chore: update hosted privacy policy for Firebase Analytics release

[jjoonleo]

Summary

Update the backend-hosted OnTime privacy policy page before releasing the OnTime-front version that enables Firebase Analytics / Help Improve OnTime.

This is a release handoff item. It does not need to ship for the analytics preference API alone, but it must be complete before any frontend release that includes Firebase Analytics collection.

Hosted policy URL:

• https://ontime-back.duckdns.org/privacy-policy

Related backend API issue:

• feat: add account-scoped analytics preference API #318

Required policy page changes

The hosted privacy policy should match the updated OnTime-front draft and include:

• Product usage analytics data as a collected/accessed data category.
• Firebase Analytics as a third-party service/provider.
• The Help Improve OnTime opt-out setting.
• Purposes: product improvement, debugging and operations, and non-personalized experiments.
• A statement that marketing and personalization are not enabled for this release.
• A statement that raw schedule names, notes, place names, preparation step names, email, OAuth identifiers, FCM token, raw exceptions, request bodies, response bodies, and free text are not included in analytics events.
• Account deletion behavior: future user-linked Product Usage Events stop, Firebase Analytics user association is cleared by the app, and historical analytics may be retained only in aggregate or de-identified form.
• Any confirmed Firebase console settings, optional exports, linked Google services, or backend processors if they process personal or sensitive user data.

Source wording

Use the updated OnTime-front draft as the source of truth when preparing the hosted text:

• docs/Privacy-Policy-Draft.md in OnTime-front
• docs/Google-Play-Data-Safety.md in OnTime-front
• docs/Analytics-Preference-API.md in OnTime-front
• docs/Analytics-Event-Catalog.md in OnTime-front

Acceptance criteria

• The hosted page at https://ontime-back.duckdns.org/privacy-policy includes the approved Firebase Analytics / Help Improve OnTime wording.
• Product/legal owner has approved the final text before publication.
• Firebase console settings and optional exports have been confirmed or explicitly documented as disabled.
• The hosted page remains publicly accessible without login.
• The updated hosted text matches the Google Play Data Safety answers used for the Firebase Analytics release.

Out of scope

• Implementing the analytics preference API; tracked separately in feat: add account-scoped analytics preference API #318.
• Defining Firebase event names.
• Flutter UI or BLoC instrumentation.
• Enabling marketing or personalization analytics.