privacy: the key goes to the service, and the service asks UpdatePulse

The line said licences are validated against UpdatePulse, "which sees the
key." True of the system, but read next to the scripts it suggested the
client contacts that host — and every client script talks only to
api.html2wp.dev. A reviewer comparing outbound hosts to the privacy text finds
one that the code never calls. It now says where the key travels, who
validates it and where, and that nothing on the user's machine reaches
UpdatePulse directly.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0193x9K42x622Pcf8kAsj1dn

Author: iOSDevSK

PRIVACY.md

@@ -74,8 +74,10 @@ would not want kept for that long.
 
 - **Free tier:** counted per network address, as seen by Cloudflare. Stored as
   a truncated hash, never as an address.
-- **Licensed:** by the licence key, also stored as a hash. Validated against
-  UpdatePulse (`updates.designready.studio`), which sees the key.
+- **Licensed:** by the licence key, also stored as a hash. The key travels
+  only to `api.html2wp.dev`; the service validates it server-side against
+  UpdatePulse (`updates.designready.studio`), which therefore also sees it.
+  Nothing on your machine contacts UpdatePulse directly.
 
 ## Who else is involved