diff --git a/zet/privacy-policy.md b/zet/privacy-policy.md
new file mode 100644
index 0000000..65a1b46
--- /dev/null
+++ b/zet/privacy-policy.md
@@ -0,0 +1,67 @@
+# Privacy Policy for zet
+
+**Last updated:** July 5, 2026
+
+**Developer:** Software Smyth  
+**App:** zet (`com.softwaresmyth.zet`)  
+**Contact:** Use the support email listed on the Google Play store listing.
+
+## Overview
+
+zet is a note-capture app with a home-screen widget. Notes are stored on your device and can be pushed to a git repository **you** configure (GitHub, GitLab, Gitea, or another Git HTTP remote). zet does **not** operate developer-controlled servers and does **not** collect analytics.
+
+## Data stored on your device
+
+| Data | Purpose | Storage |
+|------|---------|---------|
+| Note text and metadata | Local drafts and history before/after sync | App-private SQLite database |
+| Repository URL and folder path | Know where to push notes | Android SharedPreferences |
+| Filename pattern | Name new note files on push | Android SharedPreferences |
+| API token | Authenticate to your git host | Android EncryptedSharedPreferences |
+| Local retention setting | Optional auto-purge of old local notes | Android SharedPreferences |
+
+## Data transmitted
+
+When you save or sync a note, zet sends data **only** to the repository URL you configured:
+
+- Note content (as a markdown file in your chosen folder)
+- API token (in HTTP headers for authentication to your git host)
+
+zet does not send data to Software Smyth or any other third party except the git host you select.
+
+## Data not collected
+
+- No accounts with the developer
+- No advertising identifiers
+- No crash or usage analytics to developer servers
+- No sale or sharing of personal data for marketing
+
+## Permissions
+
+zet requests **Internet** access solely to communicate with your configured git remote.
+
+## HTTP vs HTTPS
+
+You may enter `http://` or `https://` repository URLs. HTTPS is recommended. Cleartext HTTP is permitted so self-hosted remotes without TLS can be used at your own risk.
+
+## Backups
+
+Automatic Android backup is **disabled** for zet so encrypted credentials and configuration are not copied to cloud backup services. Notes remain in app-private storage until you push them or delete them locally.
+
+## Data retention and deletion
+
+- **Local notes:** You can set a retention period in Settings to delete old notes from this device. This does not delete copies already pushed to your remote repository.
+- **Remote copies:** Managed by you on your git host.
+- **Uninstall:** Removing the app deletes all local zet data from the device.
+
+## Children
+
+zet is not directed at children under 13.
+
+## Changes
+
+We may update this policy. The “Last updated” date will change when we do. Continued use after changes constitutes acceptance.
+
+## Your rights
+
+Depending on your jurisdiction you may have rights to access, correct, or delete personal data. Because zet stores data locally and on **your** git host, you can delete local data by uninstalling or using retention settings, and manage remote data through your git provider.