From 34b8bb215279765709f031f9df267cd2404487fa Mon Sep 17 00:00:00 2001
From: Echo <github@3kh0.net>
Date: Tue, 12 Aug 2025 16:30:12 -0400
Subject: [PATCH] privacy policy deluxe (#473)

---
 app/views/layouts/application.html.erb  |  4 ++
 app/views/static_pages/index.html.erb   |  6 +++
 app/views/static_pages/privacy.html.erb | 63 +++++++++++++++++++++++++
 config/routes.rb                        |  2 +-
 4 files changed, 74 insertions(+), 1 deletion(-)
 create mode 100644 app/views/static_pages/privacy.html.erb

diff --git a/app/views/layouts/application.html.erb b/app/views/layouts/application.html.erb
index d6c99be..a731baf 100644
--- a/app/views/layouts/application.html.erb
+++ b/app/views/layouts/application.html.erb
@@ -164,7 +164,11 @@
     <!-- 250px is defined in nav.css -->
     <main class="flex-1 lg:ml-[250px] lg:max-w-[calc(100%-250px)] p-5 mb-[100px] pt-16 lg:pt-5 transition-all duration-300 ease-in-out">
       <%= yield %>
+      <!-- the real footer -->
       <footer class="relative w-full mt-12 mb-5 p-2.5 text-center text-xs text-gray-600 hover:text-gray-300 transition-colors duration-200">
+        <p class="text-sm text-gray-300">
+          Made with ❤️ by <%= link_to "Hack Club", "https://hackclub.com", class: "text-inherit underline opacity-80 hover:opacity-100 transition-opacity duration-200", target: "_blank", rel: "noopener" %> | <%= link_to "Privacy Policy", "/privacy", class: "text-inherit underline opacity-80 hover:opacity-100 transition-opacity duration-200" %>
+        </p>
         <div class="container">
           <p>
             Build <%= link_to Rails.application.config.git_version, Rails.application.config.commit_link, class: "text-inherit underline opacity-80 hover:opacity-100 transition-opacity duration-200" %>
diff --git a/app/views/static_pages/index.html.erb b/app/views/static_pages/index.html.erb
index d1b3e11..fa884fc 100644
--- a/app/views/static_pages/index.html.erb
+++ b/app/views/static_pages/index.html.erb
@@ -95,6 +95,9 @@
             <p class="m-0 ml-2 italic text-gray-400"><%= @ssp_message %> (this is real data)</p>
           <% end %>
         </div>
+        <div class="flex items-center text-gray-600">
+          By continuing, you agree to Hackatime's <%= link_to "Privacy Policy", "/privacy", class: "text-inherit underline opacity-80 hover:opacity-100 transition-opacity duration-200 mx-1" %>
+        </div>
       </div>
     <% end %>
     <p>
@@ -165,6 +168,9 @@
               Because you're on localhost, <%= link_to "click here to view the email", letter_opener_web_path %>
             <% end %>
           <% end %>
+          <p class="text-sm text-gray-600">
+            By using this site, you agree to our <%= link_to "Privacy Policy", "/privacy", class: "text-inherit underline opacity-80 hover:opacity-100 transition-opacity duration-200" %>.
+          </p>
         </div>
       </div>
     </div>
diff --git a/app/views/static_pages/privacy.html.erb b/app/views/static_pages/privacy.html.erb
new file mode 100644
index 0000000..91131b7
--- /dev/null
+++ b/app/views/static_pages/privacy.html.erb
@@ -0,0 +1,63 @@
+<div class="max-w-4xl mx-auto px-4 sm:px-6 lg:px-8 py-8 bg-dark text-gray-300 rounded-xl">
+  <h1 class="text-3xl font-bold text-primary mb-2">Hackatime Privacy Policy</h1>
+  <p class="mb-2">
+    This page outlines how Hackatime, a platform owned and operated by Hack Club, collects, uses, stores, and protects your personal data when you use Hackatime. We will use many complex terms in this, so be ready. Hack Club is committed to safeguarding your privacy in Hackatime. By using Hackatime, you agree to the terms described in this policy.
+  </p>
+
+  <h2 class="text-2xl font-semibold text-primary mt-6 mb-2">1. Information We Collect</h2>
+  <p class="mb-2">
+    We collect and store all data transmitted by users (that’s you!), including:
+  </p>
+  <ul class="list-disc pl-5">
+    <li>Email addresses, Slack account information (including Slack IDs and authentication details for users signing in via Slack), and GitHub authentication details when you link your GitHub account.</li>
