AI Support is removed and will not be published (progmaweb#59 is
closed): it used every core of the second server for each answer, and
it stated commands and names that are not in the documentation. The
policy in every language no longer lists it among the services it
covers, and the paragraph about where its questions go is gone.

The review found four promises the policies made beyond what exists:

- ViGet takes no uploads from accounts yet; only Progmasoft publishes,
  through a server command. The Privacy Policy now says so, and that
  ViGet will record the IP address of each upload, for that one purpose
  and for the same time, once uploads open. ops/README.md tells the
  upload endpoint to do exactly that.
- A yank leaves a JAR served by nginx and cached by Cloudflare for a
  year. The Security Policy says a malicious version is taken off ViGet
  and kept out of reach as evidence; ops/README.md gives the four steps:
  yank, move the JAR into a root-only quarantine, purge the Cloudflare
  cache, close the account.
- The API cannot delete an account. ops/README.md gives the procedure
  support follows on a request from the account's address: a dump, then
  one transaction that removes the OpenIddict tokens and authorizations
  of the account, the applications it alone owns, and the account with
  its sessions and ownerships.
- Pages allow Cloudflare's analytics script besides their own, and the
  Security Policy now names it.

ops/README.md also records the nginx logs without client addresses on
both servers, which make the Privacy Policy's statement about web-server
logs true.

progmasoft.com/privacy and progmasoft.com/security publish the two
policies in en-US, de-DE, ru-RU and he-IL, and the footer links both.
The Privacy Policy says what an account keeps and that Progmasoft keeps
an IP address for one purpose only: with a ViGet upload, to establish
where an upload that turns out to be malicious software came from and
to give it to the competent authorities. It says that no data, the IP
address included, is sold, rented or traded. The Security Policy covers
passwords, sessions, HTTPS, the ban on malicious software in ViGet and
how to report a weakness.

The registration form asks the person to accept both policies, and the
API refuses a registration without that acceptance, with a password
(acceptPolicies, a validation error of that field) or through Google:
the start of a Google registration without acceptPolicies=true goes
back to /register?google=policies-required, and the completion creates
no account unless the authentication state carries the current version.
An account keeps the version it accepted and the moment, in two new
columns that schema step 2 adds; accounts created before it keep null.
PolicyAcceptance.CurrentVersion and policyVersion on the web side name
the same date, and a web test reads the C# constant to keep them equal.