diff --git a/src/lib/paths.ts b/src/lib/paths.ts
index 6fbdc75..128092c 100644
--- a/src/lib/paths.ts
+++ b/src/lib/paths.ts
@@ -19,6 +19,8 @@ const APP_SECTIONS = new Set([
 	"admin",
 	"auth",
 	"post",
+	"privacy",
+	"terms",
 ]);
 
 export function toAppPath(href: string, origin?: string): string | null {
@@ -89,6 +91,10 @@ export function appPathLabel(appPath: string, titles?: Record<string, string>):
 			return "Sign in";
 		case "post":
 			return rest === "question" ? "New question" : "New note";
+		case "privacy":
+			return "Privacy policy";
+		case "terms":
+			return "Terms";
 		default:
 			return rest ? `${head} post` : head;
 	}
diff --git a/src/routes/+layout.svelte b/src/routes/+layout.svelte
index 468e9f9..f9d2b3d 100644
--- a/src/routes/+layout.svelte
+++ b/src/routes/+layout.svelte
@@ -43,6 +43,10 @@
 				DSEC Notebook is a community resource for Deakin University students. Not affiliated
 				with Deakin University.
 			</p>
+			<nav class="mt-4 flex flex-wrap gap-x-5 gap-y-2" aria-label="Legal">
+				<a href="/privacy" class="nav-link">Privacy</a>
+				<a href="/terms" class="nav-link">Terms</a>
+			</nav>
 		</div>
 	</footer>
 </div>
diff --git a/src/routes/auth/+layout.svelte b/src/routes/auth/+layout.svelte
new file mode 100644
index 0000000..a41b42c
--- /dev/null
+++ b/src/routes/auth/+layout.svelte
@@ -0,0 +1,35 @@
+<script lang="ts">
+	import { goto } from "$app/navigation";
+	import { initAuth, isAuthenticated } from "$lib/stores/auth";
+	import { onMount } from "svelte";
+	import { get } from "svelte/store";
+
+	let { children } = $props();
+	let ready = $state(false);
+
+	onMount(() => {
+		let cancelled = false;
+
+		(async () => {
+			await initAuth();
+			if (cancelled) return;
+			if (get(isAuthenticated)) {
+				await goto("/account", { replaceState: true });
+				return;
+			}
+			ready = true;
+		})();
+
+		return () => {
+			cancelled = true;
+		};
+	});
+</script>
+
+{#if ready}
+	{@render children()}
+{:else}
+	<div class="page">
+		<p class="kicker py-16">Loading</p>
+	</div>
+{/if}
diff --git a/src/routes/auth/login/+page.svelte b/src/routes/auth/login/+page.svelte
index 31d67e7..3539994 100644
--- a/src/routes/auth/login/+page.svelte
+++ b/src/routes/auth/login/+page.svelte
@@ -242,6 +242,15 @@
 						{loading ? "Sending code..." : "Send verification code"}
 					</button>
 
+					<p class="text-faint text-xs leading-relaxed">
+						By creating an account you agree to the
+						<a href="/terms" class="text-secondary hover:text-secondary-dark">Terms</a>
+						and
+						<a href="/privacy" class="text-secondary hover:text-secondary-dark"
+							>Privacy policy</a
+						>.
+					</p>
+
 					<button
 						type="button"
 						onclick={() => switchMode("signin")}
diff --git a/src/routes/privacy/+page.svelte b/src/routes/privacy/+page.svelte
new file mode 100644
index 0000000..e314081
--- /dev/null
+++ b/src/routes/privacy/+page.svelte
@@ -0,0 +1,130 @@
+<svelte:head>
+	<title>Privacy policy — DSEC Notebook</title>
+	<meta
+		name="description"
+		content="How DSEC Notebook collects, uses, and stores personal information for Deakin University students."
+	/>
+</svelte:head>
+
+<div class="page">
+	<p class="kicker">Legal</p>
+	<h1 class="text-ink mt-2 font-serif text-4xl font-medium">Privacy policy</h1>
+	<p class="text-muted mt-2 text-sm">Last updated 18 September 2026</p>
+
+	<div class="markdown border-rule mt-8 max-w-2xl border-t pt-8 text-[15px] leading-relaxed">
+		<p>
+			DSEC Notebook (“Notebook”, “we”, “us”) is a student-run community resource at
+			<a href="https://notebook.dsec.club/">notebook.dsec.club</a>. It is not affiliated with
+			Deakin University. This policy explains what personal information we collect, why we
+			collect it, and the choices you have.
