Privacy policy

Placeholder. Google OAuth verification and production launch both require real privacy-policy content here before going live — see "Required user-provided inputs" in the deployment plan.