diff --git a/templates/zerver/help/include/sidebar.md b/templates/zerver/help/include/sidebar.md
index a525d6995c..648c489481 100644
--- a/templates/zerver/help/include/sidebar.md
+++ b/templates/zerver/help/include/sidebar.md
@@ -147,6 +147,7 @@
 * [View all bots in your organization](/help/view-all-bots-in-your-organization)
 
 ## Stream management
+* [Stream permissions](/help/stream-privacy-settings)
 * [Delete or archive a stream](/help/delete-a-stream)
 * [Set default streams for new users](/help/set-default-streams-for-new-users)
 * [Rename a stream](/help/rename-a-stream)
diff --git a/templates/zerver/help/stream-privacy-settings.md b/templates/zerver/help/stream-privacy-settings.md
new file mode 100644
index 0000000000..cb8452c63b
--- /dev/null
+++ b/templates/zerver/help/stream-privacy-settings.md
@@ -0,0 +1,63 @@
+# Stream privacy settings
+
+There are three types of streams in Zulip.
+
+* **Public**: Anyone can join, and anyone can view the complete message
+  history without joining.
+
+* **Private, shared history**: You must be added by a member of the stream. The
+  complete message history is available as soon as you are added.
+
+* **Private, protected history**: You must be added by a member of the
+  stream. You only have access to the messages that are sent after you are added.
+
+## Privacy model for private streams
+
+At a high level:
+
+* Organization admins can see and modify most aspects of a private stream,
+  including the membership and estimated traffic. Admins cannot see stream
+  messages or do anything that would indirectly give them access to stream
+  messages, like adding members or changing the stream privacy settings.
+
+* Non-admins cannot easily see which private streams exist, or interact with
+  them in any way until they are added. Given a stream name, they can figure
+  out whether a stream with that name exists, but cannot see any other
+  details about the stream.
+
+## Detailed permissions
+
+### Public streams
+
+|                       | Org admins | Stream members | Org members |
+|---                    |---         |---             |---          |
+| Join                  | ✔   | —        | ✔    |
+| Add others            | ✔   | ✔       | ✔    |
+| See subscriber list   | ✔   | ✔       | ✔    |
+| See full history      | ✔   | ✔       | ✔    |
+| See estimated traffic | ✔   | ✔       | ✔    |
+| Change the privacy    | ✔   |                |             |
+| Rename                | ✔   |                |             |
+| Edit the description  | ✔   |                |             |
+| Remove others         | ✔   |                |             |
+| Delete                | ✔   |                |             |
+
+### Private streams
+
+|                       | Org admins | Stream members | Org members |
+|---                    |---         |---             |---          |
+| Join                  |            | —        |             |
+| Add others            |            | ✔       |             |
+| See subscriber list   | ✔   | ✔       |             |
+| See full history      |            | [1]            |             |
+| See estimated traffic | ✔   | ✔       |             |
+| Change the privacy    | [2]        |                |             |
+| Rename                | ✔   |                |             |
+| Edit the description  | ✔   |                |             |
+| Remove others         | ✔   |                |             |
+| Delete                | ✔   |                |             |
+
+[1] Depends on the stream type.
+
+[2] Yes, but only if subscribed. If you have a private stream without an
+admin, you'll have to add an admin in order to change the stream's privacy.