songs2vid/app/privacy/page.tsx

import { LegalPageLayout } from "@/components/LegalPageLayout";
import { LEGAL_OPERATOR } from "@/lib/legal/constants";
import { DOCS_URL, GITEA_URL } from "@/lib/plans";

export default function PrivacyPage() {
  return (
    <LegalPageLayout title="Privacy Policy">
      <p>
        This policy describes how a <strong>self-hosted Songs2VID</strong> instance typically
        handles data. Songs2VID OSS does not include payment processing, plans, credits, or
        Stripe. The person or organization that operates this deployment (the &quot;operator&quot;)
        controls the server, database, uploads, logs, and Google OAuth configuration, and is
        responsible for privacy compliance for their users.
      </p>

      <h2>1. Who is responsible</h2>
      <p>
        For this software package as published by {LEGAL_OPERATOR.legalName}, contact:{" "}
        <a href={`mailto:${LEGAL_OPERATOR.email}`}>{LEGAL_OPERATOR.email}</a>. For data on{" "}
        <em>this running instance</em>, contact the operator of the deployment you signed into —
        not necessarily the hosted SaaS at songs2vid.com, which is a separate product with its own
        policies.
      </p>

      <h2>2. Data this software processes</h2>
      <ul>
        <li>Account profile from Google sign-in (email, name, avatar)</li>
        <li>YouTube OAuth tokens (encrypted at rest when configured) and channel metadata</li>
        <li>Uploaded cover art, audio, optional logos/fonts, and derived video files</li>
        <li>Job metadata (titles, tags, privacy, layouts, watermarks)</li>
        <li>API key hashes and rate-limit counters</li>
      </ul>

      <h2>3. Google and YouTube</h2>
      <p>
        Google and YouTube process account and upload data under their own terms and policies.
        Operators must configure OAuth correctly and respect{" "}
        <a
          href="https://developers.google.com/terms/api-services-user-data-policy"
          target="_blank"
          rel="noopener noreferrer"
        >
          Google API Services User Data Policy
        </a>{" "}
        and{" "}
        <a
          href="https://developers.google.com/youtube/terms/developer-policies"
          target="_blank"
          rel="noopener noreferrer"
        >
          YouTube API Services Policies
        </a>
        .
      </p>

      <h2>4. Your choices</h2>
      <p>
        Use <strong>Dashboard → Settings</strong> to export or delete your account data on this
        instance, or ask the operator. You can also revoke Google access in your{" "}
        <a
          href="https://security.google.com/settings/security/permissions"
          target="_blank"
          rel="noopener noreferrer"
        >
          Google Account permissions
        </a>
        .
      </p>

      <h2>5. Documentation</h2>
      <p>
        Product docs: <a href={DOCS_URL}>{DOCS_URL}</a>. Source:{" "}
        <a href={GITEA_URL}>{GITEA_URL}</a>.
      </p>
    </LegalPageLayout>
  );
}