kyeunga25 · kyeunga25 · Jul 24, 2026 · Jul 24, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -5,12 +5,15 @@ on:
     branches: [main, develop]
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   quality:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 22
           cache: npm

diff --git a/.gitignore b/.gitignore
@@ -16,6 +16,7 @@ test-results/
 .env.*
 !.env.example
 .dev.vars
+AGENTS.md
 *.local
 *.pem
 *.key

diff --git a/AGENTS.md b/AGENTS.md
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -4,6 +4,27 @@ All notable changes to Wallpect are recorded in this file. The format follows [K
 
 ## [Unreleased]
 
+## [0.2.2] - 2026-07-25
+
+### Added
+
+- Added Traditional Chinese and English terms, privacy, disclaimer, trademark, and data-source notices inside the app.
+- Added a public legal, privacy, and data policy with a review gate for future third-party sources, SDKs, and APIs.
+- Added profile validation for safe source URLs, real review dates, finite geometry, in-bounds overlays, and unique slugs.
+- Added automated coverage for the legal and privacy interface on desktop and mobile.
+
+### Changed
+
+- Documented the exact browser-memory, versioned `localStorage`, browser-cache, and Cloudflare network-data boundaries.
+- Prevented overlapping image decodes and restored same-file selection after a decode attempt.
+- Updated Wrangler to `4.114.0`, pinned GitHub Actions to reviewed commits, and limited CI permissions to read-only repository contents.
+- Tightened public-repository hygiene and release review guidance.
+
+### Security
+
+- Restricted device-profile source URLs to credential-free HTTPS links on `support.apple.com`.
+- Confirmed zero known npm vulnerabilities in both the complete and production dependency graphs at release preparation time.
+
 ## [0.2.1] - 2026-07-23
 
 ### Changed
@@ -52,6 +73,7 @@ All notable changes to Wallpect are recorded in this file. The format follows [K
 - Uploaded images remain in browser memory and are not sent to an upload API or analytics service.
 - Local secrets, credentials, build output, browser reports, and editor/OS metadata are excluded from version control.
 
-[Unreleased]: https://github.com/kyeunga25/wallpect/compare/v0.2.1...HEAD
+[Unreleased]: https://github.com/kyeunga25/wallpect/compare/v0.2.2...HEAD
+[0.2.2]: https://github.com/kyeunga25/wallpect/compare/v0.2.1...v0.2.2
 [0.2.1]: https://github.com/kyeunga25/wallpect/compare/v0.2.0...v0.2.1
 [0.2.0]: https://github.com/kyeunga25/wallpect/releases/tag/v0.2.0
diff --git a/README.md b/README.md
@@ -43,7 +43,9 @@ Wallpect helps you compose an image for a selected Apple device, inspect likely
 4. Adjust the composition and enable the guides you want to inspect.
 5. Choose PNG, JPEG, or WebP and export at the displayed resolution.
 
-Your image stays in browser memory and is released when it is replaced or the page is closed. Only preferences such as the recent device identifier may be saved in `localStorage`.
+Your image stays in browser memory and is released when it is replaced, the page is refreshed, or the page is closed. Only the selected locale and up to four recent device identifiers are saved in versioned `localStorage`. Normal requests for public site files still pass through Cloudflare, but they do not contain your selected image bytes.
+
+The website provides directly accessible Traditional Chinese and English privacy, terms, disclaimer, and data-source notices. Maintenance and third-party source/API rules are documented in the [Terms, Privacy, and Data Policy](docs/LEGAL_PRIVACY_AND_DATA_POLICY.md).
 
 <p align="center">
   <img src="docs/screenshots/wallpect-mobile.png" width="320" alt="Wallpect mobile workspace showing the device selector and wallpaper preview">
@@ -112,8 +114,7 @@ Preview and export both call `renderWallpaper`. Pan offsets use the target canva
 - [Device profile guide](docs/DEVICE_PROFILE_GUIDE.md)
 - [Deployment guide](docs/DEPLOYMENT.md)
 - [Release guide](docs/RELEASING.md)
-- [Product requirements and implementation plan](docs/WALLPECT_PRODUCT_REQUIREMENTS_AND_IMPLEMENTATION_PLAN.md)
-- [Implementation checklist](TODO.md)
+- [Legal, privacy, and data policy](docs/LEGAL_PRIVACY_AND_DATA_POLICY.md)
 - [Changelog](CHANGELOG.md)
 
 ## Contributing
@@ -125,3 +126,5 @@ Issues and focused pull requests are welcome. Read [CONTRIBUTING.md](CONTRIBUTIN
 Wallpect is available under the [MIT License](LICENSE).
 
