Privacy policy

TODO before launch: this is a placeholder, not legal advice. Replace it with a policy that matches what the site actually does, and have it reviewed.