Docs: marketing site decisions (crosscode.co.za)

crosscode.co.za as Cross Code's main site with a Cross Events page;
church website and app as "coming later"; repo joshua/crosscode-site;
own server; no prices yet; contact form to info@crosscode.co.za;
privacy notice and terms of use; no cookies. Content from Joshua later.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/HANDOVER.md

@@ -91,9 +91,12 @@ encrypted settings unreadable or break existing installs.
      the webhooks or the old links — those get 410 after the update (MIGRATING-TO-2.md).
    - **AI for a church:** set the licence's monthly AI cap above R0 on the Hub (Hub 1.6.0+); with
      no cap the buttons don't show.
-   - **Marketing site** (roadmap §17): a simple static HTML site — Cross Code as the main site,
-     with a Cross Events page, in its own repo. Questions still open: see the roadmap's "Still
-     open".
+   - **Marketing site** (roadmap §17, all decided 2026-11-02): **crosscode.co.za**, Cross Code's
+     main site with a Cross Events page; church website and church app as "coming later"; repo
+     **`joshua/crosscode-site`** (create it on Gitea first); Joshua's own server (nginx); no prices;
+     a **contact form to info@crosscode.co.za** (needs a small send endpoint on the server — see
+     §17's building notes); a privacy notice and terms of use; no cookies or analytics. Logo,
+     colours, wording and screenshots come from Joshua later — start with placeholders.
    - Testing AI locally: run the Hub (`../events-hub`, port 5200), set Settings → AI there, give a
      test licence an AI cap, and start Cross Events with `HUB_URL=http://localhost:5200`.
 2. **AI rules** (decided 2026-10-29, roadmap §15): the AI buttons show only when the licence's

docs/ROADMAP-v2.md

@@ -13,7 +13,7 @@ providers), maintainable (tests, CI, typed backend, versioned API), and with
 
 **Status (2026-11-02):** everything in this document has shipped — 1.32.0 – 1.52.3, then
 **2.0.0 (released 2026-11-02)**, built on `release/2.0` in parts — except the marketing site
-(§17), which lives in its own repo and waits on the questions under "Still open":
+(§17), which lives in its own repo (decided 2026-11-02, not built yet):
 
 | # | Part | Where | State |
 |---|------|-------|-------|
@@ -22,7 +22,7 @@ providers), maintainable (tests, CI, typed backend, versioned API), and with
 | 3 | The five helpers (§15) with their buttons, an eval set, privacy notice text | 2.0.0 | ✅ eval 19/19 through a local Hub (2026-10-30) |
 | 4 | v1 removed (webhook paths and old message links keep working); clean-ups: Argon2id passwords with rehash-on-login, `node-fetch` gone, React Compiler lint rules back to errors | 2.0.0 | ✅ |
 | 5 | Migration guide (`MIGRATING-TO-2.md`), docs | 2.0.0 | ✅ |
-| 6 | Marketing site: Cross Code with a Cross Events page (§17) | its own repo | to do — repo, domain, hosting, prices and contact route still to decide |
+| 6 | Marketing site: Cross Code with a Cross Events page (§17) | `joshua/crosscode-site` | to do — decided 2026-11-02 (§17); content and logo from Joshua |
 
 The full version list is in [HANDOVER.md](./HANDOVER.md) and the [build order](#suggested-build-order) below.
 
