Privacy Policy — Minimal logs, no sale of personal data. GDPR/CCPA-ready.