From e3818db2947ba0c7aa28e4e665763934ba14673e Mon Sep 17 00:00:00 2001
From: Richard R <me@richardr.dev>
Date: Sun, 31 May 2026 14:28:59 -0600
Subject: [PATCH] refactor(privacy): restructure policy sections and clarify
 provider, analytics, and encryption details

Reorganize privacy policy content to improve clarity on service provider roles,
analytics consent, and encryption limitations. Update section headings and
descriptions for accuracy. Enhance CookieConsentBanner and PrivacyModal to
reflect optional analytics and clarify storage, operator access, and password
handling. Improve CSS for policy section headings and lists for better
readability.
---
 src/app/(public)/privacy/page.tsx      | 37 ++++++++++++++++++++------
 src/app/(public)/public.css            |  3 +++
 src/components/CookieConsentBanner.tsx |  4 +--
 src/components/PrivacyModal.tsx        | 15 ++++++++++-
 4 files changed, 48 insertions(+), 11 deletions(-)

diff --git a/src/app/(public)/privacy/page.tsx b/src/app/(public)/privacy/page.tsx
index aa47b64..66f615e 100644
--- a/src/app/(public)/privacy/page.tsx
+++ b/src/app/(public)/privacy/page.tsx
@@ -48,6 +48,11 @@ export default async function PrivacyPage() {
           ) : null}
         </section>
 
+        {/* Claim audit
+            Code-verified: consent/GPC analytics handling, analytics toggle, export/delete controls, US geo-gate, AES256 storage headers.
+            Deployment-dependent: processing/storage region and exact provider infrastructure locations.
+            Operator-statement: OpenReader does not sell personal information.
+        */}
         <div className="policy-grid public-reveal-2">
           <aside className="policy-nav" aria-label="Privacy sections">
             <p className="policy-nav-title">On this page</p>
@@ -87,18 +92,22 @@ export default async function PrivacyPage() {
             </section>
 
             <section id="sharing" className="policy-section">
-              <h2>3. Sharing and service providers</h2>
+              <h2>3. Service providers and analytics</h2>
               <p>
-                OpenReader does not sell personal information. Limited processing may be delegated to infrastructure
-                or model providers as required to run the service.
+                OpenReader does not sell personal information. We use service providers only to run product
+                infrastructure and user-initiated features.
               </p>
+              <div className="policy-highlight">
+                Optional analytics is controlled by your consent choice, and Global Privacy Control (GPC) opt-out
+                signals are honored.
+              </div>
               <ul className="policy-fact-list">
                 {isRichardrDevProductionInstance ? (
                   <>
                     <li><strong>Hosting:</strong> Vercel for application hosting, edge runtime, and performance analytics.</li>
                     <li><strong>Database:</strong> Neon PostgreSQL for account and document metadata storage.</li>
                     <li><strong>File storage:</strong> Railway S3-compatible object storage for encrypted uploaded documents and audio artifacts.</li>
-                    <li><strong>TTS processing:</strong> DeepInfra or configured OpenAI-compatible providers, only when initiated by user actions.</li>
+                    <li><strong>TTS processing:</strong> User-initiated TTS is handled by shared providers: Kitten TTS FastAPI (self-hosted on a local Pi cluster) and Replicate.</li>
                   </>
                 ) : (
                   <>
@@ -132,8 +141,20 @@ export default async function PrivacyPage() {
             <section id="retention" className="policy-section">
               <h2>5. Retention and security</h2>
               <p>
-                Account data and uploaded files are retained while your account remains active. Documents are stored
-                encrypted at rest. When account deletion completes, active database and storage records are removed.
+                Account data and uploaded files are retained while your account remains active. Data is encrypted at
+                rest in storage. OpenReader does not currently provide end-to-end encryption.
+              </p>
+              <p>
+                The owner of this instance may be able to access stored metadata and uploaded files needed to operate
+                the service.
+              </p>
+              <p>
+                Passwords are not stored as readable plaintext; the authentication system stores credential values as
+                non-plaintext verification data.
+              </p>
+              <p>
+                Account deletion triggers removal of active account records and associated storage artifacts as part
+                of the deletion flow.
               </p>
             </section>
 
@@ -141,8 +162,8 @@ export default async function PrivacyPage() {
               <h2>6. Processing location</h2>
               {isRichardrDevProductionInstance ? (
                 <p>
-                  For the official instance, processing and storage occur in the United States. By using this service,
-                  you acknowledge that data is handled in the US and that availability may be limited to US users.
+                  For the official instance, access is restricted to users in the United States. Processing location
+                  depends on the configured infrastructure and providers used by this deployment.
                 </p>
               ) : (
                 <p>
diff --git a/src/app/(public)/public.css b/src/app/(public)/public.css
index 7681f31..9736a5f 100644
--- a/src/app/(public)/public.css
+++ b/src/app/(public)/public.css
@@ -567,6 +567,7 @@
 .policy-section h2 {
   margin: 0;
   font-size: 1.05rem;
+  font-weight: 700;
   letter-spacing: -0.01em;
 }
 
@@ -580,6 +581,8 @@
 .policy-list {
   margin: 0.72rem 0 0;
   padding-left: 1rem;
+  list-style: disc;
+  list-style-position: outside;
   display: grid;
   gap: 0.38rem;
 }
diff --git a/src/components/CookieConsentBanner.tsx b/src/components/CookieConsentBanner.tsx
index 1b3f57c..b62a0fd 100644
--- a/src/components/CookieConsentBanner.tsx
+++ b/src/components/CookieConsentBanner.tsx
@@ -49,8 +49,8 @@ export function CookieConsentBanner() {
             🍪 We use cookies
           </h3>
           <p className="text-sm leading-relaxed text-foreground/90">
-            We use strictly necessary cookies for authentication and optional cookies for anonymous analytics
-            to improve the app. See our <Link href="/privacy" className="font-medium text-accent hover:underline">Privacy Policy</Link> for details.
+            We use strictly necessary cookies for authentication. Optional analytics is enabled only when you consent.
+            See our <Link href="/privacy" className="font-medium text-accent hover:underline">Privacy Policy</Link> for details.
           </p>
         </div>
 
diff --git a/src/components/PrivacyModal.tsx b/src/components/PrivacyModal.tsx
index dbf0567..b462a32 100644
--- a/src/components/PrivacyModal.tsx
+++ b/src/components/PrivacyModal.tsx
@@ -29,7 +29,20 @@ function PrivacyModalBody({ origin }: { origin: string }) {
 
       <p className="leading-relaxed">
         We value your privacy. This application uses strictly necessary cookies for authentication
-        and anonymous analytics to improve performance. Your documents are stored securely and encrypted at rest.
+        and optional analytics only when consent allows it. Your documents are stored encrypted at rest.
+      </p>
+
+      <p className="leading-relaxed">
+        OpenReader does not currently provide end-to-end encryption.
+      </p>
+
+      <p className="leading-relaxed">
+        The owner of this instance may be able to access stored metadata and uploaded files needed to operate the
+        service.
+      </p>
+
+      <p className="leading-relaxed">
+        Passwords are not stored as readable plaintext.
       </p>
 
       <p className="leading-relaxed">