Update privacy documents

TurboWarp/scratch-gui@4d90950

Author: GarboMuffin

docs/privacy.html

@@ -71,10 +71,13 @@
     <main>
       <h1>Privacy Policy</h1>
 
-      <p><i>Updated May 24, 2024 (v1.12.0)</i></p>
+      <p><i>Updated September 27, 2025</i></p>
 
       <p>A comprehensive privacy policy for all of TurboWarp can be found at <a href="https://turbowarp.org/privacy.html">https://turbowarp.org/privacy.html</a>. Here, we have simplified it down to just the parts relevant to the desktop app.</p>
 
+      <h2>Abuse</h2>
+      <p>When a service is being abused, we may take measures to collect information to protect the service. For example, we could log IP addresses making excessive amounts of requests. We strive to do this carefully so that no one is caught in the crossfire. Data is kept only as long as needed to stop the abuse.</p>
+
       <h2>This website</h2>
       <p>Some download links on the website are stored on GitHub. GitHub maintains a public download count for these files.</p>
 
@@ -87,8 +90,10 @@ <h2>Rich Presence</h2>
       <h2>Loading projects</h2>
       <p>When you load a project from another website, you are subject to the privacy practices of that website. For example, when loading projects from Scratch, you are subject to the <a href="https://scratch.mit.edu/privacy_policy">Scratch privacy policy</a>. When loading projects from Scratch specifically, the project ID will also be shared with TurboWarp as part of Scratch's API does not allow direct access. We may briefly log the project ID for caching.</p>
 
-      <h2>Running projects</h2>
-      <p>When connecting to our cloud variable servers (in the desktop app, this will only happen in packaged projects, not in the editor), the project ID and username may be logged for 14 days. Data in cloud variables is sent to anyone else connected at the same time. Custom cloud variable servers are outside of our control.</p>
+      <h2>Cloud variables</h2>
+      <p>When connecting to our cloud variable servers, the project ID and username may be logged for 14 days. Data in cloud variables is public and sent to anyone else connected at the same time. Custom cloud variable servers are outside of our control.</p>
+
+      <h2>Extensions</h2>
       <p>Some extensions must communicate with external APIs to function. For example, the translate and text-to-speech extensions rely on the Scratch API, which is covered by the <a href="https://scratch.mit.edu/privacy_policy">Scratch privacy policy</a>. To improve performance, some extensions access TurboWarp's APIs instead where both the request (for example, the text being translated) and the result after forwarding to Scratch (for example, the translated version of the text) may be cached.</p>
       <p>Most extensions on the <a href="https://extensions.turbowarp.org/">official extension gallery</a> will ask for permission when the project attempts to use the extension to access an untrusted website, however we cannot guarantee this is 100% reliable.</p>
       <p>When loading a custom extension from a place other than the official gallery such as a URL or file on your computer, the editor will ask for permission to load the extension. If you approve this dialog, the extension can bypass the permission dialogs that official extensions show.</p>

src-renderer/privacy/privacy.html

@@ -38,13 +38,16 @@
 
       <h1>Privacy Policy</h1>
 
-      <p><i>Updated September 8, 2023 (v1.9.0)</i></p>
+      <p><i>Updated September 27, 2025</i></p>
 
       <p>A comprehensive privacy policy for all of TurboWarp can be found at <a href="https://turbowarp.org/privacy.html">https://turbowarp.org/privacy.html</a>. Here, we have simplified it down to just the parts relevant to the desktop app.</p>
 
       <h2 class="if-update-checker">Update Checker</h2>
       <p class="if-update-checker">The desktop app contains an update checker which <a href="#" class="open-desktop-settings">can be disabled in desktop settings</a>.</p>
 
+      <h2>Abuse</h2>
+      <p>When a service is being abused, we may take measures to collect information to protect the service. For example, we could log IP addresses making excessive amounts of requests. We strive to do this carefully so that no one is caught in the crossfire. Data is kept only as long as needed to stop the abuse.</p>
+
       <h2>Rich Presence</h2>
       <p>The desktop app has a disabled-by-default option to enable "Rich Presence" which shares the name of the project you have open and how long it has been open with chat apps running on your computer, which may be displayed on your public profile. This <a href="#" class="open-desktop-settings">can be configured in desktop settings</a>.</p>
 
@@ -59,8 +62,10 @@ <h2>Rich Presence</h2>
       <h2>Loading projects</h2>
       <p>When you load a project from another website, you are subject to the privacy practices of that website. For example, when loading projects from Scratch, you are subject to the <a href="https://scratch.mit.edu/privacy_policy">Scratch privacy policy</a>. When loading projects from Scratch specifically, the project ID will also be shared with TurboWarp as part of Scratch's API does not allow direct access. We may briefly log the project ID for caching.</p>
 
-      <h2>Running projects</h2>
-      <p>When connecting to our cloud variable servers (in the desktop app, this will only happen in packaged projects, not in the editor), the project ID and username may be logged for 14 days. Data in cloud variables is sent to anyone else connected at the same time. Custom cloud variable servers are outside of our control.</p>
+      <h2>Cloud variables</h2>
+      <p>When connecting to our cloud variable servers, the project ID and username may be logged for 14 days. Data in cloud variables is public and sent to anyone else connected at the same time. Custom cloud variable servers are outside of our control.</p>
+
+      <h2>Extensions</h2>
       <p>Some extensions must communicate with external APIs to function. For example, the translate and text-to-speech extensions rely on the Scratch API, which is covered by the <a href="https://scratch.mit.edu/privacy_policy">Scratch privacy policy</a>. To improve performance, some extensions access TurboWarp's APIs instead where both the request (for example, the text being translated) and the result after forwarding to Scratch (for example, the translated version of the text) may be cached.</p>
       <p>Most extensions on the <a href="https://extensions.turbowarp.org/">official extension gallery</a> will ask for permission when the project attempts to use the extension to access an untrusted website, however we cannot guarantee this is 100% reliable.</p>
       <p>When loading a custom extension from a place other than the official gallery such as a URL or file on your computer, the editor will ask for permission to load the extension. If you approve this dialog, the extension can bypass the permission dialogs that official extensions show.</p>