Blame · Line-by-line history
privacy.tsx
Each line is annotated with the commit that last touched it. Click any SHA to jump to that commit and see the surrounding change.
| 89b9e21 | 1 | /** |
| 2 | * Privacy Policy — GDPR + CCPA + COPPA aware. | |
| 3 | * | |
| 4 | * DRAFT — requires attorney review before any paid launch. | |
| 5 | */ | |
| 6 | ||
| 7 | import { Hono } from "hono"; | |
| 8 | import { Layout } from "../../views/layout"; | |
| 9 | import { softAuth } from "../../middleware/auth"; | |
| 10 | import type { AuthEnv } from "../../middleware/auth"; | |
| 11 | ||
| 12 | const privacy = new Hono<AuthEnv>(); | |
| 13 | ||
| 14 | privacy.use("*", softAuth); | |
| 15 | ||
| 16 | privacy.get("/legal/privacy", (c) => { | |
| 17 | const user = c.get("user"); | |
| 18 | return c.html( | |
| 19 | <Layout title="Privacy Policy" user={user}> | |
| 20 | <article style="max-width: 820px; margin: 0 auto; line-height: 1.7; font-size: 15px"> | |
| 21 | <h1 style="font-size: 28px; margin-bottom: 8px">Privacy Policy</h1> | |
| 22 | <p style="color: var(--text-muted); font-size: 13px; margin-bottom: 24px"> | |
| 23 | DRAFT — requires attorney review. Last updated: 2026-04-16. | |
| 24 | </p> | |
| 25 | ||
| 26 | <div | |
| 27 | style="background: rgba(210, 153, 34, 0.1); border: 1px solid var(--yellow); color: var(--yellow); padding: 12px 16px; border-radius: var(--radius); margin-bottom: 24px; font-size: 13px" | |
| 28 | > | |
| 29 | <strong>DRAFT notice.</strong> This Privacy Policy is a good-faith | |
| 30 | draft published during Gluecron's pre-launch phase. It has not been | |
| 31 | reviewed by privacy counsel. Article 13 GDPR disclosures, | |
| 32 | sub-processor lists, and retention schedules are provisional and | |
| 33 | will be finalized before general availability. | |
| 34 | </div> | |
| 35 | ||
| 36 | <h2>1. Data we collect</h2> | |
| 37 | <ul> | |
| 38 | <li> | |
| 39 | <strong>Account data:</strong> username, email address, display | |
| 40 | name, hashed password, 2FA secrets, WebAuthn credentials, SSH | |
| 41 | public keys, personal access tokens (stored as SHA-256 hashes). | |
| 42 | </li> | |
| 43 | <li> | |
| 44 | <strong>Git content:</strong> repositories you push, including | |
| 45 | commits, branches, tags, file contents, commit messages, and | |
| 46 | author metadata embedded in commits. | |
| 47 | </li> | |
| 48 | <li> | |
| 49 | <strong>AI interactions:</strong> prompts you submit to AI | |
| 50 | features (chat, code review, explanations, completions) and | |
| 51 | responses generated by third-party AI providers. | |
| 52 | </li> | |
| 53 | <li> | |
| 54 | <strong>Usage telemetry:</strong> requests, request IDs, rate-limit | |
| 55 | counters, error traces, audit events, deployment events, gate run | |
| 56 | results. | |
| 57 | </li> | |
| 58 | <li> | |
| 59 | <strong>Network data:</strong> IP address, user-agent string, | |
| 60 | request timestamps, session cookie identifiers. | |
| 61 | </li> | |
| 62 | </ul> | |
| 63 | ||
| 64 | <h2>2. How we use it</h2> | |
| 65 | <ul> | |
| 66 | <li>To operate, maintain, and secure the Service.</li> | |
| 67 | <li> | |
| 68 | To provide AI-assisted features that you explicitly invoke (code | |
| 69 | review, chat, explanations, test generation, auto-repair, | |
| 70 | dependency updates, incident summaries, semantic search). | |
| 71 | </li> | |
| 72 | <li> | |
| 73 | To detect, investigate, and prevent abuse, fraud, security | |
| 74 | incidents, and violations of our Terms or AUP. | |
| 75 | </li> | |
| 76 | <li> | |
| 77 | To comply with legal obligations, respond to lawful requests from | |
| 78 | authorities, and enforce our rights. | |
| 79 | </li> | |
| 80 | <li> | |
| 81 | To communicate service-related messages (security alerts, policy | |
| 82 | updates, incident notifications). | |
| 83 | </li> | |
| 84 | </ul> | |
| 85 | ||
| 86 | <h2>3. Data controller</h2> | |
| 87 | <p> | |
| 88 | The data controller is <strong>Gluecron</strong> (entity name | |
| 89 | placeholder — <em>DRAFT</em>; final legal entity name and registered | |
| 90 | address to be inserted prior to launch). Contact: | |
| 91 | support@gluecron.com (placeholder). | |
| 92 | </p> | |
| 93 | ||
| 94 | <h2>4. Sub-processors</h2> | |
| 95 | <p> | |
