diff --git a/RULES.md b/RULES.md
index 5cfc926..af6ee2b 100644
--- a/RULES.md
+++ b/RULES.md
@@ -22,10 +22,12 @@ contradicts either, the originals govern.
 
 ## External Communication
 
-- [ ] Extension contacts exactly three external services: configured RPC
-      endpoint, CoinDesk price API, and Blockscout block-explorer API
+- [ ] Until the user changes a setting, the extension contacts only the
+      configured RPC endpoint
 - [ ] No analytics, telemetry, or tracking
-- [ ] No user-specific data sent except to the configured RPC endpoint
+- [ ] No user-specific data sent except to the configured RPC endpoint, unless
+      the user turns on "Use Blockscout" or "Check recipients on Etherscan",
+      both off by default
 - [ ] No Infura/Alchemy hard dependency
 - [ ] No backend servers operated by the developer
 - [ ] RPC endpoint is user-configurable (defaults to publicnode.com)