Privacy policy page and site footer #196

Problem

The app collects real user data with no privacy policy: Firebase Auth (email, display name, provider IDs), Firestore (map titles, node text, collaborator UIDs, everUpdatedBy history), Google Analytics + Performance Monitoring, and App Check (reCAPTCHA v3 device/browser signal).

Two aggravating factors:

• Anonymous accounts are created automatically for every visitor who opens /mindmaps or a shared map (AnonymousAuth wraps those routes) — users are in the auth system before consenting to anything.
• The pitch targets students, so some users are plausibly under 13 — COPPA applies, affecting the sign-up flow, and requiring child-directed/non-personalized configuration if ads ever run.

Proposed approach

• Draft the policy from the actual data inventory above; a human reviews it before it ships (counsel if being careful).
• Add a footer following the exact Navigation pattern in src/components/Routing/index.tsx: present on Home, About, SignIn, CreateAccount, Account, ManageMindMaps; deliberately absent on /mindmaps/:mindmapID to keep the canvas chrome-free. Content: privacy policy link, GitHub link, optionally the Congressional App Challenge award mention.
• Operationally: enable Firebase's auto-cleanup of stale anonymous accounts, since they otherwise accumulate forever.
• Sequencing: do this once the stack stops moving, since the policy must describe what is actually live. Any ads decision is strictly after this ships.

Acceptance criteria

• Privacy policy page live, covering auth (incl. anonymous), Firestore content, Analytics/Perf, App Check, and COPPA posture
• Footer on the marketing/account routes, absent on the map canvas
• Anonymous-account auto-cleanup enabled
• Human review of the policy text recorded before merge

References

ROADMAP.md section 10.