Add public /privacy + /support pages before basic-auth gate for App Store listing URLs

471a89638edf9ee690f2f8e0d04c92cc68d8ee39 · 2026-08-09 10:42:55 -0700 · Steve Abrams
Files touched

A public/legal/privacy.html
A public/legal/support.html
M server.js
Diff

commit 471a89638edf9ee690f2f8e0d04c92cc68d8ee39
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Sun Aug 9 10:42:55 2026 -0700

    Add public /privacy + /support pages before basic-auth gate for App Store listing URLs
---
 public/legal/privacy.html | 84 +++++++++++++++++++++++++++++++++++++++++++++++
 public/legal/support.html | 79 ++++++++++++++++++++++++++++++++++++++++++++
 server.js                 |  8 +++++
 3 files changed, 171 insertions(+)

diff --git a/public/legal/privacy.html b/public/legal/privacy.html
new file mode 100644
index 0000000..61c107c
--- /dev/null
+++ b/public/legal/privacy.html
@@ -0,0 +1,84 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Privacy Policy — Costa Rica: Stay, Tour &amp; Book</title>
+<meta name="robots" content="index,follow">
+<style>
+  :root{--ink:#14261d;--muted:#5b6b62;--line:#e3e9e5;--brand:#0b7a4b;--bg:#f7faf8}
+  *{box-sizing:border-box}
+  body{margin:0;font:16px/1.65 -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Helvetica,Arial,sans-serif;color:var(--ink);background:var(--bg)}
+  .wrap{max-width:760px;margin:0 auto;padding:40px 22px 80px}
+  header{border-bottom:1px solid var(--line);padding-bottom:18px;margin-bottom:28px}
+  .kicker{color:var(--brand);font-weight:700;letter-spacing:.04em;text-transform:uppercase;font-size:12px}
+  h1{font-size:28px;margin:6px 0 4px;line-height:1.2}
+  .updated{color:var(--muted);font-size:13px}
+  h2{font-size:18px;margin:34px 0 8px}
+  ul{padding-left:20px}
+  li{margin:4px 0}
+  a{color:var(--brand)}
+  .foot{margin-top:48px;padding-top:18px;border-top:1px solid var(--line);color:var(--muted);font-size:13px}
+</style>
+</head>
+<body>
+<div class="wrap">
+  <header>
+    <div class="kicker">Costa Rica · Stay, Tour &amp; Book</div>
+    <h1>Privacy Policy</h1>
+    <div class="updated">Last updated: August 9, 2026</div>
+  </header>
+
+  <p>This Privacy Policy explains what information the Costa Rica: Stay, Tour &amp; Book app
+  (&ldquo;the app,&rdquo; &ldquo;we,&rdquo; &ldquo;us&rdquo;) collects, how we use it, and the
+  choices you have. By using the app you agree to this policy.</p>
+
+  <h2>Information we collect</h2>
+  <ul>
+    <li><strong>Contact information</strong> (name, email, phone number) — to create and secure your account and let you communicate with hosts.</li>
+    <li><strong>User content</strong> (messages you send) — to deliver in-app messaging between you and hosts.</li>
+    <li><strong>Identifiers</strong> (account ID) — to operate your account and keep you signed in.</li>
+    <li><strong>Location</strong> (coarse, optional) — only when you allow it, to show listings near you on the map.</li>
+    <li><strong>Contacts</strong> (optional, user-initiated) — only when you choose to invite friends. Your contacts are used solely on your device to show which friends are already here; we do not upload, store, sell, or message your contacts.</li>
+    <li><strong>Purchases</strong> (booking history) — to show your trips and process bookings.</li>
+  </ul>
+
+  <h2>How we use your information</h2>
+  <ul>
+    <li>To provide the core app functions: browsing listings, booking stays/tours/services, and messaging hosts.</li>
+    <li>To process payments made by international card or SINPE Móvil through our payment processors.</li>
+    <li>To secure your account and prevent fraud and abuse.</li>
+    <li>To respond to your support requests.</li>
+  </ul>
+
+  <h2>Tracking &amp; advertising</h2>
+  <p>We do <strong>not</strong> use your data to track you across other companies&rsquo; apps or
+  websites, and we do <strong>not</strong> share your personal information with third parties for
+  their own advertising.</p>
+
+  <h2>Sharing</h2>
+  <p>We share information only as needed to run the service — for example, with payment processors
+  to complete a transaction, and with a host when you contact or book with them. We may disclose
+  information if required by law.</p>
+
+  <h2>Data retention &amp; deletion</h2>
+  <p>We keep your information for as long as your account is active. You can request deletion of your
+  account and associated personal data at any time by emailing us at the address below; we will delete
+  it except where we are required to retain records (for example, transaction records) by law.</p>
+
+  <h2>Security</h2>
+  <p>Data is transmitted over encrypted HTTPS/TLS connections and stored on access-controlled servers.</p>
+
+  <h2>Children</h2>
+  <p>The app is rated 4+ and is intended for a general audience. It is not directed to children under 13,
+  and we do not knowingly collect personal information from them.</p>
+
+  <h2>Contact us</h2>
