Dev Log: How a Free, Privacy-First Site Pays for Itself

這是 LocalPapa Notes 開發紀錄系列的第五篇。前四篇都在講技術——做工具、拆架構、做 SEO。這一篇講一件比較少人願意攤開來談的事：錢。

公開建造（building in public）如果只秀漂亮的部分，就不算誠實。所以這篇，我們聊聊一個免費網站怎麼養活自己。

免費，不等於沒有成本

LocalPapa 對使用者免費，而且承諾檔案永遠不離開你的裝置。但「免費」是對你，不是對我們——網域要錢、託管要錢，未來的同步資料庫也要錢。

一個工具站如果長期入不敷出，最後只有兩條路：收掉，或是開始對使用者做不該做的事（賣資料、硬塞付費牆）。我們兩個都不想。於是有了 v1.4.0——在不動搖核心承諾的前提下，引入廣告做為永續的營運資金來源。

原則先講清楚

加廣告很容易做成「為了賺錢什麼都來」。所以動工前先立規矩：

隱私承諾不退讓。 廣告是廣告，工具是工具。你的檔案依然 100% 在瀏覽器本地處理，不會因為有廣告就被上傳。
不能拖慢工具。 工具箱的「秒開」體驗是招牌，不能為了廣告犧牲。
合規不是選配。 要投放廣告，就把法規該做的一次做齊，而不是先上線再說。

三件必須做對的事

接 Google AdSense 不是貼一段腳本就好，背後有三塊基礎工程：

1. ads.txt — 證明「這些廣告位是我授權的」 在網站根目錄放一份 ads.txt，用發佈商 ID 與 Google 憑證聲明哪些廣告來源是經我們授權的。這能避免廣告流量被判定為未授權或無效——是廣告生態裡防詐騙的標準作法。

2. CSP — 讓廣告能跑，又不破壞安全防線 這塊最棘手。LocalPapa 有嚴格的內容安全政策（CSP, Content Security Policy）來防 XSS。但 AdSense 與 DoubleClick 載入廣告時會動態注入第三方 iframe 與統計代碼，預設會被我們的 CSP 擋下。

解法是精準開白名單：只在 script-src、frame-src、connect-src 放行 Google 官方授權的網域（googlesyndication.com、doubleclick.net 等），而不是把政策整個放寬。安全防線只開必要的縫，不是拆掉。

3. 非同步載入 — 廣告慢，工具不能跟著慢 廣告腳本一律用 async 載入，讓它不跟瀏覽器解析主頁面的執行緒搶資源。廣告自己慢慢來，工具該秒開還是秒開。

別忘了隱私政策本身

廣告會用到 Cookie 做個人化投放，這在歐盟（GDPR）與加州（CCPA）有明確的告知義務。所以我們同步更新了多語系的隱私政策頁，明列 AdSense 相關聲明——讓不同地區的訪客都拿到完整、合規的告知。

有點諷刺也很合理：一個主打隱私的網站，在「對使用者誠實揭露資料如何被使用」這件事上，標準只能更高、不能更低。

學到的事

永續本身就是一種對使用者的負責。 養得活的網站，才談得上長期守護那個隱私承諾；錢的問題逃避不了，只能正面解。
變現與價值觀不必二選一。 關鍵在劃清界線：廣告碰的是版面，碰不到你的檔案。
合規是工程，不是法務作文。 ads.txt、CSP 白名單、async、隱私政策——每一項都是要落到程式碼與設定裡的具體工作。
公開建造要連帳單一起公開。 只講功能不講成本，不算真的透明。

一以貫之的問題

前幾篇問的是「能不能在瀏覽器完成」「怎麼被找到」。這一篇問的是更現實的一個：怎麼讓這一切撐得久？

答案是：在不出賣使用者的前提下，誠實地把網站養活。

下一篇開發紀錄，我們會回到工具本身——手機感測器的即時資料串流。想追蹤系列？把 LocalPapa Notes 加入書籤吧。

This is the fifth post in the LocalPapa Notes dev-log series. The first four were about technology — building tools, splitting architecture, doing SEO. This one is about something fewer people are willing to lay bare: money.

Building in public isn't honest if you only show the pretty parts. So this time, let's talk about how a free site pays for itself.

Free doesn't mean free of cost

LocalPapa is free for users, and promises your files never leave your device. But "free" is for you, not for us — domains cost money, hosting costs money, and the future sync database will too.

A tool site that runs at a loss long-term has only two exits: shut down, or start doing things to its users it shouldn't (selling data, slapping on paywalls). We wanted neither. Hence v1.4.0 — introducing ads as a source of sustainable operating funds, without shaking the core promise.

State the principles first

Ads are easy to turn into "anything goes if it makes money." So we set rules before starting:

No retreat on the privacy promise. Ads are ads; tools are tools. Your files are still processed 100% locally in the browser — having ads doesn't mean anything gets uploaded.
Don't slow the tools down. The toolbox's "instant open" is our signature; it can't be sacrificed for ads.
Compliance isn't optional. If you're going to serve ads, do the legal homework all at once — not "ship first, deal with it later."

Three things you must get right

Wiring up Google AdSense isn't just pasting a script. Three pieces of foundation sit behind it:

1. ads.txt — proving "these ad slots are authorised by me" A root-level ads.txt declares, via the publisher ID and Google's certification, which ad sources we've authorised. This keeps ad traffic from being flagged as unauthorised or invalid — the standard anti-fraud practice in the ad ecosystem.

2. CSP — let ads run without breaking the security line This is the trickiest part. LocalPapa runs a strict Content Security Policy (CSP) to prevent XSS. But AdSense and DoubleClick inject third-party iframes and analytics code when loading ads, which our CSP blocks by default.

The fix is a precise allowlist: permit only Google's officially-authorised domains (googlesyndication.com, doubleclick.net, etc.) in script-src, frame-src and connect-src — rather than loosening the policy wholesale. Open only the necessary gaps in the security line; don't tear it down.

3. Async loading — ads are slow; tools mustn't be The ad script always loads async, so it doesn't fight the browser's main thread while parsing the page. Ads can take their time; tools still open instantly.

Don't forget the privacy policy itself

Ads use cookies for personalised delivery, which carries clear disclosure obligations under GDPR (EU) and CCPA (California). So we updated the multilingual privacy policy pages in step, spelling out the AdSense-related statements — so visitors in every region get complete, compliant disclosure.

A little ironic, and entirely fitting: a privacy-first site has to hold itself to a higher standard, not a lower one, when it comes to honestly disclosing how data is used.

What we learned

Sustainability is itself a responsibility to users. Only a site that survives can keep guarding that privacy promise long-term. You can't dodge the money question; you can only face it.
Monetisation and values aren't either/or. The key is drawing the line: ads touch the layout, never your files.
Compliance is engineering, not legal prose. ads.txt, CSP allowlists, async, privacy policy — each is concrete work that lands in code and config.
Building in public means publishing the bills too. Talking only about features and never costs isn't real transparency.

The same question, made real

Earlier posts asked "can this be done in the browser?" and "how do people find it?" This one asks the most practical one of all: how does all of this last?

The answer: keep the site alive honestly, without selling out the people who use it.

In the next dev log, we head back to the tools themselves — real-time data streaming from phone sensors. Want to follow the series? Bookmark LocalPapa Notes.