Update .github/workflows/build.yml

For security and also to have a source of true for AppVerifierBG and https://github.com/privacyguides/verified-apps/

.github/workflows/build.yml

@@ -34,6 +34,11 @@ jobs:
           gpg -d --passphrase "${{ secrets.RELEASE_KEYSTORE_PASSWORD }}" --batch keystore.asc > app/keystore.properties
           gpg -d --passphrase "${{ secrets.RELEASE_KEYSTORE_PASSWORD }}" --batch key.asc > app/key.jks          
 
+      - name: Generate Dynamic Release Notes
+        run: |
+          mkdir -p tmp/whatsnew
+          echo "Various improvements for you to experience..." > tmp/whatsnew/whatsnew-en-US
+          
       - name: create and checkout branch
         if: github.event_name == 'pull_request'
         env:
@@ -62,7 +67,9 @@ jobs:
           else
             VERSION_NAME="${VERSION_BASE}"
           fi
-          ./gradlew assembleSignedRelease -PVERSION_CODE=$VERSION_CODE -PVERSION_NAME=$VERSION_NAME
+          ./gradlew bundleSignedRelease assembleSignedRelease -PVERSION_CODE=$VERSION_CODE -PVERSION_NAME=$VERSION_NAME
+        # ./gradlew assembleSignedRelease -PVERSION_CODE=$VERSION_CODE -PVERSION_NAME=$VERSION_NAME
+        # ./gradlew bundleSignedRelease -PVERSION_CODE=$VERSION_CODE -PVERSION_NAME=$VERSION_NAME
 
       - name: Upload APK
         uses: actions/upload-artifact@v7
@@ -82,4 +89,15 @@ jobs:
               echo "false"
             else
               echo "true"
-            fi
+            fi
+
+      - name: Upload to Google Play
+        uses: r0adkll/upload-google-play@v1
+        if: startsWith(github.ref, 'refs/tags/')
+        with:
+          serviceAccountJsonPlainText: ${{ secrets.SERVICE_ACCOUNT_JSON }}
+          packageName: net.helcel.cowspent
+          releaseFiles: app/build/outputs/bundle/signedRelease/app-signedRelease.aab
+          tracks: ${{ startsWith(github.ref, 'refs/tags/') && 'production' || 'alpha' }}
+          status: completed
+          whatsNewDirectory: tmp/whatsnew

PRIVACY.md

@@ -1,12 +1,74 @@
-# Cowspent Privacy Policy
+# Privacy Policy for Cowspent
 
-Cowspent does not collect any personal data.
-This is a Free/Libre software so you can verify no data is collected
-by reading the source code or asking someone to do it.
+**App:** Cowspent (`net.helcel.cowspent`)
+**Developer:** Helcel
+**Effective date:** 19 September 2026
 
-Members and bills are synchronized with
-the Cospend server of your choice.
+## What we collect
 
-CAMERA permission is used to read QR-codes.
+Nothing. We operate no servers and receive no data from the app. Cowspent
+contains no analytics, advertising, or tracking libraries.
 
-GET\_ACCOUNTS permission is used by Single-Sign-On library to access accounts from Nextcloud Files app.
+## Data you enter and where it goes
+
+Cowspent stores your projects, members, bills, categories, and app settings on
+your device.
+
+If you connect the app to a Cospend or IHateMoney server, this data is
+synchronised with **the server you choose**: either your own or one operated by
+a third party. That server's operator controls that copy of your data and their
+privacy policy applies to it. We are not involved in that transfer and cannot
+access it.
+
+Your server address, username, and password or access token are stored on your
+device and sent only to the server you configured, over the connection it
+provides. If you sign in through the Nextcloud Files app, authentication is
+handled by that app's Single Sign-On and we never see your password.
+
+## Sharing projects
+
+Project share links and QR codes are generated by your server. Anyone who
+obtains a link or code may be able to access the project, so share them only
+with people you trust.
+
+## Permissions
+
+- `INTERNET`, `ACCESS_NETWORK_STATE` — synchronising with your chosen server.
+- `CAMERA` — scanning QR codes to import a project. Images are processed on the
+  device, never stored or transmitted.
+- `GET_ACCOUNTS` — used by the Nextcloud Single Sign-On library to list accounts
+  from the Nextcloud Files app.
+
+## Retention and deletion
+
+Data on your device remains until you delete it. Clearing the app's data in
+Android Settings, or uninstalling Cowspent, removes the local copy and the
+stored credentials. Data already synchronised to a server must be deleted on
+that server, by you or its administrator.
+
+## Children
+
+Cowspent is suitable for all ages and collects no data from any user, including
+children.
+
+## Security
+
+Credentials and project data are held in the app's private storage, protected by
+the Android sandbox. Use an HTTPS server address so that synchronisation is
+encrypted in transit.
+
+## Open source
+
+Cowspent is released under the GNU General Public License v3.0. The full source
+is available at https://github.com/helcel-net/cowspent, so these statements can
+be independently verified.
+
+## Changes
+
+Any change affecting privacy will be published in this document before or with
+the release that introduces it.
+
+## Contact
+
+Email: net-helcel+privacy@gmail.com
+Issues: https://github.com/helcel-net/cowspent/issues

