tqt
/
Ghost
mirror of https://github.com/TryGhost/Ghost.git
2
1
Fork 0
Code Issues 1 Releases Wiki Activity
Ghost/PRIVACY.md

48 lines
3.0 KiB
Markdown
Raw Normal View History

Introduce disclosure document for all third party integrations
2014-06-24 15:40:55 +02:00
# Privacy
This is a plain English summary of all of the components within Ghost which may affect your privacy in some way. Please keep in mind that if you use third party Themes or Apps with Ghost, there may be additional things not listed here.
Updated links to docs (#10941) no issue
2019-07-22 12:17:50 +02:00
Each of the items listed in this document can be disabled via Ghost's `config.[env].json` file. Check out the [configuration guide](https://ghost.org/docs/concepts/config/#privacy) for details.
Introduce disclosure document for all third party integrations
2014-06-24 15:40:55 +02:00
## Official Services
Some official services for Ghost are enabled by default. These services connect to Ghost.org and are managed by the Ghost Foundation: the Non-Profit organisation which runs the Ghost project.
### Automatic Update Checks
Updated links to docs (#10941) no issue
2019-07-22 12:17:50 +02:00
When a new session is started, Ghost pings a Ghost.org service to check if the current version of Ghost is the latest version of Ghost. If an update is available, a notification on the About Page appears to let you know.
Introduce disclosure document for all third party integrations
2014-06-24 15:40:55 +02:00
Updated links to docs (#10941) no issue
2019-07-22 12:17:50 +02:00
Ghost will collect basic anonymised usage statistics from your blog before sending the request to the service. You can disable collecting statistics using the [privacy configuration](https://ghost.org/docs/concepts/config/). You will still receive notifications from the service.
Update Notification improvements (#9123) closes #5071 - Remove hardcoded notification in admin controller - NOTE: update check notifications are no longer blocking the admin rendering - this is one of the most import changes - we remove the hardcoded release message - we also remove adding a notification manually in here, because this will work differently from now on -> you receive a notification (release or custom) in the update check module and this module adds the notification as is to our database - Change default core settings keys - remove displayUpdateNotification -> this was used to store the release version number send from the UCS -> based on this value, Ghost creates a notification container with self defined values -> not needed anymore - rename seenNotifications to notifications -> the new notifications key will hold both 1. the notification from the USC 2. the information about if a notification was seen or not - this key hold only one release notification - and n custom notifications - Update Check Module: Request to the USC depends on the privacy configuration - useUpdateCheck: true -> does a checkin in the USC (exposes data) - useUpdateCheck: false -> does only a GET query to the USC (does not expose any data) - make the request handling dynamic, so it depends on the flag - add an extra logic to be able to define a custom USC endpoint (helpful for testing) - add an extra logic to be able to force the request to the service (helpful for testing) - Update check module: re-work condition when a check should happen - only if the env is not correct - remove deprecated config.updateCheck - remove isPrivacyDisabled check (handled differently now, explained in last commit) - Update check module: remove `showUpdateNotification` and readability - showUpdateNotification was used in the admin controller to fetch the latest release version number from the db - no need to check against semver in general, the USC takes care of that (no need to double check) - improve readability of `nextUpdateCheck` condition - Update check module: refactor `updateCheckResponse` - remove db call to displayUpdateNotification, not used anymore - support receiving multiple custom notifications - support custom notification groups - the default group is `all` - this will always be consumed - groups can be extended via config e.g. `notificationGroups: ['migration']` - Update check module: refactor createCustomNotification helper - get rid of taking over notification duplication handling (this is not the task of the update check module) - ensure we have good fallback values for non present attributes in a notification - get rid of semver check (happens in the USC) - could be reconsidered later if LTS is gone - Refactor notification API - reason: get rid of in process notification store -> this was an object hold in process -> everything get's lost after restart -> not helpful anymore, because imagine the following case -> you get a notification -> you store it in process -> you mark this notification as seen -> you restart Ghost, you will receive the same notification on the next check again -> because we are no longer have a separate seen notifications object - use database settings key `notification` instead - refactor all api endpoints to support reading and storing into the `notifications` object - most important: notification deletion happens via a `seen` property (the notification get's physically deleted 3 month automatically) -> we have to remember a seen property, because otherwise you don't know which notification was already received/seen - Add listener to remove seen notifications automatically after 3 month - i just decided for 3 month (we can decrease?) - at the end it doesn't really matter, as long as the windows is not tooooo short - listen on updates for the notifications settings - check if notification was seen and is older than 3 month - ignore release notification - Updated our privacy document - Updated docs.ghost.org for privacy config behaviour - contains a migration script to remove old settings keys
2018-01-09 15:20:00 +01:00
All of the information and code related to this service is available in the [update-check.js](https://github.com/TryGhost/Ghost/blob/master/core/server/update-check.js) file.
