spsays-training/app/(legal)/privacy/page.tsx

import type { Metadata } from "next";
import Link from "next/link";
import { PageHeader } from "@/components/page-header";
import { buildOgMeta } from "@/lib/og";

const EFFECTIVE_DATE = "June 1, 2026";
const CONTACT_EMAIL = "support@prabhupadasays.org";
const OPERATOR = "Krispire Solutions LLP";
const SERVICE = "Prabhupāda Says";

export function generateMetadata(): Metadata {
  return buildOgMeta({
    title: "Privacy Policy — Prabhupāda Says",
    quote:
      "How we collect, use, and protect your information when you use Prabhupāda Says.",
  });
}

export default function PrivacyPolicyPage() {
  return (
    <div className="min-h-screen bg-background">
      <PageHeader>
        <Link
          href="/"
          className="text-sm text-muted-foreground hover:text-foreground transition-colors"
        >
          &larr; Home
        </Link>
        <h1 className="mt-3 text-3xl font-bold text-foreground">
          Privacy Policy
        </h1>
        <p className="mt-1 text-muted-foreground">
          Effective {EFFECTIVE_DATE}
        </p>
      </PageHeader>

      <main className="max-w-3xl mx-auto px-6 py-10 space-y-10 text-[15px] leading-relaxed text-muted-foreground">
        <section className="space-y-3">
          <p>
            This Privacy Policy explains how {OPERATOR} (&ldquo;we&rdquo;,
            &ldquo;us&rdquo;, &ldquo;our&rdquo;) collects, uses, stores, and
            shares your personal information when you use {SERVICE}{" "}
            (the &ldquo;Service&rdquo;) available at prabhupadasays.org. By using
            the Service you agree to the practices described below.
          </p>
          <p>
            We are committed to handling your information lawfully, fairly, and
            transparently in accordance with India&rsquo;s Digital Personal Data
            Protection Act, 2023 (DPDP Act).
          </p>
        </section>

        <Section title="1. Who we are">
          <p>
            The Service is developed and owned by {OPERATOR}, a limited
            liability partnership registered in India. For any questions about
            this Policy or your personal data, contact us at{" "}
            <a
              href={`mailto:${CONTACT_EMAIL}`}
              className="text-primary underline-offset-4 hover:underline"
            >
              {CONTACT_EMAIL}
            </a>
            .
          </p>
        </Section>

        <Section title="2. Information we collect">
          <p>We collect only the information needed to operate the Service:</p>

          <h3 className="mt-4 text-base font-semibold text-foreground">
            (a) Information you give us
          </h3>
          <ul className="list-disc pl-6 space-y-1.5">
            <li>
              <strong className="text-foreground">Account details</strong> when
              you sign up by email: your name, email address, password (stored
              only as a one-way bcrypt hash &mdash; we never see or store your
              plain password), and a public handle.
            </li>
            <li>
              <strong className="text-foreground">Profile information</strong>{" "}
              that you choose to add: display name, handle, and an optional
              avatar image you upload.
            </li>
            <li>
              <strong className="text-foreground">User content</strong> you
              create within the Service, such as posts (selected quotes you
              choose to share publicly), bookmarks (private), collections
              (private or public), and short share links.
            </li>
            <li>
              <strong className="text-foreground">Reading preferences</strong>{" "}
              such as your chosen font, theme, and palette, so the reading
              experience follows you across devices.
            </li>
            <li>
              <strong className="text-foreground">Feedback messages</strong>{" "}
              you submit through the feedback form, including any contact
              email you provide.
            </li>
          </ul>

          <h3 className="mt-4 text-base font-semibold text-foreground">
            (b) Information from third-party sign-in
          </h3>
          <ul className="list-disc pl-6 space-y-1.5">
            <li>
              If you choose &ldquo;Login with Google&rdquo; or
              &ldquo;Login with Facebook&rdquo;, we receive a stable
              provider user identifier, your email, your name, and your
              profile picture URL from that provider. We use this information
              solely to create or sign you in to your account.
            </li>
          </ul>