README.md

@@ -12,8 +12,6 @@ Which is originally a fork of [PhoneTrack-Android](https://gitlab.com/eneiluj/ph
 Which is itself a fork of [Nextcloud Notes for Android](https://github.com/stefan-niedermann/nextcloud-notes).
 Many thanks to their developers :heart: !
 
-
-
 </p>
 
 <a href="https://ko-fi.com/I2I615VP5M"><img src="https://ko-fi.com/img/githubbutton_sm.svg" alt="ko-fi"></a>
@@ -24,6 +22,7 @@ Many thanks to their developers :heart: !
 <a href="https://github.com/helcel-net/cowspent/actions/workflows/build.yml">
 <img src="https://github.com/helcel-net/cowspent/actions/workflows/build.yml/badge.svg?branch=main" alt="Build Status">
 </a>
+
 </div>
 
 ## 🌄 Screenshots
@@ -57,18 +56,27 @@ Extra Features:
 - Support for Cospend archived-status (hide archived projects by default)
 - Modern UI and code with Kotlin and Jetpack-Compose
 
-
 ## 📳 Installation
 
 <div style="display: flex; justify-content: center; align-items: center; flex-direction: row;">
     <a href="https://apt.izzysoft.de/fdroid/index/apk/net.helcel.cowspent">
-        <img width="200" height="80" alt="Izzy Download" src=".github/images/izzy.png">
+        <img width="200" height="84" alt="Izzy Download" src=".github/images/izzy.png">
     </a>
     <a href="https://github.com/helcel-net/cowspent/releases/latest">
         <img width="200" height="84" alt="APK Download" src=".github/images/apk.png">
     </a>
+    <a future-href="https://f-droid.org/en/packages/net.helcel.cowspent">
+        <img width="200" height="84" alt="Fdroid Download" src=".github/images/fdroid.png">
+    </a>
+    <a href="https://play.google.com/store/apps/details?id=net.helcel.cowspent">
+        <img width="200" height="84" alt="GooglePlay Download" src=".github/images/playstore.png">
+    </a>
 </div>
 
+Note:
+ - Fdroid: requested, see https://gitlab.com/fdroid/rfp/-/work_items/4412
+ - PlayStore: alpha test restriction by Google. To access, join https://groups.google.com/g/helcel-android-test
+
 ## ⚙️ Permissions
 
 - `CAMERA`: recommended for scanning barcodes from camera
@@ -88,6 +96,13 @@ Cowspent is a user-driven project. We welcome any contribution, big or small.
 
 Thanks to all contributors, the developers of our dependencies, and our users.
 
+## Signinig key
+
+```
+net.helcel.cowspent
+D3:EE:68:A8:5A:7F:35:A1:14:D2:74:B4:50:AA:CE:8C:ED:68:EA:C8:1A:A2:22:E2:7F:F5:0E:98:4C:C6:29
+```
+
 ## 📝 License
 
 ```

app/src/main/assets/adi-registration.properties

@@ -0,0 +1 @@
+CUE6FCSBR6JIAAAAAAAAAAAAAA