<script setup lang="ts">
useHead({ title: 'Privacy policy · GuestGuard' })
</script>

<template>
  <article class="prose prose-invert mx-auto max-w-2xl py-8 text-zinc-300">
    <h1 class="text-2xl font-semibold text-zinc-100">Privacy policy</h1>
    <p class="text-sm text-zinc-500">Last updated: <strong>placeholder — pending legal review</strong></p>

    <p>
      This page is a placeholder while we have proper privacy copy
      reviewed by a lawyer. The substance below reflects how the
      product actually handles data today — the final wording will
      replace this page before public launch.
    </p>

    <h2 class="mt-6 text-lg font-semibold text-zinc-100">What we collect</h2>
    <ul class="list-disc pl-6">
      <li><strong>Host account</strong>: email, name, hashed password.</li>
      <li><strong>Guest list</strong>: names, emails, phone numbers — only what
        the host enters or imports.</li>
      <li><strong>RSVP responses</strong>: the answer the guest sends back.</li>
      <li><strong>Access logs</strong>: IP, device fingerprint, and a fraud
        risk score, for each invitation-link open. Used to flag suspicious
        access (e.g. someone forwarded the link).</li>
      <li><strong>Billing</strong>: handled by Stripe — we store only the
        Stripe customer + subscription IDs locally, never card details.</li>
    </ul>

    <h2 class="mt-6 text-lg font-semibold text-zinc-100">Your rights</h2>
    <ul class="list-disc pl-6">
      <li><strong>Export</strong>: download a full JSON dump of your data via
        Settings → "Export my data".</li>
      <li><strong>Delete</strong>: delete your account via Settings → "Delete
        account". Your row is soft-deleted immediately and hard-deleted 30
        days later (kept briefly in case of accidental clicks).</li>
      <li><strong>Question</strong>: email
        <a href="mailto:privacy@gg.k4scloud.com" class="text-brand-400">privacy@gg.k4scloud.com</a>.</li>
    </ul>

    <h2 class="mt-6 text-lg font-semibold text-zinc-100">Sub-processors</h2>
    <p>We use these third parties to run the service:</p>
    <ul class="list-disc pl-6">
      <li><strong>Stripe</strong> — billing</li>
      <li><strong>Resend</strong> — transactional email delivery</li>
      <li><strong>AWS S3</strong> — encrypted database backups</li>
    </ul>

    <NuxtLink to="/" class="mt-8 inline-block text-sm text-brand-400 hover:text-brand-300">← Back home</NuxtLink>
  </article>
</template>
