diff --git a/.github/workflows/sync-legal.yml b/.github/workflows/sync-legal.yml new file mode 100644 index 0000000..aff7be8 --- /dev/null +++ b/.github/workflows/sync-legal.yml @@ -0,0 +1,104 @@ +name: Sync legal pages + +# The policy text has one home: PRIVACY.md in submersion-app/submersion. This +# workflow regenerates privacy/index.html from it so the site cannot drift out +# of step with the app's own policy, which is what happened before: the app +# repo's policy was rewritten while the published page kept serving a version +# months out of date. A store listing that links a policy contradicting the +# app's Data safety declaration is a policy violation, so the drift was not +# cosmetic. +# +# Triggers: +# schedule a daily floor, so a missed dispatch still converges +# workflow_dispatch manual "sync it now" +# repository_dispatch the app repo can push a `legal-updated` event to make +# a policy change land here within a minute +# push template or renderer changes regenerate immediately +# +# The push trigger cannot loop: the sync job commits only when the rendered +# output differs, so the commit it makes produces a run that finds no change +# and stops. + +on: + schedule: + - cron: "17 6 * * *" + workflow_dispatch: + repository_dispatch: + types: [legal-updated] + push: + branches: [main] + paths: + - tools/render_legal.py + - privacy/index.html + - .github/workflows/sync-legal.yml + pull_request: + paths: + - tools/render_legal.py + - privacy/index.html + - .github/workflows/sync-legal.yml + +# Source of the policy text. Kept here rather than inline so the two jobs +# cannot disagree about where it comes from. +env: + POLICY_URL: https://raw.githubusercontent.com/submersion-app/submersion/main/PRIVACY.md + +permissions: + contents: read + +jobs: + # On a pull request, verify rather than write. This is what stops someone + # hand-editing the generated region of the page: the edit would be silently + # reverted by the next sync, so the PR fails instead and says why. + check: + if: github.event_name == 'pull_request' + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + + - name: Fetch the policy from the app repository + run: curl -fsSL --retry 3 "$POLICY_URL" -o /tmp/PRIVACY.md + + - name: Verify the page matches the policy + run: | + if ! python3 tools/render_legal.py \ + --source /tmp/PRIVACY.md \ + --target privacy/index.html \ + --check; then + echo "::error::privacy/index.html does not match PRIVACY.md in the app repo." + echo "::error::Edit PRIVACY.md there, not the generated region of this page." + echo "::error::To refresh locally: python3 tools/render_legal.py --source --target privacy/index.html" + exit 1 + fi + + sync: + if: github.event_name != 'pull_request' + runs-on: ubuntu-latest + permissions: + contents: write + steps: + - uses: actions/checkout@v4 + + - name: Fetch the policy from the app repository + run: curl -fsSL --retry 3 "$POLICY_URL" -o /tmp/PRIVACY.md + + - name: Render the page + run: | + python3 tools/render_legal.py \ + --source /tmp/PRIVACY.md \ + --target privacy/index.html + + - name: Commit if the page changed + run: | + if git diff --quiet -- privacy/index.html; then + echo "Policy page already current; nothing to commit." + exit 0 + fi + git config user.name "github-actions[bot]" + git config user.email "41898282+github-actions[bot]@users.noreply.github.com" + git add privacy/index.html + git commit -m "Sync the privacy policy page with PRIVACY.md + + Regenerated by .github/workflows/sync-legal.yml from + submersion-app/submersion. Edit PRIVACY.md there rather than the + generated region of this page." + git push diff --git a/privacy/index.html b/privacy/index.html index b4e6e22..781defb 100644 --- a/privacy/index.html +++ b/privacy/index.html @@ -70,15 +70,17 @@

Privacy Policy.

Submersion is a local-first dive log. Your data stays on your device unless you choose to back it up to a service you control.

-

App: Submersion · Last updated: 2026-03-06

+ +

App: Submersion · Last updated: 2026-09-19

+
+ +

Data Collection

-

- Submersion is a local-first dive logging application. All data you enter is stored on - your device. The app may collect and store the following types of information based on - your usage: -

+

Submersion is a local-first dive logging application. All data you enter is stored on your device. The app may collect and store the following types of information based on your usage:

-

Data Storage

-

- All data is stored locally on your device in a SQLite database. Submersion does not - operate any remote servers, and your data is not transmitted to any server owned or - operated by Submersion. -

- -

Cloud Backup

-

Submersion offers an optional backup feature using Google Drive. This backup is:

+

All data is stored locally on your device in a SQLite database. Submersion does not operate any remote servers. No data is ever transmitted to a server owned or operated by Submersion, because no such server exists.

