<?php
require_once __DIR__ . '/includes/config.php';
requireLogin();
$user        = currentUser();
$currentPage = '';
$pageTitle   = 'Privacy Policy';
?>
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0">
<title>Privacy Policy – SPACE</title>
<link rel="preconnect" href="https://fonts.googleapis.com">
<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
<link href="https://fonts.googleapis.com/css2?family=Poppins:wght@300;400;500;600;700;800&display=swap" rel="stylesheet">
<link rel="stylesheet" href="assets/css/main.css">
<meta name="csrf-token" content="<?= e(csrfToken()) ?>">
<style>
.legal-wrap { max-width: 760px; margin: 0 auto; }
.legal-hero { text-align: center; padding: 32px 0 28px; }
.legal-hero h1 { font-size: 28px; font-weight: 800; margin-bottom: 6px; }
.legal-hero p  { font-size: 13px; color: var(--muted); }
.legal-card { background: var(--bg); border-radius: 24px; padding: 32px 28px; box-shadow: var(--neu-out); margin-bottom: 16px; }
.legal-section-title { font-size: 14px; font-weight: 700; text-transform: uppercase; letter-spacing: .06em; margin-bottom: 12px; }
.legal-body { font-size: 13px; line-height: 1.8; color: #444; }
.legal-body p { margin-bottom: 12px; }
.legal-body ul { padding-left: 20px; margin-bottom: 12px; }
.legal-body li { margin-bottom: 6px; }
.data-table { width: 100%; border-collapse: collapse; font-size: 12px; margin: 12px 0; }
.data-table th { background: rgba(0,0,0,.05); padding: 8px 12px; text-align: left; font-weight: 700; border-radius: 6px; }
.data-table td { padding: 8px 12px; border-bottom: 1px solid #ddd; }
.legal-updated { font-size: 11px; color: var(--muted); text-align: center; margin-top: 20px; }
@media (max-width: 768px) { .legal-card { padding: 22px 18px; } }
</style>
</head>
<body>
<div class="app-layout">
  <?php include __DIR__ . '/includes/sidebar.php'; ?>
  <main class="main-content">
    <div class="mobile-header">
      <button class="menu-open-btn" id="menu-open-btn">
        <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.2" width="20"><path stroke-linecap="round" d="M4 6h16M4 12h16M4 18h16"/></svg>
      </button>
      <div class="logo-circle-sm"><img src="assets/img/logo.svg" alt="SPACE" width="26"></div>
      <a href="ai.php" style="font-size:11px;color:var(--muted);font-weight:600;">← Back</a>
    </div>

    <div class="legal-wrap">
      <div class="legal-hero">
        <div style="font-size:40px;margin-bottom:8px;">🔒</div>
        <h1>Privacy Policy</h1>
        <p>We care about your data. Here's exactly how we use it.</p>
      </div>

      <div class="legal-card">
        <div class="legal-section-title">👁️ Overview</div>
        <div class="legal-body">
          <p>SPACE ("we", "the App") is committed to protecting your privacy. This Privacy Policy explains what data we collect, how we use it, and your rights regarding that data. We believe in transparency and keeping your information safe.</p>
        </div>
      </div>

      <div class="legal-card">
        <div class="legal-section-title">📊 Data We Collect</div>
        <div class="legal-body">
          <table class="data-table">
            <tr><th>Category</th><th>What We Collect</th><th>Why</th></tr>
            <tr><td><strong>Account</strong></td><td>Name, username, email, course, school</td><td>Account creation & personalization</td></tr>
            <tr><td><strong>Content</strong></td><td>Notes, tasks, calendar events</td><td>Core app functionality</td></tr>
            <tr><td><strong>AI Chats</strong></td><td>Chat messages, session history</td><td>Conversation continuity</td></tr>
            <tr><td><strong>Documents</strong></td><td>Uploaded files (text extracted)</td><td>AI document analysis</td></tr>
            <tr><td><strong>Flashcards</strong></td><td>Decks, cards, study progress</td><td>Learning tracking</td></tr>
            <tr><td><strong>Study Data</strong></td><td>Pomodoro sessions, focus minutes</td><td>Productivity stats</td></tr>
            <tr><td><strong>Technical</strong></td><td>Session cookies, IP address</td><td>Security & authentication</td></tr>
          </table>
          <p>We do <strong>not</strong> collect payment information, precise location data, or device identifiers beyond what is necessary for session management.</p>
        </div>
      </div>

