fyp

app/i18n/email_translations.py

@@ -22,6 +22,20 @@ EMAIL_TRANSLATIONS = {
         "otp_reset_expiry": "This code will expire in 15 minutes.",
         "otp_reset_footer": "If you didn't request a password reset, please ignore this email and your password will remain unchanged.",
         "otp_reset_brand": "Lojiz - Find Your Perfect Home",
+
+        # Email Update OTP
+        "otp_email_update_subject": "Verify Your New Email Address",
+        "otp_email_update_greeting": "Hello!",
+        "otp_email_update_message": "You requested to update your email address on Lojiz. Please use the verification code below to confirm this change:",
+        "otp_email_update_expiry": "This code will expire in 15 minutes.",
+        "otp_email_update_footer": "If you didn't request this change, please ignore this email. Your account email will not be changed.",
+
+        # Phone Update OTP (sent via email)
+        "otp_phone_update_subject": "Verify Your New Phone Number",
+        "otp_phone_update_greeting": "Hello!",
+        "otp_phone_update_message": "You requested to update your phone number on Lojiz. Please use the verification code below to confirm this change:",
+        "otp_phone_update_expiry": "This code will expire in 15 minutes.",
+        "otp_phone_update_footer": "If you didn't request this change, please ignore this email. Your phone number will not be changed.",
     },
 
     "fr": {
@@ -42,6 +56,20 @@ EMAIL_TRANSLATIONS = {
         "otp_reset_expiry": "Ce code expirera dans 15 minutes.",
         "otp_reset_footer": "Si vous n'avez pas demandé de réinitialisation de mot de passe, veuillez ignorer cet e-mail et votre mot de passe restera inchangé.",
         "otp_reset_brand": "Lojiz - Trouvez votre maison parfaite",
+
+        # Email Update OTP
+        "otp_email_update_subject": "Vérifiez votre nouvelle adresse e-mail",
+        "otp_email_update_greeting": "Bonjour !",
+        "otp_email_update_message": "Vous avez demandé à modifier votre adresse e-mail sur Lojiz. Veuillez utiliser le code ci-dessous pour confirmer ce changement :",
+        "otp_email_update_expiry": "Ce code expirera dans 15 minutes.",
+        "otp_email_update_footer": "Si vous n'avez pas demandé ce changement, veuillez ignorer cet e-mail.",
+
+        # Phone Update OTP
+        "otp_phone_update_subject": "Vérifiez votre nouveau numéro de téléphone",
+        "otp_phone_update_greeting": "Bonjour !",
+        "otp_phone_update_message": "Vous avez demandé à modifier votre numéro de téléphone sur Lojiz. Veuillez utiliser le code ci-dessous pour confirmer ce changement :",
+        "otp_phone_update_expiry": "Ce code expirera dans 15 minutes.",
+        "otp_phone_update_footer": "Si vous n'avez pas demandé ce changement, veuillez ignorer cet e-mail.",
     },
 
     "es": {
@@ -62,6 +90,20 @@ EMAIL_TRANSLATIONS = {
         "otp_reset_expiry": "Este código expirará en 15 minutos.",
         "otp_reset_footer": "Si no solicitaste un restablecimiento de contraseña, por favor ignora este correo y tu contraseña permanecerá sin cambios.",
         "otp_reset_brand": "Lojiz - Encuentra tu hogar perfecto",
+
+        # Email Update OTP
+        "otp_email_update_subject": "Verifica tu nueva dirección de correo",
+        "otp_email_update_greeting": "¡Hola!",
+        "otp_email_update_message": "Solicitaste actualizar tu dirección de correo en Lojiz. Usa el código a continuación para confirmar el cambio:",
+        "otp_email_update_expiry": "Este código expirará en 15 minutos.",
+        "otp_email_update_footer": "Si no solicitaste este cambio, ignora este correo.",
+
+        # Phone Update OTP
+        "otp_phone_update_subject": "Verifica tu nuevo número de teléfono",
+        "otp_phone_update_greeting": "¡Hola!",
+        "otp_phone_update_message": "Solicitaste actualizar tu número de teléfono en Lojiz. Usa el código a continuación para confirmar el cambio:",
+        "otp_phone_update_expiry": "Este código expirará en 15 minutos.",
+        "otp_phone_update_footer": "Si no solicitaste este cambio, ignora este correo.",
     },
 
     "ar": {
@@ -82,6 +124,20 @@ EMAIL_TRANSLATIONS = {
         "otp_reset_expiry": "سينتهي صلاحية هذا الرمز خلال 15 دقيقة.",
         "otp_reset_footer": "إذا لم تطلب إعادة تعيين كلمة المرور، يرجى تجاهل هذا البريد الإلكتروني وستبقى كلمة مرورك دون تغيير.",
         "otp_reset_brand": "Lojiz - اعثر على منزلك المثالي",
+
+        # Email Update OTP
+        "otp_email_update_subject": "تحقق من عنوان بريدك الإلكتروني الجديد",
+        "otp_email_update_greeting": "مرحباً!",
+        "otp_email_update_message": "لقد طلبت تحديث عنوان بريدك الإلكتروني على Lojiz. يرجى استخدام رمز التحقق أدناه لتأكيد هذا التغيير:",
+        "otp_email_update_expiry": "سينتهي صلاحية هذا الرمز خلال 15 دقيقة.",
+        "otp_email_update_footer": "إذا ل�� تطلب هذا التغيير، يرجى تجاهل هذا البريد الإلكتروني.",
+
+        # Phone Update OTP
+        "otp_phone_update_subject": "تحقق من رقم هاتفك الجديد",
+        "otp_phone_update_greeting": "مرحباً!",
+        "otp_phone_update_message": "لقد طلبت تحديث رقم هاتفك على Lojiz. يرجى استخدام رمز التحقق أدناه لتأكيد هذا التغيير:",
+        "otp_phone_update_expiry": "سينتهي صلاحية هذا الرمز خلال 15 دقيقة.",
+        "otp_phone_update_footer": "إذا لم تطلب هذا التغيير، يرجى تجاهل هذا البريد الإلكتروني.",
     },
 
     "pt": {
@@ -102,6 +158,20 @@ EMAIL_TRANSLATIONS = {
         "otp_reset_expiry": "Este código expirará em 15 minutos.",
         "otp_reset_footer": "Se você não solicitou uma redefinição de senha, por favor ignore este e-mail e sua senha permanecerá inalterada.",
         "otp_reset_brand": "Lojiz - Encontre sua casa perfeita",
+
+        # Email Update OTP
+        "otp_email_update_subject": "Verifique seu novo endereço de e-mail",
+        "otp_email_update_greeting": "Olá!",
+        "otp_email_update_message": "Você solicitou a atualização do seu endereço de e-mail no Lojiz. Use o código abaixo para confirmar a alteração:",
+        "otp_email_update_expiry": "Este código expirará em 15 minutos.",
+        "otp_email_update_footer": "Se você não solicitou esta alteração, ignore este e-mail.",
+
+        # Phone Update OTP
+        "otp_phone_update_subject": "Verifique seu novo número de telefone",
+        "otp_phone_update_greeting": "Olá!",
+        "otp_phone_update_message": "Você solicitou a atualização do seu número de telefone no Lojiz. Use o código abaixo para confirmar a alteração:",
+        "otp_phone_update_expiry": "Este código expirará em 15 minutos.",
+        "otp_phone_update_footer": "Se você não solicitou esta alteração, ignore este e-mail.",
     },
 }
 

