Marketing and privacy claim freeze

Blocked public language

Do not publish on marketing site, docs, or in-product copy:

• "zero-knowledge"
• "end-to-end encrypted feedback" (without defined mode)
• "server cannot read answers"
• "keys never leave the browser" (current implementation contradicts this for results/PDP)

Allowed interim language

• "Encrypted in transit (TLS)"
• "Sealed response envelopes stored on the server"
• "Subject-controlled keys for sealing submissions"
• "Privacy and data handling" pages must link to exact data classes in wiki/internal/security/data-classes.md

Enforcement

• Prompt 04/05 checks fail if blocked phrases appear while runs/02A/gate.json lacks approved status.
• Content rule: .cursor/rules/050-content-and-marketing-truth.mdc

Lift criteria

1. ADR-002 status = accepted
2. No private keys in URLs or logs (audit green)
3. Documented mode for consented_scores and server decrypt paths
4. Security review sign-off recorded in wiki/shared/decision-log.md