// Privacy Policy, Terms of Service, Data Deletion — Facebook-review compatible.
// Honest about local-only data storage; forward-looking language for Instagram Graph API.

const LEGAL_EFFECTIVE_DATE = "May 22, 2026";
const LEGAL_OPERATOR = "Joseph Grzyb";
const LEGAL_LOCATION = "San Francisco, California, United States";
const LEGAL_EMAIL = "joegrzyb24@gmail.com";

function LegalLayout({ title, subtitle, children, onClose }) {
  return (
    <div style={{
      minHeight: '100vh',
      padding: 'clamp(24px, 6vw, 80px) clamp(20px, 6vw, 64px)',
      maxWidth: 820,
      margin: '0 auto',
      fontSize: 15.5,
      lineHeight: 1.7,
    }}>
      <div style={{ marginBottom: 32 }}>
        <a href="#"
          onClick={(e) => { e.preventDefault(); onClose(); }}
          style={{
            display: 'inline-flex', alignItems: 'center', gap: 8,
            color: 'var(--text-muted)', textDecoration: 'none',
            fontFamily: 'var(--mono)', fontSize: 13, letterSpacing: '0.02em',
          }}
        >
          <span>←</span> <span>Back to home</span>
        </a>
      </div>

      <h1 style={{ fontSize: 'clamp(36px, 5vw, 56px)', lineHeight: 1.05, marginBottom: 12 }}>{title}</h1>
      <div style={{
        fontFamily: 'var(--mono)', fontSize: 12.5, color: 'var(--text-dim)',
        letterSpacing: '0.04em', textTransform: 'uppercase', marginBottom: 8,
      }}>
        Effective {LEGAL_EFFECTIVE_DATE}
      </div>
      {subtitle && <p style={{ color: 'var(--text-muted)', fontSize: 17, marginBottom: 40 }}>{subtitle}</p>}
      {!subtitle && <div style={{ height: 40 }} />}

      <div className="legal-body">{children}</div>

      <hr style={{ border: 'none', borderTop: '1px solid var(--border)', margin: '64px 0 24px' }} />
      <div style={{ display: 'flex', gap: 16, flexWrap: 'wrap', fontFamily: 'var(--mono)', fontSize: 12.5, color: 'var(--text-dim)' }}>
        <a href="#privacy" style={{ color: 'inherit' }}>Privacy</a>
        <a href="#terms" style={{ color: 'inherit' }}>Terms</a>
        <a href="#data-deletion" style={{ color: 'inherit' }}>Data Deletion</a>
        <span style={{ marginLeft: 'auto' }}>© 2026 {LEGAL_OPERATOR}</span>
      </div>

      <style>{`
        .legal-body h2 {
          font-family: var(--display);
          font-size: 22px;
          margin: 40px 0 12px;
          letter-spacing: -0.01em;
        }
        .legal-body h3 {
          font-family: var(--display);
          font-size: 17px;
          margin: 28px 0 8px;
          color: var(--text);
        }
        .legal-body p { margin: 0 0 14px; color: var(--text); }
        .legal-body ul { margin: 0 0 14px; padding-left: 22px; }
        .legal-body li { margin-bottom: 6px; color: var(--text); }
        .legal-body strong { color: var(--text); font-weight: 600; }
        .legal-body a { color: var(--accent); text-decoration: underline; text-underline-offset: 3px; text-decoration-thickness: 1px; }
        .legal-body code {
          font-family: var(--mono); font-size: 0.9em;
          background: var(--panel-2); padding: 1px 6px; border-radius: 4px;
          border: 1px solid var(--border);
        }
      `}</style>
    </div>
  );
}

function PrivacyPolicy({ onClose }) {
  return (
    <LegalLayout
      title="Privacy Policy"
      subtitle={`How ${LEGAL_OPERATOR} handles your information across the apps PepPal, Touch Grass, and Pottery Pal.`}
      onClose={onClose}
    >
      <h2>1. Summary</h2>
      <p>
        <strong>The short version:</strong> Our apps do not collect, transmit, or store your personal data on
        any server. Everything you enter, including tracking entries, settings, photos, and journal notes, stays
        on your device. We have no accounts, no analytics, no advertising trackers, and no third-party SDKs
        that report back to us.
      </p>
      <p>
        This policy explains this in detail, describes the limited situations in which third-party platforms
        (such as Apple, Google, or Meta) may handle data on our behalf, and outlines your rights and how to
        contact us.
      </p>

