S2 (a1): compliance + approval pack

- /responsible-gambling rebuilt sincerely: 21+, 1-800-GAMBLER primary,
  17-state resource list, warning signs, self-exclusion guidance, links
  to the existing /settings surfaces. No marketing adjacency.
- /terms + /privacy honest drafts with entity placeholders ([ENTITY NAME],
  [STATE OF FORMATION], [ARBITRATION VENUE], [CONTACT EMAIL]); privacy
  sub-processors match reality (adds Sentry, honest PostHog description).
- NEW /methodology: pipeline -> engine -> letter grades, refusals,
  VYNDR Originals, ledger settle + CLV + n>=20, why misses are public.
- /about audited to North Star framing (THE PROOF card, methodology link).
- Footer: 1-800-GAMBLER + Methodology link; compliance audit found zero
  pages suppressing the global footer.
- 5 Ghost seed articles in content/articles/ + docs/GHOST-PUBLISHING.md
  manual runbook (no Ghost access used).
- tests/unit/compliancePages.test.js (repo source-text style). 2429 tests
  green, web build exit 0.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

web/src/app/privacy/page.tsx

@@ -5,21 +5,25 @@ export const metadata: Metadata = {
   description: 'How VYNDR handles your data. Plain English.',
 };
 
+// Session 2 (A1 board) — approval-pack draft. Entity details are placeholder
+// tokens ([ENTITY NAME], [CONTACT EMAIL]) for Kev to fill before this ships
+// as the legal document.
+
 const SECTIONS: { title: string; body: string[]; emphasized?: boolean }[] = [
   {
     title: 'We never sell your personal data.',
     body: [
-      'VYNDR Intelligence LLC does not sell, rent, or trade your personal data to anyone. Ever. Our business is a subscription to an analytics product — not a data resale operation.',
+      '[ENTITY NAME], the company that operates VYNDR, does not sell, rent, or trade your personal data to anyone. Our business is a subscription to an analytics product — not a data resale operation.',
     ],
     emphasized: true,
   },
   {
     title: 'Data we collect',
     body: [
-      'Account data: email, password hash, age confirmation, signup timestamp.',
+      'Account data: email, password hash (managed by Supabase Auth — we never see your plaintext password), age confirmation, signup timestamp.',
       'Usage data: reads you run (player, stat, line, sport, grade), parlays you build, page views.',
-      'Payment data: Stripe processes all card data — we never see or store your card number, CVC, or any other payment instrument detail. We retain a Stripe customer ID, Stripe subscription ID, and your subscription status (active, canceled, grace period, expired) so we can gate paid features and respond to renewal/cancellation events from Stripe webhooks.',
-      'Device data: IP address, browser type, basic device info (for fraud prevention and analytics).',
+      'Payment data: Stripe processes all card data — we never see or store your card number, CVC, or any other payment instrument detail. We retain a Stripe customer ID, Stripe subscription ID, and your subscription status (active, canceled, grace period, expired) so we can gate paid features and respond to renewal and cancellation events from Stripe webhooks.',
+      'Device data: IP address, browser type, basic device info (for fraud prevention, error monitoring, and analytics).',
     ],
   },
   {
@@ -27,7 +31,7 @@ const SECTIONS: { title: string; body: string[]; emphasized?: boolean }[] = [
     body: [
       'To provide the service: sign you in, gate reads by tier, deliver grades.',
       'To improve the model: aggregate, anonymized read data helps calibration. Individual reads are never used to identify you to third parties.',
-      'Aggregate trend features: "Most Read Tonight" and "Most Parlayed Tonight" use anonymized counts across all users. Your individual reads are not exposed.',
+      'Aggregate trend features: surfaces like "Most Read Tonight" use anonymized counts across all users. Your individual reads are not exposed.',
       'To communicate: account confirmation, payment receipts, renewal reminders, critical service notices.',
     ],
   },
@@ -51,17 +55,18 @@ const SECTIONS: { title: string; body: string[]; emphasized?: boolean }[] = [
     title: 'Cookies and analytics',
     body: [
       'Essential cookies: auth session, read counter (cannot be disabled — the service does not work without them).',
-      'Analytics: PostHog (anonymized IPs, no third-party trackers). You can opt out by setting your browser to "Do Not Track" or contacting us.',
+      'Analytics: PostHog, with autocapture disabled — we record only the product events we name (page views, feature usage), never keystrokes or form contents, and no third-party ad trackers. The cookie notice on first visit is a disclosure of this. To opt out of analytics entirely, contact us at [CONTACT EMAIL].',
     ],
   },
   {
     title: 'Sub-processors',
     body: [
       'We rely on a small set of third-party processors. They handle data on our behalf under their own privacy commitments; we do not give them permission to use your data for their own purposes.',
-      'Stripe — payment processing and subscription management. Receives: name (if you provide), email, billing address (if you provide), and the card details you enter on their hosted checkout page. We never see your card number.',
+      'Stripe — payment processing and subscription management. Receives: name (if you provide it), email, billing address (if you provide it), and the card details you enter on their hosted checkout page. We never see your card number.',
       'Supabase — authentication, database, and file storage. Receives: everything in the "Data we collect" section above. Supabase is our primary backend.',
-      'PostHog — product analytics. Receives: anonymized event data (page views, button clicks). IPs are anonymized before storage.',
+      'PostHog — product analytics. Receives: the named product events above (page views, feature usage) with basic device context. Autocapture is off.',
       'Resend — transactional email (account confirmations, payment receipts, renewal reminders). Receives: your email address and the message contents.',
+      'Sentry — error monitoring. Receives: technical error reports (browser type, page, stack trace), which may include your IP address in transit. Used only to find and fix bugs.',
     ],
   },
   {
@@ -74,9 +79,10 @@ const SECTIONS: { title: string; body: string[]; emphasized?: boolean }[] = [
     title: 'Your rights',
     body: [
       'Access: request a copy of your data at any time.',
-      'Deletion: request account and data deletion at privacy@vyndr.app — we comply within 30 days.',
+      'Deletion: request account and data deletion at [CONTACT EMAIL] — we comply within 30 days.',
       'Correction: update your email and other profile data from the profile page.',
       'Export: request a JSON export of your read history.',
+      'If you are in a jurisdiction with statutory privacy rights (for example the EEA, UK, or California), those rights apply to you and the requests above are how you exercise them with us.',
     ],
   },
   {
@@ -94,7 +100,7 @@ const SECTIONS: { title: string; body: string[]; emphasized?: boolean }[] = [
   {
     title: 'Contact',
     body: [
-      'Privacy questions or data requests: privacy@vyndr.app',
+      '[ENTITY NAME]. Privacy questions or data requests: [CONTACT EMAIL].',
     ],
   },
 ];
@@ -105,7 +111,7 @@ export default function PrivacyPage() {
       <header style={{ marginBottom: 32 }}>
         <h1 style={{ fontSize: 36, fontWeight: 700, letterSpacing: '-0.03em', marginBottom: 8 }}>Privacy Policy</h1>
         <p className="mono" style={{ fontSize: 12, color: 'var(--text-tertiary)', letterSpacing: '0.05em' }}>
-          EFFECTIVE: MAY 2026
+          DRAFT: JULY 2026
         </p>
       </header>
       {SECTIONS.map((s) => (