diff --git a/README.md b/README.md
index c501c02..495e5fc 100644
--- a/README.md
+++ b/README.md
@@ -78,9 +78,8 @@ HMAC-signed cookie (`names.session`). There are no user accounts in this app.
 
 Optional. `/settings` stores an Anthropic or Gemini key in `localStorage`
 (`names.aiKey`) and the browser calls that provider **directly** — the key never
-touches our server. Same pattern as `rpo`'s Google Vision key, for the same
-reason: the platform has no per-app env tool, and this is a free public tool that
-shouldn't hold a metered credential.
+touches our server. Same pattern as `rpo`'s Google Vision key. It overrides the
+platform path above and works without signing in.
 
 The `anthropic-dangerous-direct-browser-access` header is correct here and would
 be wrong in a product that owns the key. The distinction is whose key it is.