| 96 | We engage the following sub-processors to operate the Service. This | |
| 97 | list is current as of the date above and may change; we intend to | |
| 98 | provide 30 days' notice of material changes. | |
| 99 | </p> | |
| 100 | <div style="overflow-x: auto; margin: 12px 0"> | |
| 101 | <table style="width: 100%; border-collapse: collapse; font-size: 14px; border: 1px solid var(--border); border-radius: var(--radius)"> | |
| 102 | <thead style="background: var(--bg-tertiary)"> | |
| 103 | <tr> | |
| 104 | <th style="text-align: left; padding: 8px 12px; border-bottom: 1px solid var(--border)"> | |
| 105 | Sub-processor | |
| 106 | </th> | |
| 107 | <th style="text-align: left; padding: 8px 12px; border-bottom: 1px solid var(--border)"> | |
| 108 | Purpose | |
| 109 | </th> | |
| 110 | <th style="text-align: left; padding: 8px 12px; border-bottom: 1px solid var(--border)"> | |
| 111 | Data categories | |
| 112 | </th> | |
| 113 | </tr> | |
| 114 | </thead> | |
| 115 | <tbody> | |
| 116 | <tr> | |
| 117 | <td style="padding: 8px 12px; border-bottom: 1px solid var(--border)"> | |
| 118 | Neon (neon.tech) | |
| 119 | </td> | |
| 120 | <td style="padding: 8px 12px; border-bottom: 1px solid var(--border)"> | |
| 121 | Managed PostgreSQL (primary database) | |
| 122 | </td> | |
| 123 | <td style="padding: 8px 12px; border-bottom: 1px solid var(--border)"> | |
| 124 | Account data, metadata, telemetry | |
| 125 | </td> | |
| 126 | </tr> | |
| 127 | <tr> | |
| 128 | <td style="padding: 8px 12px; border-bottom: 1px solid var(--border)"> | |
| 129 | Anthropic | |
| 130 | </td> | |
| 131 | <td style="padding: 8px 12px; border-bottom: 1px solid var(--border)"> | |
| 132 | Claude API (AI features) | |
| 133 | </td> | |
| 134 | <td style="padding: 8px 12px; border-bottom: 1px solid var(--border)"> | |
| 135 | AI prompts (including code snippets you submit) | |
| 136 | </td> | |
| 137 | </tr> | |
| 138 | <tr> | |
| 139 | <td style="padding: 8px 12px; border-bottom: 1px solid var(--border)"> | |
| 140 | Resend (if enabled) | |
| 141 | </td> | |
| 142 | <td style="padding: 8px 12px; border-bottom: 1px solid var(--border)"> | |
| 143 | Transactional email delivery | |
| 144 | </td> | |
| 145 | <td style="padding: 8px 12px; border-bottom: 1px solid var(--border)"> | |
| 146 | Email address, message contents | |
| 147 | </td> | |
| 148 | </tr> | |
| 149 | <tr> | |
| 150 | <td style="padding: 8px 12px; border-bottom: 1px solid var(--border)"> | |
| 151 | Fly.io / Railway | |
| 152 | </td> | |
| 153 | <td style="padding: 8px 12px; border-bottom: 1px solid var(--border)"> | |
| 154 | Application hosting (compute) | |
| 155 | </td> | |
| 156 | <td style="padding: 8px 12px; border-bottom: 1px solid var(--border)"> | |
| 157 | All transient request data | |
| 158 | </td> | |
| 159 | </tr> | |
| 160 | <tr> | |
| 161 | <td style="padding: 8px 12px">Cloudflare (if fronting)</td> | |
| 162 | <td style="padding: 8px 12px">CDN, DDoS mitigation, DNS</td> | |
| 163 | <td style="padding: 8px 12px"> | |
| 164 | IP address, request metadata | |
| 165 | </td> | |
| 166 | </tr> | |
| 167 | </tbody> | |
| 168 | </table> | |
| 169 | </div> | |
| 170 | <p> | |
| 171 | <em>DRAFT — requires attorney review; sub-processor list must be | |
| 172 | verified against signed DPAs prior to launch.</em> | |
| 173 | </p> | |
| 174 | ||
| 175 | <h2>5. Data retention</h2> | |
| 176 | <ul> | |
| 177 | <li> | |
| 178 | <strong>Account data:</strong> retained while your account is | |
| 179 | active and for thirty (30) days after account deletion, after | |
| 180 | which we intend to purge it. | |
| 181 | </li> | |
| 182 | <li> | |
| 183 | <strong>Git repository content:</strong> retained for the | |
| 184 | lifetime of your account; deleting a repository is intended to | |
| 185 | purge its content within 30 days. | |
| 186 | </li> | |
| 187 | <li> | |
| 188 | <strong>Sessions:</strong> 30 days (rolling). | |
| 189 | </li> | |
| 190 | <li> | |
| 191 | <strong>Audit and security logs:</strong> up to 12 months for | |
| 192 | security and abuse-detection purposes. | |
| 193 | </li> | |
| 194 | <li> | |
| 195 | <strong>Backups:</strong> may persist for up to 30 days beyond | |
| 196 | the primary retention period. | |
| 197 | </li> | |
| 198 | </ul> | |
| 199 | ||
| 200 | <h2>6. GDPR compliance (EU / UK residents)</h2> | |
