fix: F-Droid compliance - remove tracking, proprietary deps, and external assets
Description:
Refactored the project to achieve full F-Droid compliance by removing all proprietary dependencies, tracking/analytics SDKs, and external CDN usage. Ensured all assets and dependencies are locally managed and build is fully reproducible.
- Removed PostHog analytics completely (posthog-js) from codebase and dependencies
- Removed lovable-tagger (proprietary dev tool) from project
- Cleaned and regenerated dependency lock files to eliminate transitive references
- Replaced all external CDN usage (jsdelivr, unpkg, placeholder) with local assets
- Bundled PDF.js worker locally instead of loading from CDN
- Configured Leaflet marker icons to use local files
- Removed Google Services Gradle plugin for Android compliance
- Verified no deprecated storage permissions in AndroidManifest
- Ensured no tracking, analytics, or proprietary SDKs remain
- Maintained existing functionality and UI without breaking changes
Type of Change:
-
Bug Fix -
Feature Development -
Documentation
Testing:
-
Tested on desktop -
Tested on mobile -
Tested in different browsers
Screenshots (if applicable):
No UI changes. All changes are internal (compliance, dependency cleanup, and configuration).
Video Demo
N/A (No UI/feature changes)
Checklist:
-
Code follows project style guidelines -
Self-review completed -
No console errors -
TypeScript types are correct
Final F-Droid Audit Statement:
The project has been fully audited for F-Droid compliance and meets all required criteria:
- No proprietary dependencies (posthog-js, lovable-tagger removed)
- No tracking or analytics SDKs present
- No external CDN usage (all assets are local)
- Android configuration is compliant (no Google services, no deprecated permissions)
- Build is reproducible and passes successfully
- Codebase is clean with no forbidden references
Final Verdict: