Action: Update Sentry integration in the Next.js app to minimize privacy impact. Implement a beforeSend hook to scrub PII (emails, usernames, IPs) from events, disable default PII collection (sendDefaultPii: false), and ensure cookies/authorization headers are not captured. Gate telemetry behind an explicit user consent toggle and document data practices in the privacy policy. Example outline: 1) configure Sentry.init with sendDefaultPii: false and a beforeSend that removes event.user, event.request.headers.cookie, and event.request.headers.authorization, and redact email-like strings in event.message. 2) Do not include PII in any URL or payload. 3) Add a privacy-consent toggle and only enable Sentry after consent. 4) Add tests to verify no PII remains in payloads before sending.

Actionable fix: Inspect the signup/login/AI widget component. Remove any immediate or unconditional calls to AI/LLM endpoints on page load. Implement a consent/activation flow for the AI feature (e.g., a modal or toggle) and load the AI widget only after user clicks 'Enable AI Assistant' or interacts with the widget. Move AI calls behind a feature flag and ensure requests include user consent and appropriate data minimization. Add error handling for AI requests and log any privacy-impacting events with user-visible notices.

Update the Next.js/CDN configuration to serve all /_next/static/*, manifest.webmanifest, and font files with proper Cache-Control: max-age and immutable where appropriate. Enable gzip/Brotli compression and verify that the assets are fingerprinted for long-term caching. After changes, revalidate with a cache headers check and ensure the resources have explicit caching rules.