/* tunnelops — the policy pages.
 *
 * The landing page carries its CSS inline: it is one file on purpose, it is the
 * page that has to render on the first paint, and it was delivered that way. This
 * stylesheet is for the documents beside it — /terms, /privacy, /app and the 404 —
 * which are long-form prose rather than a landing page and would otherwise
 * duplicate a thousand lines of grid and calculator CSS to use forty of it.
 *
 * ─────────────────────────────────────────────────────────────────────────────
 * IT NO LONGER CARRIES ITS OWN TOKENS
 * ─────────────────────────────────────────────────────────────────────────────
 *
 * It used to. The head of this file was a :root block with forty-odd declarations
 * copied verbatim out of the landing page, with a comment saying that if a token
 * changed there it had to change here too. That is a promise a file cannot keep:
 * the first edit to a colour on the front page would have left /terms and /privacy
 * on the old one, and nothing would have said so.
 *
 * The values now come from web/static/css/tokens.css, which the pages link ahead of
 * this file. Every page that uses this stylesheet must link both, in that order.
 *
 * The one thing still declared here is the pair of spacing values these pages take
 * differently from the landing page — see the RESPONSIVE section at the bottom,
 * which explains why the difference is kept rather than resolved.
 *
 * There are no colour literals in this file. A new colour is a token first and a
 * use second, the same rule the landing page follows, and internal/landing's
 * TestThePolicyPagesHaveNoColourOfTheirOwn is what enforces it. The sizes are still
 * literals: they are this stylesheet's own typography rather than a scale shared
 * with anything, and moving them would be a change to how the pages look dressed up
 * as a refactor.
 */

/* ============================================================
   BASE
   ============================================================ */
*,*::before,*::after{box-sizing:border-box}
html{scroll-behavior:smooth}
body{margin:0;background:var(--paper);color:var(--ink);font-family:var(--f-body);
  font-size:15px;line-height:1.55;-webkit-font-smoothing:antialiased;overflow-x:hidden}
.wrap{width:100%;padding-left:var(--gut);padding-right:var(--gut)}
h1,h2,h3{font-family:var(--f-dsp);font-weight:800;margin:0;letter-spacing:-.042em;line-height:1.05}
h4,h5{margin:0;font-weight:600}
p{margin:0}
a{color:inherit;text-decoration:none}
dl,dd{margin:0}
/* 13px is the text floor. The eyebrow was 10.5px; at 13px the same word is ~24%
   wider, so the tracking comes down from .19em to .12em — the longest one here,
   "ACCEPTABLE USE POLICY", still takes one line inside the gutter at 380px. The
   same pair of numbers as the landing page's .eyebrow. */
.eyebrow{font-family:var(--f-mono);font-size:13px;font-weight:500;letter-spacing:.12em;
  text-transform:uppercase;color:var(--petrol)}

/* buttons — only the two variants these pages use */
/* min-height is --tap, the 44px pointer floor: the padding alone came to 40px on
   a .btn and 31px on the nav's .btn-sm. */
.btn{display:inline-flex;align-items:center;justify-content:center;gap:8px;padding:12px 20px;
  min-height:var(--tap);
  border-radius:var(--r);font-family:var(--f-body);font-size:14px;font-weight:600;cursor:pointer;
  border:1px solid transparent;transition:background .18s,border-color .18s,color .18s;
  white-space:nowrap;line-height:1}
.btn-primary{background:var(--petrol);color:var(--white);border-color:var(--petrol)}
.btn-primary:hover{background:var(--petrol-d);border-color:var(--petrol-d)}
.btn-ghost{background:transparent;color:var(--ink);border-color:var(--line-2)}
.btn-ghost:hover{border-color:var(--ink)}
.btn-sm{padding:8px 14px;font-size:13px}
.btn-signal{background:var(--signal);color:var(--signal-ink);border-color:var(--signal)}
.btn-signal:hover{background:var(--signal-h);border-color:var(--signal-h)}

