docs(privacy): state the two local values PostHog actually stores (#1242)

* docs(privacy): state the two local values PostHog actually stores Verified in production after Support went live: PostHog's conversations module writes ph_conv_<token> = {"widgetSessionId": uuid} to localStorage at PAGE LOAD, before the user contacts support at all, and it bypasses persistence: 'memory' exactly like surveys' seenSurvey_ flags do. The privacy page claimed enkäter were the only thing stored locally. That became wrong the moment Support was enabled, so it now names both values and what they are for. The substance is unchanged: both are functional UI state with no personuppgifter (do-not-ask-again, and find-my-own-ticket in this browser), no cookies are set, and no analytics data is stored on the device, so the no-consent-banner position still holds. Only the claim needed to match reality. Lesson recorded in DECISIONS.md: enabling any new PostHog product can silently add device storage, so check localStorage in prod after each one rather than trusting the persistence setting. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * docs(compliance): inventory the client-side storage keys Closes the ISO 27001 A.5.9 finding from the compliance swarm on #1242: the two device-side keys were described in prose but were not enumerated anywhere that a future change would be checked against. Lists both application keys and both PostHog keys, what each contains, why neither PostHog key is personal data (which is what makes the strictly-necessary assessment hold), and why purge-legacy-storage deliberately leaves them alone. Adds the review trigger that would have caught this earlier: enabling a new PostHog product can silently add storage, because the products write to localStorage directly rather than through the SDK persistence setting. The Support product was found in prod, not in review. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-07-27 16:55:45 +02:00
parent fbd4b992f5
commit 88099f5390
4 changed files with 61 additions and 4 deletions
@@ -618,3 +618,4 @@ One line per decision: `[YYYY-MM-DD] <decision>: <why>`. Appended by agents and
 [2026-07-27] isConfigured() gates /connect only, not /disconnect, /schedule or /sync: a deployment losing its OAuth credentials must not trap users with a connection they cannot remove or a schedule they cannot switch off.
 [2026-07-27] Dropbox web links point at /home/Apps unless DROPBOX_APP_FOLDER_NAME is set: app-folder scoped calls cannot discover where the app folder sits in the user's account, and a link into the wrong folder reads as a lost backup, so the app-name deep link is opt-in rather than guessed.
 [2026-07-27] performSync keeps `provider` optional, defaulting to Google Drive: it preserves the pre-Dropbox call shape (and its test suite) as the documented legacy path while all three production call sites pass a provider explicitly.
+[2026-07-27] Privacy page corrected after verifying prod: PostHog's conversations module writes ph_conv_<token> = {"widgetSessionId": uuid} to localStorage at PAGE LOAD, not when support is contacted, bypassing persistence: 'memory' exactly like surveys' seenSurvey_ flags. The page previously claimed enkäter were the only local storage, which was wrong the moment Support was enabled. Both values are functional UI state without personuppgifter (do-not-ask-again, and find-my-own-ticket), so the no-consent-banner position holds, but "inga kakor eller annan lagring" did not and is now stated accurately. Worth remembering that enabling any new PostHog product can silently add device storage: check localStorage in prod after each one rather than trusting the persistence setting.