diff --git a/PRIVACY.md b/PRIVACY.md
new file mode 100644
index 0000000..b83cbd3
--- /dev/null
+++ b/PRIVACY.md
@@ -0,0 +1,37 @@
+# Privacy Policy
+
+**Forji** is an open-source iOS client for Forgejo. This policy explains how the app handles your data.
+
+## Data Collection
+
+Forji does not collect, store, or transmit any personal data to the developer or any third party.
+
+## Data Storage
+
+All data stays on your device:
+
+- **Credentials** (passwords and API tokens) are stored in the iOS Keychain, encrypted by the operating system.
+- **Server configuration** (instance URLs and usernames) is stored locally on your device using SwiftData.
+- **Preferences** (such as appearance settings) are stored locally in UserDefaults.
+
+## Network Communication
+
+Forji communicates exclusively with the Forgejo server(s) you configure. No data is sent anywhere else. The app supports HTTPS and allows connections to self-hosted instances that may use self-signed certificates.
+
+## Analytics and Tracking
+
+Forji does not include any analytics, tracking, or advertising frameworks.
+
+## Third-Party Services
+
+Forji does not integrate with any third-party services. The only network communication is between the app and your Forgejo instance(s).
+
+## Changes to This Policy
+
+Any updates to this privacy policy will be published in this repository.
+
+## Contact
+
+If you have questions about this privacy policy, please open an issue on the [Forji repository on Codeberg](https://codeberg.org/secana/Forji).
+
+*Last updated: February 28, 2026*