      <h2>2. Who we are</h2>
      <p>
        These apps are designed, built, and operated by <strong>{LEGAL_OPERATOR}</strong>, an independent sole
        proprietor based in {LEGAL_LOCATION}. For the purposes of the EU General Data Protection Regulation
        (GDPR), the UK GDPR, and the California Consumer Privacy Act (CCPA/CPRA), {LEGAL_OPERATOR} is the
        data controller for any personal information processed in connection with our apps.
      </p>
      <p>Contact: <a href={`mailto:${LEGAL_EMAIL}`}>{LEGAL_EMAIL}</a></p>

      <h2>3. Apps covered by this policy</h2>
      <ul>
        <li><strong>PepPal:</strong> a peptide tracker for logging dosages, schedules, and notes.</li>
        <li><strong>Touch Grass:</strong> a screen time control tool that helps you limit and schedule app usage.</li>
        <li><strong>Pottery Pal:</strong> a companion app for pottery makers to track pieces, glazes, and firings.</li>
      </ul>

      <h2>4. Information we do not collect</h2>
      <p>We want to be explicit. Our apps do <strong>not</strong> collect, transmit, sell, or share:</p>
      <ul>
        <li>Your name, email address, phone number, or postal address</li>
        <li>Account credentials (we have no accounts)</li>
        <li>Health, medical, or biometric data</li>
        <li>Precise or coarse location data</li>
        <li>Contacts, calendar entries, or other personal records</li>
        <li>Browsing history or behavioral tracking data</li>
        <li>Advertising identifiers (IDFA, AAID) or third-party ad tracking</li>
        <li>Photos, except images you explicitly attach to entries inside the app, which remain on your device</li>
      </ul>

      <h2>5. Information stored locally on your device</h2>
      <p>
        Everything you create in the apps, including peptide log entries, screen-time rules, pottery records, journal
        notes, attached images, and app preferences, is stored exclusively in your device's local storage
        (for example, in the iOS or Android sandboxed app container). This data:
      </p>
      <ul>
        <li>Never leaves your device under normal operation.</li>
        <li>Is not transmitted to {LEGAL_OPERATOR} or any third party.</li>
        <li>Is deleted automatically when you delete the app, except where included in a device-level backup you have configured (see Section 7).</li>
      </ul>

      <h2>6. Third-party platforms</h2>
      <h3>6.1 Apple App Store and Google Play</h3>
      <p>
        When you download our apps from Apple's App Store or Google Play, those platforms may collect
        information about the download as described in their own privacy policies. We receive only aggregated,
        anonymized download and crash counts (where the platform exposes them). We do not receive your
        personal identity from these platforms.
      </p>

      <h3>6.2 Device backup services</h3>
      <p>
        If you have enabled iCloud Backup, Google One Backup, or a similar service on your device, your
        operating system may include our app's local data in encrypted device backups. We have no access to
        these backups; they are governed by Apple's or Google's privacy policies.
      </p>

      <h3>6.3 Instagram Graph API (future feature, not yet active)</h3>
      <p>
        We plan to introduce optional features that connect to your Instagram account using the official
        Meta Platforms <strong>Instagram Graph API</strong>. <strong>This integration is not currently active
        in any released version of our apps.</strong> When it does launch, the following will apply:
      </p>
      <ul>
        <li>
          The integration will be <strong>opt-in</strong>. You will be prompted to authorize it explicitly through
          Meta's standard OAuth login flow, and you can disconnect at any time.
        </li>
        <li>
          We will only request the minimum permission scopes required for the feature (for example, basic
          profile information and your own media).
        </li>
        <li>
          Any Instagram-derived data we request will be used solely to power the feature you have authorized,
          will be processed in-memory or stored locally on your device, and will not be sold, rented, shared
          with advertisers, or used for any independent purpose.
        </li>
        <li>
          Our use of Instagram data will comply with the <strong>Meta Platform Terms</strong>, the
          <strong> Developer Policies</strong>, and applicable law.
        </li>
        <li>
          You may revoke access at any time by visiting your Instagram account settings under
          <em> Apps and Websites</em>, or by following the instructions in our <a href="#data-deletion">Data
          Deletion</a> page.
        </li>
      </ul>
      <p>
        We will update this policy with an effective date change before the Instagram feature is enabled for
        any user.
      </p>

