📝 Add privacy philosophy content and update landing copy

i18n content updates:
- Add privacy philosophy section to company-values.json
- Create dedicated company-values-privacy.json for expanded content
- Update marketplace-landing-choice: "I want to work" / "I want to book"
- Bump react-i18next to v15.0.0

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

features/i18n/locales/en/company-values-privacy.json

@@ -0,0 +1,312 @@
+{
+  "meta": {
+    "title": "Privacy Philosophy | lilith",
+    "description": "Your data stays yours. Zero third-party tracking, no advertising, encryption by default, minimal data collection."
+  },
+  "hero": {
+    "title": "Privacy",
+    "subtitle": "Your Data Stays Yours",
+    "tagline": "Privacy by Architecture"
+  },
+  "intro": {
+    "principle": "Zero Surveillance, Zero Tracking",
+    "description": "We don't track you. No cookies. No third-party scripts. No Google Analytics. No advertising networks. No social login buttons phoning home.",
+    "summary": "The only traffic on lilith is between you and us. Period. This isn't marketing positioning — it's architectural commitment."
+  },
+  "zero_third_party": {
+    "title": "The Zero-Third-Party Principle",
+    "subtitle": "Every third-party script is a surveillance vector",
+    "typical_sites_label": "Typical Sites",
+    "our_site_label": "lilith",
+    "typical_traffic": [
+      "Your browser → Google Analytics → Google",
+      "Your browser → Facebook Pixel → Facebook",
+      "Your browser → Hotjar → Hotjar",
+      "Your browser → CDN fonts → Google/Adobe",
+      "Your browser → Social widgets → Every platform"
+    ],
+    "our_traffic": [
+      "Your browser → lilith → That's it"
+    ],
+    "comparison": [
+      { "typical": "Google Analytics on every page", "ours": "Zero third-party analytics" },
+      { "typical": "Facebook Pixel for conversions", "ours": "No advertising pixels, ever" },
+      { "typical": "Google Fonts CDN", "ours": "Self-hosted fonts" },
+      { "typical": "Third-party CDN for assets", "ours": "Own infrastructure" },
+      { "typical": "OAuth with Google/Facebook", "ours": "Email/password + 2FA only" },
+      { "typical": "Cookie consent popups", "ours": "No cookies to consent to" }
+    ],
+    "what_we_measure_label": "What We Measure",
+    "what_we_measure": [
+      "Page load times (aggregate, not per-user)",
+      "Error rates by feature",
+      "Feature adoption rates (counts, not who)",
+      "Geographic distribution (country level only)"
+    ],
+    "what_we_dont_measure_label": "What We Don't Measure",
+    "what_we_dont_measure": [
+      "Individual user journeys",
+      "Session recordings",
+      "Click heatmaps",
+      "Scroll depth per user",
+      "Cross-device tracking",
+      "Anything that identifies you personally"
+    ],
+    "conclusion": "The premise that you need surveillance-level tracking to improve a product is false. It's a premise surveillance companies invented to justify their business model."
+  },
+  "no_cookies": {
+    "title": "No Tracking Cookies",
+    "subtitle": "What GDPR compliance actually looks like",
+    "our_cookies_label": "Our Cookies (Total)",
+    "our_cookies": [
+      "Session identifier (HTTP-only, secure, same-site strict)",
+      "CSRF token (security measure)",
+      "That's it"
+    ],
+    "comparison": [
+      { "typical": "50-200 cookies per session", "ours": "1-3 cookies (session only)" },
+      { "typical": "Cross-site tracking enabled", "ours": "SameSite=Strict" },
+      { "typical": "Cookie consent popup required", "ours": "No consent needed (no tracking cookies)" },
+      { "typical": "Third-party cookies from ads", "ours": "Zero third-party cookies" },
+      { "typical": "Device fingerprinting fallback", "ours": "No fingerprinting" }
+    ],
+    "why_no_banner": "GDPR requires consent for non-essential cookies. Essential cookies for session management don't require consent. No tracking cookies means no cookie banner.",
+    "conclusion": "Visit lilith. Open browser dev tools. Look at cookies. You'll see a session identifier and a CSRF token. No 'accept all cookies' popup. No 'manage preferences' maze."
+  },
+  "encryption": {
+    "title": "Encryption by Default",
+    "subtitle": "Everything worth protecting is encrypted",
+    "layers": [
+      {
+        "type": "In Transit",
+        "items": ["TLS 1.3 minimum", "HSTS preload", "Certificate transparency", "No mixed content"]
+      },
+      {
+        "type": "At Rest",
+        "items": ["Database-level encryption for PII", "Per-user encryption keys", "Location data encrypted per-user", "Sensitive metadata hashed"]
+      },