| 201 | <p> | |
| 202 | If you are in the European Economic Area, the United Kingdom, or | |
| 203 | Switzerland, we process your data under the following lawful bases | |
| 204 | (GDPR Art. 6): (a) performance of a contract (providing the | |
| 205 | Service to you); (b) our legitimate interests in securing and | |
| 206 | improving the Service; (c) compliance with legal obligations; and | |
| 207 | (d) where required, your consent (which you may withdraw at any | |
| 208 | time). | |
| 209 | </p> | |
| 210 | <p> | |
| 211 | <strong>Article 13 disclosures.</strong> The identity of the | |
| 212 | controller, data categories, purposes, retention, recipients, and | |
| 213 | your rights are described throughout this Policy. International | |
| 214 | transfers of personal data outside the EEA/UK will rely on the EU | |
| 215 | <em> Standard Contractual Clauses</em> ("SCCs") or another approved | |
| 216 | transfer mechanism. | |
| 217 | </p> | |
| 218 | <p> | |
| 219 | <strong>Your rights</strong> include access, rectification, | |
| 220 | erasure, restriction, portability, and objection. You may lodge a | |
| 221 | complaint with your local supervisory authority. <em>DRAFT — | |
| 222 | requires attorney review.</em> | |
| 223 | </p> | |
| 224 | ||
| 225 | <h2>7. CCPA / CPRA compliance (California residents)</h2> | |
| 226 | <p> | |
| 227 | If you are a California resident, you have the right to (a) know | |
| 228 | what personal information we collect, use, disclose, and sell or | |
| 229 | share; (b) delete your personal information, subject to legal | |
| 230 | exceptions; (c) correct inaccurate personal information; (d) opt | |
| 231 | out of the sale or sharing of personal information (we do not | |
| 232 | sell personal information); and (e) non-discrimination for | |
| 233 | exercising these rights. | |
| 234 | </p> | |
| 235 | ||
| 236 | <h2>8. Right to erasure / access</h2> | |
| 237 | <p> | |
| 238 | To exercise any of the rights above, email{" "} | |
| 239 | <strong>support@gluecron.com</strong> (placeholder). We intend to | |
| 240 | respond within thirty (30) days. We may need to verify your | |
| 241 | identity before acting. Some data (e.g., audit logs required for | |
| 242 | security, legal holds) may be exempt from deletion. | |
| 243 | </p> | |
| 244 | ||
| 245 | <h2>9. Cookies</h2> | |
| 246 | <p> | |
| 247 | We use only <strong>strictly necessary cookies</strong> (session | |
| 248 | authentication, theme preference, CSRF). We do not use advertising | |
| 249 | cookies. We do not use third-party analytics cookies on our | |
| 250 | marketing surfaces. | |
| 251 | </p> | |
| 252 | ||
| 253 | <h2>10. Children</h2> | |
| 254 | <p> | |
| 255 | The Service is not directed to children under 18. We do not | |
| 256 | knowingly collect personal information from children under 13 | |
| 257 | (COPPA, U.S.) or 16 (GDPR, EEA). If you believe a child has | |
| 258 | provided us information in violation of this Policy, contact us | |
| 259 | and we will delete it. | |
| 260 | </p> | |
| 261 | ||
| 262 | <h2>11. Breach notification</h2> | |
| 263 | <p> | |
| 264 | In the event of a personal-data breach that is likely to result in | |
| 265 | a risk to your rights and freedoms, we intend to notify the | |
| 266 | relevant supervisory authority within <strong>72 hours</strong> of | |
| 267 | becoming aware, as required by GDPR Art. 33, and to notify | |
| 268 | affected users without undue delay where required. | |
| 269 | </p> | |
| 270 | ||
| 271 | <h2>12. Changes to this Policy</h2> | |
| 272 | <p> | |
| 273 | We intend to provide thirty (30) days' notice of material changes | |
| 274 | to this Policy, by email or by posting a notice in the Service. | |
| 275 | </p> | |
| 276 | ||
| 277 | <hr style="margin: 32px 0; border: none; border-top: 1px solid var(--border)" /> | |
| 278 | <p style="font-size: 13px; color: var(--text-muted)"> | |
| 279 | See also:{" "} | |
| 280 | <a href="/legal/terms">Terms of Service</a> ·{" "} | |
| 281 | <a href="/legal/acceptable-use">Acceptable Use Policy</a> ·{" "} | |
| 282 | <a href="/legal/dmca">DMCA Policy</a> | |
| 283 | </p> | |
| 284 | </article> | |
| 285 | </Layout> | |
| 286 | ); | |
| 287 | }); | |
| 288 | ||
| 289 | export default privacy; |