2.0 KiB
Legal — imprint, privacy, photos
Not legal advice — but the points where school sites regularly get flagged. The
actual imprint and privacy texts are pages records in PocketBase (slugs
imprint and privacy), edited in the admin UI — see redaktion.md. Filling
them in with released, real data before go-live is tracked as a Gitea issue
(milestone „Elternbeirat-Website").
Imprint (§ 5 DDG)
If the Elternbeirat has no legal form of its own, the operator is listed personally in the imprint with name and a valid postal address for service. This is a decision, not a formality — the private address becomes public. Alternative: the school's address, but only with its explicit consent and if the school is a co-operator.
Privacy policy
With the move, Tom becomes the controller in the sense of the GDPR. Name the server logs with IP addresses, define the legal basis and the deletion period.
No external resources
Google Fonts, Maps, YouTube embeds, and CDN scripts transmit visitors' IPs to third
parties. Fonts are served by ourselves. This is the reason behind the "no external
resources" rule in CLAUDE.md — data protection, not taste.
The site font is Nunito (SIL Open Font License 1.1), self-hosted under
wwwroot/fonts/ with its license file OFL.txt next to it, as the OFL requires.
The icons are Lucide (ISC, partly MIT via Feather), inlined as SVG in
Shared/IconSet.cs with the license notice in its comment. A smoke test fails if
the stylesheet or the home page loads anything from an absolute URL.
Photos of children
Only with the consent of the legal guardians — by far the most common mistake on school sites. When in doubt, no photos of people. Note: the old WordPress backup contained no own images anyway (only URLs in the database), so any photo used is a fresh, consciously released one.
Hosting on a private connection
The public IP of the private connection appears in the DNS of a school site. A deliberate decision, not a side effect.