Release Privacy Tools 0.2.0

docs/ARCHITECTURE.md

@@ -27,8 +27,14 @@ arrays, and plain objects. No parser returns HTML or a live third-party object.
    decoded sample. `buildSanitizationReport` assigns verified/warning/failed
    based on explicit coverage and output findings.
 6. `archive` serializes bounded deterministic JSON and creates stored ZIP
-   entries from application-generated `images/` paths and sanitized unique
-   names.
+   entries from application-generated `images/` paths. Safe-share archives use
+   generic sequential image names and a reduced report; detailed reports remain
+   an explicit, separate download for local auditing.
+7. `policy` applies frozen, versioned category rules to normalized findings. It
+   creates pseudonymous per-file evidence across every inventoried format and
+   separately reports whether the requested removal can be executed by the
+   existing verified re-encode path. New policy profiles can be added without
+   changing a container parser.
 
 Pixel decoding and Canvas encoding currently run on the main browser context
 because portable cross-browser image encoder support is there; metadata parsing

docs/PRIVACY-SECURITY.md

@@ -55,5 +55,17 @@ filesystem metadata, clipboard/history records, application caches, backed-up
 originals, or cloud/recipient copies. Review the visible output, destination,
 report, and surrounding files yourself.
 
-The JSON report is sensitive by design: it can include original filenames,
-hashes, timestamps, and metadata values. Share or retain it only intentionally.
+The detailed JSON report is sensitive by design: it can include original
+filenames, hashes, timestamps, metadata values, offsets, and parser notes. Share
+or retain it only intentionally. The separate safe-share report replaces file
+identity with sequential pseudonyms and omits those source identifiers and raw
+values. It retains formats, dimensions, coverage states, note counts, and
+finding-category totals so it is useful for review without claiming anonymity.
+Safe-share ZIPs likewise use generic sequential output names.
+
+Selective-removal policy evidence follows the same pseudonymization boundary.
+It can show which finding categories a policy would remove, preserve, or send
+for review, but it never upgrades inspection coverage and never calls a format
+safe when no verified output exists. A requested “location-only” policy is
+therefore non-executable with the current all-metadata pixel re-encode; users
+receive evidence rather than a misleading partially preserved output.