Publish privacy policy page and strip merged INTERNET permission

app/src/main/AndroidManifest.xml

@@ -6,6 +6,13 @@
     <uses-permission android:name="android.permission.RECORD_AUDIO" />
     <uses-feature android:name="android.hardware.camera.front" android:required="false" />
 
+    <!-- Play Services base libraries (transitive via bundled ML Kit face detection) merge
+         INTERNET and ACCESS_NETWORK_STATE into the final manifest. The bundled model needs
+         no network, so strip both to keep the merged manifest at exactly the two declared
+         runtime permissions and preserve the no network egress privacy posture. -->
+    <uses-permission android:name="android.permission.INTERNET" tools:node="remove" />
+    <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" tools:node="remove" />
+
     <application
         android:name=".BaselineMSApp"
         android:allowBackup="false"

web/app/components/Footer.tsx

@@ -6,6 +6,7 @@ export function Footer() {
         <div className="flex gap-5">
           <a href="https://github.com/MustafaNazeer/BaselineMS">GitHub</a>
           <a href="/methodology">Methodology</a>
+          <a href="/privacy-policy">Privacy policy</a>
         </div>
       </div>
     </footer>