edgepress 2026.9.6 → 2026.9.10

package/README.md

@@ -63,10 +63,10 @@ Posts under content/posts/ use the Markdown renderer. Themes own shared head, na
 
 The only persisted page-audit report is the accessible PDF at tools/page-check.pdf. Desktop and mobile screenshots are embedded in the PDF and removed from temporary storage afterward. Automated checks do not replace manual accessibility or legal review.
 
-The main navigation includes a Posts entry to the localized article archive. The header search page filters Markdown posts from the generated local search index; it does not send search queries to an external service. Article pages show a linked table of contents and code blocks have accessible copy buttons. The first post, “EdgePress and Markdown: a complete writing guide,” documents and verifies the supported Markdown syntax in English and Chinese.
+The main navigation includes a Posts entry to the localized article archive. The header search page filters Markdown posts from the generated local search index; it does not send search queries to an external service. Long articles show a floating, scroll-aware table of contents, and code blocks have accessible copy buttons. The first post, “EdgePress and Markdown: a complete writing guide,” documents and verifies the supported Markdown syntax in English and Chinese.
 
-Project guides are published from content/pages/: project introduction, quick start, theme development, plugin development, and privacy policy. The starter config uses `https://edgepress.js.gripe` and credits `toewpq`; the privacy policy still reports that its real operator name and working privacy contact must be added before publication.
+Project guides are published from content/pages/: project introduction, quick start, theme development, plugin development, and privacy policy. The starter config uses `https://edgepress.js.gripe` and credits `toewpq`. Before production use, confirm that the configured operator name identifies the responsible person or organization and complete any applicable representative or data protection officer details.
 
-Version 2026.9.6 records the sixth requested release update for September 2026. It is available as the `edgepress` npm package. See the [request 1 notes](content/posts/2026-09-24-edgepress-release-2026-9-1/), [request 2 notes](content/posts/2026-09-25-edgepress-release-2026-9-2/), [request 3 notes](content/posts/2026-09-25-edgepress-release-2026-9-3/), [request 4 notes](content/posts/2026-09-25-edgepress-release-2026-9-4/), [request 5 notes](content/posts/2026-09-25-edgepress-release-2026-9-5/), and [request 6 notes](content/posts/2026-09-25-edgepress-release-2026-9-6/).
+Version 2026.9.10 records the tenth requested release update for September 2026. See the [request 1 notes](content/posts/2026-09-24-edgepress-release-2026-9-1/), [request 2 notes](content/posts/2026-09-25-edgepress-release-2026-9-2/), [request 3 notes](content/posts/2026-09-25-edgepress-release-2026-9-3/), [request 4 notes](content/posts/2026-09-25-edgepress-release-2026-9-4/), [request 5 notes](content/posts/2026-09-25-edgepress-release-2026-9-5/), [request 6 notes](content/posts/2026-09-25-edgepress-release-2026-9-6/), [request 7 notes](content/posts/2026-09-26-edgepress-release-2026-9-7/), [request 8 notes](content/posts/2026-09-26-edgepress-release-2026-9-8/), [request 9 notes](content/posts/2026-09-26-edgepress-release-2026-9-9/), and [request 10 notes](content/posts/2026-09-27-edgepress-release-2026-9-10/).
 
-The release also adds shared icons, EdgePress brand artwork, paginated homepage post lists, and article author bylines. See [CHANGELOG.txt](CHANGELOG.txt) for the complete entry.
+This release keeps privacy choices across locale changes, adds localized page-block links, improves article tag links, loads search code only on search pages, redraws two SVG icons, and simplifies privacy wording. Optional services remain disabled until a visitor makes an explicit choice.

