diff --git a/web/src/pages/architecture.astro b/web/src/pages/architecture.astro
index 00b8b03..22823b2 100644
--- a/web/src/pages/architecture.astro
+++ b/web/src/pages/architecture.astro
@@ -106,158 +106,14 @@ const storage = [
 
   <main class="wide">
     <section>
-      <h2>The moving parts</h2>
+      <h2>how it works</h2>
       <p>
-        The extension runs as four separate contexts in your browser, and talks
-        to AT Protocol services directly. There is no substandard server in any
-        of these paths. Everything below is in the
-        <a href={REPO}>source repository</a>.
+        The extension runs in your browser and talks to AT Protocol services directly.
       </p>
-      <figure class="diagram" set:html={diagram} />
-    </section>
-
-    <section>
-      <h2>The four contexts</h2>
-      <ul>
-        <li>
-          <strong>Content script</strong> (<a href={src("src/content.ts")}
-            ><code>src/content.ts</code></a
-          >) — runs in the page, reads its
-          <code>site.standard.publication</code> and
-          <code>site.standard.document</code> link tags, and reports those two
-          <code>at://</code> URIs to the worker. It reads nothing else from the page
-          and makes no network requests of its own.
-        </li>
-        <li>
-          <strong>Background service worker</strong> (<a
-            href={src("src/background.ts")}><code>src/background.ts</code></a
-          >) — keeps detection state per tab, sets the toolbar badge, and makes
-          the public reads: the well-known probe, identity resolution, and
-          unauthenticated record fetches.
-        </li>
-        <li>
-          <strong>Popup</strong> (<a href={src("src/popup")}
-            ><code>src/popup/</code></a
-          >) — the UI and its cards. It gathers the context around a
-          publication, and it is where writes to your PDS happen, using the
-          restored session.
-        </li>
-        <li>
-          <strong>Offscreen document</strong> (<a href={src("src/offscreen")}
-            ><code>src/offscreen/</code></a
-          >) — an invisible page that exists only to host the OAuth client,
-          which needs <code>window</code> and DOM storage that a service worker
-          does not have.
-        </li>
-      </ul>
-    </section>
-
-    <section>
-      <h2>What crosses the network</h2>
       <p>
-        Public reads carry no cookies and no credentials
-        (<a href={src("src/lib/http.ts")}><code>src/lib/http.ts</code></a> sets
-        <code>credentials: "omit"</code>), and their answers are cached in your
-        browser. Only the last two rows are authenticated, and both go to your
-        own PDS. XRPC calls are named without their
-        <code>com.atproto.</code> prefix.
-      </p>
-      <div class="table-scroll">
-        <table>
-          <thead>
-            <tr>
-              <th>From</th>
-              <th>To</th>
-              <th>Call</th>
-              <th>For</th>
-            </tr>
-          </thead>
-          <tbody>
-            {
-              calls.map((call) => (
-                <tr>
-                  <td>{call.from}</td>
-                  <td>{call.to}</td>
-                  <td>
-                    <code>{call.what}</code>
-                  </td>
-                  <td>{call.why}</td>
-                </tr>
-              ))
-            }
-          </tbody>
-        </table>
-      </div>
-    </section>
-
-    <section>
-      <h2>What is written, and what is only read</h2>
-      <p>
-        The OAuth scope the extension asks for is listed in full in its
-        <a href="/client-metadata.json">client metadata</a>. It permits exactly
-        two kinds of write:
-      </p>
-      <ul>
-        <li>
-          <code>site.standard.graph.subscription</code> — created when you
-          subscribe, deleted when you unsubscribe, in your own repository.
-        </li>
-        <li>
-          <code>app.userinput.discussion</code> — created only when you submit
-          the feedback form.
-        </li>
-      </ul>
-      <p>
-        Everything else is read-only, including your follows, your blocks, your
-        profile and your labeler preferences. Nothing follows, blocks or posts
-        on your behalf: sharing to Bluesky opens a compose link rather than
-        writing a post.
-      </p>
-    </section>
-
-    <section>
-      <h2>What is stored, and where</h2>
-      <div class="table-scroll">
-        <table>
-          <thead>
-            <tr>
-              <th>Where</th>
-              <th>What</th>
-              <th>How long</th>
-            </tr>
-          </thead>
-          <tbody>
-            {
-              storage.map((row) => (
-                <tr>
-                  <td>
-                    <code>{row.where}</code>
-                  </td>
-                  <td>{row.what}</td>
-                  <td>{row.life}</td>
-                </tr>
-              ))
-            }
-          </tbody>
-        </table>
-      </div>
-      <p>
-        Tokens are never put in <code>chrome.storage</code>; the OAuth client
-        keeps them in the extension origin's own storage. Uninstalling the
-        extension removes all of it.
-      </p>
-    </section>
-
-    <section>
-      <h2>Why the extension asks for every site</h2>
-      <p>
-        Detection needs the well-known probe, and there is no list of which
-        sites publish on <a href="https://standard.site">standard.site</a>, so
-        the probe has to be able to run wherever you are. That is what the
-        host permissions in the manifest are for. The
-        <a href="/privacy">privacy policy</a> covers what that means for your data;
-        this page is its diagram.
+        This includes the site you're on, both their and your PDS, and ecosystem services (like Bluesky APIs).
       </p>
+      <figure class="diagram" set:html={diagram} />
     </section>
   </main>
 </Layout>