diff --git a/frontend/src/customer/PrivacyPolicy.tsx b/frontend/src/customer/PrivacyPolicy.tsx
index 754d8f7..33fd5ba 100755
--- a/frontend/src/customer/PrivacyPolicy.tsx
+++ b/frontend/src/customer/PrivacyPolicy.tsx
@@ -51,6 +51,31 @@ export default function PrivacyPolicy() {
           your browser until you close the tab or clear it.
         </Paragraph>
 
+        <Title level={4}>Cookies and browser storage</Title>
+        <Paragraph>
+          We do not show a cookie banner, because until you ask for something that needs one we do
+          not set anything that requires your permission. Here is everything, so you can check that
+          claim rather than take it on trust:
+        </Paragraph>
+        <Paragraph>
+          <strong>A sign-in cookie (<code>rd_session</code>).</strong> Set only when you sign in,
+          and only so the site knows it is still you on the next page. It cannot be read by
+          JavaScript, is not shared with anyone, and is not used to track you. Signing out removes
+          it. This is what the rules call a strictly necessary cookie: without it, signing in would
+          not work at all, so it does not need — and we do not ask for — separate consent.
+        </Paragraph>
+        <Paragraph>
+          <strong>Two preferences kept in your browser</strong>, not cookies and never sent to us:
+          whether you chose the light or dark theme, and how many items you like to see per page.
+          They stay on your device and are readable only by this site. Clearing your browser data
+          removes them.
+        </Paragraph>
+        <Paragraph>
+          <strong>Brevo's tracking cookie — only if you opted in to sharing your activity.</strong>{' '}
+          If you have not, the script that would set it is never loaded, so the cookie never exists.
+          It is not set for signed-out visitors under any circumstances.
+        </Paragraph>
+
         <Title level={4}>Your rights</Title>
         <Paragraph>
           You may request a copy of your data ("Download my data" in your account page), or delete your