docs: disclose scanned capabilities with facts in README and privacy

The Obsidian preview scan flags three real capabilities: filesystem access
(outside-vault media download), vault file enumeration (dedup + folder
auto-complete), and clipboard (copy debug log, write only). All are legitimate
and necessary or opt-in. Document each plainly in a README Permissions section
and reconcile PRIVACY.md (add device-access detail, fix the enumeration nuance,
drop the BRAT reference, bump the date) rather than removing the functionality.

PRIVACY.md

@@ -1,8 +1,8 @@
 # Privacy Policy
 
-_Last updated: 2026-06-14_
+_Last updated: 2026-06-15_
 
-This policy explains what the **RSS Importer** Obsidian plugin ("the plugin") does and does not do with your data. It applies to the plugin as distributed through the Obsidian Community Plugins marketplace, GitHub releases, and BRAT.
+This policy explains what the **RSS Importer** Obsidian plugin ("the plugin") does and does not do with your data. It applies to the plugin as distributed through the Obsidian Community Plugins marketplace and GitHub releases.
 
 ## Summary
 
@@ -14,10 +14,17 @@ RSS Importer reads feeds you add and writes their items into your vault as Markd
 
 - When you add a feed, the plugin fetches the URL you entered (and, for a Substack handle, the public Substack profile API) to resolve and preview the feed.
 - When you import, the plugin fetches the feed and the selected items, converts each to Markdown, and writes a note into the destination folder you chose. If you turn on image download, it also fetches the images referenced by those items and saves them into your vault.
-- To avoid re-importing, the plugin scans the frontmatter of notes under your destination folder (through Obsidian's metadata cache) and reads an existing note at a target path before overwriting it. It does not read other files in your vault.
+- To avoid re-importing, the plugin lists note paths in your vault and reads the frontmatter of notes under your destination folder (through Obsidian's metadata cache), and reads an existing note at a target path before overwriting it. It enumerates paths to find its own notes and to offer folder auto-complete in settings; it does not read the contents of unrelated files.
 
 Every fetch is triggered by an explicit action of yours (adding a feed, or running an import). The plugin does no background polling.
 
+## Device access
+
+Beyond network requests, the plugin uses a small set of device capabilities, all local and all disclosed by Obsidian's plugin scan:
+
+- **Filesystem outside the vault.** Only the optional "save media outside the vault" setting uses Node's `fs` module, and only to write downloaded media into the folder you configure (Obsidian's vault API cannot write outside the vault). It is desktop-only and reads nothing. With the setting off, the default, the plugin does not access the filesystem outside your vault.
+- **Clipboard, write only.** The "copy debug log" action writes the plugin's own diagnostic log to your clipboard so you can paste it into a bug report. The plugin never reads the clipboard.
+
 ## Network use
 
 The plugin makes outbound HTTP requests through Obsidian's `requestUrl` API. It contacts only:

README.md

@@ -35,6 +35,16 @@ It is an importer, not a reader. It writes notes you own and then gets out of th
 2. Run the **Import from a feed** command (or the ribbon icon) to open the import window. Tick items (or use **Select all**) and import; for Substack, scroll the list to load older archived posts automatically. The summary reports what was created, skipped, or failed.
 3. Optionally run **Clean up imported notes** to re-apply a feed's cleanup rules to notes you already imported.
 
+## Permissions and access
+
+RSS Importer is desktop-only, runs entirely on your device, and has no telemetry or maintainer server. Obsidian's plugin scan discloses three capabilities. Here is exactly what each is and why it exists:
+
+- **Filesystem access outside the vault.** Used only by the optional **save media outside the vault** setting. When you turn it on and choose a folder, the plugin writes downloaded podcast, audio, or video files to that folder with Node's `fs` module, because Obsidian's vault API cannot write outside the vault. It is guarded to desktop only, writes only to the folder you configure, and reads nothing. With the setting off (the default), the plugin never touches the filesystem outside your vault.
+- **Vault file enumeration.** The plugin lists note paths for two reasons: to find the notes it already imported so it never creates duplicates, and to offer folder auto-complete in settings. It reads the frontmatter of notes in your destination folders to match them, and does not read the contents of unrelated files.
+- **Clipboard, write only.** The only clipboard use is the **copy debug log** action, which writes the plugin's own diagnostic log to your clipboard so you can paste it into a bug report. It never reads the clipboard, so it cannot see anything you copied elsewhere.
+
+None of these send data anywhere. Full network and data behavior is in [PRIVACY.md](./PRIVACY.md).
+
 ## Installation
 
 ### Obsidian Community plugins (recommended)