Close OSS self-host gaps: in-repo API docs, legal notes, and packaging.

Add MIT license and docs/api, strip SaaS status/admin remnants from robots and footer, align env/compose/README with payment-free product truth.

app/privacy/page.tsx

@@ -1,15 +1,76 @@
 import { LegalPageLayout } from "@/components/LegalPageLayout";
+import { LEGAL_OPERATOR } from "@/lib/legal/constants";
+import { DOCS_URL, GITEA_URL } from "@/lib/plans";
 
 export default function PrivacyPage() {
   return (
     <LegalPageLayout title="Privacy Policy">
       <p>
-        Songs2VID is self-hosted software. Your operator controls the deployment, database, uploads,
-        logs, and Google OAuth configuration. Songs2VID does not include payment processing.
+        This policy describes how a <strong>self-hosted Songs2VID</strong> instance typically
+        handles data. Songs2VID OSS does not include payment processing, plans, credits, or
+        Stripe. The person or organization that operates this deployment (the &quot;operator&quot;)
+        controls the server, database, uploads, logs, and Google OAuth configuration, and is
+        responsible for privacy compliance for their users.
       </p>
+
+      <h2>1. Who is responsible</h2>
       <p>
-        Google and YouTube process account and upload data according to their own policies. Contact
-        the operator of this instance for data access or deletion requests.
+        For this software package as published by {LEGAL_OPERATOR.legalName}, contact:{" "}
+        <a href={`mailto:${LEGAL_OPERATOR.email}`}>{LEGAL_OPERATOR.email}</a>. For data on{" "}
+        <em>this running instance</em>, contact the operator of the deployment you signed into —
+        not necessarily the hosted SaaS at songs2vid.com, which is a separate product with its own
+        policies.
+      </p>
+
+      <h2>2. Data this software processes</h2>
+      <ul>
+        <li>Account profile from Google sign-in (email, name, avatar)</li>
+        <li>YouTube OAuth tokens (encrypted at rest when configured) and channel metadata</li>
+        <li>Uploaded cover art, audio, optional logos/fonts, and derived video files</li>
+        <li>Job metadata (titles, tags, privacy, layouts, watermarks)</li>
+        <li>API key hashes and rate-limit counters</li>
+      </ul>
+
+      <h2>3. Google and YouTube</h2>
+      <p>
+        Google and YouTube process account and upload data under their own terms and policies.
+        Operators must configure OAuth correctly and respect{" "}
+        <a
+          href="https://developers.google.com/terms/api-services-user-data-policy"
+          target="_blank"
+          rel="noopener noreferrer"
+        >
+          Google API Services User Data Policy
+        </a>{" "}
+        and{" "}
+        <a
+          href="https://developers.google.com/youtube/terms/developer-policies"
+          target="_blank"
+          rel="noopener noreferrer"
+        >
+          YouTube API Services Policies
+        </a>
+        .
+      </p>
+
+      <h2>4. Your choices</h2>
+      <p>
+        Use <strong>Dashboard → Settings</strong> to export or delete your account data on this
+        instance, or ask the operator. You can also revoke Google access in your{" "}
+        <a
+          href="https://security.google.com/settings/security/permissions"
+          target="_blank"
+          rel="noopener noreferrer"
+        >
+          Google Account permissions
+        </a>
+        .
+      </p>
+
+      <h2>5. Documentation</h2>
+      <p>
+        Product docs: <a href={DOCS_URL}>{DOCS_URL}</a>. Source:{" "}
+        <a href={GITEA_URL}>{GITEA_URL}</a>.
       </p>
     </LegalPageLayout>
   );