Platform
Privacy policy and terms (drafts)
The draft privacy policy, terms of use and store terms in the shop, what they promise, what the code really does, and the placeholders the owner must fill in before anyone relies on them.
Updated 22 October 2026View as Markdown
These texts are drafts. Neither the owner nor a lawyer has reviewed them, they are not legal advice, and they must not be treated as final. They were written from what the code does today, so a lawyer can check the facts first and the wording second. Every page shows a draft notice at the top; remove it only after review.
Where they are
| Page | Address | Linked from |
|---|---|---|
| Privacy policy | leitagu.ee/privacy |
Footer of the landing page, the catalogue and every legal page; the sign-up form; the store sign-up page (/join) |
| Terms of use | leitagu.ee/terms |
The same footers; the sign-up form |
| Terms for stores | leitagu.ee/partner-terms |
The store sign-up page (/join) |
All three are in Estonian and English. The text is in packages/core/src/shared/legal.ts; the page shell is apps/web/src/components/legal/LegalPage.tsx. A unit test checks that both languages have the same structure and that only known placeholders appear.
What the privacy draft says, and where it comes from
- Data kept: account (password only as a scrypt hash), rooms, chats, favourites, the first search typed before sign-up, events and short-lived throttle hashes. A room photo is sent to Claude to be read and is not stored; only the room read from it is.
- Page views are counted without cookies, as described in Traffic analytics. Raw views are deleted after 400 days; the daily salts after one day.
- Cookies: only
leitagu_session(30 days) andlang(1 year) in the shop. See Sessions and cookies. - Processors: Anthropic (chat messages and room photos), Resend (verification and reset emails), and the hosting and database providers.
- Retention, honestly: sessions end after 30 days, verification links after 24 hours, reset links after an hour, page views after 400 days. Accounts, rooms, chats, favourites, events and unverified accounts have no automatic deletion yet; the draft marks each as planned. When an account is deleted its events lose their user id.
- Deleting an account:
DELETE /api/meremoves the account and what belongs to it, but the shop has no button for it yet, so the draft tells people to ask by email. Building the button is planned.
Placeholders the owner must fill in
All are in PLACEHOLDERS at the top of legal.ts; change them there once.
| Placeholder | What to put |
|---|---|
[COMPANY NAME] |
The legal name of the company that runs Leitagu |
[REGISTRY CODE] |
Its commercial register code |
[POSTAL ADDRESS] |
Its registered address |
[CONTACT EMAIL] |
The address for privacy requests and questions |
[HOSTING PROVIDER] |
Who runs the servers (see DEPLOYMENT.md) |
[DATABASE PROVIDER] |
Who runs PostgreSQL |
[LAWYER TO CHECK] |
Left where a lawyer must set limits of liability, consumer rights and governing law |
Open points for the lawyer
- The legal basis for each kind of data, and whether the event totals shown to stores need a different one.
- The transfer basis for Anthropic and Resend in the USA.
- Retention periods for accounts, chats, rooms, events and unverified accounts, then the jobs that apply them.
- Whether the server's ordinary logs hold IP addresses, and for how long (not checked here).
- Limits of liability in the terms, and a minimum age for accounts, which the drafts do not set.
- Whether the store terms need a data-processing section if a store's staff can see shopper data (today they see totals only; see Analytics definitions).