synAdminandClaude Opus 5
25bec50902
Completes the consent picture the rest of this branch builds. The claim worth being able to check is that no cookie needing permission is set before it is asked for, so the policy now lists everything rather than asserting it: the rd_session sign-in cookie, which is strictly necessary and therefore exempt, the two preferences kept in localStorage and never sent anywhere, and Brevo's cookie, which cannot exist unless analytics consent was given because the script that would set it is never loaded otherwise. No cookie banner, and that is a finding rather than an omission. ePrivacy requires consent before storing anything non-essential, and this application does not store anything non-essential until the customer has asked for the feature that needs it. A banner would be asking permission for things that are either exempt or already separately consented to, which teaches people to dismiss the one consent that does matter. Described in terms of what each thing does rather than by category, since a list of cookie names tells a customer nothing they can act on. Refs #56 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
100 lines
5.2 KiB
TypeScript
Executable File
100 lines
5.2 KiB
TypeScript
Executable File
import Typography from 'antd/es/typography';
|
|
import Card from 'antd/es/card';
|
|
|
|
const { Title, Paragraph } = Typography;
|
|
|
|
export default function PrivacyPolicy() {
|
|
return (
|
|
<div style={{ maxWidth: 720, margin: '48px auto', padding: '0 16px' }}>
|
|
<Card>
|
|
<Title level={2}>Privacy Policy</Title>
|
|
<Paragraph type="secondary">
|
|
This is a general-purpose starter policy. Have it reviewed by a lawyer before relying on it —
|
|
it is not legal advice and may not reflect your specific obligations.
|
|
</Paragraph>
|
|
|
|
<Title level={4}>What we collect</Title>
|
|
<Paragraph>
|
|
If you create an account, we collect your email address, name (optional), and a securely
|
|
hashed password. If you make a purchase, we record the item, amount, and payment processor
|
|
transaction reference. We do not store your card or PayPal login details — payment is handled
|
|
entirely by our payment processor.
|
|
</Paragraph>
|
|
|
|
<Title level={4}>Marketing emails</Title>
|
|
<Paragraph>
|
|
We only send you marketing emails if you explicitly opt in during signup or in your account
|
|
settings. You can withdraw consent at any time from your account page, or via the unsubscribe
|
|
link included in every marketing email — no login required.
|
|
</Paragraph>
|
|
|
|
<Title level={4}>Analytics and tracking</Title>
|
|
<Paragraph>
|
|
If — and only if — you have separately opted in to it, we share what you browse and buy on
|
|
this site with <strong>Brevo</strong>, the service that sends our emails, so that what
|
|
they contain is relevant to you. That covers the pages you visit here, items you add to
|
|
your cart or favorite, and completed orders, linked to your email address.
|
|
</Paragraph>
|
|
<Paragraph>
|
|
<strong>This is a separate choice from receiving the emails themselves.</strong> You can
|
|
have the emails without it, or turn it off and keep receiving them. It is off unless you
|
|
switch it on — we never enable it by default, and never as a side effect of subscribing to
|
|
anything else. Both choices live in your account settings, and turning either off is as
|
|
easy as turning it on.
|
|
</Paragraph>
|
|
<Paragraph>
|
|
If you have not opted in, none of this happens: no tracking script is loaded, nothing is
|
|
sent, and no tracking cookie is set. The same is true if you are not signed in — we do not
|
|
track visitors who do not have an account. Turning it off stops any further activity being
|
|
shared. Two limits worth being plain about: anything already shared with Brevo before you
|
|
turned it off remains with them, and a tracking cookie set earlier in your visit stays in
|
|
your browser until you close the tab or clear it.
|
|
</Paragraph>
|
|
|
|
<Title level={4}>Cookies and browser storage</Title>
|
|
<Paragraph>
|
|
We do not show a cookie banner, because until you ask for something that needs one we do
|
|
not set anything that requires your permission. Here is everything, so you can check that
|
|
claim rather than take it on trust:
|
|
</Paragraph>
|
|
<Paragraph>
|
|
<strong>A sign-in cookie (<code>rd_session</code>).</strong> Set only when you sign in,
|
|
and only so the site knows it is still you on the next page. It cannot be read by
|
|
JavaScript, is not shared with anyone, and is not used to track you. Signing out removes
|
|
it. This is what the rules call a strictly necessary cookie: without it, signing in would
|
|
not work at all, so it does not need — and we do not ask for — separate consent.
|
|
</Paragraph>
|
|
<Paragraph>
|
|
<strong>Two preferences kept in your browser</strong>, not cookies and never sent to us:
|
|
whether you chose the light or dark theme, and how many items you like to see per page.
|
|
They stay on your device and are readable only by this site. Clearing your browser data
|
|
removes them.
|
|
</Paragraph>
|
|
<Paragraph>
|
|
<strong>Brevo's tracking cookie — only if you opted in to sharing your activity.</strong>{' '}
|
|
If you have not, the script that would set it is never loaded, so the cookie never exists.
|
|
It is not set for signed-out visitors under any circumstances.
|
|
</Paragraph>
|
|
|
|
<Title level={4}>Your rights</Title>
|
|
<Paragraph>
|
|
You may request a copy of your data ("Download my data" in your account page), or delete your
|
|
account entirely at any time. Deleting your account removes your personal information; past
|
|
order records are retained in anonymized form for accounting purposes.
|
|
</Paragraph>
|
|
|
|
<Title level={4}>Data retention</Title>
|
|
<Paragraph>
|
|
Account data is retained until you delete your account. Order records are retained as required
|
|
for financial recordkeeping, disconnected from your identity upon account deletion.
|
|
</Paragraph>
|
|
|
|
<Title level={4}>Contact</Title>
|
|
<Paragraph>
|
|
For privacy questions or data requests, contact us at the email address listed on this site.
|
|
</Paragraph>
|
|
</Card>
|
|
</div>
|
|
);
|
|
}
|