Initial scaffold: submissions page + reader-magnet stub

Mirrors twosquirrelspress-site's submissions form and
michaelferrara-site's gift/course-enroll pattern. Gift page content,
cover art, and the download file are stubs until the real
reader-magnet is ready.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

content/privacy.md

@@ -0,0 +1,65 @@
+---
+title: "Privacy Policy"
+description: "How thistleandmoth.org collects, uses, and protects your information."
+---
+
+_Last updated: July 2026_
+
+This policy explains what information this site collects through use of
+thistleandmoth.org, and what happens to it.
+
+## What this site collects
+
+Depending on how you use the site, that may include:
+
+- Your name, email address, and message, when you submit the contact form.
+- Your email address, if you sign up for the free story.
+- Your email address and name, if given, if you opt in to ongoing updates.
+- Your name, email, manuscript, bio, and (optionally) a headshot, if you
+  submit work through the [submissions page](/submissions/).
+
+This site doesn't use third-party analytics, ad trackers, or tracking
+pixels. Everything above runs on infrastructure operated directly —
+nothing is handed to a third-party marketing platform.
+
+## Why this site collects it
+
+- To respond to messages sent through the contact form.
+- To deliver the free story you signed up for.
+- To review manuscripts submitted for consideration.
+- To send periodic updates to people who've explicitly opted in — never
+  as a side effect of simply using the site.
+
+## What this site doesn't do
+
+- This site doesn't sell or rent your information to anyone.
+- This site doesn't share it with third parties except the infrastructure
+  providers necessary to run the site and send email (e.g. the hosting
+  provider and its network) — none of whom get to use it for their own
+  purposes.
+
+## Your control over it
+
+- **Unsubscribe**: every ongoing-update email includes an unsubscribe
+  link. Clicking it removes you from that list immediately.
+- **The free story**: this is a one-off signup with no ongoing
+  subscription — once you've received it, there's nothing further to opt
+  out of unless you also joined the ongoing updates list.
+- **Deletion**: reach out through [the contact form](/contact/) and
+  your information will be deleted from these systems.
+
+## Security
+
+Your information is stored on infrastructure controlled directly, not
+handed off to third-party SaaS platforms. That doesn't make it
+invulnerable — no system is — but it does mean there's exactly one place
+your data lives, and one party accountable for it.
+
+## Changes
+
+If this policy changes in a way that matters, the date at the top of this
+page will be updated.
+
+## Questions
+
+[Get in touch](/contact/).