add privacy policy

PRIVACY.md

@@ -0,0 +1,21 @@
+# Privacy Policy
+
+## Who we are
+I am Chris Arderne, a developer living in the UK. I built this site for myself, but you can use it too.
+
+## Cookies
+When you log in, an encrypted cookie is stored in your browser so the website can remember who you are so we can automatically log you in. This is not used to track you or do anything else.
+
+There is no tracking or analytics or anything like that, I will never know that you even used the website.
+
+## Who we share your data with
+No one.
+
+## How long we retain your data
+We will store your Strava refresh token in a secure database, normally only for about 15 minutes.
+
+## What rights you have over your data
+If you have an account on this site, or have left comments, you can request to receive an exported file of the personal data we hold about you, including any data you have provided to us. You can also request that we erase any personal data we hold about you. This does not include any data we are obliged to keep for administrative, legal, or security purposes.
+
+## Where we send your data
+Nowhere.

templates/index.html.hbs

@@ -66,6 +66,7 @@
     <p class="my-4">Just a little app to make it a bit easier to explore all your Strava activities on a single map.</p>
     <p class="my-4">As a bonus, you get to fill out hexagons with every workout.</p>
     <p class="mt-4">You can have a look at the source code <a class="font-bold text-blue-800" href="https://github.com/carderne/hexy">here</a>.</p>
+    <p class="mt-4">And the privacy policy <a class="font-bold text-blue-800" href="https://raw.githubusercontent.com/carderne/hexy/main/PRIVACY.md">here</a>.</p>
   </div>
 </div>