@extends('layouts.app')

@section('seo')
    <x-seo :title="'Privacy Policy | '.setting('site_name', 'InstaGrab')"
           description="What InstaGrab collects (very little), what it never collects, and your rights under GDPR and CCPA." />
@endsection

@section('content')
<section class="page-head">
    <div class="container">
        <x-breadcrumbs :items="[['name' => 'Home', 'url' => route('home')], ['name' => 'Privacy Policy', 'url' => route('page.privacy')]]" />
        <h1 class="page-title">Privacy Policy</h1>
        <p class="text-body-secondary small">Last updated: {{ date('F j, Y') }}</p>
    </div>
</section>

<section class="section pt-4">
    <div class="container">
        <div class="row justify-content-center">
            <div class="col-lg-8 content-prose">
                <h2>The short version</h2>
                <p>No accounts, no Instagram logins, no stored downloads, no selling of data. We keep the minimum needed to run and protect the service.</p>

                <h2>What we collect</h2>
                <ul>
                    <li><strong>Links you paste.</strong> Used only to resolve the post. The post shortcode is kept in an anonymized log (see below); the resolved media is cached briefly for performance and then expires.</li>
                    <li><strong>Anonymized usage logs.</strong> We store the post shortcode, media type, success/failure and a one-way hash of your IP address for rate limiting and abuse prevention. The raw IP is never stored, and logs are deleted after 90 days.</li>
                    <li><strong>Contact form data.</strong> Name, email and message - used only to reply to you.</li>
                    <li><strong>Cookies.</strong> A session cookie and a CSRF token, both strictly necessary for the site to function. No advertising or cross-site tracking cookies.</li>
                </ul>

                <h2>What we never collect</h2>
                <p>Your Instagram username or password, your contact lists, your downloaded files, or your browsing history on other sites.</p>

                <h2>Third parties</h2>
                <p>Media files are fetched from Instagram's content delivery network and streamed to you; that request is subject to Meta's own policies. Fonts and the Bootstrap framework load from public CDNs (Google Fonts, jsDelivr), which see standard request metadata.</p>

                <h2>Your rights</h2>
                <p>Depending on your jurisdiction (including GDPR and CCPA), you may request access to or deletion of personal data we hold - in practice this applies to contact form messages, since usage logs are anonymized. Email us via the <a href="{{ route('page.contact') }}">contact page</a>.</p>

                <h2>Changes</h2>
                <p>If this policy changes materially, we will update the date above. Continued use of the site means acceptance of the current policy.</p>
            </div>
        </div>
    </div>
</section>
@endsection