Add Terms of Service and Privacy Policy (plain-language, architecture-grounded)

README.md

@@ -65,7 +65,14 @@ Because Tinfoil requires EHBP-encrypted request bodies (it rejects plaintext wit
 
 Members govern the project through [Loomio](https://www.loomio.com) and the Open Collective. See the [Charter](charter.md) for the cooperative's values, membership terms, and governance structure, and [Open Questions](open-questions.md) for the decisions currently open for member discussion.
 
-During the pilot phase, Nathan Schneider serves as Managing Director and has sole final discretion on decisions. 
+During the pilot phase, Nathan Schneider serves as Managing Director and has sole final discretion on decisions.
+
+## Legal
+
+- [Terms of Service](terms-of-service.md) — the agreement between the cooperative and its members about the service.
+- [Privacy Policy](privacy-policy.md) — how we handle your data, including what we can and can't see.
+
+By creating your account, you agree to these terms. 
 
 ---