diff --git a/PRIVACY.md b/PRIVACY.md
new file mode 100644
index 0000000..8fca6d2
--- /dev/null
+++ b/PRIVACY.md
@@ -0,0 +1,9 @@
+# Privacy
+
+cA2A (the ca2a runtime) collects and transmits no personal data.
+
+It runs locally as a Python library. It processes only the inputs you give it, entirely on your machine, and sends no telemetry, analytics, or usage data to agentrust-io, OPAQUE, or any third party. There is no account, login, or tracking, and no cookies or background network calls.
+
+It transmits delegation metadata only to the peer you explicitly call, over the transport you configure; it sends nothing to us.
+
+Uninstalling removes it completely. Questions or corrections: https://github.com/agentrust-io/ca2a/issues