/* ============================================================
   NAV — the landing page's
   ============================================================ */
.nav{position:sticky;top:0;z-index:900;background:var(--nav-bg);
  backdrop-filter:blur(18px) saturate(170%);-webkit-backdrop-filter:blur(18px) saturate(170%);
  border-bottom:1px solid var(--line);box-shadow:var(--sh-nav)}
.nav-in{display:flex;align-items:center;gap:26px;height:56px}
/* A 26px image in a link is a 26px target, and it is the way home from every
   document. The image keeps its size; the link grows around it. */
.brand{display:flex;align-items:center;flex:none;line-height:0;min-height:var(--tap)}
.brand img{height:26px;width:auto;display:block}
.nav-links{display:flex;gap:2px;margin-right:auto}
.nav-links a{display:flex;align-items:center;min-height:var(--tap);
  font-size:13.5px;color:var(--muted);padding:7px 11px;border-radius:var(--r);
  transition:color .18s,background .18s}
.nav-links a:hover{color:var(--ink);background:var(--paper-2)}
.nav-links a[aria-current]{color:var(--ink);background:var(--paper-2)}
/* The language chooser sits inside .nav-links, so its three anchors take the
   padding and the 44px floor above — but only once they are laid out. Without a
   display of its own the <nav> is a block and the links inside it are inline
   boxes, which ignore min-height and measured 30px. The declarations are the ones
   components.css gives .langswitch, so the public pages and the cabinet agree. */
.langswitch{display:flex;align-items:center;gap:6px;flex:none}
.nav-sep{width:1px;height:18px;background:var(--line);flex:none}
.nav-act{display:flex;gap:6px;align-items:center;flex:none}
.nav-login{display:flex;align-items:center;min-height:var(--tap);
  font-size:13.5px;color:var(--muted);padding:7px 11px;border-radius:var(--r);
  transition:color .18s,background .18s}
.nav-login:hover{color:var(--ink);background:var(--paper-2)}

/* ============================================================
   DOCUMENT
   ============================================================ */
.doc-head{background:var(--ink);color:var(--white);padding:46px 0 40px}
.doc-head .eyebrow{color:var(--signal)}
.doc-head h1{font-size:clamp(26px,3.2vw,42px);margin:12px 0 0;max-width:26ch}
.doc-meta{display:flex;gap:10px 28px;flex-wrap:wrap;margin-top:20px;
  font-family:var(--f-mono);font-size:13px;color:var(--d-muted)}
.doc-meta b{color:var(--d-bright);font-weight:600}
/* The one link in the metadata row — a mailto in "Questions: legal@…". It is a
   row of labels rather than a sentence, so the address takes the 44px floor the
   same way the footer's links do. */
.doc-meta a{display:inline-flex;align-items:center;min-height:var(--tap)}
.doc-sub{color:var(--d-body-2);font-size:14.5px;max-width:70ch;margin-top:16px}

/* One column, the document centred to a readable measure of 60–75 characters. The
   contents sit on top — where somebody arriving from a footer link looks for one
   paragraph, usually the retention period or the abuse address — rather than in a
   sidebar. The sidebar was worse than no design: its grid handed the wide column to
   the contents and crushed the text of the document itself into 250px. */
/* Only the vertical padding here: the shorthand used to be padding:44px 0, which
   zeroed the gutter .wrap sets on the sides and pushed the body text against the
   phone's edge — the "no mobile adaptation" this rework is about. */
.doc-body{padding-top:44px;padding-bottom:var(--sec)}
.doc-main{max-width:68ch;margin:0 auto}

.doc-toc{max-width:68ch;margin:0 auto 28px;padding-bottom:22px;
  border-bottom:1px solid var(--line);font-size:13px}
.doc-toc h2{font-family:var(--f-mono);font-size:13px;font-weight:500;letter-spacing:.12em;
  text-transform:uppercase;color:var(--faint);margin-bottom:12px}
.doc-toc ol{list-style:none;margin:0;padding:0;counter-reset:toc;columns:2;column-gap:28px}
.doc-toc li{counter-increment:toc;margin-bottom:2px;break-inside:avoid}
/* 12px of vertical padding round a 13px line is 44px, the pointer floor. It stays
   display:block rather than becoming a flex box, because ::before is the item
   number and a flex container would eat the space after the full stop. */
.doc-toc a{display:block;padding:12px 10px;border-radius:var(--r);color:var(--muted);
  border-left:2px solid var(--line);transition:color .18s,background .18s,border-color .18s}
.doc-toc a::before{content:counter(toc) '. ';color:var(--faint);font-family:var(--f-mono);
  font-size:13px}
.doc-toc a:hover{color:var(--ink);background:var(--surface);border-left-color:var(--petrol)}

