import type { Metadata } from "next";
import Link from "next/link";
import { ProsePage, Section, Callout, Bullets } from "@/components/lobby/prose";

export const metadata: Metadata = {
  title: "Privacy Policy",
  description: "Spinza's privacy policy: we store a username, a password hash and gameplay statistics. No email, no trackers, no ads, no data sales.",
  alternates: { canonical: "/legal/privacy" },
};

const TOC = [
  { id: "summary", label: "In one paragraph" },
  { id: "collect", label: "What we collect" },
  { id: "not", label: "What we do not collect" },
  { id: "use", label: "How we use it" },
  { id: "cookies", label: "Cookies" },
  { id: "sharing", label: "Sharing" },
  { id: "retention", label: "Retention & deletion" },
  { id: "security", label: "Security" },
  { id: "rights", label: "Your choices" },
  { id: "changes", label: "Changes" },
];

const ROWS: [string, string][] = [
  ["Username", "Identifies your account and appears on leaderboards (unless you opt out)."],
  ["Password hash", "A one-way Argon2id hash. We never store or see your actual password."],
  ["Recovery code hash", "A one-way hash of your recovery code, used only to verify it when you reset your password."],
  ["Age confirmation", "The time you confirmed you are 18 or older."],
  ["Gameplay records", "Each round: game, bet, win, multiplier, features, balance after and a round ID; plus aggregate statistics (spins, wins, biggest win, level, XP)."],
  ["Credit ledger", "Every movement of fictional Spinza Credits, so your balance is always auditable."],
  ["Rewards & progression", "Daily-reward streak, missions, achievements, favourites."],
  ["Settings", "Sound, animation, reminder and leaderboard preferences."],
  ["Session data", "A session token (as a hash), the time of sign-in and last activity, your browser's user-agent string and a truncated IP address, so you can review and revoke devices."],
  ["Security log", "Sign-in successes and failures, password and recovery-code changes, and rate-limit events, kept to protect accounts."],
];

export default function PrivacyPage() {
  return (
    <ProsePage eyebrow="Legal" title="Privacy Policy" lead="Spinza is built to know as little about you as possible. This page lists exactly what we store, why, and what we deliberately never touch." updated="September 7, 2026" toc={TOC}>
      <Section id="summary" title="In one paragraph">
        <Callout>
          We store your <strong>username</strong>, a <strong>hash of your password</strong>, and your <strong>gameplay statistics and settings</strong>. We do not collect your email address, phone number, real name, location, payment details or contacts. We use <strong>no advertising, no analytics trackers and no third-party scripts</strong>. We never sell, rent or share your data.
        </Callout>
      </Section>

      <Section id="collect" title="What we collect">
        <p>Everything below is created by you using Spinza. Nothing is gathered from other sources.</p>
        <div className="overflow-hidden rounded-md border border-line">
          <table className="w-full text-left text-[14px]">
            <thead className="bg-surface text-[11px] uppercase tracking-wider text-fg-3">
              <tr>
                <th className="px-4 py-2.5 font-semibold">Data</th>
                <th className="px-4 py-2.5 font-semibold">Purpose</th>
              </tr>
            </thead>
            <tbody className="divide-y divide-line">
              {ROWS.map(([k, v]) => (
                <tr key={k}>
                  <td className="whitespace-nowrap px-4 py-2.5 align-top font-medium text-fg">{k}</td>
                  <td className="px-4 py-2.5 text-fg-2">{v}</td>
                </tr>
              ))}
            </tbody>
          </table>
        </div>
      </Section>

      <Section id="not" title="What we do not collect">
        <Bullets items={["Email address, phone number or any other contact detail.", "Real name, date of birth, address or government identifiers.", "Payment information of any kind — Spinza has no payments.", "Precise location. IP addresses are truncated before being shown to you and used only for security rate-limiting.", "Advertising identifiers, cross-site cookies or browsing history.", "Anything from your device beyond what your browser sends with every web request."]} />
      </Section>

      <Section id="use" title="How we use it">
        <Bullets items={["To run the game: keep your balance, history, progress and settings in sync across your devices.", "To keep accounts secure: sign you in, let you review and revoke sessions, detect brute-force attempts and abuse.", "To operate leaderboards and the wins feed — only if you have not opted out.", "To keep the games fair: aggregate, anonymous game statistics (spins, returns, hit rates) are used to monitor that each game behaves as certified."]} />
        <p>We do not profile you, make automated decisions that affect you, or use your data for marketing.</p>
      </Section>

      <Section id="cookies" title="Cookies">
        <p>
          Spinza sets one strictly necessary cookie, <code className="rounded bg-surface-2 px-1.5 py-0.5 font-mono text-[13px]">spinza_session</code>, which keeps you signed in. It is HttpOnly, Secure and SameSite, and expires after 30 days or when you sign out. There are no analytics, advertising or third-party cookies, so no cookie banner is needed.
        </p>
      </Section>

      <Section id="sharing" title="Sharing">
        <p>We do not sell, rent, trade or share personal data with third parties. Other players can see only your username, level and leaderboard results, and only if you participate in leaderboards. The only circumstance in which data would leave Spinza is a valid legal obligation, in which case we disclose the minimum required.</p>
        <p>Spinza is hosted on infrastructure we operate. No third-party analytics, advertising, font, CDN or social-media services load on the player pages.</p>
      </Section>

      <Section id="retention" title="Retention and deletion">
        <p>Your data is kept while your account exists so your history and progress remain intact. Sessions expire after 30 days of inactivity. Security-log entries are kept for a limited period for abuse prevention. When an account is closed, its personal data is deleted; anonymous, aggregate game statistics that cannot identify you are retained.</p>
      </Section>

      <Section id="security" title="Security">
        <p>Passwords and recovery codes are hashed with Argon2id and never stored in plain text. Sessions are random tokens stored as hashes. All traffic is encrypted in transit. Sign-in, registration and recovery endpoints are rate-limited. You can review every active session and sign any of them out from Settings → Security.</p>
      </Section>

      <Section id="rights" title="Your choices">
        <Bullets
          items={[
            <>
              <strong>Leaderboards:</strong> opt out at any time in{" "}
              <Link href="/settings#leaderboard" className="text-accent-2 underline-offset-4 hover:underline">
                Settings
              </Link>
              ; your entries disappear immediately.
            </>,
            <>
              <strong>Sessions:</strong> revoke any device from Settings → Security.
            </>,
            <>
              <strong>Access:</strong> your profile, round history and credit ledger pages show you everything we hold about your play.
            </>,
            <>
              <strong>Deletion:</strong> you may request closure of your account and deletion of its data through the channels listed on this site.
            </>,
          ]}
        />
        <p>Depending on where you live you may have additional rights under local law (such as access, correction, portability or objection). We honour them regardless of jurisdiction.</p>
      </Section>

      <Section id="changes" title="Changes to this policy">
        <p>If we change what we collect or how we use it, we will update this page and its “last updated” date before the change takes effect. We will never start collecting email addresses, adding trackers or selling data without saying so here first — and we have no plans to.</p>
        <p>
          Read alongside our{" "}
          <Link href="/legal/terms" className="text-accent-2 underline-offset-4 hover:underline">
            Terms of Service
          </Link>
          .
        </p>
      </Section>
    </ProsePage>
  );
}