app/routes/contact_update.py

@@ -0,0 +1,430 @@
+# ============================================================
+# app/routes/contact_update.py - Update Email & Phone with OTP
+# ============================================================
+
+import logging
+from fastapi import APIRouter, HTTPException, status, Depends, Request
+from pydantic import BaseModel, EmailStr, Field
+from typing import Optional
+from app.middleware import limiter, AUTH_RATE_LIMIT
+from app.guards.jwt_guard import get_current_user
+from app.services.otp_service import otp_service
+from app.database import get_db
+from app.core.rate_limiter import get_rate_limiter, RateLimitExceeded
+from datetime import datetime
+
+router = APIRouter(tags=["Contact Update"])
+logger = logging.getLogger(__name__)
+
+
+# ============================================================
+# DTOs
+# ============================================================
+
+class SendEmailOtpDto(BaseModel):
+    """Request OTP to update email"""
+    new_email: EmailStr
+    language: str = Field(default="en", pattern="^(en|fr|es|ar|pt)$")
+
+
+class VerifyEmailOtpDto(BaseModel):
+    """Verify OTP and update email"""
+    new_email: EmailStr
+    code: str = Field(..., min_length=6, max_length=6)
+    language: str = Field(default="en", pattern="^(en|fr|es|ar|pt)$")
+
+
+class SendPhoneOtpDto(BaseModel):
+    """Request OTP to update phone"""
+    new_phone: str = Field(..., min_length=5, max_length=20)
+    language: str = Field(default="en", pattern="^(en|fr|es|ar|pt)$")
+
+
+class VerifyPhoneOtpDto(BaseModel):
+    """Verify OTP and update phone"""
+    new_phone: str = Field(..., min_length=5, max_length=20)
+    code: str = Field(..., min_length=6, max_length=6)
+    language: str = Field(default="en", pattern="^(en|fr|es|ar|pt)$")
+
+
+# ============================================================
+# RATE LIMITING HELPER
+# ============================================================
+
+async def check_contact_rate_limit(identifier: str, operation: str, request: Request):
+    """Check rate limit for contact update operations"""
+    rate_limiter = get_rate_limiter()
+    allowed, info = await rate_limiter.is_allowed(
+        user_id=identifier,
+        operation=operation,
+        ip_address=request.client.host if request.client else None,
+    )
+    if not allowed:
+        raise HTTPException(
+            status_code=status.HTTP_429_TOO_MANY_REQUESTS,
+            detail=f"Too many {operation} attempts. Please try again later.",
+            headers={"Retry-After": str(info.get("user", {}).get("reset_in", 60))},
+        )
+
+
+# ============================================================
+# EMAIL UPDATE ENDPOINTS
+# ============================================================
+
+@router.post("/email/send-otp", status_code=status.HTTP_200_OK)
+@limiter.limit(AUTH_RATE_LIMIT)
+async def send_email_update_otp(
+    dto: SendEmailOtpDto,
+    request: Request,
+    current_user: dict = Depends(get_current_user),
+):
+    """
+    Step 1: Send OTP to new email address.
+    Requires authentication. Checks that the new email is not already in use.
+    """
+    user_id = current_user.get("user_id")
+    new_email = dto.new_email.lower()
+
+    logger.info(f"Email update OTP requested by user {user_id} for {new_email}")
+
+    db = await get_db()
+    users_collection = db["users"]
+
+    # Check if new email is same as current
+    current_email = current_user.get("email", "")
+    if current_email and current_email.lower() == new_email:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="New email is the same as your current email.",
+        )
+
+    # Check if email already taken by another user
+    existing = await users_collection.find_one({"email": new_email})
+    if existing:
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT,
+            detail="This email is already registered to another account.",
+        )
+
+    # Send OTP to the NEW email
+    try:
+        await otp_service.send_otp(new_email, "email_update", dto.language)
+    except Exception as e:
+        logger.error(f"Failed to send email update OTP: {e}")
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail="Failed to send verification email. Please try again.",
+        )
+
+    return {
+        "success": True,
+        "message": "Verification code sent to your new email address.",
+        "data": {"email": new_email},
+    }
+
+
+@router.post("/email/verify-otp", status_code=status.HTTP_200_OK)
+async def verify_email_update_otp(
+    dto: VerifyEmailOtpDto,
+    request: Request,
+    current_user: dict = Depends(get_current_user),
+):
+    """
+    Step 2: Verify OTP and update email.
+    On success, updates the user's email in the database.
+    """
+    user_id = current_user.get("user_id")
+    new_email = dto.new_email.lower()
+
+    await check_contact_rate_limit(user_id, "verify_email_otp", request)
+
+    logger.info(f"Email update OTP verification by user {user_id} for {new_email}")
+
+    # Verify OTP
+    await otp_service.verify_otp(new_email, dto.code, "email_update", dto.language)
+
+    db = await get_db()
+    users_collection = db["users"]
+
+    # Double-check email not taken (race condition guard)
+    existing = await users_collection.find_one({"email": new_email})
+    if existing and str(existing["_id"]) != user_id:
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT,
+            detail="This email was just registered by another account.",
+        )
+
+    # Update user email
+    from bson import ObjectId
+    await users_collection.update_one(
+        {"_id": ObjectId(user_id)},
+        {
+            "$set": {
+                "email": new_email,
+                "isEmailVerified": True,
+                "updatedAt": datetime.utcnow(),
+            }
+        },
+    )
+
+    # Clean up OTP
+    await otp_service.delete_otp(new_email, "email_update")
+
+    logger.info(f"Email updated successfully for user {user_id}: {new_email}")
+
+    return {
+        "success": True,
+        "message": "Email updated successfully!",
+        "data": {"email": new_email},
+    }
+
+
+@router.post("/email/resend-otp", status_code=status.HTTP_200_OK)
+@limiter.limit(AUTH_RATE_LIMIT)
+async def resend_email_update_otp(
+    dto: SendEmailOtpDto,
+    request: Request,
+    current_user: dict = Depends(get_current_user),
+):
+    """Resend OTP for email update."""
+    new_email = dto.new_email.lower()
+
+    # Check if previous OTP has expired
+    is_expired = await otp_service.is_otp_expired(new_email, "email_update")
+    if not is_expired:
+        from app.i18n.error_translations import get_error_message
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail=get_error_message(dto.language, "otp_still_valid"),
+        )
+
+    try:
+        await otp_service.send_otp(new_email, "email_update", dto.language)
+    except Exception as e:
+        logger.error(f"Failed to resend email update OTP: {e}")
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail="Failed to resend verification email.",
+        )
+
+    return {
+        "success": True,
+        "message": "New verification code sent to your email.",
+    }
+
+
+# ============================================================
+# PHONE UPDATE ENDPOINTS
+# ============================================================
+
+@router.post("/phone/send-otp", status_code=status.HTTP_200_OK)
+@limiter.limit(AUTH_RATE_LIMIT)
+async def send_phone_update_otp(
+    dto: SendPhoneOtpDto,
+    request: Request,
+    current_user: dict = Depends(get_current_user),
+):
+    """
+    Step 1: Send OTP to new phone number.
+    Requires authentication. Checks that the new phone is not already in use.
+
+    NOTE: SMS delivery depends on SMS provider being configured.
+    Currently sends via email if phone user has an email on file.
+    """
+    user_id = current_user.get("user_id")
+    new_phone = dto.new_phone.strip()
+
+    logger.info(f"Phone update OTP requested by user {user_id} for {new_phone}")
+
+    db = await get_db()
+    users_collection = db["users"]
+
+    # Check if same as current
+    current_phone = current_user.get("phone", "")
+    if current_phone and current_phone == new_phone:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="New phone number is the same as your current number.",
+        )
+
+    # Check if phone already taken
+    existing = await users_collection.find_one({"phone": new_phone})
+    if existing:
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT,
+            detail="This phone number is already registered to another account.",
+        )
+
+    # For phone OTP, we send to the user's email since SMS is not implemented
+    # The OTP is keyed by the new phone number for verification
+    from bson import ObjectId
+    user = await users_collection.find_one({"_id": ObjectId(user_id)})
+    user_email = user.get("email") if user else None
+
+    if not user_email:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="You need a verified email on your account to update your phone number.",
+        )
+
+    # Generate OTP keyed to new phone, but send via email
+    otp_code = await otp_service.generate_otp(new_phone, "phone_update")
+    try:
+        await otp_service._send_otp_via_email(user_email, otp_code, "phone_update", dto.language)
+    except Exception as e:
+        logger.error(f"Failed to send phone update OTP: {e}")
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail="Failed to send verification code. Please try again.",
+        )
+
+    return {
+        "success": True,
+        "message": "Verification code sent to your email address.",
+        "data": {"phone": new_phone},
+    }
+
+
+@router.post("/phone/verify-otp", status_code=status.HTTP_200_OK)
+async def verify_phone_update_otp(
+    dto: VerifyPhoneOtpDto,
+    request: Request,
+    current_user: dict = Depends(get_current_user),
+):
+    """
+    Step 2: Verify OTP and update phone number.
+    """
+    user_id = current_user.get("user_id")
+    new_phone = dto.new_phone.strip()
+
+    await check_contact_rate_limit(user_id, "verify_phone_otp", request)
+
+    logger.info(f"Phone update OTP verification by user {user_id} for {new_phone}")
+
+    # Verify OTP
+    await otp_service.verify_otp(new_phone, dto.code, "phone_update", dto.language)
+
+    db = await get_db()
+    users_collection = db["users"]
+
+    # Double-check phone not taken
+    existing = await users_collection.find_one({"phone": new_phone})
+    if existing and str(existing["_id"]) != user_id:
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT,
+            detail="This phone number was just registered by another account.",
+        )
+
+    # Update user phone
+    from bson import ObjectId
+    await users_collection.update_one(
+        {"_id": ObjectId(user_id)},
+        {
+            "$set": {
+                "phone": new_phone,
+                "isPhoneVerified": True,
+                "updatedAt": datetime.utcnow(),
+            }
+        },
+    )
+
+    # Clean up OTP
+    await otp_service.delete_otp(new_phone, "phone_update")
+
+    logger.info(f"Phone updated successfully for user {user_id}: {new_phone}")
+
+    return {
+        "success": True,
+        "message": "Phone number updated successfully!",
+        "data": {"phone": new_phone},
+    }
+
+
+@router.post("/phone/resend-otp", status_code=status.HTTP_200_OK)
+@limiter.limit(AUTH_RATE_LIMIT)
+async def resend_phone_update_otp(
+    dto: SendPhoneOtpDto,
+    request: Request,
+    current_user: dict = Depends(get_current_user),
+):
+    """Resend OTP for phone update (sent via email)."""
+    new_phone = dto.new_phone.strip()
+
+    is_expired = await otp_service.is_otp_expired(new_phone, "phone_update")
+    if not is_expired:
+        from app.i18n.error_translations import get_error_message
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail=get_error_message(dto.language, "otp_still_valid"),
+        )
+
+    user_id = current_user.get("user_id")
+    db = await get_db()
+    users_collection = db["users"]
+    from bson import ObjectId
+    user = await users_collection.find_one({"_id": ObjectId(user_id)})
+    user_email = user.get("email") if user else None
+
+    if not user_email:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="You need a verified email to update your phone number.",
+        )
+
+    otp_code = await otp_service.generate_otp(new_phone, "phone_update")
+    try:
+        await otp_service._send_otp_via_email(user_email, otp_code, "phone_update", dto.language)
+    except Exception as e:
+        logger.error(f"Failed to resend phone update OTP: {e}")
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail="Failed to resend verification code.",
+        )
+
+    return {
+        "success": True,
+        "message": "New verification code sent to your email.",
+    }
+
+
+# ============================================================
+# ACCOUNT DELETION
+# ============================================================
+
+@router.delete("/account", status_code=status.HTTP_200_OK)
+async def delete_account(
+    request: Request,
+    current_user: dict = Depends(get_current_user),
+):
+    """
+    Permanently delete user account and all associated data.
+    Requires authentication. This action is irreversible.
+    """
+    user_id = current_user.get("user_id")
+    logger.warning(f"Account deletion requested by user {user_id}")
+
+    from bson import ObjectId
+    db = await get_db()
+    oid = ObjectId(user_id)
+
+    # Delete user's data across collections
+    await db["users"].delete_one({"_id": oid})
+    await db["listings"].delete_many({"landlord_id": user_id})
+    await db["otps"].delete_many({"identifier": current_user.get("email", "")})
+    await db["conversations"].delete_many({
+        "$or": [{"user_id": user_id}, {"landlord_id": user_id}]
+    })
+    await db["bookings"].delete_many({
+        "$or": [{"renter_id": user_id}, {"landlord_id": user_id}]
+    })
+    await db["reviews"].delete_many({
+        "$or": [{"reviewer_id": user_id}, {"landlord_id": user_id}]
+    })
+    await db["wishlists"].delete_many({"user_id": user_id})
+
+    logger.info(f"Account and associated data deleted for user {user_id}")
+
+    return {
+        "success": True,
+        "message": "Your account has been permanently deleted.",
+    }