package/config.yml

@@ -84,68 +84,126 @@ privacy:
 plugins:
   consent:
     enabled: true
-    version: "1"
+    # Drafting date; set effectiveDate when a revised notice takes effect.
+    proposedDate: "2026-09-26"
+    effectiveDate: "2026-09-26"
     expiresDays: 180
-  tracking:
-    enabled: true
-    services: []
-    # Example:
-    # - id: tag-manager
-    #   provider: google-tag-manager
-    #   purpose: Load consented campaign tags.
-    #   retention: Set and disclose the applicable retention period.
-    #   containerId: GTM-ABCD123
-    # - id: social-pixel
-    #   provider: meta-pixel
-    #   purpose: Measure consented campaign traffic.
-    #   retention: Set and disclose the provider's retention period.
-    #   pixelId: "123456789012345"
-  statistics:
-    enabled: true
-    services: []
-    # Examples use public provider IDs only.
-    # - id: primary-analytics
-    #   provider: google-analytics
-    #   purpose: Measure consented site visits.
-    #   retention: Set and disclose the provider's retention period.
-    #   measurementId: G-ABC12345
-    # - id: edge-analytics
-    #   provider: cloudflare-web-analytics
-    #   purpose: Measure consented site visits.
-    #   retention: Set and disclose the applicable retention period.
-    #   token: 01234567-89ab-cdef-0123-456789abcdef
-    # - id: baidu-analytics
-    #   provider: baidu-tongji
-    #   purpose: Measure consented site visits.
-    #   retention: Set and disclose the provider's retention period.
-    #   siteId: abcdef0123456789abcdef01
-  advertising:
-    enabled: true
-    services: []
-    # Example:
-    # - id: display-ads
-    #   provider: google-adsense
-    #   purpose: Display consented advertising.
-    #   retention: Set and disclose the provider's retention period.
-    #   clientId: ca-pub-1234567890123456
-  captcha:
-    enabled: true
-    services: []
-    # Choose a provider for each CAPTCHA block. Never add its secret key here.
-    # - id: contact-form-check
-    #   provider: cloudflare-turnstile
-    #   purpose: Reduce automated contact form submissions.
-    #   retention: Configure and disclose the provider's retention period.
-    #   siteKey: 0x4AAAAAAABBBBBBBBCCCCCCDDDD
-    # - id: signup-form-check
-    #   provider: google-recaptcha
-    #   purpose: Reduce automated signup submissions.
-    #   retention: Configure and disclose the provider's retention period.
-    #   siteKey: 6LcAbCdEfGhIjKlMnOpQrStUvWxYz0123456789a
-    # - id: support-form-check
-    #   provider: hcaptcha
-    #   purpose: Reduce automated support requests.
-    #   retention: Configure and disclose the provider's retention period.
-    #   siteKey: 0123456789abcdefghijklmnopqrstuvwx
-# Add browser services under these groups after filling the real site operator details above.
-# Every configured service waits for the visitor's explicit consent before its vendor code loads.
+    tracking:
+      enabled: true
+      services: []
+      # Example:
+      # - id: tag-manager
+      #   provider: google-tag-manager
+      #   name: { en: Google Tag Manager, zh-CN: Google 跟踪代码管理器 }
+      #   purpose: { en: Load campaign tags after consent., zh-CN: 经同意后加载营销标签。 }
+      #   dataCategories: { en: Describe data sent by this container., zh-CN: 填写此容器发送的数据类别。 }
+      #   recipient: { en: Google LLC, zh-CN: Google LLC }
