Make the policies say what ViGet and support do today

The review found four promises the policies made beyond what exists:

- ViGet takes no uploads from accounts yet; only Progmasoft publishes,
  through a server command. The Privacy Policy now says so, and that
  ViGet will record the IP address of each upload, for that one purpose
  and for the same time, once uploads open. ops/README.md tells the
  upload endpoint to do exactly that.
- A yank leaves a JAR served by nginx and cached by Cloudflare for a
  year. The Security Policy says a malicious version is taken off ViGet
  and kept out of reach as evidence; ops/README.md gives the four steps:
  yank, move the JAR into a root-only quarantine, purge the Cloudflare
  cache, close the account.
- The API cannot delete an account. ops/README.md gives the procedure
  support follows on a request from the account's address: a dump, then
  one transaction that removes the OpenIddict tokens and authorizations
  of the account, the applications it alone owns, and the account with
  its sessions and ownerships.
- Pages allow Cloudflare's analytics script besides their own, and the
  Security Policy now names it.

ops/README.md also records the nginx logs without client addresses on
both servers, which make the Privacy Policy's statement about web-server
logs true.

0 files changed, 0 insertions, 0 deletions