// Static legal/contact pages: Privacy, Terms, Contact.
// Routed from app.jsx via the '#/privacy', '#/terms', '#/contact' hashes.
// Each page registers itself on window so app.jsx can render it without an
// explicit import.

const MM_SUPPORT_EMAIL = 'support@magictools.com';
window.MM_SUPPORT_EMAIL = MM_SUPPORT_EMAIL;

function PageShell({ title, sub, children }) {
  React.useEffect(() => {
    const onKey = (e) => { if (e.key === 'Escape') window.mmNavigate?.('home'); };
    document.addEventListener('keydown', onKey);
    return () => document.removeEventListener('keydown', onKey);
  }, []);
  return (
    <div className="legal-shell">
      <header className="legal-head">
        <button className="dash-back" onClick={() => window.mmNavigate?.('home')}>
          <window.Icon name="arrow" size={14} style={{ transform: 'rotate(180deg)' }} />
          <span>MiniMagics</span>
        </button>
        <div style={{ flex: 1 }}>
          <h1 className="legal-h1">{title}</h1>
          {sub && <p className="legal-sub">{sub}</p>}
        </div>
      </header>
      <main className="legal-body">{children}</main>
      <footer className="legal-foot">
        <span>Need help? <a href={`mailto:${MM_SUPPORT_EMAIL}`}>{MM_SUPPORT_EMAIL}</a></span>
      </footer>
    </div>
  );
}

window.PrivacyPage = function PrivacyPage() {
  const updated = '25 April 2026';
  return (
    <PageShell title="Privacy Policy" sub={`Last updated ${updated}`}>
      <section>
        <h2>1. Summary</h2>
        <p>
          MiniMagics is a privacy-first set of in-browser tools. We do not upload your files
          to our servers when you use a tool. Image, PDF, and file processing happens on
          your device using JavaScript and WebAssembly. Your files never leave your machine
          unless you explicitly choose to use a tool that requires a remote API
          (clearly marked).
        </p>
      </section>

      <section>
        <h2>2. Data We Collect</h2>
        <p>We distinguish three categories of data:</p>
        <ul>
          <li>
            <strong>File contents</strong> — never collected. Files dropped into a tool stay
            on your device. Browser memory and disk are the only places they exist.
          </li>
          <li>
            <strong>Account data</strong> (only if you sign in) — your email address, your
            chosen display name, and an OAuth identifier issued by Google or Apple.
            We use this to recognise you across devices and to send service-related
            email when you ask us to (e.g. password reset).
          </li>
          <li>
            <strong>Usage telemetry</strong> — when a tool is opened or a job completes, we
            log an event with the tool ID, an anonymous user ID (if signed in),
            duration, and success/failure. We never log file names, file contents, IP
            addresses, geolocation, browser fingerprints, or device identifiers.
          </li>
        </ul>
      </section>

      <section>
        <h2>3. Cookies and Local Storage</h2>
        <p>
          We use <code>localStorage</code> on your browser to remember your preferences:
          theme (light/dark), favourite tools, recently used tools. These never leave
          your browser. We do not use third-party tracking cookies, advertising
          pixels, or fingerprinting libraries.
        </p>
        <p>
          When you sign in, Supabase Auth (our identity provider) stores a session token
          in <code>localStorage</code>. You can sign out at any time to clear it.
        </p>
      </section>

      <section>
        <h2>4. Third-Party Services</h2>
        <ul>
          <li>
            <strong>Supabase</strong> (EU region) — powers authentication and the small
            amount of usage telemetry described above. Data is stored on EU servers
            inside the European Economic Area.
          </li>
          <li>
            <strong>Stripe</strong> — only used if you purchase a paid tier. Payment data
            is collected by Stripe directly; we never see your card number.
          </li>
          <li>
            <strong>Google / Apple</strong> — only if you choose social sign-in.
          </li>
          <li>
            <strong>Public CDNs</strong> (jsdelivr, unpkg, Hugging Face) — your browser
            downloads JavaScript libraries and machine-learning models from these
            CDNs on demand. Your IP address is visible to those CDNs as part of any
            HTTP request, just as with any website resource.
          </li>
        </ul>
      </section>

      <section>
        <h2>5. Your Rights (GDPR / KVKK)</h2>
        <p>
          If you are located in the European Economic Area, the United Kingdom, or
          Türkiye, you have the right to access, correct, export, or delete your
          personal data. Send a request to <a href={`mailto:${MM_SUPPORT_EMAIL}`}>{MM_SUPPORT_EMAIL}</a>.
          We respond within 30 days.
        </p>
        <p>
          For users in Türkiye, this notice also serves as the disclosure required by
          Article 10 of KVKK (Law No. 6698 on the Protection of Personal Data).
          Data is processed on the legal basis of explicit consent (Article 5(1)(a))
          and to fulfil the service you have requested (Article 5(2)(c)).
        </p>
      </section>

      <section>
        <h2>6. Children</h2>
        <p>
          MiniMagics is not directed at children under 13. We do not knowingly collect
          personal data from children.
        </p>
      </section>

      <section>
        <h2>7. Security</h2>
        <p>
          Account data is stored in Supabase with row-level security. API keys we issue
          are stored only as SHA-256 hashes; the raw key is shown to you once and
          never persisted server-side. All transport uses TLS.
        </p>
        <p>
          We are not a substitute for your own security review — please don't process
          classified or regulated information without verifying that browser-side
          processing meets your obligations.
        </p>
      </section>

