Bring the release documents back in line with what the app now does

The checklist still recorded the first artefacts (aab 4 682 814, apk 2 081 955); re-measured at 4 836 490 and 2 155 563 and noted why they moved, that the permission set did not change, and that a stale hash is worse than no hash because it looks checked.

PRIVACY.md said the app keeps no copies of your files and deletes what you select directly. Both stopped being true when deletes started staging into the trash: the item is moved, not erased, and stays on the volume for 24 hours. A privacy policy that misdescribes deletion is not a small thing on a paid listing, so the deleting and retention sections now describe the trash, the index it keeps, and the one caveat that clearing app storage forgets the trash without emptying it.

Also flags that the screenshots show none of search, undo, trash or receiving a share.

PRIVACY.md

@@ -1,6 +1,6 @@
 # Privacy Policy — File Manager
 
-_Last updated: 2026-10-14_
+_Last updated: 2026-10-15_
 
 ## Summary
 
@@ -41,19 +41,34 @@ is handled entirely by Google Play, never by the app (see [Purchases](#purchases
 
 ## Deleting files
 
-Files are deleted only when you ask. Deleting through the app asks for confirmation first.
-Where Android provides its own delete dialog for media files, the app hands the request to
-the system and Android performs the deletion; otherwise the app deletes the files you
-selected directly. The app never deletes anything you did not select.
+Files are deleted only when you ask, and deleting asks for confirmation first. Where Android
+provides its own delete dialog for media files, the app hands the request to the system and
+Android performs that deletion.
+
+For everything else the app **moves** the item into a hidden `.plainfiles-trash` folder on the
+same volume instead of erasing it, and keeps it there for 24 hours so a mistake can be undone.
+Those items are still on your device and still count against your free space until they expire;
+the app removes them by itself after that. The **Trash** screen, in the app's menu, lists what
+is still there and puts it back where it came from. The app never touches anything you did not
+select.
 
 ## Data retention and deletion
 
-The app stores a small amount of data in its own private storage: your view preferences
-(list or grid, sort order), any folder permission you granted through the system picker,
-and nothing else. This data never leaves your device. Uninstalling the app, or clearing its
-storage in Android Settings, removes all of it.
+The app stores a small amount of data in its own private storage:
 
-The app does not keep copies of your files.
+- your view preferences (list or grid, sort order);
+- any folder permission you granted through the system picker;
+- a small index of what is currently in the trash — file names, the folder each item came
+  from, its size and when it was deleted — so that a deletion can be put back even after the
+  app has been restarted.
+
+None of it leaves your device. Uninstalling the app, or clearing its storage in Android
+Settings, removes all of it. One thing worth knowing: clearing the app's storage forgets *what
+is in the trash*, but the trashed files themselves stay on your volume until they expire, or
+until you move them back by hand.
+
+The app does not keep a second copy of your files. The trash holds the originals by moving
+them, so nothing is duplicated and no extra space is used beyond the items themselves.
 
 ## Purchases
 

docs/PLAY_RELEASE_CHECKLIST.md

@@ -40,14 +40,21 @@ rest are things you must do in the Play Console or with your own accounts.
 ./gradlew :app:lintDebug          # Android Lint
 ```
 
-- [x] **[code] verified 2026-10-14.** `bundleRelease` and `assembleRelease` both succeed
+- [x] **[code] re-verified 2026-10-15.** `bundleRelease` and `assembleRelease` both succeed
       with R8 minification and resource shrinking on.
-      - `app-release.aab` is **4 682 814 bytes**
-        (`sha256 9014627a8596397623404cb9d986af5019c5e33cf331c5d363427c140f121788`).
-      - `app-release.apk` is **2 081 955 bytes**, signed by the upload key above.
+      - `app-release.aab` is **4 836 490 bytes**
+        (`sha256 0c0702d3917e9b94f42dabfce8002cae6b9377ee4b25d054bf97f73b4c3a8652`).
+      - `app-release.apk` is **2 155 563 bytes**, signed by the upload key above.
       - Both report `versionCode=1 versionName=1.0.0 targetSdk=36` and exactly the
         permission set in step 4 — **no `INTERNET`**, so "nothing leaves the device" holds
         in the shipped artefact and not just in the source manifest.
+      - The figures moved from the first measurement (4 682 814 / 2 081 955) because of the
+        LZMA library behind `.xz` and 7z. The permission set did **not** change: the share
+        target, the file picker and the trash index all arrived without a single new
+        permission, which is the point of having designed them that way.
+      - ⚠️ **Re-measure after any further change.** These numbers are a record of a verified
+        artefact, not a constant — a stale hash here is worse than no hash, because it looks
+        checked.
 - [ ] Upload the **`.aab`** (not the APK) to the Play Console.
       ⚠️ **Expect a native-debug-symbols warning and ignore it.** Play finds
       `base/lib/<abi>/libandroidx.graphics.path.so`, which arrives transitively through
@@ -108,6 +115,11 @@ POST_NOTIFICATIONS
 - [ ] **Data safety** form: the app collects **nothing** and shares **nothing**. Answer "No"
       to collection, "No" to sharing, and state that data is not transmitted off the device.
 - [ ] Confirm the answers match [PRIVACY.md](../PRIVACY.md).
+- [ ] The app now keeps a small local SQLite index of staged deletes (the trash), so that a
+      deletion can be undone after a restart. It never leaves the device, so **"collects
+      nothing" is still the honest answer** — but if a form asks whether the app *stores*
+      anything, the truthful answer is "on the device only, and it is the user's own file
+      paths". [PRIVACY.md](../PRIVACY.md) should say so explicitly.
 - [ ] Content rating questionnaire: utility, no user-generated content, no ads.
 - [ ] Target audience: not directed at children.
 
@@ -125,6 +137,11 @@ graphic 1024×500, and the screenshots.
       whose app area is blank.
 - [ ] Expect the 7-inch set to be single-pane and the 10-inch set two-pane. That is the
       adaptive layout working, not an inconsistency — see the CHANGELOG.
+- [ ] The committed sets show browsing, a folder list, an image preview and storage usage.
+      **None of them show search, undo, the trash or receiving a share** — four features the
+      app now has. The existing shots stay accurate (no layout changed), so this is an
+      opportunity rather than a defect: two or three more captures would let the listing
+      advertise them. See `tools/make-store-screenshots.sh`.
 
 ## 7. Release tracks and pricing