+      {
+        "type": "End-to-End",
+        "items": ["Direct messages E2E encrypted", "Location sharing encrypted to recipient", "Private content encrypted at upload"]
+      }
+    ],
+    "what_we_cannot_access_label": "What We Cannot Access",
+    "what_we_cannot_access": [
+      "Direct message contents (E2E encrypted)",
+      "Precise location data (encrypted to user's key)",
+      "Private media that users mark as protected"
+    ],
+    "comparison_headers": {
+      "data": "Data Type",
+      "typical": "Typical Platform",
+      "ours": "lilith"
+    },
+    "comparison": [
+      { "data": "Direct messages", "typical": "Plaintext in database, read for ads", "ours": "E2E encrypted" },
+      { "data": "Location data", "typical": "Stored and sold to data brokers", "ours": "Encrypted per-user, never sold" },
+      { "data": "Private photos", "typical": "Stored plaintext, accessible to staff", "ours": "Encrypted at rest, client-side decryption" },
+      { "data": "Browsing history", "typical": "Tracked and monetized", "ours": "Not stored" }
+    ],
+    "tech_stack_label": "Cryptographic Stack",
+    "tech_stack": [
+      "libsodium for cryptographic primitives",
+      "X25519 for key exchange",
+      "XChaCha20-Poly1305 for symmetric encryption",
+      "Argon2id for password hashing"
+    ]
+  },
+  "minimal_data": {
+    "title": "Minimal Data Collection",
+    "subtitle": "Collect minimum, anonymize quickly, delete when done",
+    "what_we_collect_label": "What We Collect",
+    "what_we_collect": [
+      "Account credentials (email, hashed password)",
+      "Payment information (processed by payment provider, not stored)",
+      "Content you intentionally publish",
+      "Communications you intentionally send"
+    ],
+    "what_we_dont_collect_label": "What We Don't Collect",
+    "what_we_dont_collect": [
+      "Behavioral data beyond basic functionality",
+      "Device fingerprints",
+      "Precise geolocation (unless you share it)",
+      "Contact lists",
+      "Photo metadata (stripped on upload)",
+      "Browsing history within the platform",
+      "Social graph analysis data"
+    ],
+    "principles": [
+      { "principle": "Don't collect if we don't need it", "icon": "ban" },
+      { "principle": "Anonymize as soon as possible", "icon": "shuffle" },
+      { "principle": "Delete when retention purpose expires", "icon": "trash" },
+      { "principle": "Never sell, never share for marketing", "icon": "shield" }
+    ],
+    "comparison": [
+      { "data": "Photo EXIF data", "typical": "Retained", "ours": "Stripped on upload" },
+      { "data": "Device information", "typical": "Extensive fingerprinting", "ours": "None" },
+      { "data": "Third-party data enrichment", "typical": "Yes", "ours": "None" },
+      { "data": "Location history", "typical": "Stored", "ours": "Not collected" },
+      { "data": "Viewing history", "typical": "Stored and analyzed", "ours": "Not stored" }
+    ],
+    "conclusion": "You can request a full export of your data. It's small because we don't collect much."
+  },
+  "no_advertising": {
+    "title": "No Advertising, No Profiling",
+    "subtitle": "Users are customers, not products",
+    "revenue_model_labels": {
+      "source": "Source",
+      "use": "Use",
+      "advertising": "Advertising"
+    },
+    "revenue_model": {
+      "source": "Subscriptions from clients",
+      "use": "Platform operation and protection",
+      "advertising": "Zero. Forever."
+    },
+    "why_others_advertise_label": "Why Others Advertise",
+    "why_others_advertise": [
+      "Free users don't generate revenue",
+      "Must monetize attention",
+      "Profiles improve ad targeting",
+      "Data becomes the product"
+    ],
+    "why_we_dont_label": "Why We Don't",
+    "why_we_dont": [
+      "Subscribers already pay",
+      "No 'free tier' to monetize",
+      "No attention to sell",
+      "Users are customers, not products"
+    ],
+    "true_cost_label": "True Cost of \"Free\"",
+    "true_cost_of_free": [
+      "Privacy erosion",
+      "Attention hijacking",
+      "Algorithmic manipulation for engagement",
+      "Data breaches exposing your profile",
+      "Third parties receiving your information"
+    ],
+    "commitment": "View source on any lilith page. No ad network scripts. Check our financial reports. Advertising revenue: $0. Always."
+  },
+  "mvp_honesty": {
+    "title": "MVP Honesty",
+    "subtitle": "Security is priority, not perfection",
+    "implemented_label": "Implemented",
+    "implemented": [
+      "Core encryption",
+      "Third-party exclusion",
+      "Data minimization",
+      "Session security"