+      #   retention: { en: Configure the retention period., zh-CN: 填写适用的数据保留期限。 }
+      #   privacyUrl: https://policies.google.com/privacy
+      #   containerId: GTM-ABCD123
+      # - id: social-pixel
+      #   provider: meta-pixel
+      #   name: { en: Meta Pixel, zh-CN: Meta Pixel }
+      #   purpose: { en: Measure campaign traffic after consent., zh-CN: 经同意后衡量营销流量。 }
+      #   dataCategories: { en: Describe data sent by this pixel., zh-CN: 填写此像素发送的数据类别。 }
+      #   recipient: { en: Meta Platforms, Inc., zh-CN: Meta Platforms, Inc. }
+      #   retention: { en: Configure the provider's retention period., zh-CN: 填写供应商的数据保留期限。 }
+      #   privacyUrl: https://www.facebook.com/privacy/policy/
+      #   pixelId: "123456789012345"
+    statistics:
+      enabled: true
+      services:
+        - id: cloudflare-web-analytics
+          provider: cloudflare-web-analytics
+          name:
+            en: Cloudflare Web Analytics
+            zh-CN: Cloudflare 网站分析
+          purpose:
+            en: Measure page views and page-load performance after consent.
+            zh-CN: 经访客同意后衡量页面浏览量和页面加载性能。
+          dataCategories:
+            en: Performance timing and page-view metrics; dimensions can include path, referrer, device, browser, operating system, and country. Cloudflare receives the beacon request's source IP and says it discards it at the nearest data center without storing it in core databases or logs.
+            zh-CN: 性能计时和页面浏览指标，维度可能包括页面路径、来源页、设备、浏览器、操作系统和国家或地区。Cloudflare 会在信标请求中接收来源 IP，并表示会在最近的数据中心将其丢弃，不保存到核心数据库或日志中。
+          recipient:
+            en: Cloudflare, Inc.
+            zh-CN: Cloudflare, Inc.
+          retention:
+            en: Unsampled beacon data is kept for 7 days, then aggregated to about 10% for long-term storage. Dashboard history is available for 6 months.
+            zh-CN: 未采样的信标数据保留 7 天，之后会汇总为约 10% 的长期数据。仪表板可查看最近 6 个月的历史记录。
+          privacyUrl: https://developers.cloudflare.com/speed/observatory/rum-beacon/
+          token: "8347d72ba9f84e6783bf441e7832a80e"
+      # Examples use public provider IDs only.
+      # - id: primary-analytics
+      #   provider: google-analytics
+      #   name: { en: Google Analytics, zh-CN: Google Analytics }
+      #   purpose: { en: Measure site visits after consent., zh-CN: 经访客同意后衡量网站访问情况。 }
+      #   dataCategories: { en: Describe the data processed by this property., zh-CN: 填写此媒体资源处理的数据类别。 }
+      #   recipient: { en: Google LLC, zh-CN: Google LLC }
+      #   retention: { en: Configure the provider's retention period., zh-CN: 填写供应商的数据保留期限。 }
+      #   privacyUrl: https://policies.google.com/privacy
+      #   measurementId: G-ABC12345
+      # - id: edge-analytics
+      #   provider: cloudflare-web-analytics
+      #   name: { en: Cloudflare Web Analytics, zh-CN: Cloudflare 网站分析 }
+      #   purpose: { en: Measure site visits after consent., zh-CN: 经访客同意后衡量网站访问情况。 }
+      #   dataCategories: { en: Describe the data processed by this site., zh-CN: 填写此站点处理的数据类别。 }
+      #   recipient: { en: Cloudflare, Inc., zh-CN: Cloudflare, Inc. }
+      #   retention: { en: Configure the retention period., zh-CN: 填写数据保留期限。 }
+      #   privacyUrl: https://developers.cloudflare.com/speed/observatory/rum-beacon/
+      #   token: 01234567-89ab-cdef-0123-456789abcdef
+      # - id: baidu-analytics
+      #   provider: baidu-tongji