.doc-main section{padding-top:30px;scroll-margin-top:72px}
.doc-main section:first-child{padding-top:0}
.doc-main h2{font-size:clamp(19px,1.7vw,24px);margin-bottom:12px}
.doc-main h2 .n{font-family:var(--f-mono);font-size:13px;font-weight:600;color:var(--petrol);
  display:block;letter-spacing:.14em;margin-bottom:7px;letter-spacing:.14em}
.doc-main h3{font-size:16px;font-weight:700;letter-spacing:-.02em;margin:22px 0 8px}
.doc-main p{margin-bottom:11px;color:var(--slate)}
.doc-main p:last-child{margin-bottom:0}
.doc-main a:not(.btn){color:var(--petrol);text-decoration:underline;
  text-decoration-color:var(--petrol-l);text-underline-offset:2px}
.doc-main a:not(.btn):hover{text-decoration-color:var(--petrol)}
.doc-main ul,.doc-main ol{margin:0 0 12px;padding-left:20px;color:var(--slate)}
.doc-main li{margin-bottom:6px}
.doc-main li>b{color:var(--ink)}
.doc-main code{font-family:var(--f-code);font-size:13px;background:var(--paper-2);
  padding:2px 5px;border-radius:var(--r-s)}

/* A card, for the paragraphs somebody has to be able to find in five seconds:
   what we log, how long we keep it, where to send an abuse report. */
.card{background:var(--surface);border:1px solid var(--line);border-radius:var(--r);
  padding:20px 22px;margin:16px 0}
.card--stop{border-left:3px solid var(--stop);background:var(--stop-s)}
.card--note{border-left:3px solid var(--petrol);background:var(--petrol-s)}
.card h3{margin-top:0}
.card p:last-child{margin-bottom:0}

/* The permitted / forbidden pair. Two columns where there is room, and the
   forbidden side is not a shorter version of the permitted one — it is the list
   that gets somebody disconnected, so it is the one that reads as a list. */
.rules{display:grid;grid-template-columns:repeat(auto-fit,minmax(280px,1fr));gap:16px;
  margin:16px 0}
.rule{background:var(--surface);border:1px solid var(--line);border-radius:var(--r);
  padding:20px 22px}
.rule--yes{border-top:3px solid var(--petrol)}
.rule--no{border-top:3px solid var(--stop)}
.rule h3{margin:0 0 10px;font-size:15px}
.rule ul{list-style:none;padding:0;margin:0;font-size:14px}
.rule li{position:relative;padding-left:20px;margin-bottom:7px;color:var(--slate)}
.rule--yes li::before{content:'';position:absolute;left:2px;top:8px;width:7px;height:7px;
  border-radius:50%;background:var(--petrol)}
.rule--no li::before{content:'';position:absolute;left:2px;top:9px;width:9px;height:1.5px;
  background:var(--stop)}

/* Retention, as a table. It is the fact people come to a privacy page for and it
   should not be buried in a paragraph. */
.retain{width:100%;border-collapse:collapse;margin:16px 0;font-size:14px}
.retain th,.retain td{text-align:left;padding:11px 14px;border-bottom:1px solid var(--line);
  vertical-align:top}
.retain th{font-family:var(--f-mono);font-size:13px;font-weight:500;letter-spacing:.08em;
  text-transform:uppercase;color:var(--faint);border-bottom-color:var(--line-2)}
.retain td:first-child{font-weight:600;color:var(--ink);white-space:nowrap}
.retain td:last-child{font-family:var(--f-mono);font-variant-numeric:tabular-nums;
  white-space:nowrap;color:var(--ink)}
.retain tr:last-child td{border-bottom:0}
.retain-wrap{overflow-x:auto}

/* ============================================================
   FOOTER — the landing page's
   ============================================================ */
.foot{background:var(--ink-2);color:var(--d-muted);border-top:1px solid var(--d-line);padding-top:26px}
.foot-top{display:flex;align-items:center;gap:14px 40px;flex-wrap:wrap;padding-bottom:28px}
.foot .brand img{height:22px}
.foot-nav{display:flex;gap:26px;flex-wrap:wrap;margin-right:auto}
.foot-nav a{font-size:13.5px}
.foot-mail{display:flex;gap:20px;font-family:var(--f-mono);font-size:13px;flex-wrap:wrap}
/* Every link in the footer, once — the brand, the nav, the mail addresses and the
   two inside the legal sentence. They were 15px to 22px on their short side: one
   line of text and nothing else. The legal pair are real inline boxes, which
   ignore a min-height, so each link is made an atomic inline-flex box instead; the
   line box then grows to hold it, which is what gives the row its height. The rows
   keep their own gaps, so a wrapped footer nav on a phone goes from four 21px rows
   to four 44px rows and not to twelve.
   min-width for the same reason on the other axis: "FAQ" is 26px wide, and the
   floor is the *short* side. Same rule as the landing page's footer. */
.foot a{transition:color .18s;display:inline-flex;align-items:center;justify-content:center;
  min-height:var(--tap);min-width:var(--tap)}
.foot a:hover{color:var(--signal)}
.foot-legal{border-top:1px solid var(--d-line);padding-top:15px;padding-bottom:24px;display:flex;
  justify-content:space-between;gap:14px;flex-wrap:wrap;font-size:13px;color:var(--d-dim-2)}
.foot-attrib{border-top:0;padding-top:0;padding-bottom:26px;font-size:13px;color:var(--d-dim-3);
  max-width:88ch}
.foot-attrib a{text-decoration:underline;text-decoration-color:var(--d-rule);text-underline-offset:2px}