+		</p>
+
+		<h2>Information we collect</h2>
+		<p>We collect the information you give us when you use Notebook:</p>
+		<ul>
+			<li>
+				<strong>Account details.</strong> Your Deakin email address, display name, password (stored
+				as a salted hash, not in plain text), and optional profile picture.
+			</li>
+			<li>
+				<strong>Content you post.</strong> Notes, questions, comments, votes, and units you pin.
+			</li>
+			<li>
+				<strong>Session data.</strong> A sign-in token stored in your browser so you stay signed
+				in.
+			</li>
+			<li>
+				<strong>Verification data.</strong> Short-lived email codes when you create an account
+				or reset a password. We also store hashed request limits so we can reduce abuse of verification
+				emails.
+			</li>
+		</ul>
+
+		<h2>How we use it</h2>
+		<p>We use this information to:</p>
+		<ul>
+			<li>create and maintain your account</li>
+			<li>verify that you have a <code>@deakin.edu.au</code> address</li>
+			<li>show your name, avatar, and posts to other visitors</li>
+			<li>send verification and password-reset emails</li>
+			<li>moderate the community and keep the service running</li>
+		</ul>
+		<p>We do not sell your personal information, and we do not use it for advertising.</p>
+
+		<h2>What is public</h2>
+		<p>
+			Your display name, profile picture, and the notes, questions, and comments you post are
+			visible to anyone who can open Notebook. Your email address is not shown on your public
+			profile.
+		</p>
+
+		<h2>Cookies and local storage</h2>
+		<p>Notebook stores a few things in your browser:</p>
+		<ul>
+			<li>
+				<strong>Session token</strong> in local storage, so we can recognise you after you sign
+				in.
+			</li>
+			<li>
+				<strong>Theme preference</strong> in local storage (light or dark).
+			</li>
+			<li>
+				<strong>Verification cookie</strong> (<code>dsec_verification_client</code>), an
+				http-only cookie used only to rate-limit verification emails and reduce abuse. It is
+				not used for advertising or cross-site tracking.
+			</li>
+		</ul>
+		<p>
+			We also receive the IP address of verification-email requests so we can apply the same
+			rate limits.
+		</p>
+
+		<h2>Email and other services</h2>
+		<p>
+			We send account emails (verification and password reset) through
+			<a href="https://resend.com/">Resend</a>. Those messages include your email address and
+			the one-time code. Uploaded profile images are stored on our server and served from
+			Notebook.
+		</p>
+
+		<h2>How long we keep it</h2>
+		<p>
+			We keep your account, posts, and related records for as long as your account exists, or
+			as long as the content remains on Notebook. Verification codes expire after 10 minutes.
+			You can update your display name and profile picture from your
+			<a href="/account">account</a> page. To ask us to delete your account or personal information,
+			contact us using the details below.
+		</p>
+
+		<h2>Your choices</h2>
+		<ul>
+			<li>You can edit your profile and password while signed in.</li>
+			<li>
+				You can sign out at any time, which removes the session token from this browser.
+			</li>
+			<li>You can ask us to correct or delete personal information we hold about you.</li>
+		</ul>
+
+		<h2>Children</h2>
+		<p>
+			Notebook is intended for Deakin University students. It is not directed at children
+			under 16.
+		</p>
+
+		<h2>Changes</h2>
+		<p>
+			We may update this policy from time to time. The “Last updated” date at the top will
+			change when we do. Continued use of Notebook after an update means you accept the
+			revised policy.
+		</p>
+
+		<h2>Contact</h2>
+		<p>
+			Questions about this policy or your personal information can be sent through the DSEC
+			Discord at <a href="https://discord.dsec.club">discord.dsec.club</a>.
+		</p>
+		<p>
+			See also our <a href="/terms">Terms and conditions</a>.
+		</p>
+	</div>
+</div>
diff --git a/src/routes/terms/+page.svelte b/src/routes/terms/+page.svelte
new file mode 100644
index 0000000..9842ece
--- /dev/null
+++ b/src/routes/terms/+page.svelte
@@ -0,0 +1,129 @@
+<svelte:head>
+	<title>Terms and conditions — DSEC Notebook</title>
+	<meta
+		name="description"
+		content="Terms and conditions for using DSEC Notebook, a student-run notes and questions hub for Deakin University."
