import type { Metadata } from "next";
import Link from "next/link";
import { LegalLayout, type LegalSection } from "@/components/marketing/legal-layout";

export const metadata: Metadata = {
  title: "Acceptable Use Policy",
  description: "What you may and may not do with the Fetcha web access API, how we monitor for abuse, and what happens when this policy is violated.",
  alternates: { canonical: "/legal/acceptable-use" },
};

const sections: LegalSection[] = [
  {
    id: "purpose",
    title: "Purpose and scope",
    body: (
      <>
        <p>
          Fetcha gives developers reliable, programmatic access to the public web through shared network infrastructure. Because that infrastructure is shared with other customers and with the residents and businesses whose connections form the upstream networks, misuse by one customer harms everyone. This Acceptable Use Policy (<strong>“AUP”</strong>) sets the rules. It is part of the <Link href="/legal/terms">Terms of Service</Link> and applies to every request you send, every API key you hold, every person who uses your account, and every integration you build on the Services.
        </p>
        <p>The list of prohibited uses below is not exhaustive. If an activity is unlawful, harms third parties, or would be embarrassing to explain to the operator of the website you are accessing, assume it is prohibited. When in doubt, ask <a href="mailto:legal@fetcha.co">legal@fetcha.co</a> before you build.</p>
      </>
    ),
  },
  {
    id: "your-responsibility",
    title: "Your responsibility",
    body: (
      <>
        <p>You, not Fetcha, decide which URLs to request and what to do with the content. You are responsible for ensuring that each request and each downstream use is lawful in every jurisdiction that applies to you, to the target website and to any individuals whose data is involved. This includes, without limitation, data-protection and privacy law, copyright and database-right law, computer-misuse and anti-hacking statutes, consumer-protection law, anti-spam law, export controls and sanctions.</p>
        <p>You are also responsible for respecting the contractual terms and technical signals of the websites you access. Fetcha does not evaluate third-party terms of service or <code>robots.txt</code> on your behalf and does not warrant that any access is permitted. Where a website requires authorisation, you must have it.</p>
      </>
    ),
  },
  {
    id: "prohibited",
    title: "Prohibited uses",
    body: (
      <>
        <p>You must not use, or attempt to use, the Services to:</p>
        <ol>
          <li>
            <strong>Access systems without authorisation.</strong> Probe, scan, log in to or retrieve data from any computer, network, account or non-public resource that you are not expressly authorised to access, or exceed the scope of an authorisation you do have.
          </li>
          <li>
            <strong>Perform credential stuffing or brute force.</strong> Test stolen, leaked, guessed or generated usernames, passwords, tokens, session identifiers, gift-card numbers, coupon codes or similar credentials against any service, or otherwise attempt to take over accounts.
          </li>
          <li>
            <strong>Flood, overload or attack.</strong> Conduct denial-of-service or distributed denial-of-service attacks, deliberately send traffic at volumes or rates intended to degrade a target, exhaust inventory, skew metrics or interfere with the normal operation of any website, API or network.
          </li>
          <li>
            <strong>Bypass third-party paywalls or authentication.</strong> Circumvent login walls, paywalls, subscription checks, CAPTCHAs that protect authenticated areas, licence checks, digital-rights-management or other access controls of a third party in order to obtain content or services you are not entitled to.
          </li>
          <li>
            <strong>Collect personal data unlawfully.</strong> Harvest names, contact details, identifiers, images, location data or other personal information without a lawful basis and the notices required by applicable law; build profiles of individuals for surveillance, stalking, doxxing or discrimination; or scrape data that a website makes available only to authenticated users of its own service.
          </li>
          <li>
            <strong>Handle child sexual abuse material (CSAM).</strong> Access, retrieve, store, distribute or facilitate access to any sexual content involving minors, or any content that sexualises minors. We report such activity to the Canadian Centre for Child Protection and to law enforcement without notice.
          </li>
          <li>
            <strong>Commit or facilitate fraud.</strong> Engage in payment fraud, ad fraud, click fraud, fake reviews, fake account creation, ticket or sneaker “botting” in violation of a seller’s terms, affiliate-link hijacking, phishing, impersonation or any deceptive practice.
          </li>
          <li>
            <strong>Distribute malware or malicious content.</strong> Host, retrieve, relay or deliver viruses, ransomware, spyware, exploit kits, command-and-control traffic or content designed to compromise devices or data.
          </li>
          <li>
            <strong>Target Fetcha’s own infrastructure.</strong> Request <code>fetcha.co</code> domains, our API endpoints, dashboard, internal services or the infrastructure of our network partners; attempt to discover partner identities or internal addresses; circumvent rate limits, quotas, SSRF protections or billing; or use the Services to test their security without written permission.
          </li>
          <li>
