diff --git a/html/priv.ejs b/html/priv.ejs
index b8354ade..7a80fe9d 100644
--- a/html/priv.ejs
+++ b/html/priv.ejs
@@ -12,8 +12,7 @@
 
 
    <style>
-    /* ===== Reset & base ===== */
-    *, *::before, *::after { box-sizing: border-box; }
+     *, *::before, *::after { box-sizing: border-box; }
     html, body { margin: 0; padding: 0; }
     html { -webkit-text-size-adjust: 100%; text-size-adjust: 100%; }
     body {
@@ -264,6 +263,7 @@
             <li><a href="#summary">TL;DR</a></li>
             <li><a href="#what-we-collect">What We Do/Don’t Collect</a></li>
              <li><a href="#cookies">Cookies &amp; Storage</a></li>
+            <li><a href="#openstreetmap">OpenStreetMap</a></li>
             <li><a href="#third-parties">Third-Party Requests &amp; Proxy</a></li>
             <li><a href="#legal-bases">Legal Bases (GDPR)</a></li>
             <li><a href="#your-rights">Your Rights</a></li>
@@ -358,6 +358,20 @@
       </ul>
     </section>
 
+
+
+<!-- OpenStreetMap -->
+<section id="openstreetmap" class="policy">
+<h2>OpenStreetMap</h2>
+<p>
+Poke Maps uses <a href="https://www.openstreetmap.org/" target="_blank" rel="noopener">OpenStreetMap</a> data. That means when you explore maps at <a href="/map">/map</a>, we embed OSM via an <strong>iframe</strong> directly into the Poke site. The tiles and geographic info are delivered from OSM contributors’ servers.
+While Poke itself doesn’t collect any of your data, OpenStreetMap’s tile servers have their own <a href="https://wiki.osmfoundation.org/wiki/Privacy_Policy" target="_blank" rel="noopener">privacy policy</a>.  
+</p>
+<p>
+TL;DR: we still don’t know who you are, but since it’s an embedded iframe, map tile requests go to OSM’s infrastructure and may be logged in basic form (like request counts) to keep their servers running.
+</p>
+</section>
+
     <!-- Third parties -->
     <section id="third-parties" class="policy">
       <h2>Third‑Party Requests &amp; Proxy</h2>