privacy

App.tsx

@@ -9,6 +9,7 @@ import { SignUpForm } from './components/auth/SignUpForm';
 import { EmailVerification } from './components/auth/EmailVerification';
 import { ForgotPassword } from './components/auth/ForgotPassword';
 import { ResetPassword } from './components/auth/ResetPassword';
+import { PrivacyPolicy } from './components/PrivacyPolicy';
 import { useSession, signOut } from './lib/auth-client';
 import { LayoutDashboard, Package, FileCheck, LogOut, UserCircle } from 'lucide-react';
 
@@ -26,6 +27,10 @@ type AppView =
 
 type Tab = 'dashboard' | 'inventory' | 'protocol' | 'profile';
 
+function isPrivacyRoute() {
+  return window.location.pathname === '/privacy';
+}
+
 function isResetPasswordRoute() {
   return (
     window.location.pathname === '/reset-password' &&
@@ -35,6 +40,7 @@ function isResetPasswordRoute() {
 
 export default function App() {
   const { data: session, isPending } = useSession();
+  const [isPrivacy] = useState(isPrivacyRoute);
   const [view, setView] = useState<AppView>(
     isResetPasswordRoute() ? 'reset-password' : 'loading'
   );
@@ -60,6 +66,8 @@ export default function App() {
     });
   }, [session, isPending, view]);
 
+  if (isPrivacy) return <PrivacyPolicy />;
+
   if (view === 'reset-password') {
     return (
       <ResetPassword

components/PrivacyPolicy.tsx

@@ -0,0 +1,140 @@
+const logo = '/logo.png';
+
+export function PrivacyPolicy() {
+  return (
+    <div className="min-h-screen bg-secondary">
+      <div className="max-w-3xl mx-auto px-6 py-12">
+        <div className="flex items-center gap-3 mb-8">
+          <img src={logo} alt="LabWise" className="h-10" />
+        </div>
+
+        <h1 className="text-3xl font-bold text-primary mb-2">Privacy Policy</h1>
+        <p className="text-muted-foreground mb-8">Last updated: April 9, 2026</p>
+
+        <div className="bg-card rounded-lg border border-border p-8 space-y-6 text-primary">
+          <section>
+            <h2 className="text-xl font-semibold mb-2">Overview</h2>
+            <p>
+              LabWise ("we", "our", or "us") is a chemical inventory management platform for
+              laboratories. This Privacy Policy explains how we collect, use, and protect your
+              information when you use the LabWise mobile app and web application
+              (collectively, the "Service").
+            </p>
+          </section>
+
+          <section>
+            <h2 className="text-xl font-semibold mb-2">Information We Collect</h2>
+            <h3 className="font-medium mt-3 mb-1">Account Information</h3>
+            <p>
+              When you create an account, we collect your email address, name, and a password
+              (or authentication credentials if you sign in with Google). We also collect lab
+              profile details you provide, including PI name, building code, lab designation,
+              and contact information.
+            </p>
+            <h3 className="font-medium mt-3 mb-1">Inventory Data</h3>
+            <p>
+              We store the chemical inventory data you enter or scan, including chemical names,
+              CAS numbers, storage locations, quantities, vendor information, expiration dates,
+              and any comments you add.
+            </p>
+            <h3 className="font-medium mt-3 mb-1">Protocol Data</h3>
+            <p>
+              If you use the Protocol Checker feature, we store the protocol documents or text
+              you upload for AI-powered safety analysis.
+            </p>
+            <h3 className="font-medium mt-3 mb-1">Camera and Photos</h3>
+            <p>
+              The mobile app can use your device camera to scan chemical labels. Images are
+              processed on-device using Apple's built-in AI capabilities. Label images are not
+              transmitted to our servers unless you explicitly save them with a chemical entry.
+            </p>
+            <h3 className="font-medium mt-3 mb-1">Automatically Collected Data</h3>
+            <p>
+              We collect standard server logs (IP address, request timestamps, browser/device
+              type) to operate and secure the Service.
+            </p>
+          </section>
+
+          <section>
+            <h2 className="text-xl font-semibold mb-2">How We Use Your Information</h2>
+            <ul className="list-disc pl-6 space-y-1">
+              <li>To provide and maintain the Service, including inventory tracking, safety alerts, and protocol analysis</li>
+              <li>To authenticate your account and maintain your session</li>
+              <li>To pre-fill form fields with your lab profile defaults</li>
+              <li>To send safety alerts about expiring or low-stock chemicals</li>
+              <li>To improve and secure the Service</li>
+            </ul>
+          </section>
+
+          <section>
+            <h2 className="text-xl font-semibold mb-2">Data Sharing</h2>
+            <p>
+              We do not sell, rent, or share your personal information or inventory data with
+              third parties. Your data may be disclosed only in the following circumstances:
+            </p>
+            <ul className="list-disc pl-6 space-y-1 mt-2">
+              <li>With your consent</li>
+              <li>To comply with legal obligations or law enforcement requests</li>
+              <li>To protect the rights, safety, or property of LabWise or its users</li>
+            </ul>
+          </section>
+
+          <section>
+            <h2 className="text-xl font-semibold mb-2">Third-Party Services</h2>
+            <p>
+              The Service integrates with the following third-party services:
+            </p>
+            <ul className="list-disc pl-6 space-y-1 mt-2">
+              <li><strong>Google OAuth</strong> — if you choose to sign in with Google, your authentication is handled by Google's OAuth service, subject to Google's Privacy Policy.</li>
+              <li><strong>PubChem</strong> — when scanning chemicals, we may query PubChem's public API to look up chemical properties by CAS number. Only the CAS number is sent; no personal data is shared.</li>
+            </ul>
+          </section>
+
+          <section>
+            <h2 className="text-xl font-semibold mb-2">Data Security</h2>
+            <p>
+              We use industry-standard security measures to protect your data, including HTTPS
+              encryption for all data in transit, secure session management with HTTP-only
+              cookies, and rate limiting on authentication and API endpoints.
+            </p>
+          </section>
+
+          <section>
+            <h2 className="text-xl font-semibold mb-2">Data Retention and Deletion</h2>
+            <p>
+              Your data is retained for as long as your account is active. You may delete
+              individual chemical entries or protocol records at any time. To request full
+              account and data deletion, contact us at the email address below.
+            </p>
+          </section>
+
+          <section>
+            <h2 className="text-xl font-semibold mb-2">Children's Privacy</h2>
+            <p>
+              The Service is not directed at children under 13. We do not knowingly collect
+              personal information from children under 13. If you believe a child has provided
+              us with personal data, please contact us so we can delete it.
+            </p>
+          </section>
+
+          <section>
+            <h2 className="text-xl font-semibold mb-2">Changes to This Policy</h2>
+            <p>
+              We may update this Privacy Policy from time to time. We will notify you of any
+              material changes by posting the updated policy on this page with a revised "Last
+              updated" date.
+            </p>
+          </section>
+
+          <section>
+            <h2 className="text-xl font-semibold mb-2">Contact Us</h2>
+            <p>
+              If you have questions about this Privacy Policy or your data, please contact us
+              at: <a href="mailto:pulipakaaditya@gmail.com" className="text-blue-600 hover:underline">pulipakaaditya@gmail.com</a>
+            </p>
+          </section>
+        </div>
+      </div>
+    </div>
+  );
+}