+      #   name: { en: Baidu Tongji, zh-CN: 百度统计 }
+      #   purpose: { en: Measure site visits after consent., zh-CN: 经访客同意后衡量网站访问情况。 }
+      #   dataCategories: { en: Describe data sent to this site ID., zh-CN: 填写此站点编号接收的数据类别。 }
+      #   recipient: { en: Baidu, Inc., zh-CN: 百度 }
+      #   retention: { en: Configure the provider's retention period., zh-CN: 填写供应商的数据保留期限。 }
+      #   privacyUrl: https://privacy.baidu.com/policy.html
+      #   siteId: abcdef0123456789abcdef01
+    advertising:
+      enabled: true
+      services: []
+      # Example:
+      # - id: display-ads
+      #   provider: google-adsense
+      #   name: { en: Google AdSense, zh-CN: Google AdSense }
+      #   purpose: { en: Display ads after consent., zh-CN: 经访客同意后展示广告。 }
+      #   dataCategories: { en: Describe the data processed for ad delivery., zh-CN: 填写广告投放处理的数据类别。 }
+      #   recipient: { en: Google LLC, zh-CN: Google LLC }
+      #   retention: { en: Configure the provider's retention period., zh-CN: 填写供应商的数据保留期限。 }
+      #   privacyUrl: https://policies.google.com/privacy
+      #   clientId: ca-pub-1234567890123456
+    captcha:
+      enabled: true
+      services: []
+      # Choose a provider for each CAPTCHA block. Never add its secret key here.
+      # - id: contact-form-check
+      #   provider: cloudflare-turnstile
+      #   name: { en: Cloudflare Turnstile, zh-CN: Cloudflare Turnstile }
+      #   purpose: { en: Reduce automated contact form submissions., zh-CN: 减少联系表单中的自动化提交。 }
+      #   dataCategories: { en: Describe challenge and response data., zh-CN: 填写验证挑战和响应处理的数据类别。 }
+      #   recipient: { en: Cloudflare, Inc., zh-CN: Cloudflare, Inc. }
+      #   retention: { en: Configure the provider's retention period., zh-CN: 填写供应商的数据保留期限。 }
+      #   privacyUrl: https://www.cloudflare.com/privacypolicy/
+      #   siteKey: 0x4AAAAAAABBBBBBBBCCCCCCDDDD
+      # - id: signup-form-check
+      #   provider: google-recaptcha
+      #   name: { en: Google reCAPTCHA, zh-CN: Google reCAPTCHA }
+      #   purpose: { en: Reduce automated signup submissions., zh-CN: 减少注册表单中的自动化提交。 }
+      #   dataCategories: { en: Describe challenge and response data., zh-CN: 填写验证挑战和响应处理的数据类别。 }
+      #   recipient: { en: Google LLC, zh-CN: Google LLC }
+      #   retention: { en: Configure the provider's retention period., zh-CN: 填写供应商的数据保留期限。 }
+      #   privacyUrl: https://policies.google.com/privacy
+      #   siteKey: 6LcAbCdEfGhIjKlMnOpQrStUvWxYz0123456789a
+      # - id: support-form-check
+      #   provider: hcaptcha
+      #   name: { en: hCaptcha, zh-CN: hCaptcha }
+      #   purpose: { en: Reduce automated support requests., zh-CN: 减少自动化的支持请求。 }
+      #   dataCategories: { en: Describe challenge and response data., zh-CN: 填写验证挑战和响应处理的数据类别。 }
+      #   recipient: { en: Intuition Machines, Inc., zh-CN: Intuition Machines, Inc. }
+      #   retention: { en: Configure the provider's retention period., zh-CN: 填写供应商的数据保留期限。 }
+      #   privacyUrl: https://www.hcaptcha.com/privacy
+      #   siteKey: 0123456789abcdefghijklmnopqrstuvwx
+# Add browser services under plugins.consent after filling the real site operator details above.
+# Every configured service needs a privacyUrl linking to the provider's current privacy information.
+# Each service waits for explicit visitor consent before its vendor code loads.

