diff --git a/README.md b/README.md
index 0f297cd..b664b53 100644
--- a/README.md
+++ b/README.md
@@ -40,3 +40,9 @@ Then open `http://127.0.0.1:8000`.
 The dashboard reads `data/synthetic_aggregate.json`, displays aggregate dimension counts,
 and suppresses cohorts below `min_public_cohort`. It must not ship raw conversations,
 quotes, individual records, schools, locations, or reviewer-only data.
+
+## Developer Notes
+
+- [src/README.md](src/README.md) explains the dashboard rendering code.
+- [data/README.md](data/README.md) explains the synthetic aggregate data.
+- [scripts/README.md](scripts/README.md) explains the static validation check.
diff --git a/data/README.md b/data/README.md
new file mode 100644
index 0000000..8415e8f
--- /dev/null
+++ b/data/README.md
@@ -0,0 +1,13 @@
+# Dashboard Data
+
+This folder stores synthetic aggregate dashboard data.
+
+`synthetic_aggregate.json` is safe demo data. It has:
+
+- `record_count`
+- `min_public_cohort`
+- generation/status metadata
+- aggregate counts by behavioral dimension
+
+Values below `min_public_cohort` are suppressed by the dashboard UI. Real public data
+should only be generated by the dataset publishing pipeline after review.
diff --git a/scripts/README.md b/scripts/README.md
new file mode 100644
index 0000000..48f6ff0
--- /dev/null
+++ b/scripts/README.md
@@ -0,0 +1,13 @@
+# Dashboard Validation Scripts
+
+`validate.mjs` checks that the static dashboard has a linked script and that the synthetic
+aggregate data has a minimum cohort threshold of at least 5.
+
+Run locally with:
+
+```bash
+node scripts/validate.mjs
+```
+
+Keep this check simple. It should catch accidental removal of the privacy threshold or
+dashboard wiring.
diff --git a/src/README.md b/src/README.md
new file mode 100644
index 0000000..c0c8c81
--- /dev/null
+++ b/src/README.md
@@ -0,0 +1,22 @@
+# Dashboard Code
+
+This folder contains the JavaScript for the static aggregate dashboard.
+
+## What `dashboard.js` Does
+
+- Loads `data/synthetic_aggregate.json`.
+- Writes summary values into the page.
+- Renders one bar per behavioral dimension.
+- Suppresses counts below `min_public_cohort`.
+
+## Privacy Rule
+
+Dashboard code should only use aggregate, publication-approved data. Do not add raw
+conversations, anonymized full transcripts, reviewer-only records, quotes, schools,
+locations, or individual examples to the client.
+
+## First Place To Edit
+
+Edit `dashboard.js` for rendering behavior and `data/synthetic_aggregate.json` for
+synthetic demo data. If real data is added later, it should come from the publishing
+pipeline after review.