docs: expand privacy statement for Docs + Desktop analytics disclosure

[nicksinas]

Summary

Broadens the docs-site Privacy Statement so Avocado Desktop can link to it, and adds our first-party product-analytics disclosure.

• Scope — covers the docs site and Avocado Desktop; Desktop links to this policy from within the app. Sign-in is optional (docs needs no account either).
• What we collect (Desktop) — usage events, app/CLI/VM versions, hardware target + Linux distribution, crash/error reports, and approximate (region-level) location derived from your IP.
• What we do NOT collect — no source/file/project contents, no agent conversation content, no credentials. Desktop crash/error text is scrubbed of secrets and home-dir paths before sending.
• Identity — events tie to your email only if you sign in; otherwise a random on-device identifier.
• Processing & sharing — single product-analytics provider (PostHog), US-based, processed on our behalf; not sold/rented, not shared with third parties for their own purposes; internal use only.
• Opt-out — Desktop: Settings → Privacy (per-installation). Docs-site Google Analytics opt-out retained.

Related

• ENG-2393
• Desktop analytics PR: avocado-linux/avocado-desktop#83

[Copilot]

Pull request overview

Expands the existing docs-site Privacy Statement to cover Avocado Connect and Avocado Desktop as well, including a first-party product-analytics disclosure and opt-out instructions so both apps can link to a single canonical policy.

Changes:

• Broadens scope from docs-only to docs + Connect + Desktop, clarifying account requirements.
• Adds detailed disclosures for product analytics/crash reporting (including what is and is not collected), plus provider/processing/retention language.
• Updates opt-out instructions (including Do Not Track mention) and contact email, and refreshes the “Last updated” date.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

Suppressed comments (2)

src/docs-overview/policies/privacy.md:19

• The opening statement says you "do not ... share this information with anyone," but later the policy describes sharing analytics data with processors (PostHog/Google Analytics) and also mentions possibly sharing aggregated/de-identified information. This is internally inconsistent and could mislead readers; consider narrowing this to "do not sell/rent" and "do not share with third parties for their own purposes/advertising" (while still allowing processors).

We want to be clear up front: **we use the information described here only for
our own internal purposes — to understand how our products are used and to find
and fix problems so we can improve them. We do not sell, rent, or share this
information with anyone, and we do not use it for advertising.**

src/docs-overview/policies/privacy.md:138

• "Do Not Track" is a browser signal; referring to an operating system "Do Not Track" signal is ambiguous. Consider rephrasing to explicitly reference the browser DNT signal (and qualify applicability) so readers understand what is honored.

Opting out stops collection going forward and persists across sessions and
launches. We also honor your browser's or operating system's **Do Not Track**
signal.

[lee-reinhardt]

Reviewed the text against how the apps behave today. Comments inline; a few implementation-specific notes are on ENG-2393 rather than here.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

Suppressed comments (4)

src/docs-overview/policies/privacy.md:19

• The statement "We do not ... share this information with anyone" conflicts with later sections that explicitly describe sharing data with analytics providers as processors. Consider qualifying this as "no sharing with third parties for their own purposes" (while allowing on-our-behalf processing).

We want to be clear up front: **we use the information described here only for
our own internal purposes — to understand how our products are used and to find
and fix problems so we can improve them. We do not sell, rent, or share this
information with anyone, and we do not use it for advertising.**

src/docs-overview/policies/privacy.md:160

• The sentence "We do not sell your personal information, and we do not share it" is overly absolute given the earlier disclosure that some information is shared with analytics providers as processors. Qualifying this avoids an internal inconsistency in the statement.

We do not sell your personal information, and we do not share it.

src/docs-overview/policies/privacy.md:88

• There’s a minor grammatical issue here (comma after “secrets”) and the long line makes the sentence harder to read. Consider removing the comma and using "home directory" without a hyphen.

In Avocado Desktop, crash and error reports are additionally scrubbed on your
machine before they are sent — secrets, and home-directory paths are removed from the error text.

src/docs-overview/policies/privacy.md:143

• This sentence describes an opt-out effect for both Connect and Desktop, but uses the singular "the application". Using "the app" (per the toggled product) avoids ambiguity and reads more naturally.

Turning the toggle off disables the analytics collection for your account: the application
stops sending events and our analytics provider no longer receives or collects
any analytics information from it. This takes effect going forward and persists

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

Suppressed comments (5)

src/docs-overview/policies/privacy.md:29

• The Scope section does not include Avocado Connect, but the PR title/description indicates this policy is meant to be linked from both Avocado Connect and Avocado Desktop. Adding Connect here keeps the document aligned with its stated purpose.

- The **Avocado OS documentation site** (this website).
- **Avocado Desktop**, our desktop application.

Avocado Desktop links to this Statement from within the application so you
always have access to the current version.

src/docs-overview/policies/privacy.md:132

• The opt-out section only describes Avocado Desktop and does not mention Avocado Connect’s opt-out path or honoring Do Not Track, both of which are called out in the PR description. This makes the opt-out guidance incomplete relative to the intended scope.

## Your choices and opt-out

Product analytics in Avocado Desktop is **on by default**, but you are always in
control and can turn it off at any time in **Settings → Privacy**.

src/docs-overview/policies/privacy.md:151

• This sentence states "we do not share" personal information, but earlier the statement describes sharing with analytics providers acting as processors. Consider tightening the wording to reflect that you do not share with third parties for their own purposes (while still using processors).

We do not sell your personal information, and we do not share it.

src/docs-overview/policies/privacy.md:4

• The frontmatter description lists only the docs site and Avocado Desktop, but the PR description says this Privacy Statement is intended to also cover Avocado Connect. This can cause mismatched metadata/SEO and confusion for consumers linking to the policy.

This issue also appears in the following locations of the same file:

• line 25
• line 128
• line 151

description: Privacy Statement for the Avocado OS documentation site and Avocado Desktop

src/docs-overview/policies/privacy.md:19

• This paragraph says Peridio does not "share this information with anyone", but later sections explicitly describe sharing with analytics processors (PostHog, Google Analytics). The absolute wording is internally inconsistent and could be misleading.

We want to be clear up front: **we use the information described here only for
our own internal purposes — to understand how our products are used and to find
and fix problems so we can improve them. We do not sell, rent, or share this
information with anyone, and we do not use it for advertising.**

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

Suppressed comments (3)

src/docs-overview/policies/privacy.md:135

• PR description states Desktop opt-out also honors Do Not Track, but the updated Privacy Statement doesn't mention DNT anywhere. Please align the policy text and the PR description by either documenting how/when DNT is honored for Desktop analytics, or removing the DNT claim from the PR description if it’s not applicable.

Product analytics in Avocado Desktop is **on by default**, but you are always in
control and can turn it off at any time in **Settings → Privacy**.

src/docs-overview/policies/privacy.md:43

• PR description says Avocado Desktop requires an Avocado account, but the Privacy Statement says signing in is optional and the app can be used without an account. Please reconcile this mismatch (either update the statement if sign-in is required, or update the PR description if it’s optional).

Signing in to an Avocado account is optional in Avocado Desktop — you can use
the application without one.

src/docs-overview/policies/privacy.md:65

• PR description claims error text is scrubbed of secrets, home-dir paths, and IPs before it leaves the machine, but the policy text explicitly says approximate location is derived from your IP address (for Desktop and for Google Analytics). Please clarify which is accurate (e.g., whether IP is only observed as part of the network request and not stored, vs. actively removed/suppressed), and align the PR description and policy wording accordingly.

- **Approximate location** — a general region (such as country) that our
  analytics provider derives from your IP address. We do not collect precise
  or GPS location.