/* ============================================================
   NOT FOUND
   ============================================================ */
.gone{min-height:56vh;display:flex;flex-direction:column;align-items:flex-start;
  justify-content:center;padding:var(--sec) 0;gap:16px}
.gone .code{font-family:var(--f-mono);font-size:13px;font-weight:500;letter-spacing:.14em;
  text-transform:uppercase;color:var(--faint)}
.gone h1{font-size:clamp(26px,3.4vw,44px);max-width:24ch}
.gone p{color:var(--muted);max-width:56ch}
.gone .acts{display:flex;gap:10px;flex-wrap:wrap;margin-top:6px}

/* ============================================================
   RESPONSIVE
   ============================================================

   THE TWO VALUES THESE PAGES TAKE DIFFERENTLY, AND WHY THEY ARE STILL HERE.

   tokens.css shrinks --gut and --sec at 1080px and again at 600px, and these
   pages were built with slightly different numbers at both:

                       tokens.css        these pages
       ≤1080px   --sec      42px               44px
        ≤600px   --gut      16px               18px
        ≤600px   --sec      34px               44px   (never shrunk twice)

   Nothing about that is principled — the two files were written at different
   times by different hands — and the tidy thing would be to delete this block and
   let the policy pages take the design system's numbers. That is a two-pixel
   change to the gutter and a ten-pixel change to the section rhythm on a phone,
   which is small, visible, and a decision about how the pages look rather than
   about how the stylesheet is organised. Moving these pages onto the shared tokens
   was supposed to change no pixel, so it changes no pixel: the difference is
   written down here, in one place, where the next person can delete it on purpose.

   These declarations only work because tokens.css is linked *before* this file:
   same selector, same specificity, later one wins. Every page using this
   stylesheet links both in that order, and internal/landing checks that they do. */
@media (max-width:1080px){
  :root{--sec:44px}
}
@media (max-width:820px){
  .nav-links{display:none}
  .nav-sep{display:none}
  /* The landing page hides this at the same width (see index.html's own
     @media(max-width:820px)); these pages never did, and "Log in" plus the
     primary button are just wide enough together to scroll the page sideways
     at 380px — two-odd pixels, invisible until measured, still a horizontal
     scrollbar. */
  .nav-login{display:none}
}
@media (max-width:600px){
  /* --sec is named again even though the 1080px block above already sets it to
     44px, and it is worth saying why rather than deleting it as a duplicate.
     Below 600px four :root blocks match at once — tokens.css's two and this
     file's two — and which value wins is decided purely by document order, not by
     how narrow the media query is. It happens to come out at 44px without this
     line, because this file's 1080px block is later in the document than
     tokens.css's 600px block. That is a fact about the order the two stylesheets
     are linked in and nothing else, and it would quietly become 34px the day
     somebody moved a <link>. Naming the value here makes it a fact about this
     file. */
  :root{--gut:18px;--sec:44px}
  .doc-toc ol{columns:1}
  .doc-head{padding:34px 0 30px}
}
/* ============================================================
   THE FOCUS RING, AND THE ONE TAP TARGET STILL UNDER THE FLOOR
   ============================================================ */

/* One ring for the whole product: the same declaration components.css makes and
   the landing page makes, down to the token, so a keyboard user does not have to
   learn a second visual language on the way from /terms to the cabinet. These
   pages had no rule of their own and were relying on whatever the browser draws.

   It sits at the end of the file so nothing later can outrank it. */
:focus-visible{outline:var(--bw-tab) solid var(--signal);outline-offset:2px}

/* THE LINKS IN THE PROSE ARE DELIBERATELY NOT 44px.
   Every control on these pages is at or above the pointer floor except one class:
   an <a> inside a sentence in .doc-main, .doc-sub or a .rule list, which is 17px
   to 18px tall because that is the height of the line it is set in. Reaching 44px
   there means ~13px of padding above and below the link, and with a 23px line the
   hit area of a link would then cover most of the line above and below it — a
   click on plain text would follow a link. WCAG 2.5.8 excludes a target "in a
   sentence" for the same reason. The screenshot pass enumerates them, so they are
   counted rather than forgotten, the way components.css counts .btn--sm in a
   dense table row. */

@media (prefers-reduced-motion:reduce){*{animation:none!important;transition-duration:.001ms!important}}
