feat: add privacy policy with SMS data sharing section

frontend/src/app/login/page.tsx

@@ -95,6 +95,14 @@ export default function LoginPage() {
 					<p className="mt-4 text-center text-sm text-muted-foreground">
 						Join the flock and get rewarded for your watch time
 					</p>
+					<p className="mt-2 text-center text-xs text-muted-foreground">
+						<a
+							href="/privacy"
+							className="underline hover:text-primary transition-colors"
+						>
+							Privacy Policy
+						</a>
+					</p>
 				</CardContent>
 			</Card>
 		</div>

frontend/src/app/privacy/page.tsx

@@ -0,0 +1,128 @@
+export default function PrivacyPage() {
+	return (
+		<div className="min-h-screen bg-background p-4 sm:p-8 font-sans">
+			<div className="mx-auto max-w-3xl space-y-8">
+				<div className="rounded-3xl border-4 border-primary bg-secondary/20 p-6 shadow-[8px_8px_0px_0px_rgba(0,0,0,1)]">
+					<h1 className="font-display text-4xl leading-none text-primary uppercase italic tracking-tighter">
+						Privacy Policy
+					</h1>
+					<p className="mt-2 text-sm font-bold text-muted-foreground">
+						The coop keeps secrets. This is how.
+					</p>
+				</div>
+
+				<div className="space-y-8">
+					<section className="rounded-[2.5rem] border-4 border-foreground bg-card p-6 shadow-[10px_10px_0px_0px_rgba(0,0,0,0.05)]">
+						<h2 className="font-display text-2xl uppercase italic mb-4">
+							What We Collect
+						</h2>
+						<div className="space-y-3 text-sm font-bold text-muted-foreground">
+							<p>
+								We collect your Plex username and email when you log in.
+								That&apos;s it. No passwords, no credit cards, no tracking
+								pixels.
+							</p>
+							<p>
+								If you choose to add a phone number in the admin dashboard, we
+								store that too — purely so the farmer can send you coop updates.
+							</p>
+						</div>
+					</section>
+
+					<section className="rounded-[2.5rem] border-4 border-foreground bg-card p-6 shadow-[10px_10px_0px_0px_rgba(0,0,0,0.05)]">
+						<h2 className="font-display text-2xl uppercase italic mb-4">
+							How We Use It
+						</h2>
+						<div className="space-y-3 text-sm font-bold text-muted-foreground">
+							<p>
+								Your data powers the coop: tracking watch time, calculating
+								$COOP earnings, and processing content requests. Nothing else.
+							</p>
+							<p>
+								We don&apos;t use your data for ads, profiling, or anything
+								creepy. This is a private family app.
+							</p>
+						</div>
+					</section>
+
+					<section className="rounded-[2.5rem] border-4 border-primary bg-primary/5 p-6 shadow-[10px_10px_0px_0px_rgba(0,0,0,0.05)]">
+						<h2 className="font-display text-2xl uppercase italic mb-4 text-primary">
+							SMS / Mobile Information Sharing
+						</h2>
+						<div className="space-y-3 text-sm font-bold text-muted-foreground">
+							<p>
+								If you provide a phone number, it is used solely for sending
+								coop-related SMS updates (e.g., new content, request approvals,
+								bonus notifications).
+							</p>
+							<p className="text-primary font-black">
+								We do not sell, rent, or share SMS opt-in data or consent with
+								any third parties.
+							</p>
+							<p>
+								You can opt out anytime by removing your number from the
+								dashboard or asking the admin to delete it.
+							</p>
+						</div>
+					</section>
+
+					<section className="rounded-[2.5rem] border-4 border-foreground bg-card p-6 shadow-[10px_10px_0px_0px_rgba(0,0,0,0.05)]">
+						<h2 className="font-display text-2xl uppercase italic mb-4">
+							Cookies & Tracking
+						</h2>
+						<div className="space-y-3 text-sm font-bold text-muted-foreground">
+							<p>
+								We use a single JWT cookie to keep you logged in. That&apos;s
+								it. No Google Analytics, no Facebook pixels, no ad trackers.
+							</p>
+						</div>
+					</section>
+
+					<section className="rounded-[2.5rem] border-4 border-foreground bg-card p-6 shadow-[10px_10px_0px_0px_rgba(0,0,0,0.05)]">
+						<h2 className="font-display text-2xl uppercase italic mb-4">
+							Data Storage
+						</h2>
+						<div className="space-y-3 text-sm font-bold text-muted-foreground">
+							<p>
+								Everything lives on a private server in the Hoboken Chicken
+								household. PostgreSQL database, Redis cache. No cloud providers
+								have access.
+							</p>
+						</div>
+					</section>
+
+					<section className="rounded-[2.5rem] border-4 border-foreground bg-card p-6 shadow-[10px_10px_0px_0px_rgba(0,0,0,0.05)]">
+						<h2 className="font-display text-2xl uppercase italic mb-4">
+							Your Rights
+						</h2>
+						<div className="space-y-3 text-sm font-bold text-muted-foreground">
+							<p>
+								You can request deletion of your account and all associated data
+								by contacting the admin. We&apos;ll comply within 30 days — no
+								questions asked.
+							</p>
+						</div>
+					</section>
+
+					<section className="rounded-[2.5rem] border-4 border-foreground bg-card p-6 shadow-[10px_10px_0px_0px_rgba(0,0,0,0.05)]">
+						<h2 className="font-display text-2xl uppercase italic mb-4">
+							Changes
+						</h2>
+						<div className="space-y-3 text-sm font-bold text-muted-foreground">
+							<p>
+								If we change this policy, we&apos;ll post an update here and
+								notify users via the dashboard. Last updated: April 2026.
+							</p>
+						</div>
+					</section>
+
+					<div className="text-center pt-4">
+						<p className="text-xs font-bold text-muted-foreground uppercase tracking-widest">
+							Questions? Cluck at the admin.
+						</p>
+					</div>
+				</div>
+			</div>
+		</div>
+	);
+}