+  <p>Questions or requests (including data deletion): <a href="mailto:costarica@agentabrams.com">costarica@agentabrams.com</a></p>
+
+  <div class="foot">
+    Costa Rica: Stay, Tour &amp; Book · <a href="/support">Support</a> · &copy; 2026 Agent Abrams.
+  </div>
+</div>
+</body>
+</html>
diff --git a/public/legal/support.html b/public/legal/support.html
new file mode 100644
index 0000000..7041b9f
--- /dev/null
+++ b/public/legal/support.html
@@ -0,0 +1,79 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Support — Costa Rica: Stay, Tour &amp; Book</title>
+<meta name="robots" content="index,follow">
+<style>
+  :root{--ink:#14261d;--muted:#5b6b62;--line:#e3e9e5;--brand:#0b7a4b;--bg:#f7faf8}
+  *{box-sizing:border-box}
+  body{margin:0;font:16px/1.65 -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Helvetica,Arial,sans-serif;color:var(--ink);background:var(--bg)}
+  .wrap{max-width:760px;margin:0 auto;padding:40px 22px 80px}
+  header{border-bottom:1px solid var(--line);padding-bottom:18px;margin-bottom:28px}
+  .kicker{color:var(--brand);font-weight:700;letter-spacing:.04em;text-transform:uppercase;font-size:12px}
+  h1{font-size:28px;margin:6px 0 4px;line-height:1.2}
+  .sub{color:var(--muted);font-size:14px}
+  h2{font-size:18px;margin:34px 0 8px}
+  a{color:var(--brand)}
+  .card{background:#fff;border:1px solid var(--line);border-radius:12px;padding:18px 20px;margin:18px 0}
+  .contact{font-size:18px;font-weight:600}
+  details{border-bottom:1px solid var(--line);padding:12px 0}
+  summary{cursor:pointer;font-weight:600}
+  details p{margin:8px 0 0;color:var(--muted)}
+  .foot{margin-top:48px;padding-top:18px;border-top:1px solid var(--line);color:var(--muted);font-size:13px}
+</style>
+</head>
+<body>
+<div class="wrap">
+  <header>
+    <div class="kicker">Costa Rica · Stay, Tour &amp; Book</div>
+    <h1>Support</h1>
+    <div class="sub">We&rsquo;re here to help you discover, book, and enjoy Costa Rica.</div>
+  </header>
+
+  <div class="card">
+    <div class="contact">Email support</div>
+    <p>Reach us any time at <a href="mailto:costarica@agentabrams.com">costarica@agentabrams.com</a>.
+    We reply within 1&ndash;2 business days.</p>
+  </div>
+
+  <h2>Frequently asked questions</h2>
+
+  <details open>
+    <summary>How do I book a stay, tour, or service?</summary>
+    <p>Browse or search listings, open the one you like, choose your dates or time, and tap Book.
+    You&rsquo;ll see the full price — rate, fees, and total — before you pay.</p>
+  </details>
+  <details>
+    <summary>How do I pay?</summary>
+    <p>Pay by international card (USD) or locally with SINPE Móvil (colones). Your booking is
+    confirmed the moment payment clears.</p>
+  </details>
+  <details>
+    <summary>How do I contact a host?</summary>
+    <p>Every listing shows the best way to reach the host — WhatsApp, phone, email, or our in-app
+    messenger. Your whole conversation stays in one thread.</p>
+  </details>
+  <details>
+    <summary>How do I manage or cancel a booking?</summary>
+    <p>Open <strong>My Trips</strong> to see all your bookings. To change or cancel, message the host
+    or email us and we&rsquo;ll help.</p>
+  </details>
+  <details>
+    <summary>How do I list my property or service?</summary>
+    <p>Tap your profile and choose to become a host. You can list a stay, tour, or service and get
+    paid to your SINPE Móvil number (Costa Rica) or linked bank (international).</p>
+  </details>
+  <details>
+    <summary>How do I delete my account or data?</summary>
+    <p>Email <a href="mailto:costarica@agentabrams.com">costarica@agentabrams.com</a> and we&rsquo;ll
+    delete your account and personal data. See our <a href="/privacy">Privacy Policy</a> for details.</p>
+  </details>
+
+  <div class="foot">
+    Costa Rica: Stay, Tour &amp; Book · <a href="/privacy">Privacy Policy</a> · &copy; 2026 Agent Abrams.
+  </div>
+</div>
+</body>
+</html>
diff --git a/server.js b/server.js
index e654090..d8b6a76 100644
--- a/server.js
+++ b/server.js
@@ -57,6 +57,14 @@ app.get('/api/app/health', (_req, res) => {
     whatsapp_live: require('./lib/whatsapp').liveMode, plaid_live: require('./lib/plaid').liveMode });
 });
 
+// Public legal/support pages — mounted BEFORE the site basic-auth gate so the
+// App Store listing's Privacy Policy URL and Support URL are reachable by
+// Apple's reviewers and the public (a 401 there rejects the app submission).
+app.get(['/privacy', '/privacy.html'], (_req, res) =>
+  res.sendFile(path.join(__dirname, 'public', 'legal', 'privacy.html')));
+app.get(['/support', '/support.html'], (_req, res) =>
+  res.sendFile(path.join(__dirname, 'public', 'legal', 'support.html')));
+
 // Whole-site Basic Auth gate (in-development; remove when ready for public)
 const BA_USER = process.env.BASIC_AUTH_USER;
 const BA_PASS = process.env.BASIC_AUTH_PASS;
← b0232a1 costa-rica: add docs/GO-LIVE.md operator runbook — TK-10346 · back to Costa Rica · add creds-in-URL fetch guard to gated pages (TK-10984) a9a77cb →