BelgianBitcoinEmbassy/frontend/app/privacy/page.tsx

import type { Metadata } from "next";
import Link from "next/link";
import { Navbar } from "@/components/public/Navbar";
import { Footer } from "@/components/public/Footer";

export const metadata: Metadata = {
  title: "Privacy Policy",
  description:
    "GDPR-oriented privacy policy for the Belgian Bitcoin Embassy. Learn what data we process, why we process it, and your rights.",
  openGraph: {
    title: "Privacy Policy - Belgian Bitcoin Embassy",
    description:
      "How we process data for account access, moderation, and community features, with clear GDPR rights and transparency.",
  },
  alternates: { canonical: "/privacy" },
};

export default function PrivacyPage() {
  return (
    <>
      <Navbar />
      <div className="min-h-screen">
        <div className="max-w-3xl mx-auto px-8 pt-16 pb-24">
          <h1 className="text-4xl font-black mb-3">Privacy Policy</h1>
          <p className="text-sm text-on-surface-variant mb-8">Last updated: April 3, 2026</p>

          <div className="space-y-8 text-on-surface-variant leading-relaxed">
            <section>
              <h2 className="text-xl font-bold text-on-surface mb-4">Who We Are</h2>
              <p>
                Belgian Bitcoin Embassy is a community initiative focused on Bitcoin education
                and meetups in Belgium. We aim to process the minimum data needed to run this
                website safely and reliably.
              </p>
            </section>

            <section>
              <h2 className="text-xl font-bold text-on-surface mb-4">What Data We Process</h2>
              <p>
                If you log in with Nostr, we process your public key, role, and optional
                username. We also process content needed to operate the site, such as posts,
                submissions, media metadata, and moderation records. Some Nostr-related data
                may be cached on our servers to improve performance.
              </p>
            </section>

            <section>
              <h2 className="text-xl font-bold text-on-surface mb-4">Why We Process Data</h2>
              <p>
                We process data to provide core site features, maintain account sessions,
                prevent abuse, moderate community interactions, and keep the service secure.
                Our legal bases are contract (or steps requested by you before using features)
                and legitimate interests (security, integrity, and service operation).
              </p>
            </section>

            <section>
              <h2 className="text-xl font-bold text-on-surface mb-4">Cookies and Local Storage</h2>
              <p>
                We currently do not use third-party analytics or advertising cookies. We do use
                browser local storage to keep your authentication session active. You can clear
                this data at any time by logging out or clearing browser storage.
              </p>
            </section>

            <section>
              <h2 className="text-xl font-bold text-on-surface mb-4">Recipients</h2>
              <p>
                When you interact through Nostr, your actions are published on the Nostr network,
                which is public by design. We may also use infrastructure providers to host and
                secure the website.
              </p>
            </section>

            <section>
              <h2 className="text-xl font-bold text-on-surface mb-4">Retention</h2>
              <p>
                We keep account and operational data only as long as needed for service operation,
                security, and moderation. Technical logs may be retained for a limited period.
                You can remove local browser data at any time.
              </p>
            </section>

            <section>
              <h2 className="text-xl font-bold text-on-surface mb-4">Your GDPR Rights</h2>
              <p>
                Depending on applicable law, you may have rights to access, rectify, erase, restrict,
                object to, or request portability of your personal data. You also have the right to
                lodge a complaint with the Belgian Data Protection Authority.
              </p>
            </section>

            <section>
              <h2 className="text-xl font-bold text-on-surface mb-4">International Transfers</h2>
              <p>
                If technical providers process data outside the EEA, we aim to rely on appropriate
                safeguards as required under GDPR.
              </p>
            </section>

            <section>
              <h2 className="text-xl font-bold text-on-surface mb-4">Children</h2>
              <p>This website is not directed at children under the age of 16.</p>
            </section>

            <section>
              <h2 className="text-xl font-bold text-on-surface mb-4">Policy Updates</h2>
              <p>
                We may update this Privacy Policy from time to time. Material changes are reflected
                by updating the date at the top of this page.
              </p>
            </section>

            <section>
              <h2 className="text-xl font-bold text-on-surface mb-4">Contact</h2>
              <p>
                For privacy-related questions, reach out to us via our{" "}
                <Link href="/#community" className="text-primary hover:underline">
                  community channels
                </Link>.
              </p>
            </section>
          </div>
        </div>
      </div>
      <Footer />
    </>
  );
}