[Flotapponnier]

The submission scan rejected the privacy policy with "Review the plugin's privacy policy against the submission guidelines." The guidelines ask for five things by name:

the categories of personal data collected, the purposes of use, the categories of recipients, data retention timelines, and any controls offered to your users

Mine was written as prose and a reviewer could not find them. The page is now ordered to match. Checking each claim against the running system turned up two that were wrong.

It said no IP address is stored

That was true of the server-side capture (analytics-server.ts sets none and disables person profiles) and false of the site as a whole: the browser SDK posts through /ingest and PostHog records the request IP on ingestion, with anonymize_ips off on this project.

Measured today:

event	n	with IP
$pageview	4,382	4,382
$web_vitals	2,049	2,049
stat_read	1,319	1,319
citable_read	665	665

100% of events, every type — and PostHog derives country and city from it ("United States / Ashburn", "France / Rumilly"). Understating what is collected is as wrong as overstating it, and this is the claim a reader would most reasonably rely on.

It gave no retention period at all

One of the five, and simply absent. The project's configured product_analytics_data_retention is 1 year. Rate-limit counters live in process memory and die with the deploy. Benchmark measurements are kept indefinitely because they describe providers, not visitors.

Also added

Verified and now stated: autocapture: false (nothing recorded but the named events) and session_recording_opt_in: false (no replays, no heatmaps). Plus the processors by name (PostHog, Vercel), a children's clause, and the fact that the MCP endpoint redacts anything credential-shaped out of a query before it can appear in a response.

One decision left to you

I did not change whether an IP is collected. PostHog has an anonymize_ips setting that would make the original claim true rather than documenting the collection. That is a change to how the site measures its own traffic — your call, not a silent edit. Say the word and it is a one-line toggle; the policy would then say no IP is retained, truthfully.

tsc clean, 412 tests pass, pnpm validate passes.