diff --git a/docs/archive/privacy-2026-01-30.md b/docs/archive/privacy-2026-01-30.md
new file mode 100644
index 0000000..e335775
--- /dev/null
+++ b/docs/archive/privacy-2026-01-30.md
@@ -0,0 +1,77 @@
+# Privacy Policy — Archived Version
+
+Last updated: January 30, 2026
+
+This is an archived snapshot of the Privacy Policy as rendered on `/privacy`
+prior to the 2026-05-17 revision. It is kept for historical reference only.
+The current policy lives in `internal/ui/pages/privacy.templ`.
+
+---
+
+## 1. Introduction
+
+Welcome to {AppName} ("we," "our," or "us"). We are committed to protecting
+your personal information and your right to privacy. This Privacy Policy
+applies to our website and any related services (collectively, the "Service").
+
+{AppName} is operated by an individual developer based in Canada as a hobby
+project.
+
+## 2. Information We Collect
+
+We collect information that you provide directly to us when you use the
+Service:
+
+- **Account Information:** When you register, we collect your email address
+  and name (if provided).
+- **User Content:** We store the financial data, shopping lists, and other
+  content you manually enter into the Service.
+  *Note: We do not connect to your bank accounts or financial institutions.
+  The "financial" data stored is purely what you choose to type in, similar
+  to a spreadsheet.*
+- **Usage Data:** We may collect anonymous, aggregated information about how
+  the Service is accessed and used (e.g., pages viewed, time spent) to help
+  us improve the product.
+
+## 3. How We Use Your Information
+
+We use the information we collect to:
+
+- Provide, maintain, and improve the Service.
+- Authenticate your identity (via Magic Links or password).
+- Send you administrative emails (e.g., login links, space invitations,
+  welcome emails).
+- Respond to your comments or questions.
+
+## 4. Cookies and Tracking
+
+We use cookies and similar technologies primarily for essential functions,
+such as keeping you logged in. By using the Service, you consent to the use
+of these essential cookies.
+
+## 5. Data Storage and Third Parties
+
+Our Service is hosted on virtual private servers provided by **Hostinger**
+located in the **United States**. While we are based in Canada, your data
+may be processed and stored in the United States and subject to its laws.
+
+We self-host our email delivery system. We do not sell, trade, or otherwise
+transfer your personally identifiable information to outside parties for
+marketing purposes.
+
+## 6. Children's Privacy
+
+Our Service is not directed to anyone under the age of 13. We do not
+knowingly collect personal information from children under 13.
+
+## 7. Your Rights
+
+Depending on your location, you may have rights regarding your personal
+data, including the right to access, correct, or delete your data. You can
+delete your data by deleting your account within the application or by
+contacting us.
+
+## 8. Contact Us
+
+If you have any questions about this Privacy Policy, please contact us at
+{SupportEmail}.
diff --git a/internal/ui/pages/privacy.templ b/internal/ui/pages/privacy.templ
index 8df563a..fbcfaaf 100644
--- a/internal/ui/pages/privacy.templ
+++ b/internal/ui/pages/privacy.templ
@@ -26,7 +26,7 @@ templ Privacy() {
 					Back to Home
 				}
 				<h1 class="text-3xl font-bold tracking-tight sm:text-4xl mb-2">Privacy Policy</h1>
-				<p class="text-muted-foreground">Last updated: January 30, 2026</p>
+				<p class="text-muted-foreground">Last updated: May 17, 2026</p>
 			</div>
 			<div class="prose dark:prose-invert max-w-none space-y-8">
 				<section>
@@ -41,31 +41,35 @@ templ Privacy() {
 				</section>
 				<section>
 					<h2 class="text-2xl font-semibold mb-4">2. Information We Collect</h2>
-					<p class="text-muted-foreground mb-4">We collect information that you provide directly to us when you use the Service:</p>
+					<p class="text-muted-foreground mb-4">We only collect what is necessary to operate the Service:</p>
 					<ul class="list-disc pl-6 space-y-2 text-muted-foreground">
-						<li><strong>Account Information:</strong> When you register, we collect your email address and name (if provided).</li>
+						<li><strong>Account Information:</strong> When you register, we collect your email address and, optionally, your name.</li>
 						<li>
 							<strong>User Content:</strong> We store the financial data, shopping lists, and other content you manually enter into the Service.
 							<span class="block mt-1 italic text-sm">Note: We do not connect to your bank accounts or financial institutions. The "financial" data stored is purely what you choose to type in, similar to a spreadsheet.</span>
 						</li>
-						<li><strong>Usage Data:</strong> We may collect anonymous, aggregated information about how the Service is accessed and used (e.g., pages viewed, time spent) to help us improve the product.</li>
+						<li>
+							<strong>Server Request Logs:</strong> Our web server writes short-lived operational logs for each request. These logs include the request path, HTTP method, response status, timing, and your IP address. They are used for debugging, abuse prevention, and basic security monitoring.
+							<span class="block mt-1 italic text-sm">We do not run any web analytics, behavioural tracking, fingerprinting, or product telemetry — neither in-house nor through third parties.</span>
+						</li>
 					</ul>
 				</section>
 				<section>
 					<h2 class="text-2xl font-semibold mb-4">3. How We Use Your Information</h2>
 					<p class="text-muted-foreground mb-4">We use the information we collect to:</p>
 					<ul class="list-disc pl-6 space-y-2 text-muted-foreground">
-						<li>Provide, maintain, and improve the Service.</li>
+						<li>Provide and maintain the Service.</li>
 						<li>Authenticate your identity (via Magic Links or password).</li>
 						<li>Send you administrative emails (e.g., login links, space invitations, welcome emails).</li>
+						<li>Investigate errors, abuse, or security incidents using server request logs.</li>
 						<li>Respond to your comments or questions.</li>
 					</ul>
 				</section>
 				<section>
 					<h2 class="text-2xl font-semibold mb-4">4. Cookies and Tracking</h2>
 					<p class="text-muted-foreground">
-						We use cookies and similar technologies primarily for essential functions, such as keeping you logged in.
-						By using the Service, you consent to the use of these essential cookies.
+						We use cookies strictly for essential functions: keeping you logged in (authentication cookie) and protecting forms against cross-site request forgery (CSRF cookie).
+						We do not set advertising, analytics, or cross-site tracking cookies.
 					</p>
 				</section>
 				<section>
@@ -75,7 +79,7 @@ templ Privacy() {
 						While we are based in Canada, your data may be processed and stored in the United States and subject to its laws.
 					</p>
 					<p class="text-muted-foreground">
-						We self-host our email delivery system. We do not sell, trade, or otherwise transfer your personally identifiable information to outside parties for marketing purposes.
+						Email delivery is self-hosted on our own infrastructure. We do not embed third-party analytics, advertising networks, or tracking SDKs in the Service, and we do not sell, trade, or transfer your personal information to outside parties.
 					</p>
 				</section>
 				<section>