Privacy Policy

Placeholder. Update with the web-first version before launch. Must mention Stripe, Resend, PostHog, and cookie usage per GDPR/CCPA.