+

Encrypting that database is optional and is off unless you turn it on. You can enable encryption at rest in Settings, under Security, which protects the database with a passphrase and can unlock it with your fingerprint or face. Until you do, the database is an ordinary unencrypted file on your device, protected by your device's own lock screen and storage encryption but not by Submersion.

+

Data can leave your device only to storage you already own, and only when you choose to set that up. There are two separate features that do this, and they protect your data differently. The difference matters, so it is spelled out below.

+

Backup and Sync

+

Optional. Off until you configure it.

+

Backup and sync write your dive log to cloud storage you control: Google Drive, Dropbox, iCloud, or S3-compatible storage. You choose the provider and connect your own account.

+

Whatever you choose, the data is stored in your own account, under your own control, and is transmitted over HTTPS. Submersion has no access to your cloud storage beyond the files the app itself creates there.

+

Encryption is optional here too, and off by default

+

Sync offers end-to-end encryption, which you turn on in Settings by setting a passphrase. You are given a recovery code at that point, because without the passphrase or the recovery code the data cannot be recovered by anyone, including us.

+

With end-to-end encryption on: the dive log is sealed with AES-256-GCM before it leaves your device, using a key derived from your passphrase. The key is never uploaded and is never sent to Submersion or to your storage provider. Google, Dropbox, Apple and any S3 operator see only encrypted files and cannot read your dive log, your notes or your locations.

+

With end-to-end encryption off, which is the default: your dive log is uploaded as ordinary readable files. It is protected in transit by HTTPS and by whatever security your storage provider applies, but your storage provider can access its contents in the same way it can access any other file you keep there.

+

If your dive log matters to you, turning on end-to-end encryption before you enable sync is worth the minute it takes.

+

Photo and Video Upload

+

Optional. Off until you attach a media store.

+

Separately from backup and sync, Submersion can upload the photos and videos you attach to dives, so that your media is available on your other devices. This uses the same providers: Google Drive, Dropbox, iCloud or S3-compatible storage, in an account you connect.

+

Photos and videos uploaded this way are not encrypted by Submersion. They are transmitted over HTTPS and stored as ordinary files in your cloud account, which means your storage provider can access them in the same way it can access any other photo you keep there. Turning on end-to-end encryption for sync does not cover them: media upload has no encryption option.

+

If you do not attach a media store, your photos and videos are never uploaded. Dive media is otherwise referenced in place: Submersion points at the photo in your device's own photo library rather than copying it into the app.

+

Information About Other People

+

Some of what Submersion stores is not about you. A dive log naturally records the people you dive with, and Submersion may hold the following about them:

-

- Submersion does not have access to your Google Drive beyond the backup files you - explicitly create through the app. -

- +

You may have imported some of this from your device's contacts.

+

If you enable backup and sync, this information leaves your device along with the rest of your dive log. It goes only to storage you control. If you have also turned on end-to-end encryption, your storage provider cannot read it; if you have not, which is the default, it is uploaded in readable form. Either way it does leave your device, and the people it describes have not agreed to that, because they were never asked.

+

This is the strongest reason to turn on end-to-end encryption. The data you are uploading is not all yours to expose.

+

If you attach a media store, photos and videos containing other people are uploaded without encryption, as described above, and your storage provider can access them.

+

Certification card images deserve a specific mention. If you photograph a certification card, yours or someone else's, that image carries a full name, a certification number, an issuing agency and a date. It is stored in your dive log and is included in backup and sync like any other part of it.

+

Submersion never transmits any of this to Submersion, to any other user, or to any third party for their own purposes. It travels only to the storage account you have connected. Even so, you are the one deciding to record another person's details and to sync them, so please consider:

+ +

Online Features and Third-Party Services

+

Several Submersion features answer questions that cannot be answered on your device: what a place is called, what the weather was on the day you dived, what lives on a reef, how deep the seafloor is. These features work by asking a public service, which means sending it a question.

+

What happens without you doing anything

+

One thing only. Submersion checks GitHub for a newer version of the app. This sends nothing about you or your diving. GitHub sees a request from your IP address asking what the latest version is.