      <h2>7. Legal bases for processing (GDPR / UK GDPR)</h2>
      <p>Where any limited processing does occur, our legal bases are:</p>
      <ul>
        <li><strong>Consent:</strong> for any optional integration you actively authorize (for example, future Instagram features).</li>
        <li><strong>Legitimate interests:</strong> for operating and maintaining the apps and responding to support requests, balanced against your privacy interests.</li>
        <li><strong>Legal obligation:</strong> where we must process data to comply with applicable law.</li>
      </ul>

      <h2>8. Data retention</h2>
      <p>
        Because we do not store your data on our servers, there is no server-side retention period. Local
        data persists on your device until you delete it from within the app, clear app data, or uninstall
        the app. Support emails you send us are retained only for as long as needed to resolve your inquiry,
        and in any event no longer than 24 months.
      </p>

      <h2>9. Your rights</h2>
      <p>Depending on your jurisdiction (including the EU, UK, and California), you may have the right to:</p>
      <ul>
        <li>Know what personal information we hold about you</li>
        <li>Access a copy of that information</li>
        <li>Correct inaccurate information</li>
        <li>Delete your information</li>
        <li>Object to or restrict processing</li>
        <li>Withdraw consent for any optional integrations</li>
        <li>Lodge a complaint with your data protection authority</li>
      </ul>
      <p>
        Because we do not hold any personal data about you on our servers, requests for access, deletion, or
        portability will be answered honestly to that effect. To exercise any right, email
        <a href={`mailto:${LEGAL_EMAIL}`}> {LEGAL_EMAIL}</a>. We will respond within 30 days.
      </p>

      <h2>10. Children's privacy</h2>
      <p>
        Our apps are not directed to children under 13 (or 16 in jurisdictions where that is the relevant
        age of consent for online services), and we do not knowingly collect personal information from
        children. If you believe a child has provided us with information, contact us and we will delete it.
      </p>

      <h2>11. Security</h2>
      <p>
        Because data stays on your device, the security of that data depends primarily on your device's
        security (passcode, biometric lock, OS-level encryption). Any communications you initiate with us
        (such as a support email) are transmitted using the security of the email provider involved.
      </p>

      <h2>12. International transfers</h2>
      <p>
        We are based in the United States. Any support emails you send may therefore be processed in the
        United States. We do not transfer your personal data to any other country because we do not collect
        such data through the apps themselves.
      </p>

      <h2>13. Changes to this policy</h2>
      <p>
        We will update this policy when our practices change or when required by law. The "Effective" date
        at the top reflects the most recent revision. Material changes (such as the activation of the
        Instagram Graph API integration) will be highlighted in-app or via a notice on this page.
      </p>

      <h2>14. Contact</h2>
      <p>
        Questions or requests? Reach out to {LEGAL_OPERATOR}:
      </p>
      <ul>
        <li>Email: <a href={`mailto:${LEGAL_EMAIL}`}>{LEGAL_EMAIL}</a></li>
        <li>Location: {LEGAL_LOCATION}</li>
      </ul>
    </LegalLayout>
  );
}

function TermsOfService({ onClose }) {
  return (
    <LegalLayout
      title="Terms of Service"
      subtitle={`The agreement between you and ${LEGAL_OPERATOR} when you use PepPal, Touch Grass, or Pottery Pal.`}
      onClose={onClose}
    >
      <h2>1. Agreement</h2>
      <p>
        These Terms of Service ("Terms") form a binding agreement between you ("you" or "user") and
        <strong> {LEGAL_OPERATOR}</strong>, a sole proprietor based in {LEGAL_LOCATION} ("we," "us," "our"),
        governing your access to and use of the mobile applications and websites <strong>PepPal</strong>,
        <strong> Touch Grass</strong>, and <strong>Pottery Pal</strong> (collectively, the "Apps"). By
        downloading, installing, or using the Apps you agree to these Terms. If you do not agree, do not use
        the Apps.
      </p>

      <h2>2. License</h2>
      <p>
        Subject to your compliance with these Terms, we grant you a personal, non-exclusive,
        non-transferable, revocable license to install and use the Apps on devices you own or control, for
        your personal, non-commercial use.
      </p>

