docs: document App Attest protocol 3
docs: standardize contributor guides
Document device-bound renewable sessions
Document PumpSync component versioning policy
Clarify background sync freshness copy
Document opportunistic background refresh
docs: rename subscription terminology
Link policy text to the website and clarify sync triggers - Replace verbatim copies of the website's privacy policy wording in App-Store-and-Privacy and Features-and-Modes with links to the canonical pages, keeping implementation-only detail. The website is the canonical published source, and duplicated sentences drift. - Name manual syncing alongside the automatic app-open and daily background refreshes in Home and Features-and-Modes. - Document the PolyForm Noncommercial license now carried by the app and backend repositories.
docs: link to repo-canonical reference instead of duplicating it Backend-Operations.md's "Data Deletion Tooling" section reproduced the exact CLI commands from the backend's docs/data-deletion.md -- now a one-line pointer to that runbook, which stays canonical since it's reviewed in the same PR as the tool it documents. Also links the previously-orphaned docs/security-and-privacy.md from App-Store-and-Privacy.md, and updates the docs/legal/ bullet in Home.md to describe the new website-pointer structure. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
docs: split Self-Hosting-and-Demo into two pages, self-hosting first Self-hosting (real Tandem account) and demo mode (no Tandem account) are different audiences with different setup steps; bundling them into one page buried the self-host walkthrough under demo instructions. Splits into Self-Hosting.md (presented first) and Demo-Mode.md, each linking to the other, and rewrites the physical-iPhone reverse-proxy section to state only the PumpSync-specific facts plus links to well-maintained self-hosted options (Nginx Proxy Manager, Caddy, Traefik) rather than documenting reverse-proxy setup itself. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
docs: rewrite self-host/demo walkthrough, fix broken quickstarts Self-Hosting-and-Demo.md is now a full step-by-step guide (demo connection steps, self-host via published image or source build, TLS requirement, troubleshooting) instead of a thin config summary. Every documented backend quickstart that failed at startup (Getting Started, Testing and Verification) now includes the signing-key generation step or the minimum env for a bare dotnet run — they previously shipped the rejected placeholder key. Architecture and Features-and-Modes updated for the timezone/basal-id/dataSourceMode wire changes; Backend-Operations corrected on image tagging. Includes the maintainer's pending PumpSync-Backend -> PumpSync.backend naming pass across these same pages. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
docs: fix self-host signing key quickstart, note TLS reverse-proxy requirement The documented quickstart copied .env.example verbatim except for DataSourceMode, leaving PumpSync__ServiceTokenSigningKey at its placeholder value — which the backend now rejects at first use (PumpSync-Backend's B1 hardening), making every /self-host/session request following these exact steps fail. Add a step generating a real random key instead. Baking a single fixed key into .env.example itself would just recreate the same problem for everyone who follows the quickstart without changing it, so this generates a fresh one per deployment instead. Also note the non-root/plain-HTTP container behavior and TLS reverse-proxy requirement here, so PumpSync-Backend's docs/docker-self-host.md can link here instead of duplicating it. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
docs: describe stale sync history policy
docs: link public policy pages from wiki
docs: build out PumpSync wiki
Initial Home page