docs(privacy): explain Classic automatic crash reporting

[zoeyrose]

Outcome

Publish a static, plain-language privacy and retention notice for Atrinik Classic crash reporting before any official client enables the consent prompt or automatic-after-consent submission.

Parent initiative: atrinik/atrinik#464

The website owns the public notice and presentation only. It must remain static and must not add browser JavaScript, a form, API, database, analytics payload field, or crash-report runtime to atrinik.org.

Required content

Document, in language that matches the shipped schema and receiver behavior:

• what a crash report is and that the fatal process only writes locally;
• that submission happens on a later healthy launch;
• the default ask policy and the exact meanings of Send once, Always send, Never send, dismissal, and revocation;
• every collected field/category: schema/report ID, exact version/build identity, platform/architecture, coarse lifecycle phase, exception/access category, module basenames/identities, module-relative frames, and rounded timestamps;
• every explicit exclusion: memory dump, logs, account/character/chat data, credentials, game-server hostname/address, paths, environment, command line, config, free-form text, hardware fingerprint, and stable installation/user ID;
• that the network request necessarily exposes the source IP and other transport metadata to Cloudflare; Atrinik never stores/logs the raw address, but the receiver derives a purpose-separated HMAC-SHA-256 tag, rotates its namespace by UTC day, checks current/previous aliases solely to enforce the rolling-24-hour source limit, and deletes tag/event rows within 48 hours;
• Cloudflare as the processor for the Worker and EU-jurisdiction D1 storage, GitHub as the processor/public host for redacted aggregate issues and public release symbols, and links to their applicable privacy information;
• 48-hour maximum retention for rotating source-limit tags/events, 30-day retention for individual structured reports, and 180-day retention for unlinked signature aggregates; public GitHub issue history follows repository moderation/retention;
• the local spool/trace behavior, bounded retry behavior, receipt lifetime, and what happens when the receiver is offline, disabled, rejecting, or over quota;
• how a user can find a local receipt/report ID, request deletion before expiry, ask a privacy question, and disable future submission, including the honest limitation that Atrinik cannot search by person because no identity is collected;
• the initial Windows-only scope and a visible effective/revision date.

Do not claim that data is anonymous in an absolute sense. Use precise wording such as "no Atrinik account or stable installation identifier is collected" and separately disclose Cloudflare's necessary network processing.

Site integration

• Add one canonical, indexable page at a stable URL suitable for an in-client link.
• Link it from the existing site privacy/footer or an equally discoverable static location without changing unrelated policy text.
• Keep structured metadata, sitemap, canonical URL, CSP, accessibility, responsive layout, and no-repository-JavaScript checks intact.
• Make schema/retention changes in the receiver or client block release until this page is updated in the same coordinated rollout.

Validation

• Cross-check the rendered page line-by-line against the versioned receiver schema, client consent labels/defaults, retention jobs, GitHub public issue template, and incident/deletion runbook.
• Build/test the static Astro site and inspect generated HTML for the canonical URL, links, headings, accessibility, CSP/no-script contract, sitemap, and absence of secrets/internal endpoints.
• Verify the production link only after an explicitly authorized Pages deployment; no production deploy or DNS change is authorized by this issue alone.

Acceptance criteria

• The notice is reachable at one stable static URL and is linked from the site and client consent UI.
• Collected/excluded data, consent/revocation, provider roles, native Cloudflare rate limits, rotating source-tag purpose/retention, network metadata, local behavior, deletion limitations, and Windows-only scope exactly match the implementation.
• No form, JavaScript, dynamic function, receiver endpoint, raw report, secret, or internal administrative detail is added to the website.
• Site build, accessibility, metadata, CSP, no-script, and link checks pass.