+

Features that send a dive site's coordinates

+

If you open one of the features below, Submersion sends the relevant coordinates to the service listed beside it. Nothing else is sent: no name, no account, no device identifier, and nothing that identifies you or links one request to another. The service sees a location and the IP address the request came from.

+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
What the feature doesServices it asks
Turn coordinates into a place name, or a place name into coordinatesOpenStreetMap Nominatim
Draw maps and satellite imageryOpenStreetMap, OpenTopoMap, Esri ArcGIS, swisstopo
Look up the weather on the day of a dive, and a site's elevationOpen-Meteo
Find tide stations near a siteNOAA
Identify and suggest marine speciesiNaturalist, GBIF
Show reef health, habitat and marine protected areasNOAA Coral Reef Watch, PacIOOS, UNEP-WCMC, Esri ArcGIS
Show seafloor depth and 3D terrainEMODnet, NOAA NGDC, GMRT, swisstopo
+
+

These are independent organisations with their own privacy policies. They are not partners of Submersion, receive no payment from us and send us nothing. We ask them a question on your behalf and show you the answer.

+

If you would rather not contact them, do not open those features. Maps can also be used offline by downloading a region in advance, which avoids further tile requests for that area.

+

Services you connect yourself

+

If you choose to connect one of these accounts, Submersion communicates with that provider using credentials you supply, and only then:

+
+ + + + + + + + + + + + + + + + + + + + + + + + + +
ServiceWhat it is for
Garmin ConnectDownloading your dives from Garmin
Suunto (Sports Tracker)Downloading your dives from Suunto
Adobe LightroomReading photos from your Lightroom library
A network drive or server you nameReading media you keep on your own storage
+
+

Each is optional, off until you set it up, and can be disconnected at any time. Your credentials for these services are held in your device's secure keychain and are never sent to Submersion.

Health Data

On iOS, Submersion can optionally read dive workout data from Apple HealthKit. This data is:

This feature is not currently available on Android.

-

Data Sharing

-

Submersion does not share your data with third parties. Specifically:

+

Submersion does not sell your data, trade it, or hand it to anyone for their own purposes. Specifically:

- +

Your dive log leaves your device only through the optional backup, sync and media upload features described above, and only to a storage account you connect and control.

+

Separately from that, the online features described above send coordinates to public map, weather, tide and marine data services in order to answer a question you asked. That is a real transfer and we would rather name it than hide it behind the word "never". It is limited to coordinates, it carries nothing that identifies you, and it happens only when you open the feature that needs it.

Device Permissions

Submersion requests the following permissions only as needed for specific features:

- + + + + - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + +
PermissionPurpose
PermissionPurpose
BluetoothDiscover and communicate with BLE dive computers
LocationTag dive sites with GPS coordinates; required for BLE scanning on Android 11 and below
Photos and mediaAttach photos and videos to dive entries
Media locationRead GPS data from photo EXIF metadata to suggest dive site locations
ContactsSelect dive buddies from your device contacts
NotificationsSend gear maintenance service reminders
Exact alarmsSchedule precise gear maintenance reminders
BluetoothDiscover and communicate with BLE dive computers
LocationTag dive sites with GPS coordinates; required for BLE scanning on Android 11 and below
Photos and mediaAttach photos and videos to dive entries
Media locationRead GPS data from photo EXIF metadata to suggest dive site locations
ContactsSelect dive buddies from your device contacts
NotificationsSend gear maintenance service reminders
Exact alarmsSchedule precise gear maintenance reminders
-

- All permissions are optional. The app will function without them, though related - features will be unavailable. -

- +

All permissions are optional. The app will function without them, though related features will be unavailable.

Data Deletion

-

Children

-

- Submersion is not directed at children under the age of 13. We do not knowingly collect - personal information from children under 13. If you believe a child under 13 has - provided data through the app, please contact us so we can take appropriate action. -

- -

Changes to This Policy

-

- This privacy policy may be updated from time to time. Changes will be reflected by - updating the "Last Updated" date at the top of this document. -

- +

Submersion is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided data through the app, please contact us so we can take appropriate action.

+

Changes to This Policy

+

This privacy policy may be updated from time to time. Changes will be reflected by updating the "Last Updated" date at the top of this document.

