Privacy: no visitor is sent to a third party any more without their consent.
Added
- A real choice about services from other companies. The cookie banner only controlled Google Analytics, while videos, the Discord widget and captchas loaded whatever the visitor answered. The "Manage my cookies" window, opened from the footer of every page, shows the site's own cookies, then each service, to accept or refuse one by one. In place of a YouTube, Twitch, Vimeo or Dailymotion video, a Spotify or SoundCloud track, or the Discord widget, a notice says who would receive the visitor's IP address, with "Show" and "Always allow". The banner only opens if the site really has something to ask up front (audience measurement, a captcha run by a third party); "Accept all" and "Refuse all" carry the same weight. The choice is kept for six months, and its record, without the IP address, for thirteen months.
- Settings → Privacy: the legal notice and privacy policy pages, chosen from the published pages. Every theme's footer links to them, next to "Manage my cookies".
Changed
- Fonts are served by the site: the themes and the "Site font" setting took them from Google Fonts, and every visitor's browser sent its IP address to Google, on every page.
- Images from other sites are served by the site — a Discord, Steam or Twitch avatar, a GIF in a conversation, an image pasted into an article, the forum or a classified ad, an ad banner: the site fetches them itself and keeps them for seven days, and the browser no longer contacts their host. The places map tiles too.
- The security policy now only accepts the site itself for images and script connections (except Google Analytics, if configured). It now lets the players of known services (YouTube, Twitch, Vimeo, Dailymotion, Spotify, SoundCloud, Discord) display, which it used to block: a video in an article did not show. A script from another site pasted into an "HTML code" widget or an ad no longer runs: only Google Analytics and the chosen captcha get through.
- Until the visitor accepts a third-party captcha, ALTCHA replaces it, served by the site: no one has to hand their data to Google, hCaptcha or Cloudflare to write to the site or sign up.
- No more tracking pixel in the newsletter, and no more open rate: a tracker the subscription did not ask for (CNIL recommendation of 12 March 2026 on tracking pixels in emails).
- Retention periods: the audit log one year, the anti-abuse counters one day, newsletter subscriptions never confirmed thirty days, the newsletter sending queue ninety days; for a report handled more than a year ago, its author's IP address and the copy of the content are removed. The login cookie ends when the browser closes, except with "Remember me" (one year), which is no longer ticked by default.
- No more Google maps in texts: a Google Maps map embedded in a text is no longer accepted. The product's map is the "Places map" module, based on OpenStreetMap.
- The themes' "Powered by NeoFrag Reborn" link, the
{neofrag}copyright keyword and the admin footer links lead to the project's site; they used to lead to the original NeoFrag site.
Fixed
- No IP address is sent to neofr.ag any more: the country flag next to session addresses is removed; to get it, the administrator's browser sent all of these addresses to the original NeoFrag site.
- Deleting an account as an administrator really erases the profile, linked accounts, login history and notifications, like the deletion a member requests themselves; it used to only close the account.
- The "My data" archive now downloads: three of its lists (forum topics, comments, conversation messages) read columns that do not exist, and the archive failed.
- The tooltips of the session list and the gallery now show: they carried a Bootstrap 4 attribute, which Bootstrap 5 ignores, and stayed empty.
- The Steam widget avatar address was written into the page as is; it is now escaped, like the rest of the widget.
- The "Open the channel" tooltip and the "Close" button of the Twitch widget player, left in French, are translated.