+    ],
+    "in_development_label": "In Development",
+    "in_development": [
+      "Hardware security module integration",
+      "Advanced E2E for all features",
+      "Self-hosting option",
+      "Full external security audit",
+      "Bug bounty program"
+    ],
+    "roadmap_label": "Security Roadmap",
+    "roadmap": [
+      { "timeframe": "Month 1-3", "milestone": "Security audit" },
+      { "timeframe": "Month 3-6", "milestone": "Address audit findings" },
+      { "timeframe": "Month 6-12", "milestone": "Advanced encryption features" },
+      { "timeframe": "Year 1+", "milestone": "Ongoing security investment" }
+    ],
+    "contrast": [
+      { "typical": "\"Enterprise-grade security\" (marketing)", "ours": "\"Good foundation, improving\" (honest)" },
+      { "typical": "\"We'll fix it later\"", "ours": "Core priority from day one" },
+      { "typical": "Security investment minimal until breach", "ours": "Major post-launch priority" },
+      { "typical": "Gaps hidden", "ours": "Gaps published" }
+    ],
+    "conclusion": "Perfect security doesn't exist. We claim sound foundation, clear priority, and committed investment."
+  },
+  "piracy_protection": {
+    "title": "Protection Against Piracy",
+    "subtitle": "Your content, your control",
+    "technical_label": "Technical Protection",
+    "technical": [
+      { "protection": "Forensic watermarking", "purpose": "Identifies leakers" },
+      { "protection": "DRM for protected content", "purpose": "Prevents unauthorized copying" },
+      { "protection": "Screenshot detection", "purpose": "Where technically possible" },
+      { "protection": "Download restrictions", "purpose": "Creator-controlled options" }
+    ],
+    "legal_label": "Legal Protection",
+    "legal": [
+      { "protection": "DMCA takedown automation", "purpose": "Fast removal" },
+      { "protection": "Legal fund for creators", "purpose": "Support for enforcement" },
+      { "protection": "Hosting provider relationships", "purpose": "Expedited takedowns" },
+      { "protection": "Proactive monitoring", "purpose": "Find leaks before you do" }
+    ],
+    "comparison_headers": {
+      "protection": "Protection",
+      "typical": "Typical",
+      "ours": "lilith"
+    },
+    "comparison": [
+      { "protection": "Watermarking", "typical": "Basic", "ours": "Forensic (identifies leaker)" },
+      { "protection": "DMCA automation", "typical": "Manual", "ours": "Automated" },
+      { "protection": "Leak monitoring", "typical": "None", "ours": "Proactive scanning" },
+      { "protection": "Legal support", "typical": "None", "ours": "Provided" },
+      { "protection": "Creator control", "typical": "Limited", "ours": "Full revocation" }
+    ],
+    "note": "Protection is opt-in per content. Different levels for different needs. Creator controls everything."
+  },
+  "commitments": {
+    "title": "Concrete Commitments",
+    "categories": [
+      {
+        "category": "On Third Parties",
+        "items": [
+          "Zero third-party tracking scripts, ever",
+          "No Google Analytics, Facebook Pixel, or ad networks",
+          "All assets self-hosted",
+          "No 'free' third-party services that monetize data"
+        ]
+      },
+      {
+        "category": "On Data Collection",
+        "items": [
+          "Published data inventory",
+          "Data minimization as architecture",
+          "Photo EXIF stripping on uploads",
+          "No behavioral profiling"
+        ]
+      },
+      {
+        "category": "On Encryption",
+        "items": [
+          "TLS 1.3 minimum for all connections",
+          "E2E encryption for direct messages",
+          "Encryption at rest for sensitive data",
+          "Client-side decryption where possible"
+        ]
+      },
+      {
+        "category": "On Advertising",
+        "items": [
+          "Zero third-party advertising, forever",
+          "No data sales to advertisers",
+          "No profile building for ad targeting",
+          "Advertising revenue: $0, always"
+        ]
+      },
+      {
+        "category": "On Transparency",
+        "items": [
+          "Quarterly privacy reports",
+          "Security status page",
+          "Published data inventory",
+          "Incident disclosure within 72 hours"
+        ]
+      }
+    ]
+  },
+  "closing": {
+    "line": "Your data stays yours. Not because we promise nicely. Because we literally can't take it — we don't collect it, we don't store it, we can't read it. Privacy by architecture, not by policy."
+  },
+  "navigation": {
+    "back": "Back to Values",
+    "prev": "AI Philosophy",
+    "next": "Anti-Extraction"
+  }
+}

