diff --git a/app/cookies/page.jsx b/app/cookies/page.jsx new file mode 100644 index 0000000..282c0a9 --- /dev/null +++ b/app/cookies/page.jsx @@ -0,0 +1,35 @@ +import React from "react"; +import LegalPageLayout from "@/components/legal-page-layout"; + +export default function CookiesPage() { + return ( + +

This policy explains the browser storage Confidence Engine currently uses. LocalStorage and sessionStorage are browser storage technologies; they are not necessarily HTTP cookies.

+ +
+

Authentication and session cookies

+

Confidence Engine uses Supabase authentication and session cookies to provide secure sign-in and keep authenticated users signed in. These are essential to the authenticated service. Runtime cookie names and durations are managed by the authentication system.

+
+ +
+

Theme preference

+

confidence-engine-theme is stored in localStorage to remember your light or dark display preference. It remains until you change the preference or clear browser storage.

+
+ +
+

Introductory guidance preference

+

ce-facilitator-dismissed is stored in sessionStorage if you dismiss introductory guidance. It is session-scoped and remembers that choice while the browser session remains available.

+
+ +
+

No analytics or advertising tracking

+

Confidence Engine currently does not use advertising cookies, analytics cookies, tracking pixels, marketing cookies, or third-party browser tracking based on the current implementation.

+
+ +
+

Future changes

+

If Confidence Engine later introduces non-essential cookies or similar technologies, this policy and any consent mechanism will be reconsidered as appropriate.

+
+ + ); +} \ No newline at end of file diff --git a/app/layout.jsx b/app/layout.jsx index ba6fd18..562889c 100644 --- a/app/layout.jsx +++ b/app/layout.jsx @@ -1,6 +1,7 @@ import "./globals.css"; import ThemeToggle from "@/components/theme-toggle"; import LogoutButton from "@/components/logout-button"; +import LegalNavigation from "@/components/legal-navigation"; export const metadata = { title: "Confidence Engine", @@ -26,6 +27,9 @@ export default function RootLayout({ children }) { {children} + ); diff --git a/app/privacy/page.jsx b/app/privacy/page.jsx new file mode 100644 index 0000000..49cf564 --- /dev/null +++ b/app/privacy/page.jsx @@ -0,0 +1,47 @@ +import React from "react"; +import LegalPageLayout from "@/components/legal-page-layout"; + +export default function PrivacyPage() { + return ( + +

This policy explains how Confidence Engine handles information when you use the service.

+ +
+

Who is responsible

+

Confidence Engine is operated by RDB Solutions Ltd., Palmeira Avenue Mansions, 19 Church Road, Hove, East Sussex, England, BN3 2FA. For privacy questions or deletion requests, contact data@rdbtech.co.uk.

+
+ +
+

Information we process

+

We process your account email and authentication information, together with information you choose to enter into an investigation. This can include scenario descriptions, reconstructed SituationGraph material, Current Understanding, Open Questions, answers, Findings, Contributions, reports, and revision and timestamp metadata.

+

Please do not enter personal information that you do not need to provide, especially unnecessary information about other people.

+
+ +
+

Why we use it

+

We use account information to provide secure access to your account. We use investigation information to save your work, let you return to it, and provide the reasoning features you request. Confidence Engine supports your understanding; it does not make decisions for you.

+
+ +
+

Storage and reasoning

+

Authentication and investigation persistence are operated through our self-hosted Supabase and PostgreSQL infrastructure. Reasoning requests are processed through private Ollama/Qwen infrastructure used by the service. We also use functional browser storage for authentication sessions and interface preferences; see our Cookie Policy for details.

+
+ +
+

Retention and deletion

+

Account and investigation information is retained while your account remains active. After 18 months without activity, we will contact you before deletion; if inactivity continues, account and investigation information may then be automatically deleted. You may request deletion at data@rdbtech.co.uk.

+

Deleted information may remain temporarily in rotating backups until those backups expire.

+
+ +
+

Security and your rights

+

We use access controls and technical measures appropriate to operating the service. You can contact us about access, correction, deletion, or other data-protection requests. You may also complain to the UK Information Commissioner's Office.

+
+ +
+

Age and changes

+

Confidence Engine is for people aged 18 and over. We may update this policy as the service develops; the current version will be published on this page.

+
+ + ); +} \ No newline at end of file diff --git a/app/terms/page.jsx b/app/terms/page.jsx new file mode 100644 index 0000000..0b09a7a --- /dev/null +++ b/app/terms/page.jsx @@ -0,0 +1,42 @@ +import React from "react"; +import LegalPageLayout from "@/components/legal-page-layout"; + +export default function TermsPage() { + return ( + +

Confidence Engine is operated by RDB Solutions Ltd. These Terms govern your use of the service.

+ +
+

Eligibility and accounts

+

You must be at least 18 years old to use Confidence Engine. Keep access to your email account and sign-in link secure, and provide accurate information when creating or using an account.

+
+ +
+

Using the service

+

Use the service lawfully and responsibly. You are responsible for the information you enter and should avoid entering information about others unless it is necessary and appropriate to do so.

+

Confidence Engine facilitates understanding; it does not make decisions for you. AI or model-generated analysis may be incomplete, inaccurate, or unsuitable for your circumstances. It is not professional, legal, financial, medical, or other regulated advice. You remain responsible for your decisions and actions.

+
+ +
+

Availability

+

We aim to keep the service available, but availability may vary. Reasoning functionality may occasionally be temporarily unavailable, and we may change, suspend, or withdraw parts of the service when reasonably necessary.

