/* VALDEX — Cookie policy */

const UPDATED_CK = "May 18, 2026";

function CookiePolicyPage() {
  return (
    <LegalShell
      title="Cookie policy"
      updated={UPDATED_CK}
      intro={
        <React.Fragment>
          <p>
            This page is the complete inventory of cookies and similar technologies
            (local storage, session storage, pixels, fingerprinting) on{" "}
            <a href="/">valdexai.com</a>. We publish it because the easiest place to lie
            about tracking is in the privacy policy, and the easiest way to disprove the
            lie is a verifiable list.
          </p>
          <p>
            <strong>The short version:</strong> we do not use cookies for advertising,
            cross-site tracking, fingerprinting, or analytics. We do not load third-party
            social-media beacons, ad-tech scripts, or behavioral-targeting pixels. If a
            future change introduces any of those, this page changes first and we will
            note the change at the top of the <a href="/privacy">privacy notice</a>.
          </p>
        </React.Fragment>
      }
      sections={[
        { id: "what", h: "1. What a cookie is, briefly", body: (
          <React.Fragment>
            <p>
              A cookie is a small text file a website asks your browser to store on your
              device. The next time your browser hits that site, it sends the file back.
              Cookies are used for things like keeping you logged in, remembering language
              preferences, and — for some sites — building advertising profiles across the
              web.
            </p>
            <p>
              Related technologies include <strong>local storage</strong> and{" "}
              <strong>session storage</strong> (similar to cookies but accessed by JavaScript
              rather than sent on every request), <strong>tracking pixels</strong> (1×1
              images that fire requests to record visits), and{" "}
              <strong>browser fingerprinting</strong> (deriving a unique identifier from
              your device characteristics without storing anything). All of them count for
              the same regulatory analysis as cookies under ePrivacy and GDPR.
            </p>
          </React.Fragment>
        )},
        { id: "inventory", h: "2. The full inventory", body: (
          <React.Fragment>
            <p>
              The table below lists every cookie and similar technology this site uses.
              <strong> If this site sets it, it's listed. If a cookie isn't listed, this
              site doesn't set it.</strong>
            </p>
            <table className="legal-table">
              <thead>
                <tr>
                  <th>Name</th>
                  <th>Type</th>
                  <th>Set by</th>
                  <th>Purpose</th>
                  <th>Duration</th>
                  <th>Category</th>
                </tr>
              </thead>
              <tbody>
                <tr>
                  <td colSpan="6" style={{ fontStyle: "italic", color: "var(--ink-dim)" }}>
                    None. This site does not set any first-party cookies at the time of this
                    revision.
                  </td>
                </tr>
              </tbody>
            </table>
            <p>
              <strong>Third-party connections that may set their own cookies.</strong>{" "}
              The site loads a small number of third-party resources (fonts, runtime
              scripts, edge CDN). These providers may set cookies of their own under their
              own privacy practices — independent of us. Where this happens, the cookie is
              the third party's, not ours, and is governed by their privacy policy:
            </p>
            <table className="legal-table">
              <thead>
                <tr>
                  <th>Third party</th>
                  <th>What loads</th>
                  <th>Cookies set in our context</th>
                  <th>Their policy</th>
                </tr>
              </thead>
              <tbody>
                <tr>
                  <td>Bunny.net (fonts.bunny.net)</td>
                  <td>Web font CSS and font files</td>
                  <td>None. Bunny Fonts is a cookieless, GDPR-compliant Google Fonts alternative — see <a href="https://bunny.net/blog/announcing-bunny-fonts-an-open-source-privacy-first-web-font-platform/">their announcement</a>.</td>
                  <td><a href="https://bunny.net/privacy">bunny.net/privacy</a></td>
                </tr>
                <tr>
                  <td>unpkg.com</td>
                  <td>React, ReactDOM, Babel runtime (CDN)</td>
                  <td>None set by unpkg in normal CDN responses; some Cloudflare-issued cookies (e.g. <code>__cf_bm</code>) may be set transiently for bot management.</td>
                  <td><a href="https://www.cloudflare.com/privacypolicy/">cloudflare.com/privacypolicy</a></td>
                </tr>
                <tr>
                  <td>Cloudflare (our edge)</td>
                  <td>DNS, edge caching, DDoS protection for valdexai.com</td>
                  <td><code>__cf_bm</code> (bot management, ~30 min, strictly-necessary)</td>
                  <td><a href="https://www.cloudflare.com/privacypolicy/">cloudflare.com/privacypolicy</a></td>
                </tr>
              </tbody>
            </table>
          </React.Fragment>
        )},
        { id: "analytics", h: "3. Analytics", body: (
          <React.Fragment>
            <p>
              We use <strong>Plausible Analytics</strong>, a privacy-respecting,
              EU-hosted, <strong>cookieless</strong> web analytics tool. Plausible does
              not set cookies and does not use cross-site tracking or device
