Data collection

[patrickdet]

Great project! I was checking what data is collected per request and the RequestLog currently holds the remote_ip as well. Storing IPs is not forbidden under GDPR but requires a reason and mentioning it in the privacy policies of a site.

I think this can all be side stepped if no personal data like an IP address was stored. Simple Analytics does this really well and they even outline how unique visit tracking works in a privacy preserving way.

For most adding statements to the privacy statement is probably fine, but if the request tracking worked like Simple Analytics it would be a GDPR compliant plug and play solution that doesn't require additional pop-ups or statements and just works.

Would this be something you'd consider or accept a draft PR for?

[lalabuy948]

Hi @patrickdet , thank you for raising this issue. I was counting days since launch when this topic would be brought 😄

Since we are not really interested in storing IP addresses, as I had initial idea to show the world map but then I dropped it as maintaining up to date library with IP <-> Location is quite a challenge or you need to use paid services for that, we can easily one way hash IP address and store only hash for purpose of saving some unique identifiers.

As Simple Analytics treats every non-referer as unique visit which is imo not very accurate.

I can solve it without breaking changes in next release.

  defp hash_ip(ip), do: :erlang.phash2(ip, 1_000_000) |> Integer.to_string

  defp format_ip({a, b, c, d}), do: "#{a}.#{b}.#{c}.#{d}" |> hash_ip
  defp format_ip(ip), do: to_string(ip) |> hash_ip

Let me know what do you think on that solution.