package/content/pages/home/en.md

@@ -17,8 +17,16 @@ blocks:
           eyebrow: A project built for the edge
           title: Build a fast website from clear, editable source files.
           text: EdgePress turns Markdown posts, page layouts, themes, and consent-aware integrations into a static site served by Cloudflare Workers.
-          mascotSrc: /edgepress/brand/mascot.png
+          mascotSrc: /edgepress/brand/mascot-418.png
           mascotAlt: A curious sparrow folded from layered paper pages, EdgePress's project mascot.
+          mascotWidth: 418
+          mascotHeight: 440
+          mascotSizes: 209px
+          mascotWebpSrcset:
+            - src: /edgepress/brand/mascot-209.webp
+              width: 209
+            - src: /edgepress/brand/mascot-418.webp
+              width: 418
           cta:
             label: Start with the quick guide
             url: /quick-start/

package/content/pages/home/zh-cn.md

@@ -17,11 +17,19 @@ blocks:
           eyebrow: 为边缘网络构建
           title: 用清晰、可编辑的源文件构建快速网站。
           text: EdgePress 将 Markdown 文章、页面布局、主题和遵循同意状态的集成构建为由 Cloudflare Workers 提供服务的静态网站。
-          mascotSrc: /edgepress/brand/mascot.png
+          mascotSrc: /edgepress/brand/mascot-418.png
           mascotAlt: EdgePress 吉祥物，一只由层叠折页构成、神情好奇的小鸟。
+          mascotWidth: 418
+          mascotHeight: 440
+          mascotSizes: 209px
+          mascotWebpSrcset:
+            - src: /edgepress/brand/mascot-209.webp
+              width: 209
+            - src: /edgepress/brand/mascot-418.webp
+              width: 418
           cta:
             label: 从快速入门开始
-            url: /quick-start/
+            url: /[launge]/quick-start/
           highlights:
             - 在本地化 Markdown 前置数据中编辑页面
             - 使用 Markdown 撰写文章
@@ -35,19 +43,19 @@ blocks:
             - title: 页面使用可编辑元素
               icon: layout-grid
               text: 先设置栏数，再选择元素类型，并在各页面文件中编辑对应内容。
-              url: /theme-development/
+              url: /[launge]/theme-development/
             - title: 文章使用 Markdown
               icon: file-text
               text: 使用 Markdown 撰写长文，由内置渲染器进行清理和排版。
-              url: /project-introduction/
+              url: /[launge]/project-introduction/
             - title: 主题负责视觉设计
               icon: palette
               text: 使用 HTML 局部模板构建布局，并将各主题的配色保留在样式表中。
-              url: /theme-development/
+              url: /[launge]/theme-development/
             - title: 集成遵循用户同意
               icon: shield-check
               text: 配置跟踪、统计、广告或人机验证服务及其供应商信息。
-              url: /plugin-development/
+              url: /[launge]/plugin-development/
   - columns: 2
     cells:
       -
@@ -62,9 +70,9 @@ blocks:
               title: 项目指南
               items:
                 - label: 项目介绍
-                  url: /project-introduction/
+                  url: /[launge]/project-introduction/
                 - label: 快速入门
-                  url: /quick-start/
+                  url: /[launge]/quick-start/
       -
         - type: section
           title: 扩展项目
@@ -78,9 +86,9 @@ blocks:
               title: 开发指南
               items:
                 - label: 主题开发
-                  url: /theme-development/
+                  url: /[launge]/theme-development/
                 - label: 插件开发
-                  url: /plugin-development/
+                  url: /[launge]/plugin-development/
   - columns: 1
     cells:
       -

