<script lang="ts">
	import ProsePage from '$lib/components/prose-page.svelte';
</script>

<ProsePage title="Privacy policy" subtitle="Last updated: 1 August 2026">
	<p>
		Drizz.li is built to need as little of your data as possible: there are no user accounts, no
		cookies, no advertising and no analytics or tracking scripts. This page explains what little
		processing does happen - when you browse the site, and when you support the project with a
		contribution.
	</p>

	<h2>1. Controller</h2>
	<address>
		Vincent van der Wal<br />
		Tschalungasse 2, CH-6442 Gersau, Switzerland <br />
		Email:
		<a href="mailto:drizzli@vincentvanderwal.nl">drizzli@vincentvanderwal.nl</a>
	</address>
	<p>
		This policy covers the websites drizz.li (the weather app) and support.drizz.li (the supporter
		signup page).
	</p>

	<h2>2. Browsing the site</h2>
	<h3>Weather data requests</h3>
	<p>
		Drizz.li is a static site: when you open a forecast, your browser fetches the weather data
		directly from the open-data APIs of
		<a href="https://open-meteo.com" target="_blank" rel="noopener">Open-Meteo</a>
		(api.open-meteo.com, geocoding-api.open-meteo.com, archive-api.open-meteo.com, ensemble-api.open-meteo.com,
		and map tiles from maps.open-meteo.com / map-tiles.open-meteo.com / map-assets.open-meteo.com). Like
		any web request, this transmits your IP address and the requested location or search term to Open-Meteo.
		We do not receive or store any of this. See
		<a href="https://open-meteo.com/en/terms" target="_blank" rel="noopener"
			>Open-Meteo's terms and privacy information</a
		>. Legal basis: our legitimate interest in delivering the content you request (Art. 6(1)(f)
		GDPR).
	</p>
	<h3>Hosting</h3>
	<p>
		The static site is served by [hosting provider, location]. The hosting infrastructure may keep
		short-lived technical server logs (IP address, requested URL, timestamp) for security and
		operations. Legal basis: legitimate interest in a secure, reliable service (Art. 6(1)(f) GDPR).
	</p>
	<h3>Settings on your device (local storage)</h3>
	<p>
		Your preferences - theme, measurement units, last searched location, and (for supporters) your
		access key and its last verification result - are stored only in your browser's local storage.
		They never leave your device except as described below for key verification, and you can clear
		them at any time via your browser.
	</p>

	<h2>3. Supporting the project (contributions)</h2>
	<p>
		Supporter contributions unlock the supporter extras, so legally they are a paid agreement, not a
		pure gift - and this is what we process to handle them:
	</p>
	<h3>Signup form</h3>
	<ul>
		<li>
			<strong>Email address</strong> (required) - to send you the transfer details and, after your contribution
			arrives, your access key.
		</li>
		<li><strong>Name</strong> (optional) - to help match your bank transfer.</li>
		<li>
			<strong>Currency and amount</strong> - shown based on your browser's locale/timezone, detected on
			your device (no geolocation request is made).
		</li>
		<li>
			<strong>IP address and technical anti-bot signals</strong> - kept with the signup request to prevent
			abuse and spam of the form.
		</li>
		<li>
			<strong>Payment reference</strong> (e.g. DRZ-XXXXXX) - generated per request to match your transfer
			to your signup.
		</li>
	</ul>
	<p>
		The transfer details (bank account and reference) are sent to you by email rather than shown on
		the page. Legal bases: performance of the agreement (Art. 6(1)(b) GDPR) and, for the anti-abuse
		measures, legitimate interest (Art. 6(1)(f) GDPR).
	</p>
	<h3>Bank transfer</h3>
	<p>
		Contributions are paid by ordinary bank transfer. Your bank and ours process the transfer data
		under their own responsibility; on our bank statement we see the usual transfer details (your
		name, account number, amount, reference). We use them only to match your contribution and are
		required to retain accounting records under statutory bookkeeping and tax law (Art. 6(1)(c)
		GDPR).
	</p>
	<h3>Access key and verification</h3>
	<p>
		After your transfer is matched (manually, usually within 24 hours), you receive an access key by
		email. When you paste it into Drizz.li, your browser sends the key to our verification endpoint
		(support.drizz.li) to check whether it is active; the response contains only the validity, tier
		and expiry. The subscriber list (key, email, expiry) is stored on our server for as long as your
		access is active.
	</p>
	<h3>Email</h3>
	<p>
		Transactional emails (transfer details, access key, renewals) are sent through our email
		provider, Strato (Strato AG, Germany), acting as a processor. We send no newsletters or
		marketing email.
	</p>

	<h2>4. Retention</h2>
	<ul>
		<li>Signup requests that are never paid are deleted after 6 months at the latest.</li>
		<li>
			Supporter records (key, email, expiry) are kept while your access is active and deleted within
			12 months after it expires, unless you ask us to delete them sooner.
		</li>
		<li>
			Accounting records (bank statements showing your transfer) are kept for the statutory
			retention period (up to 10 years, depending on jurisdiction).
		</li>
	</ul>

	<h2>5. Recipients</h2>
	<p>
		We do not sell or share personal data with third parties for their own purposes. Recipients are
		limited to: Open-Meteo (weather requests made directly by your browser), our hosting provider,
		our email provider (Strato), and the banks involved in your transfer.
	</p>

	<h2>6. Your rights</h2>
	<p>
		Under the GDPR you have the right to access, rectification, erasure, restriction of processing,
		data portability, and to object to processing based on legitimate interest. Where processing is
		based on consent, you may withdraw it at any time. To exercise any of these rights, email
		<a href="mailto:drizzli@vincentvanderwal.nl">drizzli@vincentvanderwal.nl</a>. You also have the
		right to lodge a complaint with a supervisory authority, in particular in the EU member state of
		your residence, or with [competent supervisory authority of the controller].
	</p>
	<p>
		For visitors from Switzerland: the corresponding rights under the Swiss Federal Act on Data
		Protection (FADP) apply equivalently.
	</p>

	<h2>7. Changes</h2>
	<p>
		We may update this policy when the service changes; the date above reflects the latest revision.
	</p>
</ProsePage>
