ots page: privacy-shield section at the bottom

After we wired the /digest proxy, ordpool is now a full shield for OTS
stamping and verification -- calendars never observe end-users, and
our own infrastructure keeps no per-request user data. Surface that
property where users can see it: a centred shield icon (FA
shield-halved, registered in shared.module), a lead sentence, three
column blurbs (file stays local, calendars only see us, no user-data
logs), and one footnote naming Cloudflare as the only caveat plus
the VPN mitigation.

Tone: factual, no marketing. The three columns each pin a distinct
mechanism so the claim is auditable rather than vague.

Author: hans-crypto

frontend/src/app/components/_ordpool/open-timestamps/open-timestamps.component.html

@@ -166,4 +166,49 @@ <h2 id="recent-commits" class="mt-4">Recent commits</h2>
     </table>
     </div>
   }
+
+  <hr class="my-5">
+
+  <section class="ots-privacy text-center">
+    <fa-icon class="ots-privacy-icon" [icon]="['fas', 'shield-halved']"></fa-icon>
+    <h2 class="mt-3">Your privacy is the point</h2>
+    <p class="lead">
+      Ordpool is the shield. We carry every external request for you so
+      no third party sees who's stamping or verifying what.
+    </p>
+
+    <div class="row mt-4 text-start">
+      <div class="col-md-4 mb-3">
+        <h5>Your file never leaves your browser</h5>
+        <p class="text-muted">
+          We compute the 32-byte SHA-256 fingerprint locally. Only the hash
+          is ever transmitted &mdash; never the contents, never the filename.
+        </p>
+      </div>
+      <div class="col-md-4 mb-3">
+        <h5>Calendars only see us</h5>
+        <p class="text-muted">
+          Stamp submissions and confirmation polls both route through our
+          backend. The four public calendar operators receive ordpool's IP,
+          not yours, on every request.
+        </p>
+      </div>
+      <div class="col-md-4 mb-3">
+        <h5>We don't log who you are</h5>
+        <p class="text-muted">
+          Our backend keeps no per-request user data &mdash; no IPs, no
+          hashes, no timestamps in any logfile we control.
+        </p>
+      </div>
+    </div>
+
+    <p class="text-muted mt-3">
+      <small>
+        One honest caveat: Cloudflare sits in front of ordpool.space for
+        DDoS protection and records standard CDN metadata (your IP, your
+        country, the request path). If you don't trust them either, run a
+        VPN on top &mdash; then there's no path back to you.
+      </small>
+    </p>
+  </section>
 </div>

frontend/src/app/components/_ordpool/open-timestamps/open-timestamps.component.scss

@@ -16,3 +16,28 @@
     font-size: 0.75rem;
   }
 }
+
+.ots-privacy {
+  padding: 2rem 0 3rem;
+
+  .ots-privacy-icon {
+    font-size: 3rem;
+    color: var(--primary);
+    display: inline-block;
+    line-height: 1;
+  }
+
+  h2 {
+    font-weight: 600;
+  }
+
+  .lead {
+    max-width: 640px;
+    margin: 0.5rem auto 0;
+  }
+
+  h5 {
+    font-weight: 600;
+    margin-bottom: 0.4rem;
+  }
+}

frontend/src/app/shared/shared.module.ts

@@ -16,6 +16,8 @@ import { faFilter, faAngleDown, faAngleUp, faAngleRight, faAngleLeft, faBolt, fa
   // "Could not find icon with iconName=<x> and prefix=fas" the moment the master-page
   // template tries to render the nav.
   faCubes, faBook, faChartArea, faFaucetDrip, faHammer, faCheckCircle, faTimesCircle,
+  // HACK -- Ordpool: shield icon used by the privacy section on the OTS page.
+  faShieldHalved,
 } from '@fortawesome/free-solid-svg-icons';
 import { InfiniteScrollModule } from 'ngx-infinite-scroll';
 import { MenuComponent } from '@components/menu/menu.component';
@@ -599,6 +601,7 @@ export class SharedModule {
     library.addIcons(faCode);
     library.addIcons(faPause);
     library.addIcons(faPlay);
+    library.addIcons(faShieldHalved);
     // HACK -- Ordpool: post-upstream-merge missing registrations. See import comment.
     library.addIcons(faCubes);
     library.addIcons(faBook);