rules.py

"""
Rules engine: red flag patterns, suspicious phrases, categories, and scoring weights.
"""

# Section categories for privacy policies
CATEGORIES = {
    "data_collection": {
        "name": "Data Collection",
        "description": "What information is collected from you",
        "keywords": [
            "data we collect", "information we collect", "personal information",
            "personal data", "data collection", "we gather", "we obtain",
            "we receive", "we store", "we record", "we track",
            "information you provide", "data you provide",
        ],
    },
    "data_sharing": {
        "name": "Data Sharing & Third Parties",
        "description": "Who your data is shared with",
        "keywords": [
            "share with", "third party", "third-party", "affiliates",
            "partners", "service providers", "processors", "disclose",
            "transfer to", "sell your", "advertisers", "analytics",
        ],
    },
    "cookies_tracking": {
        "name": "Cookies & Tracking",
        "description": "Cookies, trackers, and surveillance technologies",
        "keywords": [
            "cookies", "tracking", "web beacons", "pixel tags",
            "fingerprint", "analytics", "advertising partners",
            "retargeting", "interest-based", "behavioral",
        ],
    },
    "user_rights": {
        "name": "User Rights",
        "description": "Your rights regarding your data",
        "keywords": [
            "your rights", "access your data", "delete your data",
            "opt out", "opt-out", "unsubscribe", "data subject",
            "right to erasure", "right to access", "data portability",
            "withdraw consent", "do not sell",
        ],
    },
    "data_retention": {
        "name": "Data Retention",
        "description": "How long your data is kept",
        "keywords": [
            "retain", "retention", "keep your data", "store for",
            "period of time", "duration", "as long as necessary",
            "indefinitely", "permanently",
        ],
    },
    "security": {
        "name": "Security Measures",
        "description": "How your data is protected",
        "keywords": [
            "security", "encrypt", "protect", "safeguard",
            "reasonable measures", "security measures", "secure",
            "firewall", "authentication",
        ],
    },
    "children_privacy": {
        "name": "Children's Privacy",
        "description": "Protection for minors",
        "keywords": [
            "children", "minors", "under 13", "under 16",
            "parental consent", "coppa", "age restriction",
        ],
    },
    "policy_changes": {
        "name": "Changes to Policy",
        "description": "How changes to the policy are communicated",
        "keywords": [
            "change this policy", "modify", "update", "amend",
            "revise", "material changes", "notify", "notice",
        ],
    },
    "jurisdiction": {
        "name": "Jurisdiction & Governing Law",
        "description": "Legal jurisdiction and applicable law",
        "keywords": [
            "governing law", "jurisdiction", "arbitration",
            "dispute resolution", "class action waiver",
            "waive right", "forum selection",
        ],
    },
    "contact_info": {
        "name": "Contact Information",
        "description": "How to reach the company about privacy",
        "keywords": [
            "contact us", "email us", "privacy officer",
            "data protection officer", "dpo", "reach us",
            "questions about", "inquiries",
        ],
    },
}