package/content/pages/plugin-development/en.md

@@ -43,9 +43,10 @@ blocks:
           blocks:
             - type: text
               paragraphs:
-                - Add browser providers in config.yml under plugins.tracking, plugins.statistics, plugins.advertising, or plugins.captcha. Each entry needs a unique ID, purpose, retention description, and a public provider identifier.
+                - Add browser providers in config.yml under plugins.consent.tracking, plugins.consent.statistics, plugins.consent.advertising, or plugins.consent.captcha. Each service needs a unique ID, provider, purpose, dataCategories, recipient, retention, a privacyUrl pointing to the provider's current privacy information, and its public site identifier. privacyUrl must be an HTTPS URL. Localized fields are maps keyed by every enabled locale, such as en and zh-CN.
                 - Available providers include Google Tag Manager and Meta Pixel; Cloudflare Web Analytics, Google Analytics, and Baidu Tongji; Google AdSense; and Cloudflare Turnstile, Google reCAPTCHA, and hCaptcha.
-                - Provider code is imported only after the visitor accepts that integration. Keep CAPTCHA secret keys out of config.yml and client code. The server must submit each CAPTCHA response to the provider verification API before accepting a form.
+                - Set plugins.consent.proposedDate to the YYYY-MM-DD date the notice was drafted. Set effectiveDate when the notice takes effect; omit it while no effective date has been set. Updating either date makes saved consent stale, so visitors are asked again.
+                - Provider code is imported only after the visitor accepts that integration. The first layer offers accept and reject together; service data and individual switches are available in its details. Keep CAPTCHA secret keys out of config.yml and client code. The server must submit each CAPTCHA response to the provider verification API before accepting a form.
             - type: notice
               title: Operator details
               text: Fill privacy.controller.name, privacy.controller.contact, and privacy.policyUrl before configuring any browser provider. The build rejects provider services when the controller name or contact is blank.
@@ -85,8 +86,8 @@ blocks:
               items:
                 - label: Cloudflare Turnstile Siteverify
                   url: https://developers.cloudflare.com/turnstile/get-started/server-side-validation/
-                - label: Consent guidelines from the EDPB
-                  url: https://www.edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_202005_consent_en.pdf
+                - label: EDPB consent summary
+                  url: https://www.edpb.europa.eu/system/files/2026-04/edpb-summary-consent_en.pdf
   - columns: 1
     cells:
       -

package/content/pages/plugin-development/zh-cn.md

@@ -43,9 +43,10 @@ blocks:
           blocks:
             - type: text
               paragraphs:
-                - 在 config.yml 的 plugins.tracking、plugins.statistics、plugins.advertising 或 plugins.captcha 下添加浏览器供应商。每项需要唯一 ID、用途、保留期限说明和公开供应商标识。
+                - 在 config.yml 的 plugins.consent.tracking、plugins.consent.statistics、plugins.consent.advertising 或 plugins.consent.captcha 下添加浏览器供应商。每项需要唯一 ID、provider、purpose、dataCategories、recipient、retention、指向供应商当前隐私说明的 privacyUrl，以及公开站点标识。privacyUrl 必须是 HTTPS 地址。多语言字段需使用语言映射，覆盖已启用的每种语言，例如 en 与 zh-CN。
                 - 可用供应商包括 Google Tag Manager 和 Meta Pixel；Cloudflare Web Analytics、Google Analytics 和百度统计；Google AdSense；以及 Cloudflare Turnstile、Google reCAPTCHA 和 hCaptcha。
-                - 只有访客接受对应集成后才会导入供应商代码。不要把 CAPTCHA 密钥放入 config.yml 或客户端代码。服务器必须在接受表单前将每个 CAPTCHA 响应提交给供应商验证 API。
+                - plugins.consent.proposedDate 必须设置为 YYYY-MM-DD 格式的告知拟定日期。告知生效后再设置 effectiveDate；尚未生效时可以省略。修改任一日期都会使旧的同意记录失效，并重新询问访客。
+                - 只有访客接受对应集成后才会导入供应商代码。首层同时提供接受和拒绝，数据详情与逐项开关位于展开内容中。不要把 CAPTCHA 密钥放入 config.yml 或客户端代码。服务器必须在接受表单前将每个 CAPTCHA 响应提交给供应商验证 API。
             - type: notice
               title: 运营者信息
               text: 配置浏览器供应商前，请填写 privacy.controller.name、privacy.controller.contact 和 privacy.policyUrl。控制者名称或联系方式为空时，构建器会拒绝启用供应商服务。
@@ -85,8 +86,8 @@ blocks:
               items:
                 - label: Cloudflare Turnstile Siteverify
                   url: https://developers.cloudflare.com/turnstile/get-started/server-side-validation/
-                - label: EDPB 同意指南
-                  url: https://www.edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_202005_consent_en.pdf
+                - label: EDPB 同意摘要
+                  url: https://www.edpb.europa.eu/system/files/2026-04/edpb-summary-consent_en.pdf
   - columns: 1
     cells:
       -