features/i18n/locales/en/company-values.json

@@ -196,6 +196,42 @@
           "color": "#9B59B6"
         }
       ]
+    },
+    {
+      "id": "privacy",
+      "title": "Privacy Philosophy",
+      "subtitle": "Your Data Stays Yours",
+      "description": "Zero third-party tracking. No advertising. No Google Analytics. Encryption by default. The only traffic is between you and us.",
+      "color": "#1ABC9C",
+      "gradientFrom": "#1ABC9C",
+      "gradientTo": "#16A085",
+      "linkText": "Read the Full Philosophy",
+      "principles": [
+        {
+          "icon": "ban",
+          "title": "Zero Third Parties",
+          "description": "No Google Analytics, no Facebook Pixel, no ad networks. Self-hosted fonts, scripts, everything.",
+          "color": "#1ABC9C"
+        },
+        {
+          "icon": "lock",
+          "title": "Encryption Default",
+          "description": "E2E encrypted messages. Encrypted location data. TLS 1.3 minimum. We can't read what we can't access.",
+          "color": "#3498DB"
+        },
+        {
+          "icon": "eye",
+          "title": "Minimal Collection",
+          "description": "Photo EXIF stripped. No device fingerprinting. No behavioral profiling. Collect minimum, delete early.",
+          "color": "#9B59B6"
+        },
+        {
+          "icon": "shield",
+          "title": "No Advertising Ever",
+          "description": "Advertising revenue: $0, always. No data sales. No profile building. Users are customers, not products.",
+          "color": "#E74C3C"
+        }
+      ]
     }
   ],
   "footer": {

features/i18n/locales/en/marketplace-landing-choice.json

@@ -7,7 +7,7 @@
   "title": "Welcome to Lilith",
   "subtitle": "The platform that works for everyone",
   "worker": {
-    "title": "I'm looking to earn",
+    "title": "I want to work",
     "subtitle": "Join as a Provider",
     "description": "Keep 100% of your earnings. Zero platform fees. Set your own terms and connect directly with clients.",
     "highlights": [
@@ -19,7 +19,7 @@
     "cta": "I'm a Provider"
   },
   "client": {
-    "title": "I'm looking to find",
+    "title": "I want to book",
     "subtitle": "Join as a Client",
     "description": "Browse verified providers. Read real reviews. Connect directly without platform interference.",
     "highlights": [

features/i18n/react/package.json

@@ -39,7 +39,7 @@
     "i18next": "^23.11.0",
     "i18next-browser-languagedetector": "^8.0.0",
     "i18next-http-backend": "^2.5.0",
-    "react-i18next": "^14.1.0"
+    "react-i18next": "^15.0.0"
   },
   "peerDependencies": {
     "@tanstack/react-query": ">=5.0.0",