#!/bin/bash
# Swiss FADP privacy for exchange.hacktivism.ch — run inside exchange container.
set -euo pipefail
export PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin${PATH:+:$PATH}"

ETAG="${PRIVACY_ETAG:-exchange-pp-swiss-v0}"
CONF="${TALER_EXCHANGE_CONFIG:-/etc/taler-exchange/taler-exchange.conf}"
DATA_HOME=$(taler-exchange-config -c "$CONF" -f -s PATHS -o TALER_DATA_HOME 2>/dev/null || true)
DATA_HOME="${DATA_HOME:-/var/lib/taler-exchange/}"
DIR="${PRIVACY_DIR:-${DATA_HOME%/}/terms}/en"
mkdir -p "$DIR"

cat >"$DIR/${ETAG}.txt" <<'EOF'
Privacy notice — exchange.hacktivism.ch (Swiss FADP / revDSG)

Controller: operators of the hacktivism.ch GNU Taler stack.
Service: experimental GOA exchange (not a licensed Swiss bank or e-money institution).

Data retained (precise):
1) Reserves — reserve public keys, current remaining amounts, creation/close times: for service life or wipe.
2) Wire-in (reserves_in) — credit amounts, timestamps, bank-side account reference as provided by the bank/wire gateway: for service life; links reserve funding to bank accounts.
3) Coins — known coin public keys, denomination serials, remaining value, spend/deposit linkage as required by protocol: for service life.
4) Withdraw / refresh / recoup / refund / deposit tables — protocol operation records and timestamps: for service life.
5) Wire-out — transfers to merchant accounts (amounts, payto/target as stored, times): for service life.
6) Keys / denominations — public denomination and signing keys (not personal data by themselves).
7) Technical logs — HTTP and process logs (IP, path, status): days–weeks via rotation.
8) Terms acceptance markers if stored by clients — as required by wallet software.

Not retained by the exchange as plaintext identity of wallet holders: GNU Taler is designed so coin spend is unlinkable to customer bank identity at the exchange when used as intended. Funding reserves via the bank may still identify the bank account holder on the bank side.

Purposes: operate GOA exchange protocol, settle with bank/merchants, security, operations.
Legal basis (FADP): provision of requested exchange service; proportionate operation of experimental stack.
Recipients: bank.hacktivism.ch (wire); merchants depositing GOA; host operators. No sale of data.
Rights: access, rectification, deletion, objection (FADP); complaint to Swiss FDPIC (EDÖB).
Security: TLS; experimental stack.

Related: https://exchange.hacktivism.ch/terms · https://bank.hacktivism.ch/intro/privacy.html · https://taler.hacktivism.ch/privacy
EOF

cat >"$DIR/${ETAG}.md" <<'EOF'
# Privacy notice · GOA Exchange · Swiss FADP

Controller: operators of **hacktivism.ch**. Service: experimental **GOA** exchange at `exchange.hacktivism.ch`.

Swiss Federal Act on Data Protection (**FADP / revDSG**, since 1 Sep 2023).

## Data retained

| Data | Examples | Retention |
|------|----------|-----------|
| Reserves | Reserve pubs, remaining amount, times | Service life or wipe |
| Wire-in | Amounts, timestamps, bank account ref from wire path | Service life |
| Coins | Coin pubs, denoms, remaining, deposit links | Service life |
| Protocol ops | Withdraw, refresh, deposit, refund, recoup | Service life |
| Wire-out | Merchant settlement amounts / targets | Service life |
| Technical logs | IP, path, status | Days–weeks (rotation) |

**Design note:** Coin spend is intended to be unlinkable to the customer at the exchange. Funding a reserve via the bank may identify the **bank** account holder on the bank system.

## Purposes

Run the GOA exchange protocol; wire settlement; security and operations.

## Rights

FADP access, correction, deletion, objection. Complaint: Swiss **FDPIC / EDÖB**.

## Related

- [Exchange terms](https://exchange.hacktivism.ch/terms)
- [Bank privacy](https://bank.hacktivism.ch/intro/privacy.html)
- [Merchant privacy](https://taler.hacktivism.ch/privacy)
EOF