package/content/pages/privacy-policy/en.md

@@ -2,72 +2,92 @@
 title: Privacy policy
 lang: en
 slug: privacy-policy
-description: Current data handling, consent controls, configured integrations, and publication details for this EdgePress site.
+description: How this site handles request data, consent choices, optional analytics, data rights, and supplier disclosures.
 blocks:
   - columns: 1
     cells:
       -
         - type: section
-          title: Site operator
+          title: Controller and contact
           tone: soft
           blocks:
             - type: privacy-controller
               nameLabel: Controller
               contactLabel: Privacy contact
               missingTitle: Publication setup required
-              missingText: config.yml still needs the site's real operator name and a working privacy contact. Add both before publishing this policy.
+              missingText: Add the responsible person's or organization's real name and a working privacy contact in config.yml before publishing.
+            - type: text
+              text: Confirm that the configured name identifies the responsible person or legal entity. Add a postal address, EU representative, or data protection officer contact here when applicable to the operator.
   - columns: 2
     cells:
       -
         - type: section
-          title: What this starter site does
+          title: Site requests and legal bases
           blocks:
             - type: text
               paragraphs:
-                - This source build contains public pages, posts, search data, a sitemap, and an Atom feed. It does not include a visitor account system, comments, or a contact form.
-                - The Worker exposes an optional /api/v1/ proxy for a backend. It forwards requests only when the deployer configures a Service Binding or BACKEND_URL together with the BACKEND_TOKEN secret. This starter site does not submit page content to that API.
-                - Hosting and delivery providers may process connection and request data to operate the site. The operator must identify the providers and describe their applicable terms and retention before publication.
+                - This site publishes pages and posts and provides client-side search. It has no visitor accounts, comments, or contact form in this build.
+                - To deliver and protect the site, the hosting and network providers receive request data such as IP address, requested path, request time, and browser or device headers. Where GDPR applies, the operator relies on legitimate interests in serving a secure and reliable site (Article 6(1)(f)); the operator must document the balancing assessment and confirm actual hosting logs and retention in the deployment account.
+                - Optional browser services listed below load only after an affirmative choice. Where their processing includes personal data and consent is the chosen legal basis, it is based on consent (Article 6(1)(a)). Refusing optional services does not prevent access to the site's basic pages.
       -
         - type: section
           title: Optional browser services
           blocks:
             - type: text
-              text: The current configuration has no tracking, statistics, advertising, or human-verification providers in its service lists. If the operator adds a service, the list below is generated from its configured provider, purpose, and retention description.
+              text: This list is generated from enabled services in config.yml. It identifies each purpose, data category, recipient, retention period, and the supplier's own privacy information.
             - type: privacy-services
-              emptyText: No optional third-party browser services are configured in this source build.
+              emptyText: No optional third-party browser services are configured.
   - columns: 1
     cells:
       -
         - type: section
-          title: Consent preferences
+          title: Cloudflare Web Analytics
+          blocks:
+            - type: text
+              paragraphs:
+                - When accepted, the Cloudflare beacon reports page-view and browser performance metrics. Its published dimensions include page path, referrer, device, browser, operating system, and country. Cloudflare says its beacon receives the source IP as part of the HTTP request, discards it at the nearest data center, and does not store it in its core databases or logs; Cloudflare also says the beacon does not use browser storage.
+                - Cloudflare states that unsampled beacon data is retained for 7 days and then aggregated to about 10% for longer-term storage; dashboard history is available for 6 months. The beacon may be processed in a different country or region from the visitor. The operator must check the actual Cloudflare account, plan, and applicable data processing terms before publication.
