docs: the privacy claim gets stronger, so the documents have to say so

Removing BetterTTV took out the plugin's only outbound network call, and five
documents were still describing it as present. PRIVACY.md led with "one outbound
network call exists by design" -- the opposite of what shipped an hour ago, and
the one claim in that file people actually check.

PRIVACY.md now opens with none at all. The section that described the call is
kept and marked as removed rather than deleted, so the claim can be read against
what it replaced: the startup fetch meant BetterTTV saw an IP as soon as the
plugin loaded, whether an emote ever appeared or not. Worth leaving visible.
BetterTTV also comes out of the third-party table, which now lists only the two
parties nobody using this plugin through Dalamud can avoid.

SECURITY.md listed the EmoteCache HTTP client as in scope for reports. There is
nothing there to report on.

THIRD_PARTY_NOTICES.md named the call as current; both entries it has ever
carried are now historical.

README dropped the pointer to the outbound call and the switch for it, a
stability bullet about a crash fix in code that no longer exists, and the line in
the Chat 2 migration that moved an emote cache directory nothing reads.

ROADMAP gained 2.0.1 and 2.0.2, and a section for what the 2.0.0 push left
behind: 47 overlong comment blocks, channel names translated in only ten of the
25 languages, an orphaned EmoteCacheV1 directory on anyone who ran an older
build, and the deprecated GlobalScaleSafe call that is the last compiler warning
in the build.

PRIVACY.md

@@ -20,8 +20,8 @@ Last reviewed: 2026-08-18 (HellionChat v1.12.0).
   `pluginConfigs/HellionChat/` directory.
 - The plugin does not phone home. No telemetry, no analytics, no crash reporter, no usage counter,
   no remote update check beyond what Dalamud itself does.
-- One outbound network call exists by design: the BetterTTV emote service (for chat emotes). It is
-  documented in detail below and can be reasoned about per request.
+- As of v2.0.2 the plugin makes **no outbound network requests at all**. The one that existed, the
+  BetterTTV emote service, was removed along with the feature it served.
 - You can export every message the plugin has stored, in Markdown, JSON or CSV. You can delete it by
   channel, by age, or all of it at once.
 
@@ -42,8 +42,9 @@ HellionChat keeps three kinds of state on your machine, all under
    ExtraChat. Public chat, NPC dialogue, system messages and battle logs are dropped on the storage
    layer and never written to disk.
 
-3. **Cached emote images** (`EmoteCacheV1/` directory). Image files downloaded from BetterTTV when
-   an emote appears in a message you receive. See "Outbound network calls" below.
+Earlier versions kept a third item here, an `EmoteCacheV1/` directory of images downloaded from
+BetterTTV. Nothing writes to it as of v2.0.2. If you used a version before that, the directory is
+still on disk and can be deleted by hand; the plugin no longer reads or creates it.
 
 There is no shared state with the upstream Chat 2 plugin. `pluginConfigs/HellionChat/` is
 independent from `pluginConfigs/ChatTwo/`.
@@ -73,35 +74,23 @@ turn the retention sweep on in the settings. Until then, stored messages stay un
 
 ## Outbound network calls
 
-HellionChat makes one kind of automatic outbound network request, inherited from upstream Chat 2 and
-documented here because "GDPR-by-design" means you should know what your client does on your behalf.
-The second one this section used to list, the Lodestone font download, was removed in v1.0.4 and the
-font is bundled instead.
+**None.** As of v2.0.2 the plugin makes no automatic outbound network requests of any kind. Both
+calls this section used to describe are gone, and the section is kept so the claim can be checked
+against what it replaced rather than simply asserted.
 