+	/>
+</svelte:head>
+
+<div class="page">
+	<p class="kicker">Legal</p>
+	<h1 class="text-ink mt-2 font-serif text-4xl font-medium">Terms and conditions</h1>
+	<p class="text-muted mt-2 text-sm">Last updated 18 September 2026</p>
+
+	<div class="markdown border-rule mt-8 max-w-2xl border-t pt-8 text-[15px] leading-relaxed">
+		<p>
+			These terms govern your use of DSEC Notebook (“Notebook”), a student-run community
+			resource at <a href="https://notebook.dsec.club/">notebook.dsec.club</a>. By creating an
+			account or using Notebook, you agree to these terms. If you do not agree, do not use the
+			service.
+		</p>
+
+		<h2>About Notebook</h2>
+		<p>
+			Notebook is an independent community project for Deakin University students. It is
+			<strong>not affiliated with, endorsed by, or operated by Deakin University</strong>.
+			Unit codes, unit names, and similar course details are used only to organise
+			student-shared material.
+		</p>
+
+		<h2>Eligibility</h2>
+		<p>
+			Contributing (creating an account, posting, voting, or commenting) is limited to people
+			with a valid <code>@deakin.edu.au</code> email address. You must be able to receive email
+			at that address to verify your account. Browsing public content does not require an account.
+		</p>
+
+		<h2>Accounts</h2>
+		<ul>
+			<li>You are responsible for the accuracy of the details you provide.</li>
+			<li>You must keep your password confidential and not share your account.</li>
+			<li>
+				You are responsible for activity that happens on your account. Tell us if you think
+				someone else has used it.
+			</li>
+			<li>
+				We may suspend or remove accounts that break these terms, including accounts that
+				are not genuine Deakin student accounts.
+			</li>
+		</ul>
+
+		<h2>Your content</h2>
+		<p>
+			You keep ownership of the notes, questions, comments, and other material you post. By
+			posting, you give DSEC Notebook a non-exclusive licence to store, display, and
+			distribute that content on the service so other students can read it.
+		</p>
+		<p>You confirm that:</p>
+		<ul>
+			<li>you have the right to post the content</li>
+			<li>it does not infringe someone else’s copyright or other rights</li>
+			<li>it is not unlawful, harassing, or misleading</li>
+		</ul>
+		<p>
+			Content you post is public. Do not include personal information you would not want
+			others to see, such as student IDs, private correspondence, or unpublished assessment
+			material that is not yours to share.
+		</p>
+
+		<h2>Academic integrity</h2>
+		<p>
+			Notebook is for sharing study notes and asking questions. It is not a place to
+			commission, sell, or request completed assignments, exam answers, or other work that
+			would breach Deakin’s academic integrity rules. You remain responsible for following
+			Deakin’s policies. Using material from Notebook in assessed work without proper
+			acknowledgement may constitute academic misconduct.
+		</p>
+
+		<h2>Acceptable use</h2>
+		<p>You agree not to:</p>
+		<ul>
+			<li>harass, threaten, or abuse other users</li>
+			<li>post spam, malware, or content that is illegal</li>
+			<li>attempt to access other accounts or disrupt the service</li>
+			<li>scrape or copy the site in a way that overloads or undermines it</li>
+			<li>misrepresent your identity or affiliation</li>
+		</ul>
+
+		<h2>Moderation</h2>
+		<p>
+			We may edit, hide, or delete content, and we may restrict or delete accounts, when we
+			consider it necessary to protect the community or the service. We are not obliged to
+			review every post before it appears.
+		</p>
+
+		<h2>No warranty</h2>
+		<p>
+			Notebook is provided as a volunteer community resource, “as is”. Study notes and answers
+			are written by students and may be incomplete or incorrect. We do not guarantee that the
+			service will always be available, secure, or error-free, or that content is suitable for
+			any particular unit, assessment, or exam.
+		</p>
+
+		<h2>Limitation of liability</h2>
+		<p>
+			To the extent permitted by law, DSEC and the people who maintain Notebook are not liable
+			for loss arising from your use of the service or from reliance on content posted by
+			users. This does not exclude any rights you cannot waive under Australian consumer law.
+		</p>
+
+		<h2>Changes and termination</h2>
+		<p>
+			We may change these terms, or change or discontinue Notebook, at any time. The “Last
+			updated” date at the top will change when the terms are revised. Continued use after an
+			update means you accept the revised terms. You may stop using Notebook at any time.
+		</p>
+
+		<h2>Privacy</h2>
+		<p>
+			How we handle personal information is described in our
+			<a href="/privacy">Privacy policy</a>.
+		</p>
+
+		<h2>Contact</h2>
+		<p>
+			Questions about these terms can be sent through the DSEC Discord at
+			<a href="https://discord.dsec.club">discord.dsec.club</a>.
+		</p>
+	</div>
+</div>