# Red flag patterns grouped by severity
# Each entry: (pattern_text, risk_points, explanation, category_hint)
RED_FLAGS = [
    # CRITICAL (30-50 points each)
    (
        "sell your personal data",
        50,
        "They explicitly state they sell your personal data to third parties.",
        "data_sharing",
    ),
    (
        "we sell",
        40,
        "The company sells user data as part of their business model.",
        "data_sharing",
    ),
    (
        "sell your.*information",
        40,
        "Your personal information may be sold to other companies.",
        "data_sharing",
    ),
    (
        "no expectation of privacy",
        50,
        "You have NO expectation of privacy when using this service.",
        "user_rights",
    ),
    (
        "waive your right to sue",
        50,
        "You are giving up your right to take legal action against them.",
        "jurisdiction",
    ),
    (
        "class action waiver",
        45,
        "You cannot join a class action lawsuit against this company.",
        "jurisdiction",
    ),
    (
        "must (?:go through|submit to|agree to|resolve through|enter into).{0,40}binding arbitration",
        45,
        "Disputes MUST go through binding arbitration - you cannot go to court.",
        "jurisdiction",
    ),
    (
        "(?:you|your|user|dispute).{0,60}(?:shall|must|will|agrees? to).{0,30}binding arbitration",
        40,
        "You are required to use binding arbitration for disputes.",
        "jurisdiction",
    ),
    (
        "we are not responsible for.*third.party",
        35,
        "They disclaim all responsibility for what third parties do with your data.",
        "data_sharing",
    ),
    (
        "biometric",
        45,
        "They collect biometric data (fingerprints, face scans, iris, etc). This is highly sensitive.",
        "data_collection",
    ),
    (
        "health information",
        40,
        "They collect health-related data, which is extremely sensitive.",
        "data_collection",
    ),
    (
        "social security number",
        50,
        "They collect or have access to your Social Security Number.",
        "data_collection",
    ),
    (
        "financial information",
        35,
        "They collect financial data (credit cards, bank accounts, income).",
        "data_collection",
    ),
    (
        "no liability",
        35,
        "The company claims no liability for data breaches or misuse.",
        "security",
    ),
    (
        "provided as.is",
        30,
        "The service is provided 'as-is' with no guarantees about data safety.",
        "security",
    ),
    (
        "(?:store|keep|retain|retain).{0,30}indefinitely",
        40,
        "They may keep your data indefinitely with no deletion timeline.",
        "data_retention",
    ),
    (
        "(?:store|keep|retain|maintain).{0,30}permanently",
        35,
        "Some data may be stored permanently and never deleted.",
        "data_retention",
    ),

    # HIGH (15-29 points)
    (
        "share with third.party",
        25,
        "Your data is shared with third-party companies.",
        "data_sharing",
    ),
    (
        "share.*affiliates",
        25,
        "Data is shared with affiliated companies in their corporate group.",
        "data_sharing",
    ),
    (
        "may use.*for purposes not described",
        30,
        "They may use your data for purposes NOT mentioned in this policy.",
        "data_collection",
    ),
    (
        "reserve the right to change",
        20,
        "They can change this policy at any time, possibly without real notice.",
        "policy_changes",
    ),
    (
        "transfer.*internationally",
        25,
        "Your data may be transferred to other countries with different privacy laws.",
        "data_sharing",
    ),
    (
        "data may be transferred",
        25,
        "Your data may be moved to servers in different jurisdictions.",
        "data_sharing",
    ),
    (
        "marketing purposes",
        20,
        "Your data may be used for marketing/advertising.",
        "data_collection",
    ),
    (
        "promotional",
        18,
        "Your data may be used for promotional communications.",
        "data_collection",
    ),
    (
        "advertising partners",
        25,
        "Your data is shared with advertising companies.",
        "data_sharing",
    ),
    (
        "cross.border",
        20,
        "Your data crosses international borders, potentially to less protective jurisdictions.",
        "data_sharing",
    ),
    (
        "may disclose",
        15,
        "The company may disclose your data under broad circumstances.",
        "data_sharing",
    ),
    (
        "comply with law",
        10,
        "Data may be shared with government/law enforcement upon request. (Standard legal requirement)",
        "data_sharing",
    ),
    (
        "legal obligation",
        10,
        "Your data may be disclosed to fulfill legal obligations. (Standard legal requirement)",
        "data_sharing",
    ),
    (
        "subsequent changes",
        20,
        "Policy changes may apply to data already collected.",
        "policy_changes",
    ),
    (
        "continued use.*constitutes.*acceptance",
        25,
        "If you keep using the service, you automatically accept any changes.",
        "policy_changes",
    ),
    (
        "by using.*you agree",
        20,
        "Using the service means you automatically agree to all terms.",
        "policy_changes",
    ),
    (
        "broad.*license",
        25,
        "You grant them a broad, possibly unlimited license to your content/data.",
        "data_collection",
    ),
    (
        "worldwide.*license",
        25,
        "They get a worldwide license to your content with no geographic limits.",
        "data_collection",
    ),
    (
        "irrevocable",
        30,
        "The license or consent you give is irrevocable - you cannot take it back.",
        "user_rights",
    ),
    (
        "nonexclusive license",
        20,
        "They get a non-exclusive license to use your content/data.",
        "data_collection",
    ),
    (
        "sublicense",
        25,
        "They can grant your data/content rights to other companies.",
        "data_sharing",
    ),
    (
        "aggregated.*anonymized",
        10,
        "They create aggregated/anonymized data profiles - unclear if truly anonymized.",
        "data_collection",
    ),
    (
        "device information",
        18,
        "They collect detailed device information (IMEI, MAC address, device ID).",
        "data_collection",
    ),
    (
        "location data",
        20,
        "They collect your location data.",
        "data_collection",
    ),
    (
        "precise location",
        25,
        "They collect precise/GPS-level location data.",
        "data_collection",
    ),
    (
        "browsing history",
        20,
        "They track and store your browsing history.",
        "data_collection",
    ),
    (
        "keystroke",
        35,
        "They may monitor your keystrokes or typing patterns.",
        "data_collection",
    ),
    (
        "screen recording",
        35,
        "They may record your screen activity.",
        "data_collection",
    ),
    (
        "audio recording",
        35,
        "They may record audio through your device.",
        "data_collection",
    ),
    (
        "video recording",
        35,
        "They may capture video through your device.",
        "data_collection",
    ),

