Release Privacy Tools 0.2.0

public/docs/PRIVACY-SECURITY.md

@@ -55,5 +55,17 @@ filesystem metadata, clipboard/history records, application caches, backed-up
 originals, or cloud/recipient copies. Review the visible output, destination,
 report, and surrounding files yourself.
 
-The JSON report is sensitive by design: it can include original filenames,
-hashes, timestamps, and metadata values. Share or retain it only intentionally.
+The detailed JSON report is sensitive by design: it can include original
+filenames, hashes, timestamps, metadata values, offsets, and parser notes. Share
+or retain it only intentionally. The separate safe-share report replaces file
+identity with sequential pseudonyms and omits those source identifiers and raw
+values. It retains formats, dimensions, coverage states, note counts, and
+finding-category totals so it is useful for review without claiming anonymity.
+Safe-share ZIPs likewise use generic sequential output names.
+
+Selective-removal policy evidence follows the same pseudonymization boundary.
+It can show which finding categories a policy would remove, preserve, or send
+for review, but it never upgrades inspection coverage and never calls a format
+safe when no verified output exists. A requested “location-only” policy is
+therefore non-executable with the current all-metadata pixel re-encode; users
+receive evidence rather than a misleading partially preserved output.