@@ -1039,9 +1039,34 @@ Part of 2.0 (decided 2026-10-30): a **simple static HTML site** for selling, not
   be added later — planned: a **church app** and a **full church website** — without a redesign
   (shown as "coming later" at most, until they exist).
 - Plain HTML and CSS (no build step, no framework), fast on a phone, no tracking cookies.
-- **To decide before building:** the repository (its own, e.g. `joshua/crosscode-site`, not this
-  one), the domain(s) (e.g. crosscode.co.za, with Cross Events at /cross-events or its own domain),
-  hosting, pricing shown or "contact us", and the contact route (email address or a form).
+- **Decided (2026-11-02):**
+
+  | Question | Answer |
+  |----------|--------|
+  | Domain | **crosscode.co.za** — the main site for Cross Code (Joshua's business), with a **Cross Events page** on it (e.g. `/cross-events`) |
+  | Other products | **Church website** and **church app** shown as **"coming later"** (cards or a section, no pages of their own yet) |
+  | Repository | **`joshua/crosscode-site`** on c-git.crosscode.co.za — its own repo, not this one |
+  | Hosting | **Joshua's own server** (nginx serving the files). Mostly information, so as simple a build as possible |
+  | Prices | **Not shown for now** — "get in touch for a licence" instead |
+  | Contact | **A form** that sends to **info@crosscode.co.za** |
+  | Legal | A **privacy notice** and **terms of use** for the site |
+  | Cookies, analytics | **None for now** (so no cookie banner) |
+  | Logo, colours, wording about Cross Code, photos, screenshots, a church to name | **Joshua provides them later** — build with placeholders until then |
+
+- **Building notes:**
+  - Plain HTML and CSS stays the plan; at most a tiny static-site step (shared header/footer) if
+    copying them by hand gets tedious — no framework.
+  - **The form needs something on the server to send the email** (a static site can't): a small
+    endpoint on the same server (e.g. a few lines of Node or PHP behind nginx) that checks the
+    fields, has a honeypot field and a rate limit against spam, and sends to info@crosscode.co.za
+    through the server's SMTP. No form-service third party, so the privacy notice stays short. The
+    page works without JavaScript (a normal POST, then a "thanks" page).
+  - The privacy notice covers only the contact form (what is kept, why, for how long, who to ask);
+    the terms of use cover using the site. Neither needs a cookie section while there are none.
+  - Cross Events page: what it does for a church (registrations and payments, multi-day events,
+    kids check-in, volunteer rosters, series and season passes, campuses, POPIA toolkit, the AI
+    helpers), how it's set up (one site and database per church, updates on request, support through
+    the Hub), and "get in touch" (the form).
 
 ---
 
@@ -1102,7 +1127,7 @@ feature.
 | — | v1 in 2.0 | **Every endpoint moves to v2 before 2.0** (1.51.7 – 1.51.16, by area), then 2.0 removes v1. Changed the same day from "retire only what's replaced". Incoming webhooks (Yoco, PayFast, WAWP) and links in emails and WhatsApp (unsubscribe, consent, ticket transfer, calendar feeds) also get v2 URLs (1.51.16); their v1 paths keep working — links redirect (308) to v2, provider webhooks are handled by the same code — because old messages and provider registrations still use them (2026-10-29) |
 | — | AI buttons and markup | AI buttons show only when the licence's monthly cap is **above R0**. When the cap is reached they stay visible but **disabled** until next month or until the cap is raised. Usage is charged at the real cost **plus a markup %** set in the Hub (a default, plus an override per licence). The markup covers small overruns and is the profit. The cap is counted in charged rand, and each call is checked against its worst-case cost before it's sent (2026-10-29) |
 | — | Building 2.0 | On a `release/2.0` branch with a WIP commit per part, tagged 2.0.0 only when everything is in; the Hub's AI proxy ships first as its own release (Hub 1.6.0) (2026-10-30) |
-| — | Marketing site | Part of 2.0: a simple static HTML site — Cross Code as the main site, with a page for Cross Events, the only product on sale for now. Laid out to add a church app and a full church website later. Repo, domain and hosting still to decide (2026-10-30) |
+| — | Marketing site | Part of 2.0: a simple static HTML site — Cross Code as the main site, with a page for Cross Events, the only product on sale for now. Laid out to add a church app and a full church website later (2026-10-30). Decided 2026-11-02: crosscode.co.za on Joshua's own server, repo `joshua/crosscode-site`, church website and app shown as "coming later", no prices for now, a contact form to info@crosscode.co.za, a privacy notice and terms of use, no cookies or analytics; logo, colours and content from Joshua later (§17) |
 | — | 2.0 clean-ups | All in 2.0 (2026-11-02): v1 removed, Argon2id passwords with rehash-on-login, `node-fetch` removed, React Compiler lint rules back to errors |
 | — | AI later | Ask AI (read-only, tools only), help/navigation assistant, actions with confirmation, more helpers, and long-term **self-hosted** AI behind the same Hub endpoint — not tied to versions (2026-10-24) |
 | — | POPIA: message kinds | Bulk messages are either **Event updates** (to registrants — still sent after unsubscribing) or **News & announcements** (marketing — opt-in, one-click unsubscribe). Every bulk email links to the preferences (2026-10-23) |
@@ -1125,5 +1150,5 @@ feature.
 
 ## Still open
 
-- **Marketing site (§17):** repository, domain(s), hosting, whether prices are shown, and the
-  contact route.
+- **Marketing site (§17):** everything is decided; waiting on Joshua for the logo, colours, text
+  about Cross Code, photos and screenshots (built with placeholders meanwhile).