Contact

If you have questions or concerns about this privacy policy, you can reach us at:

-

Open Source

Submersion is open-source software. The full source code is available at:

https://github.com/submersion-app/submersion

+

diff --git a/tools/render_legal.py b/tools/render_legal.py new file mode 100644 index 0000000..14adf8e --- /dev/null +++ b/tools/render_legal.py @@ -0,0 +1,297 @@ +#!/usr/bin/env python3 +"""Render a legal Markdown document into an existing site page. + +The policy text lives in the app repository (submersion-app/submersion) as +PRIVACY.md and TERMS.md. This script is what keeps the website from holding a +second, drifting copy of it: it converts the Markdown and replaces only the +generated region of the target page, leaving the head, navigation, intro and +footer exactly as they are. + +Two regions are replaced, each delimited by HTML comments in the page: + + ... + ... + +Anything outside those markers is never touched, so the page stays hand-owned +apart from the policy text itself. + +Usage: + render_legal.py --source PRIVACY.md --target privacy/index.html + render_legal.py --source PRIVACY.md --target privacy/index.html --check + +--check exits 1 when the page is out of date and writes nothing, which is what +CI uses to tell "needs regenerating" from "already current". + +Deliberately dependency-free: it runs on a stock python3 in Actions with no +install step, and the Markdown it has to handle is a known, small subset +(headings, paragraphs, bullet lists, pipe tables, bold, links). It is not a +general Markdown implementation and should not become one. If the policy ever +needs a construct this does not cover, add it here with a fixture rather than +reaching for a library, or the CI job grows an install step for one page. +""" + +from __future__ import annotations + +import argparse +import html +import re +import sys +from pathlib import Path + +META_BEGIN = "" +META_END = "" +BODY_BEGIN = "" +BODY_END = "" + +# Dash characters that may separate a definition bullet's term from its +# description. Spelled as escapes so the source carries no literal dash. +DEFINITION_DASHES = "\u2014\u2013-" # em dash, en dash, hyphen + +# Indentation of the generated markup inside the page, matched to the +# surrounding hand-written HTML so the diff of a regeneration stays readable. + +BODY_INDENT = " " * 12 +META_INDENT = " " * 10 + + +def slugify(text: str) -> str: + """Heading text to the id the page anchors on. + + Matches the ids the hand-written page already used (`data-collection`, + `cloud-backup`), so existing inbound links and the table of contents keep + working after the first generated render. + """ + slug = re.sub(r"<[^>]+>", "", text).lower() + slug = re.sub(r"[^a-z0-9]+", "-", slug) + return slug.strip("-") + + +def render_inline(text: str) -> str: + """Bold, links and escaping for a run of Markdown text. + + Order matters: escape first so policy text cannot inject markup, then + reintroduce the tags this function is responsible for. + """ + out = html.escape(text, quote=False) + + # Links before bold: a link label may contain bold, but a bold run that + # swallowed a link's brackets would leave the URL rendered as text. + def link(match: re.Match[str]) -> str: + label, href = match.group(1), match.group(2) + external = href.startswith("http") + attrs = ' target="_blank" rel="noreferrer"' if external else "" + return f'{label}' + + out = re.sub(r"\[([^\]]+)\]\(([^)]+)\)", link, out) + out = re.sub(r"\*\*([^*]+)\*\*", r"\1", out) + return out + + +def render_list_item(text: str) -> str: + """A bullet, with the site's `term: description` convention applied. + + The Markdown writes a definition bullet as a bolded term, then a dash, + then the description. The site renders that as + `Term: description`, which is the convention the + convention the hand-written page established. Bullets that are not + definitions pass through unchanged. + """ + rendered = render_inline(text) + return re.sub( + rf"^([^<]+)\s*[{DEFINITION_DASHES}]\s*", + r"\1: ", + rendered, + ) + + +class Block: + """One rendered HTML block, already indented.""" + + def __init__(self, lines: list[str]): + self.lines = lines + + +def render_table(rows: list[str]) -> list[str]: + """A pipe table as the site's wrapped, scrollable table.""" + cells = [[c.strip() for c in r.strip().strip("|").split("|")] for r in rows] + # Row 1 is the header, row 2 is the alignment rule, which carries no + # content and is dropped. + header, body = cells[0], cells[2:] + + out = ['

', " ", " ", " "] + out += [f' ' for c in header] + out += [" ", " ", " "] + for row in body: + out.append(" ") + out += [f" " for c in row] + out.append(" ") + out += [" ", "
{render_inline(c)}
{render_inline(c)}
", "
"] + return out + + +def parse(markdown: str) -> tuple[str, list[str]]: + """Split the document into its meta line and its rendered body blocks.""" + lines = markdown.replace("\r\n", "\n").split("\n") + + app = last_updated = "" + body: list[str] = [] + i = 0 + paragraph: list[str] = [] + bullets: list[str] = [] + + def flush_paragraph() -> None: + nonlocal paragraph + if paragraph: + body.append(f"

