// SciPHR LLC privacy policy, formatted in the brand-aligned page layout.

function PolicyLink({ href, children }) {
  return (
    <a href={href}
       style={{ color: SP_COL.white, textDecoration: 'none',
                borderBottom: `1px solid ${SP_COL.grayDark}` }}>{children}</a>
  );
}

function PrivacyPage() {
  const privacyEmail = 'privacy@sciphr.io';
  const privacyHref = SP_LINKS.emailPrivacy || 'mailto:privacy@sciphr.io?subject=Privacy%20Policy';

  const sections = [
    {
      n: 1, title: 'Information we collect',
      body: (
        <>
          <p style={{ margin: '0 0 14px 0' }}>
            We collect information needed to operate the SciPHR website, the
            xCIPHR app, identity services, support, security, and communications.
          </p>
          <p style={{ margin: '0 0 6px 0', color: SP_COL.white, fontWeight: 600 }}>a. Information you provide</p>
          <ul style={{ margin: '0 0 14px 18px', padding: 0 }}>
            <li>Email address when signing up for early access or newsletters</li>
            <li>Name, company, support requests, deletion requests, or feedback submitted via forms or outreach</li>
          </ul>
          <p style={{ margin: '0 0 6px 0', color: SP_COL.white, fontWeight: 600 }}>b. Wallet and identity data</p>
          <ul style={{ margin: '0 0 14px 18px', padding: 0 }}>
            <li>XRPL wallet address and public account status</li>
            <li>DID, xCIPHR identifier, DID document, and public identity metadata used for discovery or authentication</li>
            <li>Public XRPL transaction data, including wallet setup, NFToken minting, DID updates, signer-list, recovery, and ledger-operation records</li>
            <li>NFT metadata, token IDs, token URIs, content-addressed CIDs, hashes, or other on-chain references associated with a xCIPHR identity</li>
            <li>Encrypted master-envelope references and recovery configuration metadata needed to verify or restore identity, but not plaintext wallet secrets</li>
          </ul>
          <p style={{ margin: '0 0 6px 0', color: SP_COL.white, fontWeight: 600 }}>c. Security and diagnostic data</p>
          <ul style={{ margin: '0 0 0 18px', padding: 0 }}>
            <li>IP address, browser or user agent, device model, operating system, app version, language, and general network or region metadata</li>
            <li>Device or installation identifiers, push tokens, or similar non-advertising identifiers if generated or needed for app security, notifications, fraud prevention, or diagnostics</li>
            <li>Authentication logs, including challenge IDs, timestamps, public identifiers, success or failure status, IP address, and user agent</li>
            <li>Crash logs, diagnostic logs, performance data, and support logs when enabled by the app platform, diagnostics provider, or user</li>
            <li>Website usage data through cookies, Cloudflare Web Analytics, or similar analytics tools when enabled</li>
          </ul>
        </>
      ),
    },
    {
      n: 2, title: 'How we collect information',
      body: (
        <>
          <p style={{ margin: '0 0 12px 0' }}>We collect information in these ways:</p>
          <ul style={{ margin: '0 0 0 18px', padding: 0 }}>
            <li>Directly from you when you submit a form, email us, request support, or request deletion</li>
            <li>Automatically from the website, app, servers, security systems, and diagnostics tools</li>
            <li>From Apple, TestFlight, App Store systems, or crash-reporting providers when you install, test, or report app issues</li>
            <li>From public networks and infrastructure, including the XRP Ledger, XRPL nodes, IPFS or other content-addressed storage, and public block explorers</li>
          </ul>
        </>
      ),
    },
    {
      n: 3, title: 'How we use your information',
      body: (
        <>
          <p style={{ margin: '0 0 12px 0' }}>Your data is used to:</p>
          <ul style={{ margin: '0 0 14px 18px', padding: 0 }}>
            <li>Provide the website, xCIPHR app, identity creation, account recovery, authentication, and support services</li>
            <li>Prepare unsigned XRPL transactions, verify submitted signed transactions, and return ledger status</li>
            <li>Maintain security, prevent abuse, investigate errors, and protect users and SciPHR infrastructure</li>
            <li>Respond to direct inquiries, support requests, deletion requests, or legal requests</li>
            <li>Send opt-in updates, newsletters, TestFlight communications, or service notices</li>
            <li>Improve website experience, app reliability, accessibility, diagnostics, and technical performance</li>
          </ul>
          <p style={{ margin: 0 }}>
            We will <span style={{ color: SP_COL.white, fontWeight: 600 }}>never sell</span> your
            personal data or share it with third parties for their own advertising or marketing.
          </p>
        </>
      ),
    },
    {
      n: 4, title: 'Non-custody and biometrics',
      body: (
        <>
          <p style={{ margin: '0 0 12px 0' }}>
            SciPHR is designed as a non-custodial system.
          </p>
          <ul style={{ margin: '0 0 14px 18px', padding: 0 }}>
            <li>SciPHR does not collect private keys, seed phrases, recovery-code plaintext, biometric templates, or wallet secrets.</li>
            <li>User wallet keys are generated and held on the user's device. SciPHR backend systems do not become user-wallet signing keys.</li>
            <li>Encrypted master-key recovery envelopes, if stored, are storage-only. SciPHR is not intended to decrypt them or use them to sign transactions.</li>
            <li>Biometric authentication is handled by the device operating system and Apple platform controls. SciPHR receives authentication results, not biometric templates.</li>
          </ul>
          <p style={{ margin: 0 }}>
            You should never send SciPHR your private key, seed phrase, recovery
            secret, or biometric data.
          </p>
        </>
      ),
    },
    {
      n: 5, title: 'On-chain and public data',
      body: (
        <>
          <p style={{ margin: '0 0 12px 0' }}>
            XRPL transactions, NFT metadata, DID references, wallet addresses,
            token IDs, hashes, and other on-chain references are public by design.
          </p>
          <ul style={{ margin: '0 0 0 18px', padding: 0 }}>
            <li>Public blockchain data may be permanent, replicated, indexed, and visible to anyone.</li>
            <li>SciPHR cannot delete, hide, or modify confirmed XRPL ledger data or copies held by block explorers, XRPL nodes, IPFS nodes, or other third parties.</li>
            <li>Users should not place sensitive plaintext personal data in public wallet metadata, NFT metadata, DID documents, transaction memos, or other on-chain fields.</li>
          </ul>
        </>
      ),
    },
    {
      n: 6, title: 'Email and communication practices',
      body: (
        <>
          <ul style={{ margin: '0 0 14px 18px', padding: 0 }}>