app/routes/legal.py

@@ -0,0 +1,948 @@
+# ============================================================
+# app/routes/legal.py – Localized legal HTML pages
+# Serves Privacy Policy & Terms of Service as styled HTML
+# ============================================================
+
+from fastapi import APIRouter, Query
+from fastapi.responses import HTMLResponse
+from datetime import datetime
+
+router = APIRouter()
+
+# ── Brand colors ────────────────────────────────────────────
+GRADIENT_START = "#764BA2"
+GRADIENT_END = "#FF305A"
+BRAND_COLOR = "#FF305A"
+
+SUPPORTED_LANGS = {"en", "fr", "es", "ar", "pt"}
+LAST_UPDATED = "2026-03-01"
+
+
+def _base_template(title: str, content: str, lang: str) -> str:
+    """Wrap content in a branded, responsive HTML shell."""
+    is_rtl = lang == "ar"
+    dir_attr = ' dir="rtl"' if is_rtl else ""
+    year = datetime.now().year
+
+    return f"""<!DOCTYPE html>
+<html lang="{lang}"{dir_attr}>
+<head>
+<meta charset="UTF-8">
+<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no">
+<title>{title}</title>
+<style>
+  * {{ margin: 0; padding: 0; box-sizing: border-box; }}
+  body {{
+    font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', 'Roboto', 'Helvetica Neue', sans-serif;
+    background: #f8f8fc;
+    color: #2c2c2e;
+    line-height: 1.7;
+    -webkit-font-smoothing: antialiased;
+  }}
+  .header {{
+    background: linear-gradient(135deg, {GRADIENT_START}, {GRADIENT_END});
+    padding: 48px 24px 36px;
+    text-align: center;
+  }}
+  .header h1 {{
+    color: #fff;
+    font-size: 24px;
+    font-weight: 700;
+    letter-spacing: -0.3px;
+    margin-bottom: 8px;
+  }}
+  .header .updated {{
+    color: rgba(255,255,255,0.75);
+    font-size: 13px;
+    font-weight: 400;
+  }}
+  .content {{
+    max-width: 680px;
+    margin: -20px auto 0;
+    background: #fff;
+    border-radius: 20px 20px 0 0;
+    padding: 32px 24px 40px;
+    min-height: 60vh;
+  }}
+  h2 {{
+    font-size: 18px;
+    font-weight: 700;
+    color: {GRADIENT_START};
+    margin: 28px 0 12px;
+    letter-spacing: -0.2px;
+  }}
+  h2:first-child {{ margin-top: 0; }}
+  h3 {{
+    font-size: 15px;
+    font-weight: 600;
+    color: #1a1a2e;
+    margin: 20px 0 8px;
+  }}
+  p {{
+    font-size: 14px;
+    color: #4a4a4e;
+    margin-bottom: 14px;
+  }}
+  ul {{
+    padding-{"right" if is_rtl else "left"}: 20px;
+    margin-bottom: 14px;
+  }}
+  li {{
+    font-size: 14px;
+    color: #4a4a4e;
+    margin-bottom: 8px;
+    line-height: 1.6;
+  }}
+  .highlight {{
+    background: linear-gradient(135deg, rgba(118,75,162,0.08), rgba(255,48,90,0.06));
+    border-{"right" if is_rtl else "left"}: 3px solid {BRAND_COLOR};
+    padding: 14px 16px;
+    border-radius: 0 12px 12px 0;
+    margin: 16px 0;
+    font-size: 13.5px;
+    color: #3a3a3c;
+  }}
+  .contact-box {{
+    background: linear-gradient(135deg, {GRADIENT_START}, {GRADIENT_END});
+    border-radius: 16px;
+    padding: 24px;
+    margin-top: 32px;
+    text-align: center;
+  }}
+  .contact-box p {{
+    color: rgba(255,255,255,0.9);
+    font-size: 14px;
+    margin-bottom: 8px;
+  }}
+  .contact-box a {{
+    color: #fff;
+    font-weight: 600;
+    text-decoration: none;
+    border-bottom: 1px solid rgba(255,255,255,0.4);
+  }}
+  .footer {{
+    text-align: center;
+    padding: 24px;
+    font-size: 12px;
+    color: #8e8e93;
+  }}
+  @media (max-width: 480px) {{
+    .header {{ padding: 40px 20px 28px; }}
+    .header h1 {{ font-size: 21px; }}
+    .content {{ padding: 24px 18px 32px; }}
+    h2 {{ font-size: 16px; }}
+  }}
+</style>
+</head>
+<body>
+{content}
+<div class="footer">&copy; {year} Lojiz. All rights reserved.</div>
+</body>
+</html>"""
+
+
+# ══════════════════════════════════════════════════════════════
+# PRIVACY POLICY
+# ══════════════════════════════════════════════════════════════
+
+PRIVACY_CONTENT = {
+    "en": {
+        "title": "Privacy Policy",
+        "updated": "Last updated",
+        "sections": """
+<div class="header">
+  <h1>Privacy Policy</h1>
+  <div class="updated">Last updated: {date}</div>
+</div>
+<div class="content">
+  <h2>1. Information We Collect</h2>
+  <p>At Lojiz, we collect information to provide you with the best property rental experience. This includes:</p>
+  <ul>
+    <li><strong>Account Information:</strong> Name, email address, phone number, and profile picture when you create an account.</li>
+    <li><strong>Property Data:</strong> Listings you create, search history, saved properties, and booking details.</li>
+    <li><strong>Usage Data:</strong> How you interact with our app, including pages viewed, features used, and time spent.</li>
+    <li><strong>Device Information:</strong> Device type, operating system, and app version for optimization.</li>
+    <li><strong>Location Data:</strong> With your permission, we collect location to show nearby properties.</li>
+  </ul>
+
+  <h2>2. How We Use Your Information</h2>
+  <p>We use your information to:</p>
+  <ul>
+    <li>Provide and improve our property rental platform</li>
+    <li>Facilitate communication between renters and landlords</li>
+    <li>Power AIDA, our AI assistant, to help you find properties</li>
+    <li>Send relevant notifications about listings and bookings</li>
+    <li>Process payments securely through Stripe</li>
+    <li>Prevent fraud and ensure platform safety</li>
+  </ul>
+
+  <div class="highlight">We never sell your personal data to third parties. Your information is used solely to enhance your Lojiz experience.</div>
+
+  <h2>3. AI Assistant (AIDA)</h2>
+  <p>AIDA uses your search preferences and conversation history to provide personalized property recommendations. Conversations are processed securely and are not shared with other users or third parties.</p>
+
+  <h2>4. Data Sharing</h2>
+  <p>We may share limited information with:</p>
+  <ul>
+    <li><strong>Landlords/Renters:</strong> Contact details when you initiate a booking or inquiry.</li>
+    <li><strong>Payment Processors:</strong> Stripe processes payments; we don't store full card details.</li>
+    <li><strong>Service Providers:</strong> Hosting, analytics, and email services that help us operate.</li>
+    <li><strong>Legal Requirements:</strong> When required by law or to protect rights and safety.</li>
+  </ul>
+
+  <h2>5. Data Security</h2>
+  <p>We protect your data with:</p>
+  <ul>
+    <li>End-to-end encryption for messages</li>
+    <li>Secure JWT authentication</li>
+    <li>Regular security audits</li>
+    <li>Encrypted data storage</li>
+  </ul>
+
+  <h2>6. Your Rights</h2>
+  <p>You have the right to:</p>
+  <ul>
+    <li>Access and download your personal data</li>
+    <li>Correct inaccurate information</li>
+    <li>Delete your account and associated data</li>
+    <li>Opt out of analytics and marketing communications</li>
+    <li>Withdraw consent for location tracking at any time</li>
+  </ul>
+
+  <h2>7. Data Retention</h2>
+  <p>We retain your data for as long as your account is active. After account deletion, we remove personal data within 30 days, except where legal obligations require longer retention.</p>
+
+  <h2>8. Children's Privacy</h2>
+  <p>Lojiz is not intended for users under 18. We do not knowingly collect data from minors.</p>
+
+  <h2>9. Changes to This Policy</h2>
+  <p>We may update this policy periodically. Significant changes will be notified via the app or email.</p>
+
+  <div class="contact-box">
+    <p>Questions about your privacy?</p>
+    <a href="mailto:privacy@lojiz.com">privacy@lojiz.com</a>
+  </div>
+</div>"""
+    },
+    "fr": {
+        "title": "Politique de Confidentialité",
+        "updated": "Dernière mise à jour",
+        "sections": """
+<div class="header">
+  <h1>Politique de Confidentialité</h1>
+  <div class="updated">Dernière mise à jour : {date}</div>
+</div>
+<div class="content">
+  <h2>1. Informations que nous collectons</h2>
+  <p>Chez Lojiz, nous collectons des informations pour vous offrir la meilleure expérience de location. Cela inclut :</p>
+  <ul>
+    <li><strong>Informations de compte :</strong> Nom, adresse e-mail, numéro de téléphone et photo de profil lors de la création de votre compte.</li>
+    <li><strong>Données immobilières :</strong> Annonces créées, historique de recherche, propriétés sauvegardées et détails de réservation.</li>
+    <li><strong>Données d'utilisation :</strong> Comment vous interagissez avec notre application, pages consultées et fonctionnalités utilisées.</li>
+    <li><strong>Informations sur l'appareil :</strong> Type d'appareil, système d'exploitation et version de l'application.</li>
+    <li><strong>Données de localisation :</strong> Avec votre permission, pour afficher les propriétés à proximité.</li>
+  </ul>
+
+  <h2>2. Comment nous utilisons vos informations</h2>
+  <p>Nous utilisons vos informations pour :</p>
+  <ul>
+    <li>Fournir et améliorer notre plateforme de location</li>
+    <li>Faciliter la communication entre locataires et propriétaires</li>
+    <li>Alimenter AIDA, notre assistante IA, pour vous aider à trouver des propriétés</li>
+    <li>Envoyer des notifications pertinentes sur les annonces et réservations</li>
+    <li>Traiter les paiements de manière sécurisée via Stripe</li>
+    <li>Prévenir la fraude et assurer la sécurité de la plateforme</li>
+  </ul>
+
+  <div class="highlight">Nous ne vendons jamais vos données personnelles à des tiers. Vos informations sont utilisées uniquement pour améliorer votre expérience Lojiz.</div>
+
+  <h2>3. Assistante IA (AIDA)</h2>
+  <p>AIDA utilise vos préférences de recherche et l'historique de vos conversations pour fournir des recommandations personnalisées. Les conversations sont traitées de manière sécurisée et ne sont pas partagées.</p>
+
+  <h2>4. Partage des données</h2>
+  <p>Nous pouvons partager des informations limitées avec :</p>