{render_inline(' '.join(paragraph))}

") + paragraph = [] + + def flush_bullets() -> None: + nonlocal bullets + if bullets: + # extend(), not `body += ...`: an augmented assignment would make + # `body` local to this closure and shadow the list being built. + body.append("") + bullets = [] + + def flush() -> None: + flush_paragraph() + flush_bullets() + + while i < len(lines): + line = lines[i] + stripped = line.strip() + + if not stripped: + flush() + i += 1 + continue + + # The document's own H1 is dropped: the page supplies its title in + # hand-written markup outside the generated region. + if stripped.startswith("# "): + flush() + i += 1 + continue + + meta = re.match(r"^\*\*(App|Last Updated):\*\*\s*(.+)$", stripped) + if meta: + flush() + if meta.group(1) == "App": + app = meta.group(2).strip() + else: + last_updated = meta.group(2).strip() + i += 1 + continue + + heading = re.match(r"^(#{2,4})\s+(.*)$", stripped) + if heading: + flush() + level = len(heading.group(1)) + text = render_inline(heading.group(2)) + # Only H2 carries an id: those are the sections the page's + # anchors and any inbound deep links point at. + if level == 2: + body.append(f'

{text}

') + else: + body.append(f"{text}") + i += 1 + continue + + if stripped.startswith("|"): + flush() + rows = [] + while i < len(lines) and lines[i].strip().startswith("|"): + rows.append(lines[i]) + i += 1 + if len(rows) >= 2: + body += render_table(rows) + continue + + bullet = re.match(r"^[-*]\s+(.*)$", stripped) + if bullet: + flush_paragraph() + item = bullet.group(1) + i += 1 + # A bullet may wrap onto following indented lines. + while i < len(lines) and lines[i].startswith((" ", "\t")) and lines[i].strip(): + if re.match(r"^\s*[-*]\s+", lines[i]): + break + item += " " + lines[i].strip() + i += 1 + bullets.append(item) + continue + + flush_bullets() + paragraph.append(stripped) + i += 1 + + flush() + + meta_line = " · ".join( + part for part in (f"App: {app}" if app else "", f"Last updated: {last_updated}" if last_updated else "") if part + ) + return meta_line, body + + +def splice(page: str, begin: str, end: str, replacement: str) -> str: + """Replace the text between two markers, keeping the markers.""" + start = page.find(begin) + stop = page.find(end) + if start == -1 or stop == -1: + raise SystemExit( + f"marker not found in target page: {begin if start == -1 else end}\n" + "The page must carry the legal:meta and legal:body markers; see tools/render_legal.py." + ) + if stop < start: + raise SystemExit(f"markers out of order in target page: {end} precedes {begin}") + return page[: start + len(begin)] + replacement + page[stop:] + + +def render(markdown: str, page: str) -> str: + meta_line, body = parse(markdown) + + meta_html = ( + "\n" + + META_INDENT + + f'

{html.escape(meta_line, quote=False)}

\n' + + META_INDENT + ) + body_html = "\n" + "\n".join(BODY_INDENT + line for line in body) + "\n" + BODY_INDENT + + page = splice(page, META_BEGIN, META_END, meta_html) + page = splice(page, BODY_BEGIN, BODY_END, body_html) + return page + + +def main() -> int: + parser = argparse.ArgumentParser(description=__doc__) + parser.add_argument("--source", required=True, type=Path, help="Markdown policy file") + parser.add_argument("--target", required=True, type=Path, help="HTML page to update in place") + parser.add_argument( + "--check", + action="store_true", + help="Exit 1 if the page is out of date instead of writing it", + ) + args = parser.parse_args() + + markdown = args.source.read_text(encoding="utf-8") + page = args.target.read_text(encoding="utf-8") + updated = render(markdown, page) + + if updated == page: + print(f"{args.target}: up to date") + return 0 + + if args.check: + print(f"{args.target}: OUT OF DATE, run tools/render_legal.py without --check", file=sys.stderr) + return 1 + + args.target.write_text(updated, encoding="utf-8") + print(f"{args.target}: updated from {args.source}") + return 0 + + +if __name__ == "__main__": + raise SystemExit(main())