diff --git a/.claude-plugin/plugin.json b/.claude-plugin/plugin.json
index c581522..d637eb7 100644
--- a/.claude-plugin/plugin.json
+++ b/.claude-plugin/plugin.json
@@ -9,6 +9,10 @@
   "license": "MIT",
   "repository": "https://github.com/robdmac/flow",
   "homepage": "https://github.com/robdmac/flow",
+  "documentationUrl": "https://github.com/robdmac/flow#readme",
+  "supportUrl": "https://github.com/robdmac/flow/issues",
+  "privacyPolicyUrl": "https://github.com/robdmac/flow#what-flow-does-on-your-machine",
+  "termsOfServiceUrl": "https://github.com/robdmac/flow/blob/main/LICENSE",
   "keywords": [
     "fun",
     "ui",
diff --git a/README.md b/README.md
index bf1cd64..7e98ae8 100644
--- a/README.md
+++ b/README.md
@@ -175,6 +175,8 @@ As in Claude Code, each session keeps its own settings, kept in the session itse
 
 ## What Flow does on your machine
 
+**Privacy:** Flow collects nothing. It has no servers, sends no data anywhere, and keeps what little it stores (below) on your machine, in Claude Code's own storage for the plugin.
+
 **Network:** none. Flow sends nothing anywhere and contacts no hosts. Everything it draws and plays is computed locally from the plugin's own files. The one call that takes anything out of the plugin is `$.audio.play`, which hands one of the plugin's own clips from `sounds/` (and a volume) to the local audio player, `afplay`: nothing Flow reads (settings, the conversation, your files) goes into it, and it reaches no address.
 
 **Your settings:** Flow writes its own `/config` rows (the `flow-scenes` plugin's options: scene, mode, sound and the rest) only when you run `/flow save`, which writes the settings your session shows as the defaults for new sessions. It reads them (`$.config.list()`) to start each session on your defaults.