flagon-io/g1t

Part of #304, which stays open. The owner asked for HeyCatch to be removed because it's slow, and it isn't replaced.

Removed:

• Code: lib/analytics.client.ts, along with its wiring in entry.client.tsx and root.tsx (the g1t-analytics meta tag and the signed-in identify call).
• The EU consent banner:
  • It existed only for analytics, so these are gone: components/analytics-consent.tsx, lib/analytics-consent.ts and lib/analytics-scrub.ts, with their tests.
  • The footer's Cookie choices link is gone too.
  • The _g1t_consent part of the public page cache key in workers/app.ts is gone.
• CSP: https://in.heycatch.ai is no longer in script-src. connect-src was already a general https:.
• Dependency: @heycatch/sdk is removed, along with the posthog packages it pulled in. The lockfile diff only removes entries.

Policies:

• Privacy policy:
  • It says g1t uses no third-party analytics: no analytics script, no analytics cookie, nothing about pages or clicks sent to an analytics company.
  • The ph_…_posthog cookie row, the consent paragraphs and the local-storage mention are gone.
  • The "How the site is used" heading stays, so existing links still work.
• Subprocessors: the HeyCatch row and paragraph are gone.
• POLICIES_UPDATED is now 2026-10-21, with a history entry saying HeyCatch was removed. The 2026-10-09 entry that added it stays, since the history is a public record.
• The self-hosting guide's "Site analytics" row now reads "None". HeyCatch is also out of the privacy-erasure runbook.

Is "no third-party analytics" true? We searched for gtag, plausible, umami, mixpanel, amplitude, hotjar, clarity and sendBeacon, and found none. Fonts are self-hosted. The only third-party script left is Cloudflare Turnstile, which the policy already covers.

Checks:

• tsc is clean.
• Web tests pass: 1,163, with 0 failing and 1 skipped.
• Build: all 291 routes load, and the deploy check passes.
• The docs site builds (595 pages).
• Prettier is clean.

Dependency review

Passed. 4 dependency changes, none vulnerable.

package-lock.json

This check fails on vulnerabilities of high severity or higher. Change it in the repository's Security settings.