    # MEDIUM (8-14 points)
    # NOTE: Very common patterns get lower scores since nearly every site uses them
    (
        "cookies",
        5,
        "The service uses cookies to track you. (Very common - almost all websites do this)",
        "cookies_tracking",
    ),
    (
        "tracking technologies",
        12,
        "They use various tracking technologies beyond basic cookies.",
        "cookies_tracking",
    ),
    (
        "web beacons",
        10,
        "They use invisible tracking pixels/beacons.",
        "cookies_tracking",
    ),
    (
        "pixel tags",
        10,
        "They use pixel tags to track email opens and page views.",
        "cookies_tracking",
    ),
    (
        "fingerprint",
        15,
        "They use device fingerprinting to identify you across sessions.",
        "cookies_tracking",
    ),
    (
        "retargeting",
        12,
        "They use retargeting to follow you across the internet with ads.",
        "cookies_tracking",
    ),
    (
        "interest.based",
        12,
        "They create interest-based advertising profiles from your data.",
        "cookies_tracking",
    ),
    (
        "service providers",
        5,
        "Your data is shared with unnamed 'service providers'. (Standard practice, but vague)",
        "data_sharing",
    ),
    (
        "data processors",
        10,
        "Third-party data processors handle your personal information.",
        "data_sharing",
    ),
    (
        "reasonable measures",
        8,
        "They claim 'reasonable measures' for security - vague and unverifiable.",
        "security",
    ),
    (
        "best efforts",
        8,
        "Security is based on 'best efforts' - no guaranteed protection.",
        "security",
    ),
    (
        "no guarantee.*security",
        15,
        "They explicitly state they cannot guarantee the security of your data.",
        "security",
    ),
    (
        "opt.out",
        10,
        "Opt-out model: you must actively leave rather than being asked to join.",
        "user_rights",
    ),
    (
        "may change.*without notice",
        15,
        "They can change the policy without notifying you.",
        "policy_changes",
    ),
    (
        "material changes",
        10,
        "Only 'material' changes trigger notification - minor changes go unnoticed.",
        "policy_changes",
    ),
    (
        "court of competent jurisdiction",
        10,
        "Legal disputes may require going to a specific (possibly distant) court.",
        "jurisdiction",
    ),
    (
        "not responsible for.*content",
        12,
        "They disclaim responsibility for third-party content on their platform.",
        "security",
    ),

    # LOW/INFO (3-7 points - still worth noting)
    (
        "you can opt out",
        5,
        "Opt-out is available but requires action on your part.",
        "user_rights",
    ),
    (
        "contact us",
        3,
        "Contact information is provided for privacy inquiries.",
        "contact_info",
    ),
    (
        "reasonable security",
        5,
        "They implement 'reasonable' security measures (vague standard).",
        "security",
    ),
    (
        "encrypt",
        3,
        "They use encryption to protect your data.",
        "security",
    ),
]