cat >"$DIR/${ETAG}.html" <<'HTML'
<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="utf-8"/>
  <meta name="viewport" content="width=device-width, initial-scale=1"/>
  <title>Privacy notice · GOA Exchange · Swiss FADP</title>
  <style>
    :root { color-scheme: dark light; }
    body {
      font-family: system-ui, -apple-system, sans-serif;
      max-width: 42rem; margin: 2rem auto; padding: 0 1.1rem 3rem;
      line-height: 1.5; color: #e8e6e3; background: #1a1520;
    }
    h1 { font-size: 1.35rem; font-weight: 800; margin: 0 0 1rem; color: #f5f0ea; }
    h2 { font-size: 1.05rem; margin: 1.5rem 0 0.5rem; color: #e8c878; }
    p, li, td, th { font-size: 0.95rem; }
    ul { padding-left: 1.2rem; }
    code, a { color: #5eead4; }
    a { text-decoration: none; }
    a:hover { text-decoration: underline; }
    .badge {
      display: inline-block; font-size: 0.72rem; font-weight: 700;
      letter-spacing: 0.06em; text-transform: uppercase;
      color: #c4b5fd; border: 1px solid rgba(196,181,253,0.35);
      border-radius: 999px; padding: 0.2rem 0.65rem; margin-bottom: 0.85rem;
    }
    .note {
      border-radius: 12px; padding: 0.75rem 0.9rem; margin: 0.85rem 0 1rem;
      border: 1px solid rgba(255,255,255,0.1); background: rgba(0,0,0,0.25);
      font-size: 0.9rem; color: #c8c4bf;
    }
    table { width: 100%; border-collapse: collapse; margin: 0.6rem 0 1rem; font-size: 0.88rem; }
    th, td { border: 1px solid rgba(255,255,255,0.12); padding: 0.45rem 0.55rem; text-align: left; vertical-align: top; }
    th { background: rgba(0,0,0,0.35); color: #e8c878; font-weight: 700; }
    .muted { color: #a39e98; font-size: 0.88rem; }
    footer { margin-top: 2rem; font-size: 0.85rem; color: #a39e98; }
  </style>
</head>
<body>
  <div class="badge">exchange.hacktivism.ch · privacy · CH</div>
  <h1>Privacy notice · GOA Exchange</h1>
  <p class="note">
    Swiss Federal Act on Data Protection (<strong>FADP / revDSG</strong>, since 1&nbsp;Sep&nbsp;2023).
    Experimental GOA exchange at <code>exchange.hacktivism.ch</code> — not a licensed bank.
  </p>

  <h2>1. Controller</h2>
  <p>Operators of the hacktivism.ch GNU Taler stack. No separate DPO for this experimental service.</p>

  <h2>2. Data retained</h2>
  <table>
    <thead><tr><th>Data</th><th>Examples</th><th>Typical retention</th></tr></thead>
    <tbody>
      <tr><td>Reserves</td><td>Reserve public keys, remaining amount, times</td><td>Service life or wipe</td></tr>
      <tr><td>Wire-in</td><td>Amounts, timestamps, bank account reference from wire path</td><td>Service life</td></tr>
      <tr><td>Coins</td><td>Coin pubs, denominations, remaining value, deposit links</td><td>Service life</td></tr>
      <tr><td>Protocol operations</td><td>Withdraw, refresh, deposit, refund, recoup</td><td>Service life</td></tr>
      <tr><td>Wire-out</td><td>Merchant settlement amounts / targets</td><td>Service life</td></tr>
      <tr><td>Technical logs</td><td>IP, path, status</td><td>Days–weeks (rotation)</td></tr>
    </tbody>
  </table>
  <p><strong>Design note:</strong> Coin spend is intended to be unlinkable to the customer
    <em>at the exchange</em>. Funding a reserve via the bank may identify the bank account
    holder on the <strong>bank</strong> system.</p>

  <h2>3. Purposes</h2>
  <ul>
    <li>Operate the GOA GNU Taler exchange protocol</li>
    <li>Wire settlement with bank and merchants</li>
    <li>Security, debugging, capacity monitoring</li>
  </ul>

  <h2>4. Your rights</h2>
  <p>Access, rectification, deletion, objection under the FADP. Complaint:
    Swiss <strong>FDPIC / EDÖB</strong>.</p>

  <h2>Related</h2>
  <ul>
    <li><a href="https://exchange.hacktivism.ch/terms">Exchange terms</a></li>
    <li><a href="https://bank.hacktivism.ch/intro/privacy.html">Bank privacy</a></li>
    <li><a href="https://taler.hacktivism.ch/privacy">Merchant privacy</a></li>
  </ul>
  <footer class="muted">exchange-pp-swiss-v0 · Swiss FADP (revDSG)</footer>
</body>
</html>
HTML

chmod -R a+rX "${DATA_HOME%/}/terms"
if id taler-exchange-httpd >/dev/null 2>&1; then
  chown -R taler-exchange-httpd: "${DATA_HOME%/}/terms" 2>/dev/null || true
fi
echo "ok exchange privacy $ETAG -> $DIR"
ls -la "$DIR"/${ETAG}.*
