docs(legal): per-app privacy disclosures + scope the Apache-2.0 statement

[prabu-openclaw]

Why

Two corrections needed before the iOS apps go to TestFlight and the App Store. zer0state.com/privacy.html is the URL that will go in App Store Connect's required Privacy Policy field, so it has to match what each app actually does.

1. privacy.html — Appendix A, per-app disclosures

The umbrella policy describes what Zero State may collect across all products: usage and gameplay data, crash logs, purchases, "depending on the app."

Several apps collect nothing at all, and their App Store privacy labels will read "Data Not Collected." A reviewer comparing the label against a policy describing analytics sees a contradiction. This appendix reconciles the two.

Verified per app by reading the source, not by assumption:

• Hexwire — no networking, no analytics, no tracking identifiers, no third-party dependencies. Every import is an Apple framework. Save data is local UserDefaults.
• Surveillance Survivor — local gameplay, no accounts, no third-party analytics.
• Waykin — genuinely uses location, camera, and optional HealthKit, all on-device with no upload path. Documented specifically rather than lumped in.

Also covers the AI-audio position: music and effects were generated during development and ship as fixed files. The apps perform no AI processing at runtime and send no user data to any AI provider — worth stating plainly, since "AI audio" invites the assumption that something is being transmitted.

And a note that TestFlight crash logs and feedback are Apple's collection under Apple's policy, not ours.

Uses the existing h3 + list idiom. No new CSS — styles-light.css has no table styles.

2. terms.html — scope the Apache-2.0 statement

Current text: "The source code in the public repository is available under the Apache License 2.0."

Read narrowly that describes this website's repo, which is Apache-2.0. Read as a visitor would, it is a public representation about Zero State's code generally — and the product repos have since adopted the Zero State Proprietary License. A public offer of open-source terms over proprietary software is the kind of statement that is hard to walk back.

Now scoped explicitly: the website repo is Apache-2.0; product software and its bundled assets are proprietary and separately licensed.

Verification

Both files structurally validated (tag balance, no stray or mismatched closes). Content assertions checked. Effective dates preserved; "Last updated" bumped to 11 August 2026.

Related

• Zero-State-LLC/Hexwire#2 — audio chain-of-title and privacy manifest

Operational compliance work, not legal advice.

[scrimshawlife-ctrl]

Reviewed the legal/docs changes:

• Appendix A per-app disclosures are accurate and well-scoped (Hexwire/Surveillance Survivor: none; Waykin: on-device location/camera/optional HealthKit; fixed AI audio assets with no runtime AI processing; TestFlight crash logs correctly attributed to Apple).
• Apache-2.0 language correctly scoped to the public website repo only; product software called out as Zero State Proprietary License.
• Date bumps and minor product/status cleanups look fine.

Content is solid operational compliance work ahead of TestFlight/App Store. Approving on substance.

Note: Analyze (python) CodeQL is failing because this repo has no Python source to extract — configuration noise, not a problem with this PR. Worth fixing CodeQL language matrix separately so merge isn't blocked on that.