fix: correct github→gitea/codeberg refs and add privacy policy page

- Replace github.ref with gitea.ref in ci.yml (Forgejo uses gitea context)
- Fix README.md CI path from .github/ to .forgejo/
- Use codeberg icon instead of github icon in hugo.toml social link
- Add Privacy Policy page required for Google Play Store submission
- Add Privacy Policy link to website nav menu

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.forgejo/workflows/ci.yml

@@ -28,7 +28,7 @@ jobs:
     name: Build Linux Release
     runs-on: self-hosted
     needs: check
-    if: github.ref == 'refs/heads/main'
+    if: gitea.ref == 'refs/heads/main'
 
     steps:
       - uses: actions/checkout@v4

README.md

@@ -143,7 +143,7 @@ Run them locally:
 task test-widget   # or: flutter test test/widget/
 ```
 
-They also run in CI on every push (see the **Widget tests** step in `.github/workflows/ci.yml`).
+They also run in CI on every push (see the **Widget tests** step in `.forgejo/workflows/ci.yml`).
 
 ### After changing the DB schema
 

website/content/privacy.md

@@ -0,0 +1,57 @@
+---
+title: 'Privacy Policy'
+date: 2026-05-13T00:00:00Z
+draft: false
+---
+
+**Last updated: May 13, 2026**
+
+## 1. Data Controller
+
+Thomas Güttler
+Email: tilldu@googlemail.com
+
+## 2. Overview
+
+SharedInbox is an email client for desktop and mobile. This policy explains what data we process and how.
+
+## 3. The SharedInbox App
+
+### What data the app processes
+
+The app processes the following data **exclusively on your device**:
+
+- **Email account credentials** (username, password, server addresses) — stored locally in your device's secure storage and never transmitted to us.
+- **Email messages and attachments** — fetched directly from your email provider's IMAP server and displayed in the app. We never receive, store, or process your emails.
+- **App settings and configuration** — stored locally on your device.
+
+### Network connections
+
+The app connects only to the email servers you configure (IMAP/SMTP). It does not connect to any SharedInbox servers, analytics services, or third-party tracking services.
+
+### No telemetry
+
+We do not collect crash reports, usage statistics, or any other telemetry from the app.
+
+## 4. This Website (sharedinbox.de)
+
+This website is a static site. It does not use cookies, trackers, or analytics. No personal data is collected when you visit this site.
+
+The web server may store standard access logs (IP address, requested URL, timestamp) for up to 7 days for security and operational purposes.
+
+## 5. Your Rights (GDPR)
+
+If you are located in the European Union, you have the right to:
+
+- Access the personal data we hold about you
+- Request correction or deletion of your data
+- Object to or restrict processing
+- Lodge a complaint with your local data protection authority
+
+Since the app processes all data locally on your device and we have no access to it, there is no personal data we hold server-side.
+
+To exercise your rights or for any privacy questions, contact us at: **tilldu@googlemail.com**
+
+## 6. Changes to This Policy
+
+We may update this policy from time to time. The current version is always available at this URL.

website/hugo.toml

@@ -14,5 +14,10 @@ theme = 'PaperMod'
         Content = "The modern IMAP/SMTP email client for your desktop and mobile."
 
     [[params.socialIcons]]
-        name = "github"
+        name = "codeberg"
         url = "https://codeberg.org/guettli/sharedinbox"
+
+[[menu.main]]
+    name = "Privacy Policy"
+    url = "/privacy/"
+    weight = 10