diff --git a/index.html b/index.html
index 986e7d6..34d9857 100644
--- a/index.html
+++ b/index.html
@@ -433,6 +433,27 @@
                             <li><strong>URL datasets</strong> — Reference remote data by URL. Astrolabe fetches and caches it for preview, but the URL is what gets stored.</li>
                         </ul>
                     </section>
+
+                    <!-- Privacy Policy -->
+                    <section class="help-section">
+                        <h3 class="help-heading">Privacy & Data</h3>
+                        <p class="help-text">
+                            <strong>Your data stays yours.</strong> Astrolabe is built with privacy as a core principle:
+                        </p>
+                        <ul class="help-list">
+                            <li><strong>Local-first architecture</strong> — All snippets and datasets are stored in your browser (localStorage and IndexedDB). Nothing is sent to any server.</li>
+                            <li><strong>No accounts, no signup</strong> — There's no authentication system, no user profiles, no cloud sync. Your work exists only on your machine.</li>
+                            <li><strong>No cookies</strong> — Astrolabe doesn't use cookies or any persistent tracking identifiers.</li>
+                            <li><strong>Privacy-friendly analytics</strong> — We use GoatCounter (privacy-focused, GDPR-compliant) to track basic usage patterns like "snippet created" or "dataset exported." We collect <strong>zero personal information</strong>: no snippet names, no dataset content, no IP addresses, no user identifiers. Just aggregate counts to understand which features are used.</li>
+                            <li><strong>Data portability</strong> — Export all your snippets and datasets anytime as standard JSON/CSV/TSV files. No vendor lock-in.</li>
+                        </ul>
+                        <p class="help-text">
+                            <strong>What analytics we collect:</strong> Action types (e.g., "snippet-create", "dataset-export"), generic metadata (e.g., format types like JSON/CSV, counts like "5 snippets"). That's it.
+                        </p>
+                        <p class="help-text">
+                            <strong>What we DON'T collect:</strong> Snippet names, dataset names, actual data content, URLs, email addresses, or any personally identifiable information.
+                        </p>
+                    </section>
                 </div>
             </div>
         </div>