diff --git a/README.md b/README.md
index 17d719a..742470a 100644
--- a/README.md
+++ b/README.md
@@ -132,7 +132,22 @@ the server data directory persistent because it owns the server identity and
 stored bans.
 
 Public listing requires the discovery URL and a publicly reachable ENet UDP
-port. Discovery makes a server findable but does not relay gameplay traffic.
+port. Public browsing does not return the server's address, but dedicated rooms
+are always direct and cannot use Woofmeow's shared player-hosting relay. The
+game labels dedicated rooms direct and warns that connected peers can inspect
+one another's public IP addresses. Dedicated operators are responsible for the
+traffic and privacy design of their own server. Use off-site hosting, a VPN
+that supports inbound UDP forwarding, or comparable private infrastructure
+when exposing a home connection is unacceptable.
+Avoid retaining raw-IP firewall, reverse-proxy, or service logs unless they are
+genuinely needed, and set an explicit retention period.
+
+The dedicated-server executable does not provide residential-IP protection by
+itself. A server running on a home computer or home network still uses that
+household's public address unless its traffic goes through a correctly
+configured VPN or separately operated relay. Hosting the server off-site with
+a third-party provider keeps the operator's home connection out of the gameplay
+path.
 
 For a systemd installation, create a dedicated `straywild` system user,
 install the sample configuration and environment files under `/etc`, and copy
diff --git a/config/server.cfg.example b/config/server.cfg.example
index 99f30bd..79d2a5b 100644
--- a/config/server.cfg.example
+++ b/config/server.cfg.example
@@ -4,6 +4,15 @@ bind_address="*"
 port=7777
 max_players=8
 public=false
+# Public discovery hides this server's address while players browse, but all
+# dedicated rooms are direct. Dedicated servers cannot use Woofmeow's shared
+# player-hosting relay. The game warns players before joining. Operators are
+# responsible for providing a publicly reachable route and should use off-site
+# hosting or a VPN with inbound UDP forwarding when exposing a home connection
+# is unacceptable.
+# Running this dedicated server at home does not hide the household IP by
+# itself. Residential-IP separation requires an off-site host or correctly
+# configured VPN.
 data_directory="/var/lib/straywild-server"
 
 [discovery]