docs: add privacy policy

Add privacy policy covering current plugin functionality and optional
network features (ICS subscriptions, webhooks). Will be updated when
calendar integration is added.

PRIVACY.md

@@ -0,0 +1,51 @@
+# TaskNotes Privacy Policy
+
+Last updated: October 12, 2025
+
+## Overview
+
+TaskNotes is an Obsidian plugin that helps you manage tasks within your notes.
+
+## Data Collection and Usage
+
+TaskNotes does not collect, transmit, or share any of your data.
+
+## Data Storage
+
+- All task and note data remains local to your Obsidian vault
+- Plugin settings are stored locally in Obsidian's configuration
+- No data is sent to external servers or third parties
+
+## Data Deletion
+
+You can delete your data at any time:
+- Disable the plugin to stop processing tasks
+- Remove the plugin to delete all plugin settings
+- Your notes remain in your Obsidian vault under your control
+
+## Network Requests (Optional Features)
+
+TaskNotes operates locally by default, but includes optional features that make network requests when you enable them:
+
+**Optional network features:**
+- **ICS Calendar Subscriptions**: If you configure calendar subscriptions, TaskNotes fetches calendar data from the URLs you provide (e.g., Google Calendar, Outlook)
+- **Webhooks**: If you configure webhooks, TaskNotes sends task event data to the webhook URLs you specify
+
+**What we never do:**
+- No analytics or tracking
+- No telemetry data collection
+- No external network requests to TaskNotes servers (we don't have any servers)
+- Your notes remain local to your device
+
+## Changes to Privacy Policy
+
+We may update this policy. Changes will be posted in this file with an updated date.
+
+## Contact
+
+For questions or concerns about privacy, please open an issue on GitHub:
+- https://github.com/calluma/tasknotes/issues
+
+## Open Source
+
+TaskNotes is open source software. You can review the code at https://github.com/calluma/tasknotes to verify these privacy practices.