+  <ul>
+    <li><strong>Propriétaires/Locataires :</strong> Coordonnées lors d'une réservation ou demande.</li>
+    <li><strong>Processeurs de paiement :</strong> Stripe traite les paiements ; nous ne stockons pas les détails complets de carte.</li>
+    <li><strong>Prestataires de services :</strong> Hébergement, analytique et services e-mail.</li>
+    <li><strong>Obligations légales :</strong> Lorsque la loi l'exige.</li>
+  </ul>
+
+  <h2>5. Sécurité des données</h2>
+  <p>Nous protégeons vos données avec :</p>
+  <ul>
+    <li>Chiffrement de bout en bout pour les messages</li>
+    <li>Authentification JWT sécurisée</li>
+    <li>Audits de sécurité réguliers</li>
+    <li>Stockage de données chiffré</li>
+  </ul>
+
+  <h2>6. Vos droits</h2>
+  <p>Vous avez le droit de :</p>
+  <ul>
+    <li>Accéder et télécharger vos données personnelles</li>
+    <li>Corriger les informations inexactes</li>
+    <li>Supprimer votre compte et les données associées</li>
+    <li>Refuser l'analytique et les communications marketing</li>
+    <li>Retirer votre consentement pour le suivi de localisation</li>
+  </ul>
+
+  <h2>7. Conservation des données</h2>
+  <p>Nous conservons vos données tant que votre compte est actif. Après suppression, nous effaçons les données personnelles sous 30 jours, sauf obligation légale.</p>
+
+  <h2>8. Confidentialité des enfants</h2>
+  <p>Lojiz n'est pas destiné aux utilisateurs de moins de 18 ans. Nous ne collectons pas sciemment de données de mineurs.</p>
+
+  <h2>9. Modifications de cette politique</h2>
+  <p>Nous pouvons mettre à jour cette politique périodiquement. Les changements importants seront notifiés via l'application ou par e-mail.</p>
+
+  <div class="contact-box">
+    <p>Questions sur votre confidentialité ?</p>
+    <a href="mailto:privacy@lojiz.com">privacy@lojiz.com</a>
+  </div>
+</div>"""
+    },
+    "es": {
+        "title": "Política de Privacidad",
+        "updated": "Última actualización",
+        "sections": """
+<div class="header">
+  <h1>Política de Privacidad</h1>
+  <div class="updated">Última actualización: {date}</div>
+</div>
+<div class="content">
+  <h2>1. Información que recopilamos</h2>
+  <p>En Lojiz, recopilamos información para brindarte la mejor experiencia de alquiler. Esto incluye:</p>
+  <ul>
+    <li><strong>Información de cuenta:</strong> Nombre, correo electrónico, número de teléfono y foto de perfil al crear tu cuenta.</li>
+    <li><strong>Datos de propiedades:</strong> Anuncios creados, historial de búsqueda, propiedades guardadas y detalles de reservas.</li>
+    <li><strong>Datos de uso:</strong> Cómo interactúas con nuestra aplicación, páginas visitadas y funciones utilizadas.</li>
+    <li><strong>Información del dispositivo:</strong> Tipo de dispositivo, sistema operativo y versión de la aplicación.</li>
+    <li><strong>Datos de ubicación:</strong> Con tu permiso, para mostrar propiedades cercanas.</li>
+  </ul>
+
+  <h2>2. Cómo usamos tu información</h2>
+  <p>Usamos tu información para:</p>
+  <ul>
+    <li>Proporcionar y mejorar nuestra plataforma de alquiler</li>
+    <li>Facilitar la comunicación entre inquilinos y propietarios</li>
+    <li>Potenciar AIDA, nuestra asistente de IA, para ayudarte a encontrar propiedades</li>
+    <li>Enviar notificaciones relevantes sobre anuncios y reservas</li>
+    <li>Procesar pagos de forma segura a través de Stripe</li>
+    <li>Prevenir fraudes y garantizar la seguridad de la plataforma</li>
+  </ul>
+
+  <div class="highlight">Nunca vendemos tus datos personales a terceros. Tu información se utiliza únicamente para mejorar tu experiencia en Lojiz.</div>
+
+  <h2>3. Asistente de IA (AIDA)</h2>
+  <p>AIDA utiliza tus preferencias de búsqueda y el historial de conversaciones para ofrecer recomendaciones personalizadas. Las conversaciones se procesan de forma segura y no se comparten.</p>
+
+  <h2>4. Compartir datos</h2>
+  <ul>
+    <li><strong>Propietarios/Inquilinos:</strong> Datos de contacto al iniciar una reserva o consulta.</li>
+    <li><strong>Procesadores de pago:</strong> Stripe procesa los pagos; no almacenamos datos completos de tarjetas.</li>
+    <li><strong>Proveedores de servicios:</strong> Alojamiento, analítica y servicios de correo electrónico.</li>
+    <li><strong>Requisitos legales:</strong> Cuando lo exija la ley.</li>
+  </ul>
+
+  <h2>5. Seguridad de datos</h2>
+  <ul>
+    <li>Cifrado de extremo a extremo para mensajes</li>
+    <li>Autenticación JWT segura</li>
+    <li>Auditorías de seguridad regulares</li>
+    <li>Almacenamiento de datos cifrado</li>
+  </ul>
+
+  <h2>6. Tus derechos</h2>
+  <ul>
+    <li>Acceder y descargar tus datos personales</li>
+    <li>Corregir información inexacta</li>
+    <li>Eliminar tu cuenta y datos asociados</li>
+    <li>Rechazar analíticas y comunicaciones de marketing</li>
+    <li>Retirar el consentimiento para el seguimiento de ubicación</li>
+  </ul>
+
+  <h2>7. Retención de datos</h2>
+  <p>Conservamos tus datos mientras tu cuenta esté activa. Después de la eliminación, borramos los datos personales en 30 días, salvo obligación legal.</p>
+
+  <h2>8. Privacidad de menores</h2>
+  <p>Lojiz no está destinado a usuarios menores de 18 años.</p>
+
+  <h2>9. Cambios en esta política</h2>
+  <p>Podemos actualizar esta política periódicamente. Los cambios importantes se notificarán a través de la aplicación o correo electrónico.</p>
+
+  <div class="contact-box">
+    <p>¿Preguntas sobre tu privacidad?</p>
+    <a href="mailto:privacy@lojiz.com">privacy@lojiz.com</a>
+  </div>
+</div>"""
+    },
+    "ar": {
+        "title": "سياسة الخصوصية",
+        "updated": "آخر تحديث",
+        "sections": """
+<div class="header">
+  <h1>سياسة الخصوصية</h1>
+  <div class="updated">آخر تحديث: {date}</div>
+</div>
+<div class="content">
+  <h2>1. المعلومات التي نجمعها</h2>
+  <p>في Lojiz، نجمع المعلومات لتقديم أفضل تجربة تأجير لك. يشمل ذلك:</p>
+  <ul>
+    <li><strong>معلومات الحساب:</strong> الاسم والبريد الإلكتروني ورقم الهاتف وصورة الملف الشخصي عند إنشاء حسابك.</li>
+    <li><strong>بيانات العقارات:</strong> الإعلانات المنشأة وسجل البحث والعقارات المحفوظة وتفاصيل الحجز.</li>
+    <li><strong>بيانات الاستخدام:</strong> كيفية تفاعلك مع تطبيقنا والصفحات المعروضة والميزات المستخدمة.</li>
+    <li><strong>معلومات الجهاز:</strong> نوع الجهاز ونظام التشغيل وإصدار التطبيق.</li>
+    <li><strong>بيانات الموقع:</strong> بإذنك، لعرض العقارات القريبة.</li>
+  </ul>
+
+  <h2>2. كيف نستخدم معلوماتك</h2>
+  <ul>
+    <li>توفير وتحسين منصة التأجير</li>
+    <li>تسهيل التواصل بين المستأجرين والملاك</li>
+    <li>تشغيل AIDA، مساعدتنا الذكية، لمساعدتك في العثور على عقارات</li>
+    <li>إرسال إشعارات ذات صلة حول الإعلانات والحجوزات</li>
+    <li>معالجة المدفوعات بأمان عبر Stripe</li>
+    <li>منع الاحتيال وضمان سلامة المنصة</li>
+  </ul>
+
+  <div class="highlight">نحن لا نبيع بياناتك الشخصية أبداً لأطراف ثالثة. تُستخدم معلوماتك فقط لتحسين تجربتك في Lojiz.</div>
+
+  <h2>3. المساعدة الذكية (AIDA)</h2>
+  <p>تستخدم AIDA تفضيلات البحث وسجل المحادثات لتقديم توصيات مخصصة. تتم معالجة المحادثات بشكل آمن ولا تتم مشاركتها.</p>
+
+  <h2>4. مشاركة البيانات</h2>
+  <ul>
+    <li><strong>الملاك/المستأجرون:</strong> بيانات الاتصال عند بدء حجز أو استفسار.</li>
+    <li><strong>معالجو الدفع:</strong> يعالج Stripe المدفوعات؛ لا نخزن تفاصيل البطاقة الكاملة.</li>
+    <li><strong>مقدمو الخدمات:</strong> الاستضافة والتحليلات وخدمات البريد الإلكتروني.</li>
+    <li><strong>المتطلبات القانونية:</strong> عندما يتطلب القانون ذلك.</li>
+  </ul>
+
+  <h2>5. أمان البيانات</h2>
+  <ul>
+    <li>تشفير من طرف إلى طرف للرسائل</li>
+    <li>مصادقة JWT آمنة</li>
+    <li>تدقيقات أمنية منتظمة</li>
+    <li>تخزين بيانات مشفر</li>
+  </ul>
+
+  <h2>6. حقوقك</h2>
+  <ul>
+    <li>الوصول إلى بياناتك الشخصية وتحميلها</li>
+    <li>تصحيح المعلومات غير الدقيقة</li>
+    <li>حذف حسابك والبيانات المرتبطة</li>
+    <li>رفض التحليلات والاتصالات التسويقية</li>
+    <li>سحب الموافقة على تتبع الموقع</li>
+  </ul>
+
+  <h2>7. الاحتفاظ بالبيانات</h2>
+  <p>نحتفظ ببياناتك طالما حسابك نشط. بعد الحذف، نزيل البيانات الشخصية خلال 30 يوماً، ما لم تتطلب الالتزامات القانونية خلاف ذلك.</p>
+
+  <h2>8. خصوصية الأطفال</h2>
+  <p>Lojiz غير مخصص للمستخدمين دون 18 عاماً.</p>
+
+  <h2>9. التغييرات على هذه السياسة</h2>
+  <p>قد نحدّث هذه السياسة بشكل دوري. سيتم إخطارك بالتغييرات المهمة عبر التطبيق أو البريد الإلكتروني.</p>
+
+  <div class="contact-box">
+    <p>أسئلة حول خصوصيتك؟</p>
+    <a href="mailto:privacy@lojiz.com">privacy@lojiz.com</a>
+  </div>
+</div>"""
+    },
+    "pt": {
+        "title": "Política de Privacidade",
+        "updated": "Última atualização",
+        "sections": """
+<div class="header">
+  <h1>Política de Privacidade</h1>
+  <div class="updated">Última atualização: {date}</div>
+</div>
+<div class="content">
+  <h2>1. Informações que coletamos</h2>
+  <p>Na Lojiz, coletamos informações para oferecer a melhor experiência de aluguel. Isso inclui:</p>
+  <ul>
+    <li><strong>Informações da conta:</strong> Nome, e-mail, número de telefone e foto de perfil ao criar sua conta.</li>
+    <li><strong>Dados de imóveis:</strong> Anúncios criados, histórico de busca, imóveis salvos e detalhes de reservas.</li>
+    <li><strong>Dados de uso:</strong> Como você interage com nosso aplicativo, páginas visitadas e recursos utilizados.</li>
+    <li><strong>Informações do dispositivo:</strong> Tipo de dispositivo, sistema operacional e versão do aplicativo.</li>
+    <li><strong>Dados de localização:</strong> Com sua permissão, para mostrar imóveis próximos.</li>
+  </ul>
+
+  <h2>2. Como usamos suas informações</h2>
+  <ul>
+    <li>Fornecer e melhorar nossa plataforma de aluguel</li>
+    <li>Facilitar a comunicação entre inquilinos e proprietários</li>
+    <li>Alimentar a AIDA, nossa assistente de IA, para ajudá-lo a encontrar imóveis</li>