            <li>Emails are opt-in only.</li>
            <li>Every email we send includes an unsubscribe link.</li>
            <li>You can opt out at any time by using the unsubscribe link or contacting us.</li>
          </ul>
          <p style={{ margin: 0 }}>
            We maintain email logs for compliance and abuse prevention purposes,
            but we do not track individual user behavior beyond delivery and
            engagement metrics unless explicit consent is given.
          </p>
        </>
      ),
    },
    {
      n: 7, title: 'Third-party services',
      body: (
        <>
          <p style={{ margin: '0 0 12px 0' }}>
            We use service providers only where needed to operate SciPHR. They may
            process data on our behalf or, for public networks, independently
            process public ledger data.
          </p>
          <ul style={{ margin: '0 0 14px 18px', padding: 0 }}>
            <li>Hosting, CDN, infrastructure, database, storage, and security providers</li>
            <li>Email, support, forms, and communications providers</li>
            <li>Analytics, crash-reporting, diagnostic, logging, and monitoring providers when enabled</li>
            <li>Apple, TestFlight, App Store, and platform services for app distribution, beta testing, diagnostics, and device-level controls</li>
            <li>XRPL nodes, validators, block explorers, IPFS nodes, content-addressed storage, and related blockchain infrastructure</li>
          </ul>
          <p style={{ margin: 0 }}>
            We do not sell personal data. Service providers are expected to use
            data only to provide services to SciPHR or as otherwise required by law.
          </p>
        </>
      ),
    },
    {
      n: 8, title: 'Retention and deletion',
      body: (
        <>
          <p style={{ margin: '0 0 12px 0' }}>
            We retain personal data only as long as needed for the purpose it was
            collected, to provide the service, maintain security, comply with law,
            resolve disputes, or enforce agreements.
          </p>
          <ul style={{ margin: '0 0 14px 18px', padding: 0 }}>
            <li>Marketing contacts are retained until you unsubscribe or request deletion.</li>
            <li>Support and deletion-request records are retained as needed to complete and document the request.</li>
            <li>Authentication, security, diagnostic, and server logs are retained for limited operational, fraud-prevention, audit, and legal purposes.</li>
            <li>Account data can be deleted or de-identified from SciPHR-controlled systems after a verified deletion request, subject to legal, security, and abuse-prevention needs.</li>
          </ul>
          <p style={{ margin: 0 }}>
            You can request account deletion or deletion of personal data by
            contacting <PolicyLink href={privacyHref}>{privacyEmail}</PolicyLink>.
            We can delete or de-identify data from SciPHR-controlled systems, but
            we cannot delete confirmed XRPL transactions, public NFT records,
            public DID references, or copies held by public blockchain, IPFS, node,
            explorer, or archival systems.
          </p>
        </>
      ),
    },
    {
      n: 9, title: 'Consent and controls',
      body: (
        <>
          <p style={{ margin: '0 0 12px 0' }}>
            You can revoke consent or change many privacy settings directly:
          </p>
          <ul style={{ margin: '0 0 14px 18px', padding: 0 }}>
            <li>Use unsubscribe links to stop marketing emails.</li>
            <li>Use browser settings to block or delete cookies and similar storage.</li>
            <li>Use iOS settings to control app permissions, notifications, diagnostics sharing, Face ID, Touch ID, and Apple platform controls.</li>
            <li>Delete the app from your device to stop device-local app processing, while recognizing that public blockchain data remains public.</li>
            <li>Contact <PolicyLink href={privacyHref}>{privacyEmail}</PolicyLink> to revoke consent, ask questions, or request deletion from SciPHR-controlled systems.</li>
          </ul>
          <p style={{ margin: 0 }}>
            Some controls may limit or disable parts of the service, especially
            authentication, security, notifications, recovery, and account support.
          </p>
        </>
      ),
    },
    {
      n: 10, title: 'Your rights',
      body: (
        <>
          <p style={{ margin: '0 0 12px 0' }}>
            Depending on your location, you may have rights under applicable data
            protection laws, including:
          </p>
          <ul style={{ margin: '0 0 14px 18px', padding: 0 }}>
            <li>The right to access or correct your data</li>
            <li>The right to request deletion or restrict processing</li>
            <li>The right to data portability or to object to specific use cases</li>
            <li>The right to withdraw consent where processing is based on consent</li>
          </ul>
          <p style={{ margin: 0 }}>
            We will verify and honor valid requests within required timeframes.
            Submit requests at <PolicyLink href={privacyHref}>{privacyEmail}</PolicyLink>.
          </p>
        </>
      ),
    },
    {
      n: 11, title: 'Cookies and tracking',
      body: (
        <p style={{ margin: 0 }}>
          We may use cookies, local storage, server logs, Cloudflare Web Analytics,
          or similar tools to enhance site performance, protect the service, and
          understand general usage trends. You can manage cookie preferences
          through your browser settings. We do not use website analytics to collect
          wallet private keys, seed phrases, biometric templates, or wallet secrets.
        </p>
      ),
    },
    {
      n: 12, title: 'Data security',
      body: (
        <p style={{ margin: 0 }}>
          We apply reasonable technical, organizational, and cryptographic
          safeguards to protect your data from unauthorized access or misuse.
          SciPHR is built with privacy-first principles, and this extends to our
          operational and communication stack.
        </p>
      ),
    },
    {
      n: 13, title: 'Policy updates',
      body: (
        <p style={{ margin: 0 }}>
          We may update this policy from time to time. The latest version will
          always be available at{' '}
          <PolicyLink href="privacy.html">sciphr.io/privacy</PolicyLink>,
          with the effective date listed at the top.
        </p>
      ),
    },
    {
      n: 14, title: 'Contact',
      body: (
        <p style={{ margin: 0 }}>
          For any questions or requests regarding this policy or your data,
          contact: <PolicyLink href={privacyHref}>{privacyEmail}</PolicyLink>.
        </p>
      ),
    },
    {
      n: 15, title: 'Affiliate links',
      body: (
        <p style={{ margin: 0 }}>
          Some links on this site may earn a commission if you click or make a
          purchase.
        </p>
      ),
    },
  ];