      <h2>3. What the Apps are, and are not</h2>
      <p>
        <strong>The Apps are general-purpose tracking and productivity tools.</strong> They are not medical
        devices, do not provide medical, health, legal, financial, or professional advice, and are not a
        substitute for professional judgment.
      </p>
      <ul>
        <li>
          <strong>PepPal</strong> is for personal record-keeping. It does not diagnose, treat, cure, or
          prevent any condition. Always consult a qualified healthcare provider regarding any substance you
          intend to use.
        </li>
        <li>
          <strong>Touch Grass</strong> is a self-management tool. It is not a substitute for professional
          care for any condition related to technology overuse.
        </li>
        <li>
          <strong>Pottery Pal</strong> is a record-keeping companion. It does not provide kiln safety or
          materials safety guidance.
        </li>
      </ul>
      <p>You assume all risk associated with your reliance on information you record or receive in the Apps.</p>

      <h2>4. Your account and your data</h2>
      <p>
        The Apps do not currently require an account. Data you enter is stored locally on your device. You
        are solely responsible for backing up your device and for the security of your device. We are not
        responsible for any loss of data caused by device loss, damage, OS updates, or app uninstallation.
      </p>

      <h2>5. Acceptable use</h2>
      <p>You agree not to:</p>
      <ul>
        <li>Use the Apps for any unlawful purpose or in violation of any applicable law or regulation;</li>
        <li>Reverse engineer, decompile, or attempt to extract the source code of the Apps, except as permitted by applicable law;</li>
        <li>Use the Apps to harass, defame, or harm any person;</li>
        <li>Interfere with or disrupt the integrity or performance of the Apps;</li>
        <li>Resell, sublicense, or commercially exploit the Apps without prior written permission;</li>
        <li>Use the Apps to violate the terms of any third-party platform (including Apple, Google, or Meta).</li>
      </ul>

      <h2>6. Third-party services</h2>
      <p>
        The Apps may, now or in the future, integrate optional third-party services (for example, Instagram
        Graph API). Your use of those services is also governed by the third party's own terms and privacy
        policy. We are not responsible for the practices of any third-party service.
      </p>

      <h2>7. Intellectual property</h2>
      <p>
        The Apps, including their code, design, trademarks, and content, are the property of {LEGAL_OPERATOR}
        and are protected by intellectual property laws. You retain all rights to data you enter into the Apps.
      </p>

      <h2>8. Disclaimers</h2>
      <p>
        THE APPS ARE PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED,
        INCLUDING WITHOUT LIMITATION ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
        PURPOSE, OR NON-INFRINGEMENT. WE DO NOT WARRANT THAT THE APPS WILL BE UNINTERRUPTED, ERROR-FREE, OR
        FREE OF HARMFUL COMPONENTS.
      </p>

      <h2>9. Limitation of liability</h2>
      <p>
        TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT WILL {LEGAL_OPERATOR.toUpperCase()} BE
        LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR FOR ANY LOSS OF
        PROFITS, DATA, OR GOODWILL, ARISING OUT OF OR IN CONNECTION WITH YOUR USE OF THE APPS, WHETHER BASED
        ON CONTRACT, TORT, STRICT LIABILITY, OR ANY OTHER LEGAL THEORY. OUR TOTAL LIABILITY TO YOU FOR ALL
        CLAIMS IN THE AGGREGATE WILL NOT EXCEED FIFTY U.S. DOLLARS ($50.00) OR THE AMOUNT YOU PAID US FOR
        THE APPS IN THE TWELVE MONTHS PRECEDING THE CLAIM, WHICHEVER IS GREATER.
      </p>

      <h2>10. Indemnification</h2>
      <p>
        You agree to indemnify and hold {LEGAL_OPERATOR} harmless from any claims, losses, or damages
        (including reasonable attorneys' fees) arising out of your use of the Apps, your violation of these
        Terms, or your violation of any third party's rights.
      </p>

      <h2>11. Termination</h2>
      <p>
        We may suspend or terminate your access to the Apps at any time for any reason, including breach of
        these Terms. You may stop using the Apps at any time by uninstalling them. Sections that by their
        nature should survive termination (including Sections 7–10 and 12) will survive.
      </p>

