legal-open-source

description: Legal and privacy baseline context for every implementation alwaysApply: true

This project may be published as open-source software under the MIT license and may process personal data in club, judo, and tournament contexts.

These rules do not replace legal advice. They serve as technical guardrails so implementations do not ignore legal risks.

For every implementation, check:

• Is personal data processed, stored, synchronized, exported, or displayed?
• Are children, minors, parents, competitors, referees, tournament directors, club members, or organizers affected?
• Is data visible publicly or to unauthorized roles?
• Is the feature implemented with data minimization?
• Is there a role or permission check at a trusted layer?
• Is data transferred to external services, e.g. Supabase, email, GitHub, or hosting providers?
• Are logs, error output, or debug data produced that could contain personal data?
• Must documentation such as README.md, SECURITY.md, privacy notice, or operator guidance be updated?

Open-source and MIT context:

• No feature or documentation may claim the software is automatically GDPR-compliant, legally sound, or certified.
• Wording should clarify that operators are responsible for the specific deployment, legal basis, permissions, retention, and information obligations.
• Do not use real personal data in examples, tests, seeds, screenshots, or demos.
• License and copyright notices must be preserved.