Update the privacy policy for shared Mac data, identity and reset expiries

[shiny-code-app]

Why

The published privacy policy (docs/privacy.md, effective July 31) no longer matched the app. Version 1.0.69 shipped on October 3 with the shared account identity key and Mac-to-Mac sharing, and reset-credit data now carries every known expiry, for Claude as well as OpenAI. The policy was held until the identity key schema shipped (#745); Chris deployed that schema to Production on October 3 (#722), so the policy is now behind the shipped app.

What changed

Only docs/privacy.md, checked against current source:

• Companion sync: it happens whenever the user is signed in to iCloud, not only when a companion app is installed. It reaches companion apps and other Macs on the same iCloud account. The list of what the document carries now includes usage pace, prompt-cache hit rates and token counts, per-account display settings, widget and forecast preferences, and removal/restoration records.
• Received Mac documents: a receiving Mac validates and caches another Mac's document. It never adds those readings to its own history or republishes them, withholds the cache when the iCloud account changes, and stops showing cached readings after the refresh interval plus ten minutes.
• Shared identity: the policy no longer says "not enabled". It names the IDs each provider's pseudonym is derived from and keeps the existing promises (no raw provider ID or secret in documents; the secret is encrypted in private CloudKit and the Keychain).
• Reset credits: covers both OpenAI and Claude, and lists every known expiry plus Claude's count of credits of an unrecognized kind, instead of "earliest expiry, OpenAI only".
• Newly disclosed, local only: bounded reads of Codex session usage counters from a directory the user authorizes, and the credential-free account summary and count-only launch records used by local agent tools.
• Effective date: October 10, 2026.

Nothing else depends on the policy text (no test or script references it). It becomes public when this lands on main.

Verification

• Every statement was checked against Sources/ContextPanelCore and docs/shared-account-identity.md.
• Review by another model: OpenAI via Codex CLI (the model was not reported by the CLI) read the source and found no false statements or material omissions. It made two low-severity wording findings, and both are fixed: synced widget and forecast preferences are now named, and cache expiry is described as hiding the readings, not deleting the file.
• JetBrains inspection not run: docs-only change, no code paths affected.

Refs #745

[shiny-code-app]

Ready for the merge train

Head ae1ec0b: all six checks passed; reviewed by OpenAI with both low findings fixed; no review threads or unanswered comments. Docs-only, so no JetBrains inspection (no code paths). Landing on main publishes the updated policy; after landing, #745 closes.

[shiny-code-app]

Claim (AUD-CP, read-only audit, Claude Code on Opus): a direction-session brief assigned "#805" to a read-only review and outcome audit of the PRs merged here in the last 48 hours. #805 is this privacy-policy PR, which is already handed to the merge train. No audit issue exists, and gh-plan.py claim does not claim PRs. So I am running the audit as the brief scopes it, and I am not touching this PR or its train handoff.

Admission: the overall DIRECTION.md Order, item 3, lets other tooling and maintenance move ahead "when every milestone's available work already has the sessions it can use and provider capacity would otherwise go unused". Chris's owner decision (codex-skills#1043, comment 5982761132) applies that rule to this capacity run.

In scope: #799, #801, #803 and #804. #798 merged 70 hours ago, so it is outside the window. I will change no code. I will file issues only for concrete, reproducible defects and post the summary on cbusillo/codex-skills#884.

[shiny-code-app]

Ready for the merge train

Head: ae1ec0b

DIR-48-D1 format correction for direction#48. This unchanged head retains its qualified handoff. Fresh current-head CI is complete and nonfailing, with no pending checks/workflows or unresolved review threads; recorded review, IDE and release limits remain in that handoff. Supervisor owns routing. Comment-only correction; no source change, label or merge.