diff --git a/deploy/Caddyfile.example b/deploy/Caddyfile.example
index 8e6c7b7..c94a9d9 100644
--- a/deploy/Caddyfile.example
+++ b/deploy/Caddyfile.example
@@ -144,3 +144,9 @@ catcrafts.net {
 		}
 	}
 }
+
+# www -> apex. DNS A/AAAA for www point at this box; Caddy obtains the
+# certificate automatically. 308 to match the redirs above.
+www.catcrafts.net {
+	redir https://catcrafts.net{uri} 308
+}
diff --git a/shared/interfaces/Catcrafts.Shared-Content.cppm b/shared/interfaces/Catcrafts.Shared-Content.cppm
index 9d5ea5a..6c2832c 100644
--- a/shared/interfaces/Catcrafts.Shared-Content.cppm
+++ b/shared/interfaces/Catcrafts.Shared-Content.cppm
@@ -216,7 +216,7 @@ export const std::vector<LegalPage>& LegalPages() {
                   {
                       "Order records that belong to an invoice are kept for seven years. That is the Dutch fiscal retention obligation, and it is the one case where a deletion request cannot be honoured early. Everything in an order that the tax records do not need is deleted on request.",
                       "An order that is never paid lapses; its record is kept briefly for abuse spotting and then has no reason to exist.",
-                      "The order file is stored on a machine Catcrafts runs, readable only by the service account, and encrypted before any backup leaves that machine.",
+                      "The order file is stored on machine hosted by hetzner, a GDPR compliant german cloud hosting service.",
                   } },
                 { "What this site does not do",
                   {
@@ -226,7 +226,7 @@ export const std::vector<LegalPage>& LegalPages() {
                 { "Server logs",
                   {
                       "The web server keeps ordinary request logs. Those exist to debug faults and spot abuse, and are not connected to order records or used to build any kind of profile.",
-                      "Those logs are also this site's only analytics: a page of aggregate statistics, computed on the server, with visitor addresses anonymized before anything is stored. A tally like that is nothing to keep secret, so you are free to take a look yourself at catcrafts.net/analytics.",
+                      "Those logs are also this site's only analytics: a page of aggregate statistics, computed on the server, with visitor addresses anonymized before anything is stored. A tally like that is nothing to keep secret, so you are free to take a look yourself at https://catcrafts.net/analytics.",
                   } },
                 { "Your rights",
                   {
@@ -234,7 +234,7 @@ export const std::vector<LegalPage>& LegalPages() {
                   } },
                 { "Changes",
                   {
-                      "This page has a date at the top. Anything that changes what is collected or why gets a new date, and you do not have to take the date's word for it: every previous version of this page, with the exact diff, is public at catcrafts.net/legal/privacy/history.",
+                      "This page has a date at the top. Anything that changes what is collected or why gets a new date, and you do not have to take the date's word for it: every previous version of this page, with the exact diff, is public at https://catcrafts.net/legal/privacy/history.",
                   } },
             },
         },