Marketing Website (Bme-konza-website)

Static site at bme-konza.org. Also the host for legal pages and the Android App Links file.

Contents

index.html        # landing page
policy.html       # privacy policy
terms.html        # terms of service
deletion.html     # account/data deletion instructions (Play Store requirement)
assets/
.well-known/
  assetlinks.json # Android App Links / Digital Asset Links

Plain static HTML (Bootstrap-flavoured). No build step. Deployed via Coolify as static content. [TODO: confirm how it's served — static site in Coolify / nginx.]

  • policy.html — privacy policy (linked from the Play listing and the apps).
  • terms.html — terms of service.
  • deletion.html — account & data deletion instructions. Google Play requires a reachable data-deletion route; keep this URL live and in sync with the listing. See 16-contacts-ownership (private handover docs) for who handles deletion requests and how (the API exposes user data; soft-delete vs hard-delete policy [TODO]).

.well-known/assetlinks.json delegates URL handling to package org.bmekonza.app and lists two SHA-256 cert fingerprints:

  • the upload key fingerprint, and
  • the Google Play app-signing key fingerprint.

Both must be present for deep links to verify on installs from Play (Play re-signs with the app-signing key). See 10-mobile-app.md.

⚠️ Host mismatch to verify. The production app's deep-link host is app.bme-konza.org (and <STAGING_DEEPLINK_HOST> for staging), but this assetlinks.json is served from bme-konza.org. App Links verify against the file at https://<deep-link-host>/.well-known/assetlinks.json. Confirm the file is reachable at https://app.bme-konza.org/.well-known/assetlinks.json (and staging host), not only the apex domain. FILL: confirm DNS + where this file is actually served — see [02 *(private handover docs)*.]