            <strong>Resell the Services as an anonymous proxy.</strong> Offer, package or expose Fetcha as a general-purpose, open or anonymous proxy, VPN or “unblocker” to third parties; run a public relay on top of the API; or otherwise provide access to persons whose identity and purpose you do not know and are not responsible for. Building your own product that uses Fetcha behind the scenes for a defined purpose is fine; passing raw proxy capability to strangers is not.
          </li>
        </ol>
        <p>In addition, you must not use the Services to send unsolicited bulk messages, to violate sanctions or export-control law, to infringe intellectual-property rights at scale, to interfere with elections or public-health information, or to engage in any activity that is illegal where you or the target are located.</p>
      </>
    ),
  },
  {
    id: "technical-rules",
    title: "Technical rules",
    body: (
      <>
        <ul>
          <li>Only <code>http</code> and <code>https</code> URLs are accepted. Requests to localhost, private, link-local, metadata and internal addresses are refused, and every redirect is re-validated (<code>URL_NOT_ALLOWED</code>). Do not try to evade these checks.</li>
          <li>Respect your plan’s concurrency, timeout and retry limits. Do not spread a single workload across multiple accounts to evade limits or quotas.</li>
          <li>Keep API keys confidential. Do not embed live keys in client-side code, public repositories or shared images.</li>
          <li>Use realistic request rates against any single target. Sustained high-frequency hammering of one domain is a signal of abuse even when the content is public.</li>
          <li>Do not attempt to identify, enumerate or contact the individuals or organisations that provide upstream network capacity.</li>
        </ul>
      </>
    ),
  },
  {
    id: "monitoring",
    title: "Monitoring",
    body: (
      <>
        <p>We do not read the content you retrieve, and we do not store response bodies by default. To enforce this AUP and protect the network we do monitor <strong>request metadata</strong>: target domains and URL patterns, request rates and volumes, error and block rates, network classes and geographies, session behaviour, and signals from our upstream partners and from website operators. Automated systems flag anomalies (for example, login-endpoint hammering or credential-shaped payloads) and may throttle traffic in real time; flagged accounts are reviewed by a person.</p>
        <p>We may also act on complaints from website operators, network partners, individuals or authorities. When we investigate, we may look at the request records of the account concerned, including debug attempts where you enabled them, for the retention period of your plan.</p>
      </>
    ),
  },
  {
    id: "enforcement",
    title: "Suspension and enforcement",
    body: (
      <>
        <p>Depending on severity, we may take one or more of the following steps, with or without prior notice:</p>
        <ul>
          <li>block specific domains, URL patterns or request shapes for your account;</li>
          <li>throttle or reduce your concurrency, quota or network access;</li>
          <li>suspend individual API keys, projects or the whole account pending investigation;</li>
          <li>terminate the account and forfeit prepaid fees for the period, where the violation is serious or repeated;</li>
          <li>preserve relevant records beyond the normal retention period as required for an investigation or legal process.</li>
        </ul>
        <p>Where the situation allows, we will tell you what we observed and give you a chance to explain or fix it. For activity involving CSAM, active attacks, fraud or imminent harm, we act first and notify afterwards, if at all. Fetcha is not liable for any loss resulting from enforcement of this AUP taken in good faith.</p>
      </>
    ),
  },
  {
    id: "reporting",
    title: "Reporting",
    body: (
      <>
        <p>
          <strong>To us.</strong> If you are a website operator, network participant or individual and believe Fetcha traffic is violating this policy, write to <a href="mailto:legal@fetcha.co">legal@fetcha.co</a> with timestamps, target URLs and, if you have them, source IPs or Fetcha request ids. We acknowledge reports within two business days and act on substantiated reports promptly. Customers who discover misuse of their own keys must report it to <a href="mailto:support@fetcha.co">support@fetcha.co</a> immediately and rotate the keys.
        </p>
        <p>
          <strong>To authorities.</strong> We cooperate with lawful requests from law enforcement and regulators. We report apparent CSAM to the appropriate authorities as required by Canadian law. Where we believe in good faith that the Services are being used to commit a crime that threatens people or critical infrastructure, we may report it proactively, and we may share the metadata necessary for the report.
        </p>
      </>
    ),
  },
  {
    id: "changes",
    title: "Changes",
    body: <p>We may update this AUP as new abuse patterns emerge or the law changes. The version and effective date appear at the top of this page; material changes are announced by email or dashboard notice. Continued use after the effective date is acceptance. Questions: <a href="mailto:legal@fetcha.co">legal@fetcha.co</a>.</p>,
  },
];

export default function AcceptableUsePage() {
  return <LegalLayout title="Acceptable Use Policy" current="/legal/acceptable-use" summary="Fetcha is shared infrastructure. This policy lists what you may not do with it — no unauthorised access, credential stuffing, flooding, paywall or login bypass, unlawful data collection, CSAM, fraud, malware, attacks on Fetcha itself or anonymous-proxy resale — and explains how we monitor, suspend and report." sections={sections} />;
}