Alpha stage commit

docs/13_security_privacy.md

@@ -0,0 +1,54 @@
+# Security and Privacy
+
+## Sensitive data
+
+The app may process:
+
+- location history,
+- planned travel dates,
+- sleep locations,
+- emergency contacts,
+- account identity,
+- API tokens,
+- community reports,
+- booking/deep-link actions.
+
+## Privacy requirements
+
+- Default trips to private.
+- Let users delete trips and reports where legally possible.
+- Do not share exact sleep plans publicly by default.
+- Minimize continuous location collection.
+- Allow offline use without constant tracking.
+- Separate analytics from precise route history.
+- Hash/anonymize telemetry where possible.
+
+## Security requirements
+
+- Store secrets in environment variables or secret manager.
+- Use short-lived signed URLs for offline-pack downloads.
+- Validate GPX uploads.
+- Sanitize user-generated content.
+- Rate-limit report submission.
+- Protect against route/POI scraping if commercial data is included.
+- Keep provider API keys server-side.
+
+## Compliance notes
+
+For EU users, assume GDPR obligations:
+
+- explicit consent for location tracking,
+- data export/deletion,
+- purpose limitation,
+- retention policy,
+- processor agreements for analytics/cloud vendors.
+
+## Safety disclaimers
+
+Show concise warnings:
+
+- route data may be wrong,
+- access rules can change,
+- weather forecasts are uncertain,
+- users must obey signs and local laws,
+- remote riding requires judgment and preparation.