website: publish D3/D5 (the whole truth on privacy; the minimum machine) and D36's two sentences, HU + EN (operator yes 2026-10-23; R-985, R-991, R-1225, R-1226)

website/en/backups.html

@@ -269,8 +269,9 @@
                     <p>On one disk, every local copy is <strong>on the same disk</strong>. That protects against deleting something by mistake and against broken files, but not against a disk failure. A <strong>different disk</strong> or the <strong>remote backup</strong> protects against a disk failure. Felhom shows this too: it counts a second copy only when it knows for sure that the copy is on another disk, and when it cannot check that (for example inside a virtual machine), it says so.</p>
 
                     <h3 style="margin-top: 24px;"><svg class="ico-lg" aria-hidden="true"><use href="/assets/icons.svg?v=1#i-lock"/></svg> The recovery code – only you know it</h3>
-                    <p>Your remote backup is encrypted, and the key to the encryption is a <strong>recovery code</strong>. The code appears exactly once: on your screen, when it is set up. We keep no copy of it.</p>
-                    <p>This is a deliberate choice, and it has two sides. One: <strong>nobody</strong> but you can read your remote backup – not even us. The other: if the box is destroyed and the code is lost too, then <strong>we cannot restore</strong> the remote backup either. So the code goes on paper, and somewhere safe.</p>
+                    <p>The box encrypts your remote backup before it leaves your home. The key is made on the box, and it stays there. The box also makes a locked copy of the key, which the <strong>recovery code</strong> opens. We keep that locked copy, but we cannot open it. The code is made on the box too, and it appears exactly once: on your screen, when it is set up. We keep no copy of it.</p>
+                    <p>This is a deliberate choice, and it has two sides. One: the remote storage holds only the encrypted backup, and we hold only the locked key. From these, <strong>nobody</strong> can read your backup – not even us. The other: if the box is destroyed and the code is lost too, then <strong>we cannot restore</strong> the remote backup either. So the code goes on paper, and somewhere safe.</p>
+                    <p>One thing we tell you honestly. While your box runs, we have <strong>administrator (root) access</strong> to it for support. With it, we could reach the data on the box and the backup key too. We use this access only to run the service and to fix faults. So the recovery code protects the remote copy, not the running box.</p>
 
                     <h3 style="margin-top: 24px;"><svg class="ico-lg" aria-hidden="true"><use href="/assets/icons.svg?v=1#i-chart-column"/></svg> Monitoring and notifications</h3>
                     <p>We watch the backups all the time. If there is a problem – a failed backup, storage filling up, a connection fault – it shows up in our monitoring, and an e-mail goes out about it. One aim of the closed test is to polish these notifications in real use.</p>