# Vague language patterns that hide unfavorable terms
VAGUE_PATTERNS = [
    ("may", "Could mean they sometimes do, sometimes don't - no firm commitment."),
    ("might", "Indicates possibility without commitment."),
    ("could", "Non-committal language - they CAN do this but don't guarantee it."),
    ("from time to time", "Unspecified frequency - could happen anytime."),
    ("as needed", "No defined criteria for when this happens."),
    ("as necessary", "Vague - they decide what's 'necessary'."),
    ("at our discretion", "Entirely their choice with no accountability."),
    ("in our sole judgment", "No external oversight or criteria."),
    ("including but not limited to", "Open-ended list - they can include anything."),
    ("such as", "Examples given are not exhaustive - more may apply."),
    ("for any purpose", "Extremely broad - data can be used however they want."),
    ("any other purpose", "Catch-all that negates specificity of listed purposes."),
    ("as permitted by law", "They'll do the maximum the law allows."),
    ("to the extent permitted", "They take every legal opening."),
    ("other purposes", "Unspecified additional uses for your data."),
    ("internal purposes", "Vague - could include profiling, analytics, anything."),
    ("legitimate business interests", "Their definition of 'legitimate' is not defined."),
    ("operational purposes", "Broad catch-all for unspecified uses."),
    ("security purposes", "Often used as pretext for surveillance."),
    ("fraud prevention", "Often used to justify extensive data collection."),
]

# Opt-out vs Opt-in detection patterns
OPT_OUT_PATTERNS = [
    ("you may opt out", "opt_out"),
    ("you can opt out", "opt_out"),
    ("you may unsubscribe", "opt_out"),
    ("to opt out", "opt_out"),
    ("opt out of", "opt_out"),
    ("unsubscribe from", "opt_out"),
    ("adjust your settings", "opt_out"),
    ("modify your preferences", "opt_out"),
    ("you may disable", "opt_out"),
]

OPT_IN_PATTERNS = [
    ("we will ask", "opt_in"),
    ("we will obtain", "opt_in"),
    ("we require your consent", "opt_in"),
    ("before collecting", "opt_in"),
    ("with your permission", "opt_in"),
    ("explicitly consent", "opt_in"),
    ("affirmative consent", "opt_in"),
    ("opt in to", "opt_in"),
]

# Critical missing sections
MISSING_SECTION_FLAGS = [
    (
        "data_retention",
        "No data retention policy found",
        "WARNING: This policy doesn't explain how long they keep your data. They may retain it indefinitely.",
        15,
    ),
    (
        "contact_info",
        "No contact information found",
        "WARNING: There's no way to contact them about privacy concerns. This is a red flag.",
        15,
    ),
    (
        "user_rights",
        "No user rights section found",
        "WARNING: This policy doesn't mention your rights to access, delete, or control your data.",
        20,
    ),
    (
        "security",
        "No security measures described",
        "WARNING: No information about how they protect your data.",
        10,
    ),
    (
        "children_privacy",
        "No children's privacy protection",
        "INFO: No mention of protecting children's data. May not comply with COPPA.",
        5,
    ),
]

# Patterns indicating the policy date/last updated
DATE_PATTERNS = [
    r"last (?:updated|modified|revised|changed)\s*[:;]?\s*([A-Z][a-z]+ \d{1,2},? \d{4})",
    r"last (?:updated|modified|revised|changed)\s*[:;]?\s*(\d{1,2}[/-]\d{1,2}[/-]\d{2,4})",
    r"effective (?:date|day)\s*[:;]?\s*([A-Z][a-z]+ \d{1,2},? \d{4})",
    r"effective (?:date|day)\s*[:;]?\s*(\d{1,2}[/-]\d{1,2}[/-]\d{2,4})",
    r"as of\s*[:;]?\s*([A-Z][a-z]+ \d{1,2},? \d{4})",
    r"updated?\s+on\s*[:;]?\s*([A-Z][a-z]+ \d{1,2},? \d{4})",
    r"revised?\s+on\s*[:;]?\s*([A-Z][a-z]+ \d{1,2},? \d{4})",
    r"date\s*[:;]?\s*(\d{1,2}[/-]\d{1,2}[/-]\d{2,4})",
    r"date\s*[:;]?\s*(\w+\s+\d{1,2},?\s+\d{4})",
]

# Words that suggest data collection without consent
SILENT_COLLECTION_PATTERNS = [
    "automatically collect",
    "automatically gather",
    "automatically track",
    "collected without",
    "passively collect",
    "silently",
    "in the background",
    "without your knowledge",
    "without your consent",
    "even if you do not",
    "regardless of your settings",
]