-### 1. BetterTTV emote service (`api.betterttv.net`, `cdn.betterttv.net`)
+### 1. BetterTTV emote service (removed in v2.0.2)
 
-- **What it does:** When a chat message arrives that references a BetterTTV emote, the plugin asks
-  the BetterTTV API for the emote metadata and downloads the image from the BetterTTV CDN to display
-  it inline.
-- **What is sent:** A standard HTTPS GET request. Your IP address reaches BetterTTV (unavoidable for
-  any HTTPS request); the request itself contains no identifying user data, no character name, no
-  message text. Only the emote ID being looked up is in the URL path.
-- **When it triggers:**
-  - The emote _list_ (global emotes plus the top-1500 community emotes over fifteen API pages) is
-    fetched from `api.betterttv.net` once per session at plugin startup, provided the **Show
-    emotes** option is on. This first list-fetch happens before any chat message has arrived.
-    BetterTTV's edge therefore sees your IP as soon as the plugin loads, not only after an emote is
-    mentioned.
-  - The individual emote _images_ on `cdn.betterttv.net` are fetched on demand, only when an
-    incoming chat message contains a token matching one of the cached IDs. These are cached locally
-    (`EmoteCacheV1/`) and reused across sessions.
-- **Cached:** Yes, in `EmoteCacheV1/`. A given emote is downloaded once per machine and reused.
-- **How to opt out:** Turn off the **Show emotes** option in Settings → Chat → Display modes. With
-  it disabled, the emote cache does not load and no requests to BetterTTV are made for the rest of
-  the session.
-- **BetterTTV's privacy policy:** <https://betterttv.com/privacy>
+Until v2.0.2 the plugin fetched an emote list from `api.betterttv.net` once per session at startup,
+and individual images from `cdn.betterttv.net` on demand, caching them in `EmoteCacheV1/`. The
+startup fetch meant BetterTTV's edge saw your IP as soon as the plugin loaded, whether or not an
+emote ever appeared in your chat. A setting could switch it off, but it was on by default.
 
-Source: `HellionChat/EmoteCache.cs`.
+The feature was removed rather than defaulted off: BetterTTV moved its shared-emote endpoint behind
+authentication, which left 54 mostly static images from a set of 65, and that is not worth a
+connection nobody asked for. The download path, the cache directory and the renderer are gone from
+the source.
+
+Messages already stored with emotes in them remain readable and show the code that was typed.
 
 ### 2. Square Enix Lodestone font (removed in v1.0.4)
 
@@ -204,13 +193,12 @@ messages. Existing data needs the retroactive cleanup to apply retroactively, by
 
 | Party                                                      | Why they appear                                    | What reaches them                                                        | Their privacy policy                   |
 | ---------------------------------------------------------- | -------------------------------------------------- | ------------------------------------------------------------------------ | -------------------------------------- |
-| BetterTTV (NightDev LLC)                                   | Optional emote rendering                           | HTTPS request for an emote ID; your IP                                   | <https://betterttv.com/privacy>        |
 | Hellion Forge (Gitea, self-hosted by Hellion Online Media) | Plugin distribution via custom repo, issue tracker | Whatever the Gitea instance sees from any HTTPS request to a public repo | <https://hellion-media.de/datenschutz> |
 | Dalamud / XIVLauncher (goatcorp)                           | Plugin loader, font subsystem, repo polling        | Whatever Dalamud reports for itself; out of HellionChat's scope          | <https://github.com/goatcorp/Dalamud>  |
 
-The Hellion Forge Gitea instance and the Dalamud/XIVLauncher loader are unavoidable for anyone using
-HellionChat through Dalamud at all. BetterTTV is the only third party HellionChat introduces on top
-of that baseline, and it is opt-out via settings.
+Both are unavoidable for anyone using HellionChat through Dalamud at all. Since v2.0.2 the plugin
+introduces no third party on top of that baseline: BetterTTV was the only one, and it left with the
+emote feature.
 
 ---
 
@@ -223,11 +211,10 @@ plugin pulls in:
 - `Microsoft.Data.Sqlite`: local SQLite access, no network.
 - `morelinq`: LINQ helpers, no network.
 - `Pidgin`: parser combinators, no network.
-- `SixLabors.ImageSharp`: image decoding (used for the BetterTTV emote pipeline), no network on its
-  own.
+- `SixLabors.ImageSharp`: image decoding (icon handling), no network on its own.
 
-The single network call listed under "Outbound network calls" is written directly in HellionChat's
-own source, not delegated to a dependency.
+No dependency opens a connection on the plugin's behalf, and since v2.0.2 the plugin opens none
+itself either.
 
 ---