The privacy page

The template comes with a privacy page at /privacy/:

Fill in who answers for your visitors' data

In site.yaml:

privacy:
  controller: Bakery on Main LLC      # the person or organization responsible
  contact: privacy@bakeryonmain.example   # an address to write to
  updated: 11 October 2026            # when the notice last changed

Or in the editor's Privacy & statistics. The checks warn if there's no address to write to.

What it lists, by itself

Every time the site is built, the page lists what your site uses that touches visitors' data, from your settings:

• the statistics, if any, and whether they wait for consent;
• every form, where its submissions go, and Cloudflare Turnstile if a form uses it;
• every other website your pages load things from (your check.allow_third_party list).

Turn statistics on, add a form or a video from another site, and the page says so the next time you publish.

Anything else

For something HotDog can't see, like an embedded map you added by hand, add it under extra:

privacy:
  controller: Bakery on Main LLC
  contact: privacy@bakeryonmain.example
  extra:
    - { what: Map of our shop, who: OpenStreetMap, why: Showing where we are, basis: Legitimate interest }

basis is the legal reason you rely on: your visitor's consent, a legitimate interest, a contract, and so on.

Your own words

The page itself is content/privacy.md. Write anything you like above the list: who you are, how long you keep messages, how to ask for your data. The list keeps itself up to date below.

HotDog helps you be accurate; it isn't legal advice. If you're not sure what your privacy page must say where you are, ask someone who knows the law there.