Review privacy, security, and API-key handling before marketplace submission

[bobthearsonist]

Problem

Visual Notes sends full watched-note markdown to Anthropic and currently documents API key storage in plugin data.json. This is acceptable only if the behavior is intentional, clearly disclosed, and reviewed before community marketplace submission.

Scope

• Review README, plugin README, and docs/marketplace-readiness.md for clear data-handling disclosure.
• Confirm settings UI text matches the actual storage behavior for desktop and mobile.
• Decide whether v0.1 should remain mobile-enabled while using data.json storage, or whether mobile support or storage implementation should change before submission.
• Verify errors, logs, and notices do not expose the Anthropic API key or private note content unnecessarily.
• Document limitations around watched folders, full-note upload, third-party API usage, and sensitive notes.

Acceptance criteria

• Privacy and API-key behavior is explicitly documented in marketplace-facing docs.
• Any mismatch between code, settings text, manifest mobile support, and docs is resolved or tracked as a blocker.
• Manual review confirms no API key is logged or included in thrown user-facing errors.
• The marketplace checklist records the final privacy and security decision for v0.1.