+    <li>Enviar notificações relevantes sobre anúncios e reservas</li>
+    <li>Processar pagamentos com segurança via Stripe</li>
+    <li>Prevenir fraudes e garantir a segurança da plataforma</li>
+  </ul>
+
+  <div class="highlight">Nunca vendemos seus dados pessoais a terceiros. Suas informações são usadas exclusivamente para melhorar sua experiência na Lojiz.</div>
+
+  <h2>3. Assistente de IA (AIDA)</h2>
+  <p>A AIDA usa suas preferências de busca e histórico de conversas para fornecer recomendações personalizadas. As conversas são processadas com segurança e não são compartilhadas.</p>
+
+  <h2>4. Compartilhamento de dados</h2>
+  <ul>
+    <li><strong>Proprietários/Inquilinos:</strong> Dados de contato ao iniciar uma reserva ou consulta.</li>
+    <li><strong>Processadores de pagamento:</strong> O Stripe processa pagamentos; não armazenamos dados completos do cartão.</li>
+    <li><strong>Provedores de serviço:</strong> Hospedagem, análises e serviços de e-mail.</li>
+    <li><strong>Requisitos legais:</strong> Quando exigido por lei.</li>
+  </ul>
+
+  <h2>5. Segurança dos dados</h2>
+  <ul>
+    <li>Criptografia de ponta a ponta para mensagens</li>
+    <li>Autenticação JWT segura</li>
+    <li>Auditorias de segurança regulares</li>
+    <li>Armazenamento de dados criptografado</li>
+  </ul>
+
+  <h2>6. Seus direitos</h2>
+  <ul>
+    <li>Acessar e baixar seus dados pessoais</li>
+    <li>Corrigir informações imprecisas</li>
+    <li>Excluir sua conta e dados associados</li>
+    <li>Recusar análises e comunicações de marketing</li>
+    <li>Retirar o consentimento para rastreamento de localização</li>
+  </ul>
+
+  <h2>7. Retenção de dados</h2>
+  <p>Mantemos seus dados enquanto sua conta estiver ativa. Após a exclusão, removemos os dados pessoais em 30 dias, exceto quando obrigações legais exigirem retenção mais longa.</p>
+
+  <h2>8. Privacidade de menores</h2>
+  <p>A Lojiz não é destinada a usuários menores de 18 anos.</p>
+
+  <h2>9. Alterações nesta política</h2>
+  <p>Podemos atualizar esta política periodicamente. Mudanças significativas serão notificadas pelo aplicativo ou e-mail.</p>
+
+  <div class="contact-box">
+    <p>Dúvidas sobre sua privacidade?</p>
+    <a href="mailto:privacy@lojiz.com">privacy@lojiz.com</a>
+  </div>
+</div>"""
+    },
+}
+
+
+# ══════════════════════════════════════════════════════════════
+# TERMS OF SERVICE
+# ══════════════════════════════════════════════════════════════
+
+TERMS_CONTENT = {
+    "en": {
+        "title": "Terms of Service",
+        "sections": """
+<div class="header">
+  <h1>Terms of Service</h1>
+  <div class="updated">Last updated: {date}</div>
+</div>
+<div class="content">
+  <h2>1. Acceptance of Terms</h2>
+  <p>By accessing or using Lojiz, you agree to be bound by these Terms of Service. If you do not agree, please do not use our platform.</p>
+
+  <h2>2. Eligibility</h2>
+  <p>You must be at least 18 years old to use Lojiz. By creating an account, you represent that you meet this requirement.</p>
+
+  <h2>3. Account Responsibilities</h2>
+  <ul>
+    <li>You are responsible for maintaining the confidentiality of your account credentials.</li>
+    <li>You must provide accurate and current information.</li>
+    <li>You are responsible for all activities under your account.</li>
+    <li>Notify us immediately of any unauthorized access.</li>
+  </ul>
+
+  <h2>4. Property Listings</h2>
+  <h3>For Landlords:</h3>
+  <ul>
+    <li>You must have legal authority to list the property.</li>
+    <li>Listings must be accurate, truthful, and up-to-date.</li>
+    <li>Photos must represent the actual property.</li>
+    <li>Pricing must be transparent with no hidden fees.</li>
+  </ul>
+  <h3>For Renters:</h3>
+  <ul>
+    <li>Use the platform respectfully and in good faith.</li>
+    <li>Do not submit fraudulent bookings or inquiries.</li>
+    <li>Respect property rules set by landlords.</li>
+  </ul>
+
+  <div class="highlight">Lojiz acts as a platform connecting landlords and renters. We do not own, manage, or control any listed properties.</div>
+
+  <h2>5. AI Assistant (AIDA)</h2>
+  <p>AIDA provides property recommendations and assistance. While we strive for accuracy, AIDA's suggestions are informational and do not constitute professional real estate advice. Always verify property details independently.</p>
+
+  <h2>6. Payments & Fees</h2>
+  <ul>
+    <li>Payments are processed securely through Stripe.</li>
+    <li>Service fees may apply to bookings.</li>
+    <li>Cancellation and refund policies are specified per listing.</li>
+    <li>Landlords receive payouts according to their Stripe configuration.</li>
+  </ul>
+
+  <h2>7. Prohibited Conduct</h2>
+  <p>You may not:</p>
+  <ul>
+    <li>Post false, misleading, or discriminatory content</li>
+    <li>Harass, threaten, or abuse other users</li>
+    <li>Circumvent the platform to avoid fees</li>
+    <li>Use automated tools to scrape or manipulate the platform</li>
+    <li>Violate any applicable laws or regulations</li>
+  </ul>
+
+  <h2>8. Content Ownership</h2>
+  <p>You retain ownership of content you post (photos, descriptions). By posting, you grant Lojiz a non-exclusive license to display and promote your listings on the platform.</p>
+
+  <h2>9. Limitation of Liability</h2>
+  <p>Lojiz is provided "as is". We are not liable for:</p>
+  <ul>
+    <li>Property conditions or landlord/renter behavior</li>
+    <li>Disputes between users</li>
+    <li>Service interruptions or data loss</li>
+    <li>Third-party service failures</li>
+  </ul>
+
+  <h2>10. Account Termination</h2>
+  <p>We may suspend or terminate accounts that violate these terms. You may delete your account at any time through the app settings.</p>
+
+  <h2>11. Dispute Resolution</h2>
+  <p>Disputes will be resolved through good-faith negotiation first. If unresolved, disputes will be settled through binding arbitration.</p>
+
+  <h2>12. Governing Law</h2>
+  <p>These terms are governed by applicable laws. Any legal proceedings shall be conducted in the appropriate jurisdiction.</p>
+
+  <h2>13. Changes to Terms</h2>
+  <p>We may modify these terms at any time. Continued use after changes constitutes acceptance. Material changes will be notified via the app.</p>
+
+  <div class="contact-box">
+    <p>Questions about these terms?</p>
+    <a href="mailto:legal@lojiz.com">legal@lojiz.com</a>
+  </div>
+</div>"""
+    },
+    "fr": {
+        "title": "Conditions d'Utilisation",
+        "sections": """
+<div class="header">
+  <h1>Conditions d'Utilisation</h1>
+  <div class="updated">Dernière mise à jour : {date}</div>
+</div>
+<div class="content">
+  <h2>1. Acceptation des conditions</h2>
+  <p>En accédant ou en utilisant Lojiz, vous acceptez d'être lié par ces conditions. Si vous n'êtes pas d'accord, veuillez ne pas utiliser notre plateforme.</p>
+
+  <h2>2. Éligibilité</h2>
+  <p>Vous devez avoir au moins 18 ans pour utiliser Lojiz. En créant un compte, vous déclarez remplir cette condition.</p>
+
+  <h2>3. Responsabilités du compte</h2>
+  <ul>
+    <li>Vous êtes responsable de la confidentialité de vos identifiants.</li>
+    <li>Vous devez fournir des informations exactes et à jour.</li>
+    <li>Vous êtes responsable de toutes les activités sous votre compte.</li>
+    <li>Signalez immédiatement tout accès non autorisé.</li>
+  </ul>
+
+  <h2>4. Annonces immobilières</h2>
+  <h3>Pour les propriétaires :</h3>
+  <ul>
+    <li>Vous devez avoir l'autorité légale pour lister la propriété.</li>
+    <li>Les annonces doivent être exactes, véridiques et à jour.</li>
+    <li>Les photos doivent représenter la propriété réelle.</li>
+    <li>Les prix doivent être transparents sans frais cachés.</li>
+  </ul>
+  <h3>Pour les locataires :</h3>
+  <ul>
+    <li>Utilisez la plateforme respectueusement et de bonne foi.</li>
+    <li>Ne soumettez pas de réservations ou demandes frauduleuses.</li>
+    <li>Respectez les règles de propriété définies par les propriétaires.</li>
+  </ul>
+
+  <div class="highlight">Lojiz agit comme une plateforme connectant propriétaires et locataires. Nous ne possédons, ne gérons ni ne contrôlons les propriétés listées.</div>
+
+  <h2>5. Assistante IA (AIDA)</h2>
+  <p>AIDA fournit des recommandations et une assistance immobilière. Ses suggestions sont informatives et ne constituent pas un conseil immobilier professionnel.</p>
+
+  <h2>6. Paiements et frais</h2>
+  <ul>
+    <li>Les paiements sont traités de manière sécurisée via Stripe.</li>
+    <li>Des frais de service peuvent s'appliquer aux réservations.</li>
+    <li>Les politiques d'annulation et de remboursement sont spécifiées par annonce.</li>
+    <li>Les propriétaires reçoivent les paiements selon leur configuration Stripe.</li>
+  </ul>
+
+  <h2>7. Conduite interdite</h2>
+  <ul>
+    <li>Publier du contenu faux, trompeur ou discriminatoire</li>
+    <li>Harceler, menacer ou abuser d'autres utilisateurs</li>
+    <li>Contourner la plateforme pour éviter les frais</li>
+    <li>Utiliser des outils automatisés pour extraire ou manipuler la plateforme</li>
+    <li>Violer les lois ou réglementations applicables</li>
+  </ul>
+
+  <h2>8. Propriété du contenu</h2>
+  <p>Vous conservez la propriété du contenu que vous publiez. En publiant, vous accordez à Lojiz une licence non exclusive pour afficher et promouvoir vos annonces.</p>
+
+  <h2>9. Limitation de responsabilité</h2>
+  <p>Lojiz est fourni « tel quel ». Nous ne sommes pas responsables des conditions des propriétés, des litiges entre utilisateurs ou des interruptions de service.</p>
+
+  <h2>10. Résiliation de compte</h2>
+  <p>Nous pouvons suspendre ou résilier les comptes en violation. Vous pouvez supprimer votre compte à tout moment via les paramètres.</p>
+
+  <h2>11. Résolution des litiges</h2>
+  <p>Les litiges seront résolus par négociation de bonne foi d'abord, puis par arbitrage contraignant si nécessaire.</p>
