diff --git a/PRIVACY.md b/PRIVACY.md index b55dc0b..c28b964 100644 --- a/PRIVACY.md +++ b/PRIVACY.md @@ -1,6 +1,6 @@ # Privacy Policy — File Manager -_Last updated: 2026-10-14_ +_Last updated: 2026-10-15_ ## Summary @@ -41,19 +41,34 @@ is handled entirely by Google Play, never by the app (see [Purchases](#purchases ## Deleting files -Files are deleted only when you ask. Deleting through the app asks for confirmation first. -Where Android provides its own delete dialog for media files, the app hands the request to -the system and Android performs the deletion; otherwise the app deletes the files you -selected directly. The app never deletes anything you did not select. +Files are deleted only when you ask, and deleting asks for confirmation first. Where Android +provides its own delete dialog for media files, the app hands the request to the system and +Android performs that deletion. + +For everything else the app **moves** the item into a hidden `.plainfiles-trash` folder on the +same volume instead of erasing it, and keeps it there for 24 hours so a mistake can be undone. +Those items are still on your device and still count against your free space until they expire; +the app removes them by itself after that. The **Trash** screen, in the app's menu, lists what +is still there and puts it back where it came from. The app never touches anything you did not +select. ## Data retention and deletion -The app stores a small amount of data in its own private storage: your view preferences -(list or grid, sort order), any folder permission you granted through the system picker, -and nothing else. This data never leaves your device. Uninstalling the app, or clearing its -storage in Android Settings, removes all of it. +The app stores a small amount of data in its own private storage: -The app does not keep copies of your files. +- your view preferences (list or grid, sort order); +- any folder permission you granted through the system picker; +- a small index of what is currently in the trash — file names, the folder each item came + from, its size and when it was deleted — so that a deletion can be put back even after the + app has been restarted. + +None of it leaves your device. Uninstalling the app, or clearing its storage in Android +Settings, removes all of it. One thing worth knowing: clearing the app's storage forgets *what +is in the trash*, but the trashed files themselves stay on your volume until they expire, or +until you move them back by hand. + +The app does not keep a second copy of your files. The trash holds the originals by moving +them, so nothing is duplicated and no extra space is used beyond the items themselves. ## Purchases diff --git a/docs/PLAY_RELEASE_CHECKLIST.md b/docs/PLAY_RELEASE_CHECKLIST.md index a7249d9..b435264 100644 --- a/docs/PLAY_RELEASE_CHECKLIST.md +++ b/docs/PLAY_RELEASE_CHECKLIST.md @@ -40,14 +40,21 @@ rest are things you must do in the Play Console or with your own accounts. ./gradlew :app:lintDebug # Android Lint ``` -- [x] **[code] verified 2026-10-14.** `bundleRelease` and `assembleRelease` both succeed +- [x] **[code] re-verified 2026-10-15.** `bundleRelease` and `assembleRelease` both succeed with R8 minification and resource shrinking on. - - `app-release.aab` is **4 682 814 bytes** - (`sha256 9014627a8596397623404cb9d986af5019c5e33cf331c5d363427c140f121788`). - - `app-release.apk` is **2 081 955 bytes**, signed by the upload key above. + - `app-release.aab` is **4 836 490 bytes** + (`sha256 0c0702d3917e9b94f42dabfce8002cae6b9377ee4b25d054bf97f73b4c3a8652`). + - `app-release.apk` is **2 155 563 bytes**, signed by the upload key above. - Both report `versionCode=1 versionName=1.0.0 targetSdk=36` and exactly the permission set in step 4 — **no `INTERNET`**, so "nothing leaves the device" holds in the shipped artefact and not just in the source manifest. + - The figures moved from the first measurement (4 682 814 / 2 081 955) because of the + LZMA library behind `.xz` and 7z. The permission set did **not** change: the share + target, the file picker and the trash index all arrived without a single new + permission, which is the point of having designed them that way. + - ⚠️ **Re-measure after any further change.** These numbers are a record of a verified + artefact, not a constant — a stale hash here is worse than no hash, because it looks + checked. - [ ] Upload the **`.aab`** (not the APK) to the Play Console. ⚠️ **Expect a native-debug-symbols warning and ignore it.** Play finds `base/lib//libandroidx.graphics.path.so`, which arrives transitively through @@ -108,6 +115,11 @@ POST_NOTIFICATIONS - [ ] **Data safety** form: the app collects **nothing** and shares **nothing**. Answer "No" to collection, "No" to sharing, and state that data is not transmitted off the device. - [ ] Confirm the answers match [PRIVACY.md](../PRIVACY.md). +- [ ] The app now keeps a small local SQLite index of staged deletes (the trash), so that a + deletion can be undone after a restart. It never leaves the device, so **"collects + nothing" is still the honest answer** — but if a form asks whether the app *stores* + anything, the truthful answer is "on the device only, and it is the user's own file + paths". [PRIVACY.md](../PRIVACY.md) should say so explicitly. - [ ] Content rating questionnaire: utility, no user-generated content, no ads. - [ ] Target audience: not directed at children. @@ -125,6 +137,11 @@ graphic 1024×500, and the screenshots. whose app area is blank. - [ ] Expect the 7-inch set to be single-pane and the 10-inch set two-pane. That is the adaptive layout working, not an inconsistency — see the CHANGELOG. +- [ ] The committed sets show browsing, a folder list, an image preview and storage usage. + **None of them show search, undo, the trash or receiving a share** — four features the + app now has. The existing shots stay accurate (no layout changed), so this is an + opportunity rather than a defect: two or three more captures would let the listing + advertise them. See `tools/make-store-screenshots.sh`. ## 7. Release tracks and pricing