Introduce disclosure document for all third party integrations
2014-06-24 15:40:55 +02:00
## Third Party Services
Correct broken Google webfont in editor Fixes #4162
2014-09-25 17:33:57 +02:00
Ghost uses a number of third party services for specific functionality within Ghost.
Introduce disclosure document for all third party integrations
2014-06-24 15:40:55 +02:00
### Gravatar
To automatically populate your profile picture, Ghost pings [Gravatar](http://gravatar.com) to see if your email address is associated with a profile there. If it is, we pull in your profile picture. If not: nothing happens.
### RPC Pings
Fixed RPC pings (#9816) closes #9644 - Removed google blogsearch from pingList, because it's dead (https://plus.google.com/+GoogleWebmasters/posts/46W7ZwVrwqg) - Updated pingomatic method weblogUpdate -> weblogUpdates - Updated RPC response handler to check for errors, log improvement - the pingomatic service sends back a 200 even when it errors, so we check the xml response to see if it's good, it throws and passes of to the catch handler already in place - Avoid multiline XML error message strings, but includes a catch in case our regex stops working with a fallback to multiline XML error message - we check for arbitrary whitespace between different XML tags, which I haven't seen in any of the responses - but it could change I guess. I haven't added support of whitespace between the tags, as I believe that would be a different value with XML spec. And we wanna match on exact values here.
2018-08-23 15:20:29 +02:00
When you publish a new post, Ghost sends out an RPC ping to let third party services know that new content is available on your blog. This enables search engines and other services to discover and index content on your blog more quickly. At present Ghost sends an RPC ping to the following service when you publish a new post:
Introduce disclosure document for all third party integrations
2014-06-24 15:40:55 +02:00
- http://rpc.pingomatic.com
RPC pings only happen when Ghost is running in the `production` environment.
Added open graph tags for ghost head helper issue #3900 - uses isPrivacyDisabled helper to see if useStructuredData has been disabled in config.js - adds an array of promises to deal with asynchronous data - resolves asynchronous data then adds open graph tags after canonical link - featured image and tags are only added if present - open graph tags only added on post and page - adds unit test to check correct data is returned - updates other unit tests to reflect changes
2014-10-07 17:02:11 +02:00
### Structured Data
Adds twitter cards and schema.org to {{ghost_head}} closes #3900 - Adds twitter cards to ghost head helper - Adds schema json information - Adds test with null values for post image and cover image - Adds test for privacy flag - Adds test for the case of no tags - Updates test to check for twitter card and schema data - Updates privacy.md - Fixes issue with image urls that are linked by url rather than uploaded
2014-10-14 15:18:42 +02:00
Ghost outputs basic meta tags to allow rich snippets of your content to be recognised by popular social networks. Currently there are 3 supported rich data protocols which are output in `{{ghost_head}}`:
Added open graph tags for ghost head helper issue #3900 - uses isPrivacyDisabled helper to see if useStructuredData has been disabled in config.js - adds an array of promises to deal with asynchronous data - resolves asynchronous data then adds open graph tags after canonical link - featured image and tags are only added if present - open graph tags only added on post and page - adds unit test to check correct data is returned - updates other unit tests to reflect changes
2014-10-07 17:02:11 +02:00
Adds twitter cards and schema.org to {{ghost_head}} closes #3900 - Adds twitter cards to ghost head helper - Adds schema json information - Adds test with null values for post image and cover image - Adds test for privacy flag - Adds test for the case of no tags - Updates test to check for twitter card and schema data - Updates privacy.md - Fixes issue with image urls that are linked by url rather than uploaded
2014-10-14 15:18:42 +02:00
- Schema.org - http://schema.org/docs/documents.html
- Open Graph - http://ogp.me/
Add disclosure for new jQuery CDN usage in Casper
2015-08-24 20:53:58 +02:00
- Twitter cards - https://dev.twitter.com/cards/overview
### Default Theme
Switch to new native system font stack (#7219) no issue Based on an increasingly popular trend and modern web typography capabilities, switch out Google Fonts for default native system fonts, tailored in a stack to suit every device. Also makes some very minor visual adjustments to suit. Nixes all references to Google Fonts, and provides a faster rendering experience and fewer http requests. 💃 Reference material: https://www.smashingmagazine.com/2015/11/using-system-ui-fonts-practical-guide/ https://medium.design/system-shock-6b1dc6d6596f#.rhqx5fmyz Dependencies: TryGhost/Ghost-Admin#211 TryGhost/Ghost-Desktop#190
2016-08-18 21:29:46 +02:00
The default theme which comes with Ghost loads a copy of jQuery from the jQuery Foundation's [public CDN](https://code.jquery.com/jquery-1.11.3.min.js), and makes use of the Open Sans [Google Font](https://www.google.com/fonts). The theme also contains three sharing buttons to [Twitter](http://twitter.com), [Facebook](http://facebook.com), and [Google Plus](http://plus.google.com). No resources are loaded from any services, however the buttons do allow visitors to your blog to share your content publicly on these respective networks.