+
+ +
+

Your information and intellectual property

+

You retain responsibility for your underlying scenarios and information. We do not claim ownership of that underlying material merely because you use the service. The Confidence Engine service, branding, and software remain the property of RDB Solutions Ltd. or its licensors.

+
+ +
+

Ending access and liability

+

You may stop using the service and request account deletion at data@rdbtech.co.uk. We may suspend or end access where reasonably necessary, including for misuse or security reasons.

+

Nothing in these Terms excludes liability that cannot legally be excluded. Subject to that, the service is provided for a controlled early release and we are not liable for indirect loss or for decisions you make using it.

+
+ +
+

Changes and law

+

We may update these Terms by publishing the revised version on this page. These Terms are governed by the law of England and Wales. Questions can be sent to data@rdbtech.co.uk.

+
+ + ); +} \ No newline at end of file diff --git a/components/legal-navigation.jsx b/components/legal-navigation.jsx new file mode 100644 index 0000000..e088888 --- /dev/null +++ b/components/legal-navigation.jsx @@ -0,0 +1,12 @@ +import React from "react"; +import Link from "next/link"; + +export default function LegalNavigation() { + return ( + + ); +} \ No newline at end of file diff --git a/components/legal-page-layout.jsx b/components/legal-page-layout.jsx new file mode 100644 index 0000000..9cb1916 --- /dev/null +++ b/components/legal-page-layout.jsx @@ -0,0 +1,22 @@ +import React from "react"; +import Link from "next/link"; +import LegalNavigation from "@/components/legal-navigation"; + +export default function LegalPageLayout({ title, children }) { + return ( +
+ + Back to sign in + +
+

{title}

+
+ {children} +
+
+ +
+ ); +} \ No newline at end of file diff --git a/docs/current-handoff.md b/docs/current-handoff.md index bd0e124..f263d85 100644 --- a/docs/current-handoff.md +++ b/docs/current-handoff.md @@ -3,6 +3,12 @@ > **Role:** Concise operational snapshot for resuming work today. Not a historical diary. > The design evolution archive index at `docs/design-evolution/README.md` provides progressive loading of experiment history; load the relevant chapter only when a specific historical question requires it. +## Tester legal information + +- Public Privacy, Terms, and Cookie pages and shared legal navigation are available at `/privacy`, `/terms`, and `/cookies`. +- The service is positioned as 18+. No cookie-consent banner is used because current browser storage is limited to essential authentication/session storage and functional UI preferences. +- Legal wording remains subject to appropriate professional review. + ## Focused-investigation provider outage boundary - Focused-investigation outage handling now sanitizes provider failure at the API boundary: unavailable focused reasoning returns a controlled HTTP 503, and raw provider/Ollama diagnostics no longer leave that boundary. diff --git a/docs/current-project-state.md b/docs/current-project-state.md index 557aa5a..27d8922 100644 --- a/docs/current-project-state.md +++ b/docs/current-project-state.md @@ -1,5 +1,11 @@ # Current Project State — Confidence Engine +## Tester Legal Information + +- Public Privacy, Terms, and Cookie pages and shared legal navigation are available at `/privacy`, `/terms`, and `/cookies`. +- The service is positioned as 18+. No cookie-consent banner is used because current browser storage is limited to essential authentication/session storage and functional UI preferences. +- Legal wording remains subject to appropriate professional review. + ## Focused-Investigation Provider Outage Boundary - Focused-investigation outage handling now sanitizes provider failure at the API boundary: unavailable focused reasoning returns a controlled HTTP 503, and raw provider/Ollama diagnostics no longer leave that boundary. diff --git a/middleware.js b/middleware.js index a22afe6..9d3b24d 100644 --- a/middleware.js +++ b/middleware.js @@ -1,7 +1,7 @@ import { createServerClient } from "@supabase/ssr"; import { NextResponse } from "next/server"; -const PUBLIC_PATHS = ["/login", "/auth", "/api/health"]; +const PUBLIC_PATHS = ["/login", "/auth", "/api/health", "/privacy", "/terms", "/cookies"]; export async function middleware(request) { const pathname = request.nextUrl.pathname; diff --git a/tests/legal-pages.test.jsx b/tests/legal-pages.test.jsx new file mode 100644 index 0000000..acbcb5c --- /dev/null +++ b/tests/legal-pages.test.jsx @@ -0,0 +1,33 @@ +import React from "react"; +import { describe, expect, it } from "vitest"; +import { renderToStaticMarkup } from "react-dom/server"; +import { NextRequest } from "next/server"; +import PrivacyPage from "@/app/privacy/page.jsx"; +import TermsPage from "@/app/terms/page.jsx"; +import CookiesPage from "@/app/cookies/page.jsx"; +import LegalNavigation from "@/components/legal-navigation.jsx"; +import { middleware } from "@/middleware.js"; + +describe("public legal pages", () => { + it.each([ + ["Privacy Policy", PrivacyPage], + ["Terms of Use", TermsPage], + ["Cookie Policy", CookiesPage], + ])("renders the %s heading", (heading, Page) => { + const html = renderToStaticMarkup(); + expect(html).toContain(`

${heading}

`); + }); + + it("exposes all public legal links without cookie consent controls", () => { + const html = renderToStaticMarkup(); + expect(html).toContain('href="/privacy"'); + expect(html).toContain('href="/terms"'); + expect(html).toContain('href="/cookies"'); + expect(html).not.toMatch(/Accept cookies|Reject cookies/i); + }); + + it.each(["privacy", "terms", "cookies"])("keeps /%s public", async (path) => { + const response = await middleware(new NextRequest(`http://localhost:3000/${path}`)); + expect(response.status).toBe(200); + }); +}); \ No newline at end of file