diff --git a/public/index.html b/public/index.html
index 53c7aa9..5f4ecd3 100644
--- a/public/index.html
+++ b/public/index.html
@@ -257,9 +257,11 @@ <h2 id="videoTitle">See it in a minute</h2>
   </section>
 
   <footer>
-    <strong>Self-hosted instance.</strong> Wallet checks call the GoPlus Security API for live approval data, then Claude for the plain-language translation. Nothing is stored — each check is stateless.
+    <strong>Self-hosted instance.</strong> Wallet checks call the GoPlus Security API for live approval data, then Claude for the plain-language translation. Your input is used only to answer; a short usage record of each call is kept (see the privacy statement).
     <br><br>
     Built and debugged with <a href="https://x402-doctor.fizzl.eu" style="color: inherit;">x402 Doctor</a>, a free diagnostic tool for x402 payment flows.
+    <br><br>
+    <a href="https://fizzl.eu/privacy/">Privacy</a> · <a href="https://fizzl.eu/terms/">Terms</a>
   </footer>
   <p class="by-fizzl"><a href="https://fizzl.eu" title="Fizzl: all pay-per-call tools for AI agents, with live demos">by <svg viewBox="-6 -14 236 126" role="img" aria-label="fizzl"><g fill="none" stroke="currentColor" stroke-width="16" stroke-linecap="round" stroke-linejoin="round"><path d="M44 12 A20 20 0 0 0 20 32 V100"/><path d="M6 48 H38"/><path d="M64 56 V100"/><path d="M88 52 H124 L88 100 H124"/><path d="M144 52 H180 L144 100 H180"/><path d="M200 8 V84 A16 16 0 0 0 216 100"/></g><g class="b"><circle cx="64" cy="26" r="9"/><circle cx="78" cy="10" r="5"/><circle cx="90" cy="-2" r="3"/></g></svg><span>· all tools and live demos at fizzl.eu</span></a></p>
 </div>
diff --git a/public/openapi.json b/public/openapi.json
index 2e7bd72..533e7ee 100644
--- a/public/openapi.json
+++ b/public/openapi.json
@@ -3,6 +3,7 @@
   "info": {
     "title": "PlainText Wallet Approval Checker",
     "version": "1.0.0",
+    "termsOfService": "https://fizzl.eu/terms/",
     "description": "Looks up a wallet's live token/NFT approvals via the GoPlus Security API and explains them in plain language for people with no crypto background.",
     "contact": { "email": "Fizzl13@protonmail.com" },
     "x-guidance": "Use POST /api/check-wallet when you have an EVM wallet address and want to know whether its current token/NFT approvals are safe. Example: {\"address\":\"0x6B0F4651eD42893ab58139938175E4a69f175F25\",\"chain\":\"base\",\"kind\":\"token\"} — chain defaults to \"ethereum\" and kind defaults to \"token\" if omitted, so a call can be as small as {\"address\":\"0x...\"}. Use POST /api/explain instead when you already have a specific approval/permission JSON payload (from a scanner, a dapp prompt, etc.) and just want it translated to plain language, without an on-chain lookup. Both return {verdict: SAFE|CAUTION|RISK, explanation: string} so downstream agents can branch on verdict without parsing prose."