diff --git a/README.md b/README.md
index 16186b8..b4f5994 100644
--- a/README.md
+++ b/README.md
@@ -104,15 +104,21 @@ Apple Reminders, forward mail into it, and add it to Claude as a connector.
 | AI layer (Anthropic/OpenAI/Google/local) | Built, degrades when unconfigured |
 | Gmail: OAuth2 with PKCE, polling, one-way to tasks | Done, tested |
 | Google Calendar: read-only, laid over the task calendar | Built, never run against Google |
+| Calendar subscriptions: ICS and webcal, several per person | Done, tested |
+| Times on tasks, set by dragging in the week grid | Done, tested |
+| Notes: archive, grouped list, images, source view | Done, tested |
 | Update notice for administrators | Done, tested |
 | Personal API tokens | Done, tested |
 | OpenAPI 3.1 spec, checked against the router | Done, tested |
 | End-to-end smoke tests (Playwright) | Done |
 | Documentation, landing page, licence | Done |
 
-**Not finished:** Web Push, the AI providers, and the Gmail and Google Calendar
-API calls are implemented against their specifications and have only ever been
-exercised there, not against live services. Everything else has an interface: opening a task shows
+**Not finished:** Web Push, the AI providers and the Google Calendar API calls are
+implemented against their specifications and have only ever been exercised there,
+not against live services. Gmail is no longer in that list — it runs in production,
+including the flagging and de-duplication that took a day to get right. Calendar
+subscriptions over ICS and webcal are proven; the Google half of the calendar is
+not. Everything else has an interface: opening a task shows
 its description, sub-tasks, comments, files and reminders, and the settings pages
 cover the account, notifications, integrations, AI, API tokens, import, export and
 templates.
diff --git a/SECURITY.md b/SECURITY.md
index cb5ce6d..14389db 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -39,8 +39,23 @@ reply within a week.
 - **The CSP** is computed at startup by hashing the inline scripts in the built
   page, rather than allowing `unsafe-inline`.
 
+- **Note bodies, task titles, descriptions and comments are not encrypted.** The
+  sealing above covers credentials — mailbox passwords, OAuth tokens, TOTP secrets,
+  AI keys — and nothing else. A note holding a password is holding it in plain text
+  in every backup that can be downloaded. Encrypting note bodies is on the list and
+  is larger than it sounds: the full-text index and the folded search column are
+  both derived from the body, so both would have to go and search would have to be
+  rewritten to decrypt in application code.
+
 ## What it does not do
 
-verdande has no rate limiting beyond the login and password-reset endpoints, and
-no audit log of reads. It is built to be run behind something — a Cloudflare
-Tunnel, a reverse proxy, a VPN — by somebody who knows what they exposed.
+Rate limiting covers the endpoints a stranger can reach: signing in, resetting a
+password, the second factor, the installation beacon, and inbound mail. **Nothing
+else is limited** — an authenticated caller can ask as often as they like, and a
+signed-in account that wanted to be a nuisance can be one.
+
+There is no audit log of reads. Who *changed* something is recorded per project;
+who looked at it is not.
+
+It is built to be run behind something — a Cloudflare Tunnel, a reverse proxy, a
+VPN — by somebody who knows what they exposed.