+
+  <h2>12. Modifications des conditions</h2>
+  <p>Nous pouvons modifier ces conditions à tout moment. L'utilisation continue après les modifications constitue une acceptation.</p>
+
+  <div class="contact-box">
+    <p>Questions sur ces conditions ?</p>
+    <a href="mailto:legal@lojiz.com">legal@lojiz.com</a>
+  </div>
+</div>"""
+    },
+    "es": {
+        "title": "Términos de Servicio",
+        "sections": """
+<div class="header">
+  <h1>Términos de Servicio</h1>
+  <div class="updated">Última actualización: {date}</div>
+</div>
+<div class="content">
+  <h2>1. Aceptación de los términos</h2>
+  <p>Al acceder o usar Lojiz, aceptas estar sujeto a estos Términos de Servicio. Si no estás de acuerdo, no uses nuestra plataforma.</p>
+
+  <h2>2. Elegibilidad</h2>
+  <p>Debes tener al menos 18 años para usar Lojiz.</p>
+
+  <h2>3. Responsabilidades de la cuenta</h2>
+  <ul>
+    <li>Eres responsable de la confidencialidad de tus credenciales.</li>
+    <li>Debes proporcionar información precisa y actual.</li>
+    <li>Eres responsable de todas las actividades bajo tu cuenta.</li>
+    <li>Notifícanos inmediatamente de cualquier acceso no autorizado.</li>
+  </ul>
+
+  <h2>4. Anuncios de propiedades</h2>
+  <h3>Para propietarios:</h3>
+  <ul>
+    <li>Debes tener autoridad legal para listar la propiedad.</li>
+    <li>Los anuncios deben ser precisos, veraces y actualizados.</li>
+    <li>Las fotos deben representar la propiedad real.</li>
+    <li>Los precios deben ser transparentes sin cargos ocultos.</li>
+  </ul>
+  <h3>Para inquilinos:</h3>
+  <ul>
+    <li>Usa la plataforma respetuosamente y de buena fe.</li>
+    <li>No envíes reservas o consultas fraudulentas.</li>
+  </ul>
+
+  <div class="highlight">Lojiz actúa como plataforma que conecta propietarios e inquilinos. No poseemos, gestionamos ni controlamos las propiedades listadas.</div>
+
+  <h2>5. Asistente de IA (AIDA)</h2>
+  <p>AIDA proporciona recomendaciones e información. Sus sugerencias no constituyen asesoramiento inmobiliario profesional.</p>
+
+  <h2>6. Pagos y tarifas</h2>
+  <ul>
+    <li>Los pagos se procesan de forma segura a través de Stripe.</li>
+    <li>Pueden aplicarse tarifas de servicio a las reservas.</li>
+    <li>Las políticas de cancelación se especifican por anuncio.</li>
+  </ul>
+
+  <h2>7. Conducta prohibida</h2>
+  <ul>
+    <li>Publicar contenido falso, engañoso o discriminatorio</li>
+    <li>Acosar, amenazar o abusar de otros usuarios</li>
+    <li>Eludir la plataforma para evitar tarifas</li>
+    <li>Violar leyes o regulaciones aplicables</li>
+  </ul>
+
+  <h2>8. Propiedad del contenido</h2>
+  <p>Conservas la propiedad del contenido que publicas. Al publicar, otorgas a Lojiz una licencia no exclusiva para mostrar tus anuncios.</p>
+
+  <h2>9. Limitación de responsabilidad</h2>
+  <p>Lojiz se proporciona "tal cual". No somos responsables de las condiciones de las propiedades ni de disputas entre usuarios.</p>
+
+  <h2>10. Terminación de cuenta</h2>
+  <p>Podemos suspender cuentas que violen estos términos. Puedes eliminar tu cuenta en cualquier momento.</p>
+
+  <h2>11. Cambios en los términos</h2>
+  <p>Podemos modificar estos términos en cualquier momento. El uso continuado constituye aceptación.</p>
+
+  <div class="contact-box">
+    <p>¿Preguntas sobre estos términos?</p>
+    <a href="mailto:legal@lojiz.com">legal@lojiz.com</a>
+  </div>
+</div>"""
+    },
+    "ar": {
+        "title": "شروط الخدمة",
+        "sections": """
+<div class="header">
+  <h1>شروط الخدمة</h1>
+  <div class="updated">آخر تحديث: {date}</div>
+</div>
+<div class="content">
+  <h2>1. قبول الشروط</h2>
+  <p>باستخدام Lojiz، فإنك تواف�� على الالتزام بشروط الخدمة هذه. إذا لم توافق، يرجى عدم استخدام منصتنا.</p>
+
+  <h2>2. الأهلية</h2>
+  <p>يجب أن يكون عمرك 18 عاماً على الأقل لاستخدام Lojiz.</p>
+
+  <h2>3. مسؤوليات الحساب</h2>
+  <ul>
+    <li>أنت مسؤول عن الحفاظ على سرية بيانات اعتماد حسابك.</li>
+    <li>يجب تقديم معلومات دقيقة وحديثة.</li>
+    <li>أنت مسؤول عن جميع الأنشطة تحت حسابك.</li>
+    <li>أبلغنا فوراً عن أي وصول غير مصرح به.</li>
+  </ul>
+
+  <h2>4. إعلانات العقارات</h2>
+  <h3>للملاك:</h3>
+  <ul>
+    <li>يجب أن تملك السلطة القانونية لإدراج العقار.</li>
+    <li>يجب أن تكون الإعلانات دقيقة وصادقة ومحدثة.</li>
+    <li>يجب أن تمثل الصور العقار الفعلي.</li>
+    <li>يجب أن تكون الأسعار شفافة بدون رسوم مخفية.</li>
+  </ul>
+  <h3>للمستأجرين:</h3>
+  <ul>
+    <li>استخدم المنصة باحترام وحسن نية.</li>
+    <li>لا تقدم حجوزات أو استفسارات احتيالية.</li>
+  </ul>
+
+  <div class="highlight">Lojiz هي منصة تربط الملاك بالمستأجرين. نحن لا نملك أو ندير أو نتحكم في أي عقارات مدرجة.</div>
+
+  <h2>5. المساعدة الذكية (AIDA)</h2>
+  <p>تقدم AIDA توصيات ومعلومات. اقتراحاتها إرشادية ولا تشكل نصيحة عقارية مهنية.</p>
+
+  <h2>6. المدفوعات والرسوم</h2>
+  <ul>
+    <li>تتم معالجة المدفوعات بأمان عبر Stripe.</li>
+    <li>قد تنطبق رسوم خدمة على الحجوزات.</li>
+    <li>سياسات الإلغاء والاسترداد محددة لكل إعلان.</li>
+  </ul>
+
+  <h2>7. السلوك المحظور</h2>
+  <ul>
+    <li>نشر محتوى كاذب أو مضلل أو تمييزي</li>
+    <li>مضايقة أو تهديد أو إساءة معاملة المستخدمين الآخرين</li>
+    <li>التحايل على المنصة لتجنب الرسوم</li>
+    <li>انتهاك القوانين أو اللوائح المعمول بها</li>
+  </ul>
+
+  <h2>8. ملكية المحتوى</h2>
+  <p>تحتفظ بملكية المحتوى الذي تنشره. بالنشر، تمنح Lojiz ترخيصاً غير حصري لعرض إعلاناتك.</p>
+
+  <h2>9. تحديد المسؤولية</h2>
+  <p>يتم توفير Lojiz "كما هي". لسنا مسؤولين عن حالة العقارات أو النزاعات بين المستخدمين.</p>
+
+  <h2>10. إنهاء الحساب</h2>
+  <p>يمكننا تعليق الحسابات المخالفة. يمكنك حذف حسابك في أي وقت من الإعدادات.</p>
+
+  <h2>11. التغييرات على الشروط</h2>
+  <p>يمكننا تعديل هذه الشروط في أي وقت. الاستمرار في الاستخدام يعني القبول.</p>
+
+  <div class="contact-box">
+    <p>أسئلة حول هذه الشروط؟</p>
+    <a href="mailto:legal@lojiz.com">legal@lojiz.com</a>
+  </div>
+</div>"""
+    },
+    "pt": {
+        "title": "Termos de Serviço",
+        "sections": """
+<div class="header">
+  <h1>Termos de Serviço</h1>
+  <div class="updated">Última atualização: {date}</div>
+</div>
+<div class="content">
+  <h2>1. Aceitação dos termos</h2>
+  <p>Ao acessar ou usar a Lojiz, você concorda em estar vinculado a estes Termos de Serviço. Se não concordar, não use nossa plataforma.</p>
+
+  <h2>2. Elegibilidade</h2>
+  <p>Você deve ter pelo menos 18 anos para usar a Lojiz.</p>
+
+  <h2>3. Responsabilidades da conta</h2>
+  <ul>
+    <li>Você é responsável pela confidencialidade de suas credenciais.</li>
+    <li>Deve fornecer informações precisas e atuais.</li>
+    <li>É responsável por todas as atividades em sua conta.</li>
+    <li>Notifique-nos imediatamente sobre qualquer acesso não autorizado.</li>
+  </ul>
+
+  <h2>4. Anúncios de imóveis</h2>
+  <h3>Para proprietários:</h3>
+  <ul>
+    <li>Você deve ter autoridade legal para listar o imóvel.</li>
+    <li>Os anúncios devem ser precisos, verdadeiros e atualizados.</li>
+    <li>As fotos devem representar o imóvel real.</li>
+    <li>Os preços devem ser transparentes sem taxas ocultas.</li>
+  </ul>
+  <h3>Para inquilinos:</h3>
+  <ul>
+    <li>Use a plataforma com respeito e boa-fé.</li>
+    <li>Não envie reservas ou consultas fraudulentas.</li>
+  </ul>
+
+  <div class="highlight">A Lojiz atua como plataforma conectando proprietários e inquilinos. Não possuímos, gerenciamos ou controlamos os imóveis listados.</div>
+
+  <h2>5. Assistente de IA (AIDA)</h2>
+  <p>A AIDA fornece recomendações e informações. Suas sugestões não constituem consultoria imobiliária profissional.</p>
+
+  <h2>6. Pagamentos e taxas</h2>
+  <ul>
+    <li>Pagamentos processados com segurança via Stripe.</li>
+    <li>Taxas de serviço podem ser aplicadas às reservas.</li>
+    <li>Políticas de cancelamento especificadas por anúncio.</li>
+  </ul>
+
+  <h2>7. Conduta proibida</h2>
+  <ul>
+    <li>Publicar conteúdo falso, enganoso ou discriminatório</li>
+    <li>Assediar, ameaçar ou abusar de outros usuários</li>
+    <li>Contornar a plataforma para evitar taxas</li>
+    <li>Violar leis ou regulamentos aplicáveis</li>
+  </ul>
+
+  <h2>8. Propriedade do conteúdo</h2>
+  <p>Você mantém a propriedade do conteúdo publicado. Ao publicar, concede à Lojiz uma licença não exclusiva para exibir seus anúncios.</p>
+
+  <h2>9. Limitação de responsabilidade</h2>
+  <p>A Lojiz é fornecida "como está". Não somos responsáveis pelas condições dos imóveis ou disputas entre usuários.</p>
+
+  <h2>10. Encerramento de conta</h2>
+  <p>Podemos suspender contas que violem estes termos. Você pode excluir sua conta a qualquer momento.</p>
+
+  <h2>11. Alterações nos termos</h2>
+  <p>Podemos modificar estes termos a qualquer momento. O uso continuado constitui aceitação.</p>
+
+  <div class="contact-box">
+    <p>Dúvidas sobre estes termos?</p>
+    <a href="mailto:legal@lojiz.com">legal@lojiz.com</a>
+  </div>
+</div>"""
+    },
+}
+
+
+# ══════════════════════════════════════════════════════════════
+# ENDPOINTS
+# ══════════════════════════════════════════════════════════════
+
+@router.get("/privacy-policy", response_class=HTMLResponse)
+async def privacy_policy(lang: str = Query("en", regex="^(en|fr|es|ar|pt)$")):
+    """Serve localized Privacy Policy as styled HTML."""
+    content = PRIVACY_CONTENT.get(lang, PRIVACY_CONTENT["en"])
+    html_body = content["sections"].replace("{date}", LAST_UPDATED)
+    return HTMLResponse(_base_template(content["title"], html_body, lang))
+
+
+@router.get("/terms-of-service", response_class=HTMLResponse)
+async def terms_of_service(lang: str = Query("en", regex="^(en|fr|es|ar|pt)$")):
+    """Serve localized Terms of Service as styled HTML."""
+    content = TERMS_CONTENT.get(lang, TERMS_CONTENT["en"])
+    html_body = content["sections"].replace("{date}", LAST_UPDATED)
+    return HTMLResponse(_base_template(content["title"], html_body, lang))