          <h3 className="mt-4 text-base font-semibold text-foreground">
            (c) Information collected automatically
          </h3>
          <ul className="list-disc pl-6 space-y-1.5">
            <li>
              <strong className="text-foreground">Session cookies.</strong> We
              set an httpOnly, secure session cookie (
              <code className="font-mono text-xs">spsays_auth</code>) after
              you sign in, so you stay signed in across page loads. During
              third-party sign-in we briefly set a second cookie (
              <code className="font-mono text-xs">spsays_oauth_state</code>)
              to protect against cross-site request forgery; it is deleted at
              the end of the sign-in handshake.
            </li>
            <li>
              <strong className="text-foreground">Share link analytics.</strong>{" "}
              When someone clicks a short share link, we log the timestamp
              and whether the request came from a known social-media link
              preview bot. We do not log IP addresses or build user profiles
              from this data.
            </li>
            <li>
              <strong className="text-foreground">Standard server logs.</strong>{" "}
              Our servers retain short-lived logs containing request paths,
              status codes, and timing for security and reliability. These
              logs are not used for advertising or profiling.
            </li>
          </ul>
        </Section>

        <Section title="3. How we use your information">
          <ul className="list-disc pl-6 space-y-1.5">
            <li>To create and operate your account, and authenticate you.</li>
            <li>
              To deliver the features you request &mdash; bookmarks,
              collections, posts, share links, search, and reading
              preferences.
            </li>
            <li>
              To send transactional emails: email verification, password
              reset, and notifications you have opted into.
            </li>
            <li>
              To respond to your feedback, questions, and support requests.
            </li>
            <li>
              To protect the Service against abuse, fraud, and security
              incidents.
            </li>
            <li>
              To comply with applicable laws, court orders, and lawful
              requests by public authorities.
            </li>
          </ul>
          <p>
            We do not sell your personal information, and we do not use it for
            advertising or to build profiles about you for third parties.
          </p>
        </Section>

        <Section title="4. Legal bases">
          <p>
            Where the DPDP Act or other applicable law requires a legal basis,
            we rely on the following:
          </p>
          <ul className="list-disc pl-6 space-y-1.5">
            <li>
              Your <strong className="text-foreground">consent</strong>, given
              when you sign up or submit information voluntarily.
            </li>
            <li>
              The <strong className="text-foreground">performance of our
              service</strong> to you (for example, processing your account
              so you can sign in).
            </li>
            <li>
              Our <strong className="text-foreground">legitimate
              interests</strong> in keeping the Service secure, preventing
              abuse, and improving reliability.
            </li>
            <li>
              <strong className="text-foreground">Legal obligations</strong>{" "}
              we are required to meet.
            </li>
          </ul>
        </Section>

        <Section title="5. Sharing your information">
          <p>
            We share your information only with the service providers we need
            to run {SERVICE}. Each provider is bound by contractual or
            statutory confidentiality obligations and processes data only on
            our instructions.
          </p>
          <ul className="list-disc pl-6 space-y-1.5">
            <li>
              <strong className="text-foreground">Google LLC</strong> &mdash;
              when you use &ldquo;Continue with Google&rdquo;, Google
              authenticates you and shares your profile basics with us.
            </li>
            <li>
              <strong className="text-foreground">Meta Platforms, Inc.</strong>{" "}
              &mdash; when you use &ldquo;Continue with Facebook&rdquo;,
              Facebook authenticates you and shares your profile basics with
              us.
            </li>
            <li>
              <strong className="text-foreground">Cloudflare, Inc.</strong>{" "}
              &mdash; we store avatar images you upload in Cloudflare R2
              object storage.
            </li>
            <li>
              <strong className="text-foreground">MongoDB, Inc. and
              hosting/infrastructure providers</strong> &mdash; we store
              account data and content in managed Postgres, MongoDB, and
              DragonflyDB instances.
            </li>
            <li>
              <strong className="text-foreground">Typesense, Inc.</strong>{" "}
              &mdash; we use a Typesense search index to power on-site search
              for public content.
            </li>
            <li>
              <strong className="text-foreground">Our email delivery
              provider</strong> &mdash; we send transactional emails (account
              verification, password reset, feedback notifications) via an
              SMTP relay.
            </li>
          </ul>
          <p>
            We may also disclose information when required by law, by valid
            legal process, or to protect the rights, property, or safety of
            our users, the public, or {OPERATOR}.
          </p>
        </Section>