+  - columns: 2
+    cells:
+      -
+        - type: section
+          title: Consent, retention, and transfers
           tone: accent
           blocks:
             - type: text
               paragraphs:
-                - Browser integrations are loaded only after the visitor accepts a configured service. The consent interface stores a first-party preference in local browser storage when a choice can be saved. It is not a server-side audit log.
-                - Visitors can reopen Privacy settings to change a choice. If they withdraw a previously active service, the page reloads so that the integration can stop running.
+                - The privacy choice is saved in the visitor's browser on that device for the configured period. This site does not send the choice to the operator or keep a server-side receipt. A visitor can reopen Privacy settings to change or withdraw it; withdrawal stops an active integration after the page reloads. If the operator relies on consent to process personal data, the operator must ensure it can demonstrate consent as required by GDPR Article 7.
+                - Hosting and security log retention depends on the deployed provider account and is not set by this source configuration. Cloudflare's data processing addendum describes transfer safeguards, including standard contractual clauses for restricted transfers; the operator must confirm the applicable agreement and safeguards for this deployment.
             - type: privacy-consent
-              storageLabel: Browser storage key
+              storageLabel: Saved on
               expiryLabel: Preference expiry
-              versionLabel: Consent configuration version
+              proposedDateLabel: Notice proposed
+              effectiveDateLabel: Notice effective
               expiryText: "{days} days after saving"
-  - columns: 1
-    cells:
       -
         - type: section
-          title: Provider and legal details
+          title: Your rights
           blocks:
             - type: text
               paragraphs:
-                - Before enabling a provider, the operator must document the information it receives, purposes, recipients, applicable retention, and any cross-border transfers. Public site identifiers may be configured in the browser; CAPTCHA secret keys must stay on a trusted server, which must verify each response token.
-                - This starter configuration cannot determine the operator's jurisdiction, legal bases, retention obligations, or the rights that apply to a particular deployment. Complete this policy for the actual site and seek qualified advice where needed.
+                - Where GDPR applies, you may request access, rectification, erasure, restriction, or object to processing. You may request data portability where the legal conditions apply, and withdraw consent at any time without affecting processing that was lawful before withdrawal.
+                - Contact the controller using the details above to exercise a right or ask a question. You may also complain to the competent data protection supervisory authority, including in the EU country where you live, work, or believe an infringement occurred.
+                - This site does not configure solely automated decisions that produce legal or similarly significant effects. The operator should update this notice if that changes or if the site adds accounts, forms, or other data uses.
+  - columns: 1
+    cells:
+      -
+        - type: section
+          title: Legal reference
+          blocks:
             - type: link-list
-              title: Primary legal references
+              title: Official documents
               items:
-                - label: GDPR text on EUR-Lex
-                  url: https://eur-lex.europa.eu/eli/reg/2016/679
-                - label: UK ICO information notice guidance
-                  url: https://ico.org.uk/for-organisations/advice-for-small-organisations/getting-started-with-gdpr/data-protection-self-assessment/what-information-you-must-supply-under-the-gdpr/
-                - label: China Personal Information Protection Law
-                  url: https://www.miit.gov.cn/jgsj/zfs/fl/art/2022/art_515a4b20c12f430eab54bb4f56d89f56.html
----
+                - label: General Data Protection Regulation (EUR-Lex)
+                  url: https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng
+                - label: Cloudflare RUM beacon privacy details
+                  url: https://developers.cloudflare.com/speed/observatory/rum-beacon/
+                - label: Cloudflare Web Analytics retention and FAQ
+                  url: https://developers.cloudflare.com/web-analytics/faq/
+                - label: Cloudflare Data Processing Addendum
+                  url: https://www.cloudflare.com/cloudflare-customer-dpa/
+---