`src/app/legal/privacy/page.tsx`

54 lines
export const metadata = {
  title: "Privacy Policy — Drops",
  description: "How Drops collects, uses, and protects your data.",
};

export default function PrivacyPage() {
  return (
    <article className="card mx-auto max-w-3xl p-8">
      <h1 className="text-3xl font-semibold">Privacy Policy</h1>
      <p className="text-xs text-ink/50 mt-1">Last updated: April 24, 2026</p>

      <h2 className="mt-6 text-xl font-semibold">What we collect</h2>
      <ul className="list-disc pl-6 space-y-1">
        <li><b>Account data:</b> email address, optional name, time-zone hint.</li>
        <li><b>Subscription data:</b> tier, status, trial drops remaining, Stripe customer ID and subscription ID (if paid).</li>
        <li><b>Delivery data:</b> which drops we sent you, when they were delivered, whether they were opened (via a 1×1 tracking pixel in the email), and whether they bounced.</li>
        <li><b>Referral data:</b> if you were referred, the referring subscriber's token; if you refer others, your own referral counter.</li>
        <li><b>Technical data:</b> IP address + user agent at signup time (for rate-limit + abuse prevention), kept 30 days.</li>
      </ul>

      <h2 className="mt-6 text-xl font-semibold">What we don't collect</h2>
      <p>We don't track you across the web. We don't use third-party analytics on subscriber-only pages. We don't sell data. We don't share data with advertisers because we don't have any.</p>

      <h2 className="mt-6 text-xl font-semibold">Who processes your data</h2>
      <ul className="list-disc pl-6 space-y-1">
        <li><b>Stripe</b> (payment processing) — receives your email and billing info when you upgrade. Subject to Stripe's own privacy policy.</li>
        <li><b>Resend</b> or your configured email provider — receives your email address and the rendered drop HTML in order to deliver it.</li>
        <li><b>Cloudflare</b> — may see your IP address when requests pass through their tunnel/CDN.</li>
      </ul>
      <p className="mt-2">Our own hosting stack runs locally and does not ship data to third parties.</p>

      <h2 className="mt-6 text-xl font-semibold">Your rights (GDPR / CCPA style)</h2>
      <ul className="list-disc pl-6 space-y-1">
        <li><b>Access:</b> email drops@agentabrams.com, we'll send you the full row we hold.</li>
        <li><b>Deletion:</b> use the unsubscribe link in any email, or email us. Deletion is permanent and irreversible.</li>
        <li><b>Portability:</b> we'll export your data as JSON on request.</li>
        <li><b>Correction:</b> email us.</li>
      </ul>

      <h2 className="mt-6 text-xl font-semibold">Retention</h2>
      <p>Active subscriber records kept for the life of the account. After unsubscribe: we hold email + Stripe IDs for 3 years (tax + chargeback window) then purge. IP/user-agent logs: 30 days. Delivery logs: 1 year.</p>

      <h2 className="mt-6 text-xl font-semibold">Children</h2>
      <p>Drops is not intended for anyone under 18.</p>

      <h2 className="mt-6 text-xl font-semibold">Security</h2>
      <p>Data at rest: Postgres on a secured machine. In transit: HTTPS everywhere. No plaintext passwords — we don't have passwords, only email + unique token links. If we ever suffer a breach affecting you, we will email you within 72 hours of becoming aware.</p>

      <h2 className="mt-6 text-xl font-semibold">Contact</h2>
      <p><a href="mailto:drops@agentabrams.com" className="text-brass underline">drops@agentabrams.com</a></p>
    </article>
  );
}