        <Section title="6. International transfers">
          <p>
            Some of the providers listed above operate servers outside India.
            Where data is transferred internationally, we rely on the
            provider&rsquo;s standard contractual safeguards and security
            controls, in line with the DPDP Act and applicable cross-border
            transfer rules.
          </p>
        </Section>

        <Section title="7. How long we keep your information">
          <ul className="list-disc pl-6 space-y-1.5">
            <li>
              <strong className="text-foreground">Account data</strong> is
              kept for as long as your account is active.
            </li>
            <li>
              <strong className="text-foreground">User content</strong>{" "}
              (posts, bookmarks, collections, profile) is kept until you
              delete it or delete your account.
            </li>
            <li>
              <strong className="text-foreground">Password-reset and
              email-verification tokens</strong> expire within 1 hour and 24
              hours respectively, and are deleted shortly after.
            </li>
            <li>
              <strong className="text-foreground">Server and click logs</strong>{" "}
              are retained for a short operational window (typically 30 days
              or less) and then deleted or anonymised.
            </li>
            <li>
              <strong className="text-foreground">Feedback messages</strong>{" "}
              may be retained after your account is deleted, with your user
              identifier removed, so we can act on the product feedback you
              shared.
            </li>
          </ul>
        </Section>

        <Section title="8. Your rights">
          <p>
            Subject to the DPDP Act and other applicable laws, you have the
            right to:
          </p>
          <ul className="list-disc pl-6 space-y-1.5">
            <li>Access the personal information we hold about you.</li>
            <li>Correct information that is inaccurate or out of date.</li>
            <li>
              Request deletion of your account and personal information (see{" "}
              <Link
                href="/data-deletion"
                className="text-primary underline-offset-4 hover:underline"
              >
                Data Deletion
              </Link>
              ).
            </li>
            <li>Withdraw any consent you previously gave us.</li>
            <li>
              Nominate another person to exercise these rights on your behalf
              in the event of your death or incapacity.
            </li>
            <li>
              Lodge a grievance with us at{" "}
              <a
                href={`mailto:${CONTACT_EMAIL}`}
                className="text-primary underline-offset-4 hover:underline"
              >
                {CONTACT_EMAIL}
              </a>
              , or with the Data Protection Board of India.
            </li>
          </ul>
          <p>
            You can edit your name, handle, avatar, and reading preferences at
            any time from your profile settings. For any other request, write
            to us at the email above &mdash; we respond within 30 days.
          </p>
        </Section>

        <Section title="9. Children">
          <p>
            The Service is not directed to children under 13. If you are under
            13, please do not use the Service or provide any personal
            information. If we learn that we have collected personal
            information from a child under 13 without verified parental
            consent, we will delete that information promptly. Parents and
            guardians who believe their child has provided personal
            information to us can contact us at{" "}
            <a
              href={`mailto:${CONTACT_EMAIL}`}
              className="text-primary underline-offset-4 hover:underline"
            >
              {CONTACT_EMAIL}
            </a>
            .
          </p>
        </Section>

        <Section title="10. Security">
          <p>
            We use industry-standard safeguards to protect your information,
            including encryption in transit (HTTPS), bcrypt password hashing,
            httpOnly secure cookies, signed CSRF tokens for third-party
            sign-in, and least-privilege access controls. No method of
            transmission or storage is perfectly secure; we will notify you
            and the appropriate authority of a personal-data breach as
            required by law.
          </p>
        </Section>

        <Section title="11. Changes to this Policy">
          <p>
            We may update this Policy from time to time. We will revise the
            &ldquo;Effective&rdquo; date at the top of the page and, for
            material changes, give you reasonable advance notice (for
            example, by email or an in-app notice).
          </p>
        </Section>

        <Section title="12. Contact us">
          <p>
            Grievance Officer: contact{" "}
            <a
              href={`mailto:${CONTACT_EMAIL}`}
              className="text-primary underline-offset-4 hover:underline"
            >
              {CONTACT_EMAIL}
            </a>{" "}
            with the subject line &ldquo;Privacy&rdquo; and we will route
            your message appropriately. {OPERATOR} is registered in India.
          </p>
        </Section>
      </main>
    </div>
  );
}

function Section({
  title,
  children,
}: {
  title: string;
  children: React.ReactNode;
}) {
  return (
    <section className="space-y-3">
      <h2 className="text-xl font-bold text-foreground">{title}</h2>
      {children}
    </section>
  );
}