+    <li>Heartbeat information, such as activity information and timestamps. The specific heartbeat data collected depends on the browser extension or integration you use and what is transmitted to our servers. Please review your extension to understand the exact data collected.</li>
+  </ul>
+
+  <h2 class="text-2xl font-semibold text-primary mt-6 mb-2">2. How We Use Your Information</h2>
+  <p class="mb-2">
+    We collect data to enable time tracking for users participating in programs run by Hack Club. Additionally, we may use your data to:
+  </p>
+  <ul class="list-disc pl-5">
+    <li>Verify the legitimacy of logged hours.</li>
+    <li>Prevent fraud and ensure integrity.</li>
+  </ul>
+  <p class="mt-2">
+    We do not use your data for tracking purposes unrelated to our services. We use internal analytics tools to measure usage, utilizing only IP addresses to identify unique visits without collecting demographic information.
+  </p>
+
+  <h2 class="text-2xl font-semibold text-primary mt-6 mb-2">3. Data Storage and Security</h2>
+  <p class="mb-2">
+    All data is stored securely, and access controls are in place to protect against unauthorized access, loss, or misuse. Only members of HQ and the Fraud Department can access raw heartbeat data, and that is to ensure eligibility in programs.
+  </p>
+
+  <h2 class="text-2xl font-semibold text-primary mt-6 mb-2">4. Sharing of Information</h2>
+  <p class="mb-2">
+    Hack Club does not sell your personal data to advertisers or third parties. Your data is shared in these possible situations:
+  </p>
+  <ul class="list-disc pl-5">
+    <li>With service providers (e.g., hosting providers) under strict confidentiality agreements to operate the platform.</li>
+    <li>When others call our public API</li>
+    <li>To prevent fraud or detect abuse.</li>
+    <li>As required by law, such as in response to legal processes or government requests.</li>
+  </ul>
+
+  <h2 class="text-2xl font-semibold text-primary mt-6 mb-2">5. Data Retention</h2>
+  <p class="mb-2">
+    We retain your data indefinitely to protect against malicious, deceptive, fraudulent, or illegal activity. This retention ensures we can detect and prevent abuse. We do not delete accounts and/or data, as doing so could compromise our ability to maintain security and prevent fraudulent activity.
+  </p>
+
+  <h2 class="text-2xl font-semibold text-primary mt-6 mb-2">6. Your Rights</h2>
+  <p class="mb-2">
+    You may have certain rights regarding your personal data, depending on applicable laws, such as accessing your data, correcting inaccuracies, or requesting restrictions on processing. To exercise these rights, contact us at the details below. Note that, due to our retention policy for fraud prevention, we may not fulfill erasure requests. If you have concerns, you may contact your local data protection authority. Please allow for 30 days for us to fulfill your request from the moment it is issued.
+  </p>
+
+  <h2 class="text-2xl font-semibold text-primary mt-6 mb-2">7. Changes to This Policy</h2>
+  <p class="mb-2">
+    This policy may change at any time, with or without prior notice. We encourage you to review it periodically. Continued use of Hackatime after changes indicates acceptance of the updated policy.
+  </p>
+
+  <h2 class="text-2xl font-semibold text-primary mt-6 mb-2">8. Questions?</h2>
+  <p class="mb-2">
+    For questions, concerns, or to exercise your data rights, please contact us via email at <a href="mailto:echo@hackclub.com" class="text-blue">echo@hackclub.com</a>. Please allow for up to 5 business days for queries.
+  </p>
+</div>
diff --git a/config/routes.rb b/config/routes.rb
index 21e5469..dd27997 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -189,6 +189,6 @@ Rails.application.routes.draw do
     end
   end
 
-  # SEO routes
   get "/sitemap.xml", to: "sitemap#sitemap", defaults: { format: "xml" }
+  get "/privacy", to: "static_pages#privacy"
 end