      <h2>12. Governing law and disputes</h2>
      <p>
        These Terms are governed by the laws of the State of California, without regard to its conflict of
        laws principles. Any dispute will be resolved in the state or federal courts located in San
        Francisco County, California, and you and we consent to personal jurisdiction there. Nothing in this
        section limits your statutory rights as a consumer in your country of residence.
      </p>

      <h2>13. Changes</h2>
      <p>
        We may update these Terms from time to time. Continued use of the Apps after a change constitutes
        acceptance of the updated Terms. The "Effective" date at the top of this page reflects the most
        recent revision.
      </p>

      <h2>14. Contact</h2>
      <p>
        Questions about these Terms? Email <a href={`mailto:${LEGAL_EMAIL}`}>{LEGAL_EMAIL}</a>.
      </p>
    </LegalLayout>
  );
}

function DataDeletion({ onClose }) {
  return (
    <LegalLayout
      title="Data Deletion Instructions"
      subtitle="How to delete any data associated with PepPal, Touch Grass, or Pottery Pal."
      onClose={onClose}
    >
      <h2>The short version</h2>
      <p>
        Our apps do not maintain user accounts and do not store your personal data on any server. All of your
        data is stored locally on your device. The fastest way to delete all data is to <strong>uninstall the
        app</strong> from your device. When you uninstall, the operating system erases all data the app
        was holding.
      </p>

      <h2>Step-by-step instructions</h2>

      <h3>Option A. In-app: clear data</h3>
      <p>Inside any of our apps:</p>
      <ul>
        <li>Open the app and go to <strong>Settings</strong>.</li>
        <li>Select <strong>Clear All Data</strong> (or, in some apps, <strong>Reset App</strong>).</li>
        <li>Confirm the prompt. All entries, settings, and attached media will be deleted from the device.</li>
      </ul>

      <h3>Option B. Uninstall the app</h3>
      <p><strong>iOS / iPadOS:</strong></p>
      <ul>
        <li>Touch and hold the app icon on your Home Screen.</li>
        <li>Tap <strong>Remove App</strong>, then <strong>Delete App</strong>, then <strong>Delete</strong>.</li>
      </ul>
      <p><strong>Android:</strong></p>
      <ul>
        <li>Open <strong>Settings → Apps</strong> and select the app (PepPal, Touch Grass, or Pottery Pal).</li>
        <li>Tap <strong>Storage → Clear Data</strong> (optional, to keep the app installed), then tap <strong>Uninstall</strong>.</li>
      </ul>

      <h3>Option C. Disconnect Instagram (when applicable)</h3>
      <p>
        When our future Instagram Graph API integration becomes available and you have authorized it, you can
        revoke our access from inside Instagram:
      </p>
      <ul>
        <li>Open the Instagram app or website.</li>
        <li>Go to <strong>Settings → Apps and websites → Active</strong>.</li>
        <li>Find the connection to our app and tap <strong>Remove</strong>.</li>
      </ul>
      <p>
        Revoking access immediately terminates any further data access. Any Instagram-derived data that was
        held locally on your device can then be deleted using Option A or Option B above.
      </p>

      <h2>Request deletion by email</h2>
      <p>
        If you have contacted us by email for support or any other reason, that email correspondence is the
        only personal information about you that we may retain. To request deletion of those records:
      </p>
      <ul>
        <li>
          Send an email to <a href={`mailto:${LEGAL_EMAIL}?subject=Data%20Deletion%20Request`}>
          {LEGAL_EMAIL}</a> with the subject line <code>Data Deletion Request</code>.
        </li>
        <li>Include the email address you used to contact us and the app(s) involved.</li>
        <li>
          We will confirm receipt within 5 business days and complete the deletion within 30 days, except
          where retention is required by law.
        </li>
      </ul>

      <h2>Verification</h2>
      <p>
        For email deletion requests, we verify your identity by confirming you control the email address used
        in your original correspondence. We will never ask you for passwords, account credentials, or
        sensitive personal information to process a deletion request.
      </p>

      <h2>Contact</h2>
      <p>
        Email: <a href={`mailto:${LEGAL_EMAIL}`}>{LEGAL_EMAIL}</a><br />
        Operator: {LEGAL_OPERATOR}, {LEGAL_LOCATION}
      </p>
    </LegalLayout>
  );
}

Object.assign(window, { PrivacyPolicy, TermsOfService, DataDeletion });