app/routes/notifications.py

@@ -0,0 +1,166 @@
+# ============================================================
+# app/routes/notifications.py – Notification preferences + FCM
+# ============================================================
+
+import logging
+from fastapi import APIRouter, HTTPException, status, Depends, Request
+from pydantic import BaseModel, Field
+from typing import Optional
+from app.guards.jwt_guard import get_current_user
+from app.database import get_db
+from datetime import datetime
+from bson import ObjectId
+
+router = APIRouter(tags=["Notifications"])
+logger = logging.getLogger(__name__)
+
+
+# ============================================================
+# DTOs
+# ============================================================
+
+class NotificationPrefsDto(BaseModel):
+    """Notification preference toggles"""
+    master_enabled: bool = True
+    messages: bool = True
+    property_alerts: bool = True
+    booking_updates: bool = True
+    promotions: bool = False
+    push_enabled: bool = False
+    email_enabled: bool = False
+    voice_notes_enabled: bool = False
+
+
+class FCMTokenDto(BaseModel):
+    """Register or update FCM device token"""
+    token: str = Field(..., min_length=10, max_length=500)
+    platform: str = Field(..., pattern="^(android|ios)$")
+    device_id: Optional[str] = None
+
+
+# ============================================================
+# NOTIFICATION PREFERENCES
+# ============================================================
+
+@router.get("/preferences", status_code=status.HTTP_200_OK)
+async def get_notification_preferences(
+    request: Request,
+    current_user: dict = Depends(get_current_user),
+):
+    """Fetch user's notification preferences."""
+    user_id = current_user.get("user_id")
+
+    db = await get_db()
+    prefs = await db["notification_prefs"].find_one({"user_id": user_id})
+
+    if not prefs:
+        # Return defaults if no prefs saved yet
+        return {
+            "success": True,
+            "data": NotificationPrefsDto().model_dump(),
+        }
+
+    # Remove mongo fields
+    prefs.pop("_id", None)
+    prefs.pop("user_id", None)
+    prefs.pop("updatedAt", None)
+
+    return {
+        "success": True,
+        "data": prefs,
+    }
+
+
+@router.put("/preferences", status_code=status.HTTP_200_OK)
+async def update_notification_preferences(
+    dto: NotificationPrefsDto,
+    request: Request,
+    current_user: dict = Depends(get_current_user),
+):
+    """Update user's notification preferences. Synced across devices."""
+    user_id = current_user.get("user_id")
+
+    db = await get_db()
+    prefs_data = {
+        **dto.model_dump(),
+        "user_id": user_id,
+        "updatedAt": datetime.utcnow(),
+    }
+
+    await db["notification_prefs"].update_one(
+        {"user_id": user_id},
+        {"$set": prefs_data},
+        upsert=True,
+    )
+
+    logger.info(f"Notification prefs updated for user {user_id}")
+
+    return {
+        "success": True,
+        "message": "Notification preferences saved.",
+        "data": dto.model_dump(),
+    }
+
+
+# ============================================================
+# FCM TOKEN REGISTRATION
+# ============================================================
+
+@router.post("/fcm-token", status_code=status.HTTP_200_OK)
+async def register_fcm_token(
+    dto: FCMTokenDto,
+    request: Request,
+    current_user: dict = Depends(get_current_user),
+):
+    """
+    Register or update FCM device token for push notifications.
+    Each user can have multiple tokens (one per device).
+    """
+    user_id = current_user.get("user_id")
+
+    db = await get_db()
+    token_data = {
+        "user_id": user_id,
+        "token": dto.token,
+        "platform": dto.platform,
+        "device_id": dto.device_id,
+        "active": True,
+        "updatedAt": datetime.utcnow(),
+    }
+
+    # Upsert by token (same device updates, new device inserts)
+    await db["fcm_tokens"].update_one(
+        {"token": dto.token},
+        {"$set": token_data},
+        upsert=True,
+    )
+
+    logger.info(f"FCM token registered for user {user_id} ({dto.platform})")
+
+    return {
+        "success": True,
+        "message": "Push notification token registered.",
+    }
+
+
+@router.delete("/fcm-token", status_code=status.HTTP_200_OK)
+async def unregister_fcm_token(
+    dto: FCMTokenDto,
+    request: Request,
+    current_user: dict = Depends(get_current_user),
+):
+    """Unregister FCM token (e.g., on logout)."""
+    user_id = current_user.get("user_id")
+
+    db = await get_db()
+    await db["fcm_tokens"].delete_one({
+        "user_id": user_id,
+        "token": dto.token,
+    })
+
+    logger.info(f"FCM token unregistered for user {user_id}")
+
+    return {
+        "success": True,
+        "message": "Push notification token removed.",
+    }

app/services/email_notification_service.py

@@ -0,0 +1,152 @@
+# ============================================================
+# app/services/email_notification_service.py
+# Email notifications for bookings & property alerts only
+# Uses Resend API (same as OTP emails)
+# ============================================================
+
+import logging
+from typing import Optional
+from app.database import get_db
+from app.config import settings
+
+logger = logging.getLogger(__name__)
+
+# Categories that support email notifications
+# Messages are excluded — email is only for bookings & alerts
+EMAIL_ALLOWED_CATEGORIES = {"booking_updates", "property_alerts", "promotions"}
+
+
+class EmailNotificationService:
+    """Send email notifications via Resend for bookings and alerts."""
+
+    @staticmethod
+    async def should_send_email(user_id: str, category: str) -> bool:
+        """Check if user has email notifications enabled for this category."""
+        # Never send email for messages
+        if category not in EMAIL_ALLOWED_CATEGORIES:
+            return False
+
+        db = await get_db()
+        prefs = await db["notification_prefs"].find_one({"user_id": user_id})
+
+        if not prefs:
+            return False  # Default: email off
+
+        if not prefs.get("master_enabled", True):
+            return False
+
+        if not prefs.get("email_enabled", False):
+            return False
+
+        # Check category-specific toggle
+        return prefs.get(category, True)
+
+    @staticmethod
+    async def get_user_email(user_id: str) -> Optional[str]:
+        """Get user's email address from the database."""
+        db = await get_db()
+        user = await db["users"].find_one({"_id": user_id})
+        if not user:
+            from bson import ObjectId
+            user = await db["users"].find_one({"_id": ObjectId(user_id)})
+        return user.get("email") if user else None
+
+    @staticmethod
+    async def send_email(
+        user_id: str,
+        subject: str,
+        body_html: str,
+        category: str = "booking_updates",
+    ) -> bool:
+        """
+        Send an email notification to a user.
+
+        Only sends if:
+        - Category is allowed (bookings, property alerts, promotions)
+        - User has master + email toggles enabled
+        - User has the specific category enabled
+        """
+        if not await EmailNotificationService.should_send_email(user_id, category):
+            logger.debug(f"Email skipped (prefs) for user {user_id}, category={category}")
+            return False
+
+        email = await EmailNotificationService.get_user_email(user_id)
+        if not email:
+            logger.debug(f"Email skipped (no email) for user {user_id}")
+            return False
+
+        try:
+            import resend
+            resend.api_key = settings.RESEND_API_KEY
+
+            params = {
+                "from": f"{settings.RESEND_FROM_NAME} <{settings.RESEND_FROM_EMAIL}>",
+                "to": email,
+                "subject": subject,
+                "html": _wrap_email_template(subject, body_html),
+            }
+            resp = resend.Emails.send(params)
+            if resp.get("error"):
+                raise Exception(resp["error"].get("message", "Send failed"))
+
+            logger.info(f"Email notification sent to {email} ({category})")
+            return True
+
+        except ImportError:
+            logger.warning("resend package not installed")
+            return False
+        except Exception as e:
+            logger.error(f"Email notification failed for {email}: {e}")
+            return False
+
+    @staticmethod
+    async def notify_user(
+        user_id: str,
+        title: str,
+        body: str,
+        category: str = "booking_updates",
+    ) -> bool:
+        """
+        High-level: send a simple email notification.
+        Builds a clean HTML email from title + body text.
+        """
+        body_html = f"<p style='font-size:16px;color:#333;line-height:1.6;'>{body}</p>"
+        return await EmailNotificationService.send_email(
+            user_id=user_id,
+            subject=title,
+            body_html=body_html,
+            category=category,
+        )
+
+
+def _wrap_email_template(title: str, content_html: str) -> str:
+    """Wrap content in Lojiz branded email template."""
+    return f"""<!DOCTYPE html>
+<html>
+<head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1.0"></head>
+<body style="margin:0;padding:0;background:#f5f5fa;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif;">
+  <table width="100%" cellpadding="0" cellspacing="0" style="background:#f5f5fa;padding:32px 16px;">
+    <tr><td align="center">
+      <table width="100%" style="max-width:520px;background:#ffffff;border-radius:16px;overflow:hidden;box-shadow:0 2px 12px rgba(0,0,0,0.08);">
+        <!-- Header gradient -->
+        <tr><td style="background:linear-gradient(135deg,#764BA2,#FF305A);padding:28px 24px;text-align:center;">
+          <h1 style="margin:0;color:#ffffff;font-size:22px;font-weight:700;letter-spacing:-0.3px;">Lojiz</h1>
+        </td></tr>
+        <!-- Content -->
+        <tr><td style="padding:28px 24px;">
+          <h2 style="margin:0 0 16px;font-size:18px;font-weight:600;color:#1a1025;">{title}</h2>
+          {content_html}
+        </td></tr>
+        <!-- Footer -->
+        <tr><td style="padding:20px 24px;border-top:1px solid #eee;text-align:center;">
+          <p style="margin:0;font-size:12px;color:#999;">&copy; 2026 Lojiz. All rights reserved.</p>
+          <p style="margin:8px 0 0;font-size:11px;color:#bbb;">You received this because email notifications are enabled in your Lojiz settings.</p>
+        </td></tr>
+      </table>
+    </td></tr>
+  </table>
+</body>
+</html>"""
+
+
+email_notification_service = EmailNotificationService()

app/services/otp_service.py

@@ -105,8 +105,14 @@ class OTPService:
         try:
             template = self._generate_email_template(otp, purpose, language)
 
-            # Get localized subject
-            subject_key = "otp_verify_subject" if purpose == "signup" else "otp_reset_subject"
+            # Get localized subject based on purpose
+            subject_key_map = {
+                "signup": "otp_verify_subject",
+                "password_reset": "otp_reset_subject",
+                "email_update": "otp_email_update_subject",
+                "phone_update": "otp_phone_update_subject",
+            }
+            subject_key = subject_key_map.get(purpose, "otp_verify_subject")
             subject = get_translation(language, subject_key)
 
             params = {
@@ -144,17 +150,19 @@ class OTPService:
         current_year = datetime.now().year
         expiry_minutes = settings.OTP_EXPIRY_MINUTES
 
-        # Get localized strings
-        if purpose == "signup":
-            subject_line = get_translation(language, "otp_verify_subject").replace("Verify Your Lojiz Account", "Verify Your Account").replace("Vérifiez votre compte Lojiz", "Vérifiez votre compte")
-            greeting = get_translation(language, "otp_verify_greeting")
-            intro_text = get_translation(language, "otp_verify_message")
-            footer_text = get_translation(language, "otp_verify_footer")
-        else:
-            subject_line = get_translation(language, "otp_reset_subject").replace("Reset Your Lojiz Password", "Reset Your Password").replace("Réinitialisez votre mot de passe Lojiz", "Réinitialisez votre mot de passe")
-            greeting = get_translation(language, "otp_reset_greeting")
-            intro_text = get_translation(language, "otp_reset_message")
-            footer_text = get_translation(language, "otp_reset_footer")
+        # Get localized strings based on purpose
+        purpose_key_map = {
+            "signup": "otp_verify",
+            "password_reset": "otp_reset",
+            "email_update": "otp_email_update",
+            "phone_update": "otp_phone_update",
+        }
+        key_prefix = purpose_key_map.get(purpose, "otp_verify")
+
+        subject_line = get_translation(language, f"{key_prefix}_subject")
+        greeting = get_translation(language, f"{key_prefix}_greeting")
+        intro_text = get_translation(language, f"{key_prefix}_message")
+        footer_text = get_translation(language, f"{key_prefix}_footer")
 
