BillTracker/routes/privacy.js

const express = require('express');
const router = express.Router();

let pkg;
try { pkg = require('../package.json'); } catch { pkg = { version: '0.1.0' }; }

router.get('/', (req, res) => {
  res.json({
    name: 'Privacy',
    version: pkg.version,
    last_updated: '2026-05-16',
    summary: 'This application is designed to operate privately and locally. We do not collect, sell, analyze, or remotely store your bill tracking data.',
    sections: [
      {
        title: 'Overview',
        items: [
          'This application is designed to operate privately and locally.',
          'We do not collect, sell, analyze, or remotely store your bill tracking data.',
        ],
      },
      {
        title: 'Data Collection',
        items: [
          'This application does not collect or transmit personal bill information to any server controlled by the administrator.',
          'The administrator cannot view your bills, bill details, payment information, notes or attachments, or account activity in the app UI.',
          'All user data remains local to your installation or environment.',
        ],
      },
      {
        title: 'Version Checking',
        items: [
          'The only external communication performed by the application is an optional version check to determine whether the latest software release is installed.',
          'This communication does not include your bill data or personal information.',
          'An administrator can disable the version check entirely in the admin panel; when disabled, the application makes no external requests.',
          'Version check information is not tracked or stored server-side and is used solely to determine software update availability.',
        ],
      },
      {
        title: 'Administrative Access',
        items: [
          'The administrator has extremely limited capabilities in the application.',
          'The administrator cannot edit bill information, view bill information, or access your stored financial data in the app UI.',
          'The administrator may only reset user passwords when requested.',
        ],
      },
      {
        title: 'Logging',
        items: [
          'No application logs are transmitted externally.',
          'All logs, if enabled, remain local to the device or server where the application is installed.',
          'We do not maintain centralized logging, analytics, telemetry, or activity tracking systems.',
        ],
      },
      {
        title: 'Third-Party Services',
        items: [
          'This application does not use third-party analytics, advertising, or tracking services.',
        ],
      },
      {
        title: 'Security',
        items: [
          'Because data remains local and is not centrally stored, users retain direct control over their information and environment security.',
        ],
      },
      {
        title: 'Changes to This Policy',
        items: [
          'This privacy policy may be updated to reflect changes in the application functionality.',
          'Continued use of the software constitutes acceptance of any updated policy.',
        ],
      },
      {
        title: 'Contact',
        items: [
          'If you have questions about this privacy policy, contact the repository administrator.',
        ],
      },
    ],
  });
});

module.exports = router;