresses, define the legal basis and the deletion period.
+
+## No external resources
+
+Google Fonts, Maps, YouTube embeds, and CDN scripts transmit visitors' IPs to third
+parties. Fonts are served by ourselves. This is the reason behind the "no external
+resources" rule in `CLAUDE.md` — data protection, not taste.
+
+## Photos of children
+
+Only with the consent of the legal guardians — by far the most common mistake on
+school sites. When in doubt, no photos of people. Note: the old WordPress backup
+contained no own images anyway (only URLs in the database), so any photo used is a
+fresh, consciously released one.
+
+## Hosting on a private connection
+
+The public IP of the private connection appears in the DNS of a school site. A
+deliberate decision, not a side effect.