Privacy policy

Placeholder — real copy needed before launch (spec §9).