      <section>
        <h2>8. Changes</h2>
        <p>
          We may update this policy from time to time. We will update the "Last
          updated" date at the top, and substantial changes will be announced on
          the site for at least 30 days.
        </p>
      </section>

      <section>
        <h2>9. Contact</h2>
        <p>
          Privacy questions, deletion requests, or any other concerns: <a href={`mailto:${MM_SUPPORT_EMAIL}`}>{MM_SUPPORT_EMAIL}</a>.
        </p>
      </section>
    </PageShell>
  );
};

window.TermsPage = function TermsPage() {
  const updated = '25 April 2026';
  return (
    <PageShell title="Terms of Service" sub={`Last updated ${updated}`}>
      <section>
        <h2>1. Acceptance</h2>
        <p>
          By using MiniMagics ("the Service"), you agree to these Terms. If you don't
          agree, please don't use the Service.
        </p>
      </section>

      <section>
        <h2>2. The Service</h2>
        <p>
          MiniMagics provides browser-based utilities for working with PDFs, images,
          files, and format conversions. Most tools run entirely on your device.
          Some tools optionally call our hosted API endpoints; they are clearly
          marked and require either a signed-in session or an API key.
        </p>
      </section>

      <section>
        <h2>3. Acceptable Use</h2>
        <p>You agree not to:</p>
        <ul>
          <li>Process content that violates the rights of others or applicable law (copyright infringement, illegal pornography, etc.).</li>
          <li>Attempt to disrupt, reverse-engineer, or overload our hosted infrastructure.</li>
          <li>Share, resell, or sublicense access to paid features without our written permission.</li>
          <li>Use the Service to send spam, malware, or content that defames or harasses others.</li>
        </ul>
      </section>

      <section>
        <h2>4. Your Content</h2>
        <p>
          You retain all rights to files you process through the Service. Because
          processing is browser-side, we do not see your files and acquire no rights
          in them. When you use a hosted API endpoint, your file is transmitted to
          our servers only for the duration of the request and is not retained
          after the response is returned.
        </p>
      </section>

      <section>
        <h2>5. Paid Tiers</h2>
        <p>
          Premium and Pro tiers unlock additional tools and higher API quotas.
          Payments are processed by Stripe. Tiers are one-time unlocks (lifetime
          access for the listed feature set) unless explicitly described as
          subscriptions. Refunds within 14 days, no questions asked, by emailing <a href={`mailto:${MM_SUPPORT_EMAIL}`}>{MM_SUPPORT_EMAIL}</a>.
        </p>
      </section>

      <section>
        <h2>6. Disclaimer</h2>
        <p>
          The Service is provided "as is" without warranties of any kind, express or
          implied. We do not guarantee that any tool produces output that meets
          your specific requirements or that the Service will be uninterrupted or
          error-free. You are responsible for verifying outputs before using them
          for any consequential purpose (legal documents, medical records, etc.).
        </p>
      </section>

      <section>
        <h2>7. Limitation of Liability</h2>
        <p>
          To the maximum extent permitted by law, MiniMagics and its operators are not
          liable for any indirect, incidental, special, consequential, or punitive
          damages, or any loss of profits or revenues, whether incurred directly
          or indirectly, arising from your use of the Service.
        </p>
      </section>

      <section>
        <h2>8. Termination</h2>
        <p>
          We may suspend or terminate your account for material breach of these
          Terms (typically with at least 14 days' notice). You can stop using the
          Service at any time; your local data clears when you clear browser
          storage.
        </p>
      </section>

      <section>
        <h2>9. Governing Law</h2>
        <p>
          These Terms are governed by the laws of the Netherlands. Disputes will be
          resolved in the courts of Amsterdam, unless mandatory consumer-protection
          law in your country requires otherwise.
        </p>
      </section>

      <section>
        <h2>10. Contact</h2>
        <p>Questions about these Terms: <a href={`mailto:${MM_SUPPORT_EMAIL}`}>{MM_SUPPORT_EMAIL}</a>.</p>
      </section>
    </PageShell>
  );
};

window.ContactPage = function ContactPage() {
  return (
    <PageShell title="Contact" sub="We read every email. Replies typically within two business days.">
      <section>
        <h2>Reach us by email</h2>
        <p style={{ fontSize: 18 }}>
          <a href={`mailto:${MM_SUPPORT_EMAIL}`}><strong>{MM_SUPPORT_EMAIL}</strong></a>
        </p>
        <p>
          Use this address for support, bug reports, feature requests, business
          enquiries, partnership proposals, security disclosures, or privacy
          requests (deletion / export / correction).
        </p>
      </section>

      <section>
        <h2>What to include in a support email</h2>
        <ul>
          <li>Which tool you were using (e.g. <em>Edit PDF</em>).</li>
          <li>Your browser and operating system.</li>
          <li>What you expected to happen, and what actually happened.</li>
          <li>If a tool errored, the exact error message (a screenshot helps).</li>
          <li>Approximate file size and type — never the file itself unless we ask.</li>
        </ul>
      </section>

      <section>
        <h2>Security disclosure</h2>
        <p>
          If you have found a security issue, please email us privately at the
          address above before disclosing publicly. We aim to acknowledge within
          48 hours and to ship a fix within 14 days for high-severity issues.
        </p>
      </section>

      <section>
        <h2>Press &amp; partnerships</h2>
        <p>
          For coverage, integrations, white-label inquiries, or licensing, the same
          email reaches the operations team — please prefix the subject line with
          <code> [BIZ]</code> so we route it correctly.
        </p>
      </section>
    </PageShell>
  );
};