      <div class="legal-card">
        <div class="legal-section-title">🤖 AI & Third-Party Services</div>
        <div class="legal-body">
          <p>The Astro AI feature uses the <strong>Groq API</strong> to process your messages. When you send a message to Astro:</p>
          <ul>
            <li>Your message and recent conversation context is sent to Groq's servers</li>
            <li>Groq processes your request and returns a response</li>
            <li>Groq may have its own data retention and privacy practices — please review <a href="https://groq.com/privacy-policy/" target="_blank" rel="noopener" style="font-weight:600;">Groq's Privacy Policy</a></li>
          </ul>
          <p>Uploaded documents are processed locally for text extraction before being included in AI requests. Document text may be sent to Groq as part of the context for analysis.</p>
        </div>
      </div>

      <div class="legal-card">
        <div class="legal-section-title">🍪 Cookies & Sessions</div>
        <div class="legal-body">
          <p>SPACE uses the following cookies:</p>
          <ul>
            <li><strong>SPACE_SESSION</strong> — Required session cookie for authentication. Expires when browser closes or after your configured session lifetime.</li>
            <li><strong>remember_token</strong> — Optional persistent cookie for "Remember Me" functionality. Stored for 30 days if selected.</li>
          </ul>
          <p>We do not use tracking cookies, advertising cookies, or any third-party analytics cookies.</p>
        </div>
      </div>

      <div class="legal-card">
        <div class="legal-section-title">🗄️ Data Storage & Security</div>
        <div class="legal-body">
          <p>Your data is stored in a MySQL database on your server. We implement the following security measures:</p>
          <ul>
            <li>Passwords are hashed using bcrypt (never stored in plain text)</li>
            <li>All database queries use prepared statements to prevent SQL injection</li>
            <li>CSRF tokens protect all form submissions and API calls</li>
            <li>Sensitive files (uploads, env) are protected from direct web access</li>
            <li>Session IDs are regenerated upon login to prevent session fixation</li>
          </ul>
        </div>
      </div>

      <div class="legal-card">
        <div class="legal-section-title">✅ Your Rights</div>
        <div class="legal-body">
          <p>You have the following rights regarding your data:</p>
          <ul>
            <li><strong>Access</strong> — View all your data through the App interface</li>
            <li><strong>Edit</strong> — Update your notes, tasks, and account information anytime</li>
            <li><strong>Delete</strong> — Delete individual items (notes, tasks, events, chats) at any time</li>
            <li><strong>Account Deletion</strong> — Request full account deletion by contacting your administrator</li>
            <li><strong>Document Removal</strong> — Uploaded documents can be deleted from the chat interface</li>
          </ul>
        </div>
      </div>

      <div class="legal-card">
        <div class="legal-section-title">👶 Children's Privacy</div>
        <div class="legal-body">
          <p>SPACE is designed for students. If you are under 13 years old, please ensure you have parental or guardian consent before using this App. We do not knowingly collect personal information from children under 13 without verifiable parental consent.</p>
        </div>
      </div>

      <div class="legal-card">
        <div class="legal-section-title">📩 Contact Us</div>
        <div class="legal-body">
          <p>For privacy-related questions or data requests, please contact your institution's system administrator or the person who deployed this SPACE instance.</p>
        </div>
      </div>

      <p class="legal-updated">Last updated: <?= date('F j, Y') ?> · SPACE v2.0</p>
      <div style="text-align:center;padding-bottom:40px;">
        <a href="ai.php" class="btn btn-primary">← Back to Astro AI</a>
      </div>
    </div>
  </main>

  <nav class="mobile-bottom-nav">
    <a href="dashboard.php" class="mob-nav-btn">
      <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" width="20"><path d="M3 9l9-7 9 7v11a2 2 0 01-2 2H5a2 2 0 01-2-2z"/><polyline points="9 22 9 12 15 12 15 22"/></svg>
    </a>
    <a href="ai.php" class="mob-nav-fab">
      <svg viewBox="0 0 24 24" fill="none" stroke="#ec4899" stroke-width="2.2" stroke-linecap="round" width="26"><path d="M12 2a10 10 0 100 20"/><path d="M22 12A10 10 0 0012 2v10z"/></svg>
    </a>
    <a href="flashcards.php" class="mob-nav-btn">
      <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" width="20"><rect x="2" y="6" width="20" height="13" rx="2"/><path d="M8 6V4a2 2 0 012-2h4a2 2 0 012 2v2"/></svg>
    </a>
  </nav>
</div>
<script src="assets/js/app.js"></script>
</body>
</html>