              fingerprinting. The data it collects (page URL, referrer, country, device
              class) is aggregated and never tied to an individual.
            </p>
            <p>
              Because Plausible is cookieless and does not constitute "tracking" under
              the ePrivacy Directive, no consent banner is required for it. You can read
              their data-policy commitments at{" "}
              <a href="https://plausible.io/data-policy">plausible.io/data-policy</a>.
            </p>
          </React.Fragment>
        )},
        { id: "categories", h: "4. Cookie categories explained", body: (
          <React.Fragment>
            <p>
              Privacy regulators sort cookies into four functional categories. We list
              them here so you can see how we'd classify anything we ever do introduce.
            </p>
            <ul>
              <li><strong>Strictly necessary.</strong> Cookies a site cannot operate without — load balancing, basic security, session continuity. Do not require consent under ePrivacy. <em>Today: any Cloudflare bot-management cookie on the edge.</em></li>
              <li><strong>Functional / preference.</strong> Remembering language, theme, or layout choices. Often consented-into via clear UI. <em>Today: none.</em></li>
              <li><strong>Analytics / performance.</strong> Counting visits, understanding which pages are used. Requires consent in the EU when implemented with cookies; cookieless analytics like Plausible does not. <em>Today: none — Plausible is cookieless.</em></li>
              <li><strong>Marketing / advertising / cross-site tracking.</strong> Building profiles across sites, retargeting, look-alike audiences. Always requires consent in jurisdictions that recognize consent. <em>Today: none, and we have committed in writing not to introduce any.</em></li>
            </ul>
          </React.Fragment>
        )},
        { id: "consent", h: "5. Do you need to ask consent", body: (
          <React.Fragment>
            <p>
              Under the ePrivacy Directive and the GDPR (and the UK's PECR), consent is
              required only for cookies and similar technologies that are not strictly
              necessary. Because we set none of those, we do not display a cookie banner.
            </p>
            <p>
              If we ever introduce a non-essential cookie — whether for analytics with
              cookies, A/B testing, or anything else — we will deploy a consent layer
              first, with granular accept/reject for each category, and update this page
              before the cookie ships.
            </p>
          </React.Fragment>
        )},
        { id: "controls", h: "6. How to control cookies", body: (
          <React.Fragment>
            <p>
              You can clear and block cookies in every modern browser. The "Manage cookies"
              or "Privacy and security" section of your browser settings is the canonical
              place to do this.
            </p>
            <ul>
              <li><strong>Chrome:</strong> Settings → Privacy and security → Cookies and other site data</li>
              <li><strong>Firefox:</strong> Settings → Privacy &amp; Security → Cookies and Site Data</li>
              <li><strong>Safari:</strong> Settings → Privacy → Manage Website Data</li>
              <li><strong>Edge:</strong> Settings → Cookies and site permissions</li>
            </ul>
            <p>
              Browsers also support a <strong>Global Privacy Control (GPC)</strong> signal
              — a header indicating you do not want your personal information sold or
              shared. We honor GPC and treat it as a valid opt-out signal for any future
              sharing, even though we do not sell or share today.
            </p>
            <p>
              You can also use private/incognito browsing, which discards cookies at the
              end of the session, or browser-level tracker blocking (the EFF's{" "}
              <a href="https://privacybadger.org/">Privacy Badger</a> and uBlock Origin
              are both robust choices). Blocking strictly-necessary cookies may break some
              websites; this site does not have any features that depend on cookies.
            </p>
          </React.Fragment>
        )},
        { id: "do-not-track", h: "7. Do Not Track and Global Privacy Control", body: (
          <p>
            Most browsers send a "Do Not Track" header. There is no agreed standard for
            how websites should respond to it, but our behavior is straightforward: we
            don't track anyone, regardless of the DNT setting. We honor the{" "}
            <strong>Global Privacy Control</strong> (GPC) signal as a request to opt out
            of any sale or sharing of personal information — which is already our default.
          </p>
        )},
        { id: "changes", h: "8. Changes to this policy", body: (
          <p>
            We update this policy whenever the site's cookie behavior changes — adding
            anything new, even strictly-necessary, gets noted. The "Last updated" date at
            the top of the page reflects the most recent revision.
          </p>
        )},
        { id: "contact", h: "9. Contact", body: (
          <React.Fragment>
            <p>Questions about this policy or about anything you observe being set in your browser by this site:</p>
            <p>
              <strong>VALDEX LLC</strong><br />
              1309 Coffeen Ave, Ste 1200<br />
              Sheridan, WY 82801, United States<br />
              <a href="mailto:privacy@valdexai.com">privacy@valdexai.com</a>
            </p>
          </React.Fragment>
        )},
      ]}
    />
  );
}

ReactDOM.createRoot(document.getElementById("root")).render(<CookiePolicyPage />);