[codex] Draft privacy policy for release (#434)

[jjoonleo]

Summary

• Advances [Release] Draft and approve the privacy policy #434 and references parent track [Release Track] Privacy, account deletion, and Data safety #464.
• Adds a repo-owned OnTime privacy policy draft with explicit non-publication status and product/legal approval blockers.
• Documents the reviewed frontend data flows, third-party processors, security handling, retention/deletion placeholders, and release-owner checklist.
• Links the draft from the docs index and records the issue-specific plan.

Verification

• git diff --check
• git diff --cached --check
• rg -n "TODO|#439|Privacy Policy|Google Play|account deletion|retention|Developer legal entity|privacy contact" docs/Privacy-Policy-Draft.md plans/434-privacy-policy-draft.md

Docs-only change; Flutter analyzer/tests were not run.

Remaining human tasks

• Backend owner must complete [Release] Verify backend account and data deletion behavior #439 and confirm deletion/retention behavior by data type and auth provider.
• Product/legal owner must confirm the Google Play developer/entity name.
• Product/legal owner must provide the privacy contact method.
• Product/legal owner must confirm active backend processors/monitoring/logging providers and whether Kakao is inactive or needs disclosure.
• Product/legal owner must approve final policy text before [Release] Draft and approve the privacy policy #434 can close.
• Release owner must pass approved text to [Release] Host the privacy policy on a public HTTPS URL #435 for public HTTPS hosting, then use the hosted URL in [Release] Enter privacy policy URL in Play Console #437.