         # Check if RTL language (Arabic)
         is_rtl = language == "ar"
@@ -200,7 +208,7 @@ class OTPService:
                     <p class="intro">{intro_text}</p>
                     <div class="otp-box">
                         <div class="otp-code">{otp}</div>
-                        <div class="otp-expiry">{get_translation(language, "otp_verify_expiry" if purpose == "signup" else "otp_reset_expiry")}</div>
+                        <div class="otp-expiry">{get_translation(language, f"{key_prefix}_expiry")}</div>
                     </div>
                     <p class="warning">{footer_text}</p>
                 </div>

app/services/push_service.py

@@ -0,0 +1,197 @@
+# ============================================================
+# app/services/push_service.py – FCM Push Notification Service
+# ============================================================
+import os
+import logging
+from pathlib import Path
+from typing import Optional
+from app.database import get_db
+
+logger = logging.getLogger(__name__)
+
+# Try to initialize Firebase Admin
+_firebase_app = None
+try:
+    import firebase_admin
+    from firebase_admin import credentials, messaging
+
+    if not firebase_admin._apps:
+        # 1) Try explicit path from env
+        sa_path = os.getenv("FIREBASE_SERVICE_ACCOUNT_PATH", "")
+        if sa_path:
+            # Resolve relative to project root (where main.py lives)
+            full_path = Path(__file__).resolve().parents[2] / sa_path
+            if full_path.exists():
+                cred = credentials.Certificate(str(full_path))
+                _firebase_app = firebase_admin.initialize_app(cred)
+                logger.info(f"Firebase Admin SDK initialized from {full_path}")
+            else:
+                logger.warning(f"Firebase key not found at {full_path}")
+        # 2) Fallback: GOOGLE_APPLICATION_CREDENTIALS env var
+        if not _firebase_app and os.getenv("GOOGLE_APPLICATION_CREDENTIALS"):
+            cred = credentials.ApplicationDefault()
+            _firebase_app = firebase_admin.initialize_app(cred)
+            logger.info("Firebase Admin SDK initialized via GOOGLE_APPLICATION_CREDENTIALS")
+
+        if not _firebase_app:
+            logger.warning("No Firebase credentials found. Push notifications disabled.")
+except ImportError:
+    logger.warning("firebase-admin not installed. Run: pip install firebase-admin")
+except Exception as e:
+    logger.warning(f"Firebase Admin SDK init failed: {e}")
+
+
+class PushService:
+    """Send push notifications via Firebase Cloud Messaging."""
+
+    @staticmethod
+    async def get_user_tokens(user_id: str) -> list[str]:
+        """Get all active FCM tokens for a user."""
+        db = await get_db()
+        cursor = db["fcm_tokens"].find({
+            "user_id": user_id,
+            "active": True,
+        })
+        tokens = []
+        async for doc in cursor:
+            tokens.append(doc["token"])
+        return tokens
+
+    @staticmethod
+    async def should_notify(user_id: str, category: str) -> bool:
+        """
+        Check if user has enabled notifications for this category.
+        Categories: messages, property_alerts, booking_updates, promotions
+        """
+        db = await get_db()
+        prefs = await db["notification_prefs"].find_one({"user_id": user_id})
+
+        if not prefs:
+            defaults = {
+                "messages": True,
+                "property_alerts": True,
+                "booking_updates": True,
+                "promotions": False,
+            }
+            return defaults.get(category, True)
+
+        if not prefs.get("master_enabled", True):
+            return False
+        if not prefs.get("push_enabled", False):
+            return False
+
+        return prefs.get(category, True)
+
+    @staticmethod
+    async def send_to_user(
+        user_id: str,
+        title: str,
+        body: str,
+        category: str = "messages",
+        data: Optional[dict] = None,
+    ) -> int:
+        """
+        Send push notification to all of a user's devices.
+        Returns number of devices successfully notified.
+        """
+        if not _firebase_app:
+            logger.debug(f"Push skipped (Firebase not configured): {title}")
+            return 0
+
+        if not await PushService.should_notify(user_id, category):
+            logger.debug(f"Push skipped (user opted out of {category}): {user_id}")
+            return 0
+
+        tokens = await PushService.get_user_tokens(user_id)
+        if not tokens:
+            return 0
+
+        from firebase_admin import messaging
+
+        notification = messaging.Notification(title=title, body=body)
+
+        android_config = messaging.AndroidConfig(
+            priority="high",
+            notification=messaging.AndroidNotification(
+                sound="default",
+                channel_id="lojiz_default",
+            ),
+        )
+        apns_config = messaging.APNSConfig(
+            payload=messaging.APNSPayload(
+                aps=messaging.Aps(sound="default", badge=1),
+            ),
+        )
+
+        success_count = 0
+        stale_tokens = []
+
+        for token in tokens:
+            message = messaging.Message(
+                notification=notification,
+                android=android_config,
+                apns=apns_config,
+                token=token,
+                data=data or {},
+            )
+            try:
+                messaging.send(message)
+                success_count += 1
+            except messaging.UnregisteredError:
+                stale_tokens.append(token)
+            except Exception as e:
+                logger.error(f"FCM send failed for token {token[:20]}...: {e}")
+
+        # Clean up stale tokens
+        if stale_tokens:
+            db = await get_db()
+            await db["fcm_tokens"].delete_many({"token": {"$in": stale_tokens}})
+            logger.info(f"Cleaned {len(stale_tokens)} stale FCM tokens for user {user_id}")
+
+        logger.info(f"Push sent to {success_count}/{len(tokens)} devices for user {user_id}")
+        return success_count
+
+    @staticmethod
+    async def send_to_many(
+        user_ids: list[str],
+        title: str,
+        body: str,
+        category: str = "messages",
+        data: Optional[dict] = None,
+    ) -> int:
+        """Send push notification to multiple users."""
+        total = 0
+        for user_id in user_ids:
+            total += await PushService.send_to_user(user_id, title, body, category, data)
+        return total
+
+    @staticmethod
+    async def notify_user(
+        user_id: str,
+        title: str,
+        body: str,
+        category: str = "messages",
+        data: Optional[dict] = None,
+    ) -> dict:
+        """
+        Unified notification: sends push + email (for allowed categories).
+        Email is only sent for booking_updates, property_alerts, promotions.
+        Messages never trigger email.
+        """
+        push_count = await PushService.send_to_user(
+            user_id, title, body, category, data,
+        )
+
+        email_sent = False
+        try:
+            from app.services.email_notification_service import email_notification_service
+            email_sent = await email_notification_service.notify_user(
+                user_id, title, body, category,
+            )
+        except Exception as e:
+            logger.error(f"Email notification error for user {user_id}: {e}")
+
+        return {"push_devices": push_count, "email_sent": email_sent}
+
+
+push_service = PushService()

main.py

@@ -358,10 +358,25 @@ app.include_router(wishlist_router, prefix="/api/wishlist", tags=["Wishlist"])
 app.include_router(booking_router, prefix="/api/bookings", tags=["Bookings"])
 app.include_router(stripe_connect.router, prefix="/api/stripe", tags=["Stripe Connect"])
 
+# Contact Update (Email & Phone)
+from app.routes.contact_update import router as contact_update_router
+app.include_router(contact_update_router, prefix="/api/contact", tags=["Contact Update"])
+logger.info("✅ Contact Update router registered at /api/contact")
+
 from app.routes.quota import router as quota_router
 app.include_router(quota_router, prefix="/api/quota", tags=["Quota"])
 logger.info("✅ Quota router registered at /api/quota")
 
+# Legal Pages (Privacy Policy & Terms of Service)
+from app.routes.legal import router as legal_router
+app.include_router(legal_router, prefix="/api/legal", tags=["Legal"])
+logger.info("✅ Legal pages router registered at /api/legal")
+
+# Notification Preferences + FCM
+from app.routes.notifications import router as notifications_router
+app.include_router(notifications_router, prefix="/api/notifications", tags=["Notifications"])
+logger.info("✅ Notifications router registered at /api/notifications")
+
 logger.info("✅ Conversations router registered at /api/conversations")
 logger.info("✅ Wishlist router registered at /api/wishlist")
 logger.info("✅ Bookings router registered at /api/bookings")

push/louezmoi-5d0f0-firebase-adminsdk-fbsvc-7411d58511.json

@@ -0,0 +1,13 @@
+{
+  "type": "service_account",
+  "project_id": "louezmoi-5d0f0",
+  "private_key_id": "7411d5851127bbf9c774a497cab76dee887d1b01",
+  "private_key": "-----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDMQkVUUz9uDYPG\nD5Ch3PBUEgWDb5DTmIftsKWVa4jFQQIfkXcBFw7VWRjIUK5opbEJq/iJnsCIEkiy\nN7wu/LdTed6a/xoY3RNPUPHuDG/cJd1tThdZK10aunz460yGG1mjlKLPryqmp5WY\nhpnofmS2gFMymGCp4Kb0CtqRDgBVCAkJd5NXPpkU3iGnPo9hUENjtvwMhRK/FzLn\nJyDmSyoq7yR5Xdd1uZJa7VKzyNoqxOL9PUQSB/lI0Y8UKSdiKSBNSw5MAcapX7TJ\n/gQLSRqEUxMbEgMYT0aScDY5gl0fUBg02ASIgepTu11eIGfm6IHK0lfl4aU2MtMn\nWsKMjNLzAgMBAAECggEAAax1VviLp4Iy1zefbsQZsAapxubuH927F2aAJNZJu5wJ\nwWp2uCqRM4xUWKfYlgDtj2+6TJ5hY3wK3nL4dsYZVnTELy7x7sw48UhvgwzVCc/B\nnbirFk71p1dp2LxM1zh4Jo/8OYls5wqufh50OmR2vMwWYm6/NAUkORGxssiTlh7D\n+WZeep48XI/izUGLasEd1nq3mdi1YyktN1cRCd8BAARDDmELUZZOg3eH+TrM8rAv\nomyvBRBKAkeqcTGstEoxTtCF1ecFV5aaXV/Lx43QqYEKg5b8I/sVoEF/iqCFKIwf\ng2dmgN3F2ho7EWc6m73kZ8Yj8j95hV5/IsyBa9fvEQKBgQD45FUbnr6pGpkHRXmp\nmAI4amKxBWSLivbMjay8F9EBaB/ugJLRmxbmssxgpd2mt9H1YJz57/1GTTIESfj9\nlnpUOkk1luNZNUbRaraP4kr+xs2j/ZbxXECl7fDEFbfzovzxyH/K+CGravbo8NRL\nfUUXo76ZMgU/iGcVou3fl59W+wKBgQDSF59tPSojFVM7NUTQqwRYZUfcKNOqEQ6U\n0m5LkenGEdIJVMCt1gv6bIRe3HKBZgN1qdKcP+2Voa1/5Fop0AXAoSa4kHrLjd3M\nBg4sfCK2heLc7/RJDP4hMgZ0drYD6VwtzK8IVZt+X26QQFgGBUm4fois4PLpzjRg\n5Grf7hWSaQKBgQCC6V6Wm4W/Xn0VJQbcHFc2o0Zrw+FhwGMVroMnoANQERuSkFAp\nLcD68RqszzFpqpAl135ZvFBktN/U/6+Wepq3SL0PEeFdH7ezGMUTozw9DAZH9m95\nXkOmwyN7j8zkulr/Na157c+P4UAjv+B6IFbCG196JqQ6CZ3m9H7Xt2GZFwKBgA+M\nM/4vkpi6EUjGbmtK3K12AVVnqBJj5MJauFLbX4OK+hI6tW+n8Yb81Ob4RXkSBZuF\nj9KEYJ68MkzOp2WEwYg55NWvy4aY3xskL5RXM3JyghF7qIZncb8fJp8j0eCEOpAh\nH6rsOu+lPFdsi5cWeRgwNQkmNJPc8L9i6A3eXrZRAoGAAjJuAGNUO+YiMq2LjiHJ\nEGFjbdiPKiKpItkWsqf/OkJ8uEOaYEvYsjV+x53p0f09hyTTgBM+QV9lKWqcBp35\nZlDGZmd+TNT1rgGadh5smCe7Vgzh4jzjZwA3GvYky3lBk+iKI9HeOlidlHTPJCwm\nh1js/XYyzwagdUkpqtIBrtw=\n-----END PRIVATE KEY-----\n",
+  "client_email": "firebase-adminsdk-fbsvc@louezmoi-5d0f0.iam.gserviceaccount.com",
+  "client_id": "109525111802797881931",
+  "auth_uri": "https://accounts.google.com/o/oauth2/auth",
+  "token_uri": "https://oauth2.googleapis.com/token",
+  "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
+  "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/firebase-adminsdk-fbsvc%40louezmoi-5d0f0.iam.gserviceaccount.com",
+  "universe_domain": "googleapis.com"
+}