Terms of Service

Demo terms – not legal advice. Replace with counsel-reviewed version before going live.

Demo nature

This site is a demonstration ecommerce build. No real transactions occur. Prices, inventory and coupons are mock data. No contract is formed by using demo checkout. Checkout remains demo-only and cannot charge a user – payment adapter is in demo mode until Stripe env configured.

Use of site

You may browse and test cart/wishlist functionality, cookie consent preferences (Necessary/Analytics/Advertising), and admin mock (when env not configured). Do not attempt to inject real payment data – demo fields are not PCI-compliant. When live, payments will be handled by Stripe (PCI DSS Level 1) via server env STRIPE_SECRET_KEY.

Google services

Google Analytics loads only after explicit analytics consent and only if NEXT_PUBLIC_GA_MEASUREMENT_ID configured.
Google AdSense AdSlot renders real ad only if client ID + slot ID configured AND advertising consent given. Otherwise no ad request. Requires AdSense account approval and ads.txt.
Search Console verification via GOOGLE_SITE_VERIFICATION meta tag, server env only.

Admin area

/admin is development-only settings mock when ADMIN_EMAIL, ADMIN_PASSWORD_HASH, ADMIN_SESSION_SECRET not configured. In production, admin requires env-provided credentials with salted hash (bcrypt) and secure session secret, httpOnly signed cookie. Never use email as password, never hardcode secrets. See README Admin Hardening and src/lib/admin-auth.ts.

Hermes Connector

Generic custom API integration – configurable via HERMES_ENABLED, HERMES_BASE_URL, HERMES_API_KEY (server-only). No assumptions about Hermes service. Inactive until configured. Implementation point: src/lib/hermes-client.ts.

Intellectual property

Basco Sports wordmark and icon are fully original for this demo. Product images from Unsplash – licensed for demo use. Do not reuse without checking license. All branding, copy, and design are original to Basco Sports.