 Wallpect is an independent tool. It is not affiliated with or endorsed by Apple Inc. Apple product names are used only to identify compatible device profiles.
+
+Device specifications are manually curated from linked public manufacturer support pages. Wallpect does not use an Apple or third-party device-data API at runtime and does not scrape or mirror Apple website content. See the [Terms, Privacy, and Data Policy](docs/LEGAL_PRIVACY_AND_DATA_POLICY.md) for the detailed limitations and data-governance gate.
diff --git a/README.zh-Hant.md b/README.zh-Hant.md
@@ -43,7 +43,9 @@ Wallpect 讓你按所選 Apple 裝置調整圖片構圖、檢查可能遮擋內
 4. 調整構圖，並開啟需要檢查的輔助線。
 5. 選擇 PNG、JPEG 或 WebP，再按顯示的解析度匯出。
 
-圖片只會保存在瀏覽器記憶體，當圖片被取代或頁面關閉時便會釋放。只有最近使用的裝置識別碼等偏好可能儲存在 `localStorage`。
+圖片只會保存在瀏覽器記憶體，當圖片被取代、頁面重新整理或關閉時便會釋放。只有介面語言及最多四個最近使用的裝置識別碼會儲存在版本化 `localStorage`；公開網站檔案的正常請求仍會經過 Cloudflare，但不包含你選擇的圖片 bytes。
+
+網站內可直接查閱繁中／英文的私隱、使用條款、免責及資料來源說明。維護與新增第三方來源／API 的規則記錄於 [條款、私隱與資料政策](docs/LEGAL_PRIVACY_AND_DATA_POLICY.md)。
 
 <p align="center">
   <img src="docs/screenshots/wallpect-mobile.png" width="320" alt="Wallpect 流動版工作區，顯示裝置選擇器及桌布預覽">
@@ -112,8 +114,7 @@ Wallpect 以不含 Worker script 的 Cloudflare Workers Static Assets 模式部
 - [裝置設定檔指南](docs/DEVICE_PROFILE_GUIDE.md)
 - [部署指南](docs/DEPLOYMENT.md)
 - [發布指南](docs/RELEASING.md)
-- [產品需求與實作計劃](docs/WALLPECT_PRODUCT_REQUIREMENTS_AND_IMPLEMENTATION_PLAN.md)
-- [實作清單](TODO.md)
+- [條款、私隱與資料政策](docs/LEGAL_PRIVACY_AND_DATA_POLICY.md)
 - [版本記錄](CHANGELOG.md)
 
 ## 參與貢獻
@@ -125,3 +126,5 @@ Wallpect 以不含 Worker script 的 Cloudflare Workers Static Assets 模式部
 Wallpect 採用 [MIT License](LICENSE)。
 
 Wallpect 是獨立工具，與 Apple Inc. 無關，亦未獲其背書。Apple 產品名稱只用於識別相容的裝置設定檔。
+
+裝置規格由連結的公開製造商支援頁面人工整理；Wallpect 不會在執行時使用 Apple 或第三方裝置資料 API，也不會自動擷取或鏡像 Apple 網站內容。詳細限制及資料治理方法見 [條款、私隱與資料政策](docs/LEGAL_PRIVACY_AND_DATA_POLICY.md)。
diff --git a/TODO.md b/TODO.md
diff --git a/docs/DEPLOYMENT.md b/docs/DEPLOYMENT.md
@@ -5,7 +5,6 @@
 ### 專案設定
 
 ```text
-Project: wallpect
 Production branch: main
 Build command: npm run build
 Deploy command: npx wrangler deploy
@@ -95,7 +94,6 @@ PLAYWRIGHT_BASE_URL=https://<preview-url> npm run test:e2e
 ### Project settings
 
 ```text
-Project: wallpect
 Production branch: main
 Build command: npm run build
 Deploy command: npx wrangler deploy
-Original file line number
+Diff line change
@@ Expand Up / @@ -16,6 +16,7 @@ test-results/ @@
     .env.*
     !.env.example
     .dev.vars
+    AGENTS.md
     *.local
     *.pem
     *.key
@@ Expand Down @@