📝 Define sensitive customer information

[JFWooten4]

This can be a standalone page in conjunction with a public disclaimer (now drafted as direct commits) communicating the clarification through #21.

[JFWooten4]

If the only way to log in or control the account is a seed phrase, then the seed phrase is very likely an access device because 18 U.S.C. § 1029(e)(1) includes any “code” or other means of account access that can be used to obtain value or initiate a funds transfer. Reg S-P pulls that access-device definition into the sensitive customer information examples at 17 CFR § 248.30(d)(9)(ii)(A)(4).

That sounds good, and I'm happy to write that carve-out in. The only thing I'm iffy on is putting phone numbers down as Tier-2 data since it doesn't make sense in T3, but it's also not used for authentication. I'm putting it there for now because we don't have a full and proper account recovery support workflow, which would spell out how to deal with a lost private key without using the phone as a means of verification and risk mitigation without mediation.