  return (
    <SiteShell current="privacy">
      <PageHeader
        eyebrow="Legal · Privacy"
        title="Privacy policy."
        lede="At SciPHR LLC, we prioritize privacy and data integrity as core design principles. This policy outlines how we collect, use, retain, delete, and safeguard information when you interact with our website, xCIPHR app, identity services, support, or communications."
      />

      <div style={{
        display: 'flex', alignItems: 'baseline', gap: 18,
        fontFamily: SP_MONO_W, fontSize: 11, letterSpacing: '0.3em',
        textTransform: 'uppercase', color: SP_COL.grayDark, fontWeight: 600,
      }}>
        <span>› Effective date</span>
        <span style={{ color: SP_COL.white, letterSpacing: '0.15em' }}>June 11, 2026</span>
        <span>·</span>
        <span>SciPHR LLC ("SciPHR", "we", "our", or "us")</span>
      </div>

      <section style={{ display: 'flex', flexDirection: 'column', gap: 16 }}>
        {sections.map(s => (
          <ContentCard key={s.n} title={`${s.n}. ${s.title}`}>
            {s.body}
          </ContentCard>
        ))}
      </section>

      <section style={{ display: 'flex', flexDirection: 'column', gap: 14 }}>
        <p style={{
          fontFamily: SP_MONO_W, fontSize: 14, lineHeight: 1.65,
          color: SP_COL.grayLight, margin: 0,
        }}>
          Questions about how we handle your data? Email{' '}
          <PolicyLink href={privacyHref}>{privacyEmail}</PolicyLink>
          {' '}or reach out via the contact form on the homepage.
        </p>
        <div style={{ display: 'flex', flexWrap: 'wrap', gap: 12 }}>
          <CommandButton label="Back to home" href="index.html" />
          <CommandButton label="Contact" href={SP_LINKS.emailContact} variant="ghost" />
        </div>
      </section>
    </SiteShell>
  );
}

const root = ReactDOM.createRoot(document.getElementById('root'));
root.render(<PrivacyPage />);