Update .github/workflows/build.yml

.github/workflows/build.yml

@@ -34,6 +34,11 @@ jobs:
           gpg -d --passphrase "${{ secrets.RELEASE_KEYSTORE_PASSWORD }}" --batch keystore.asc > app/keystore.properties
           gpg -d --passphrase "${{ secrets.RELEASE_KEYSTORE_PASSWORD }}" --batch key.asc > app/key.jks          
 
+      - name: Generate Dynamic Release Notes
+        run: |
+          mkdir -p tmp/whatsnew
+          echo "Various improvements for you to experience..." > tmp/whatsnew/whatsnew-en-US
+          
       - name: create and checkout branch
         if: github.event_name == 'pull_request'
         env:
@@ -88,9 +93,11 @@ jobs:
 
       - name: Upload to Google Play
         uses: r0adkll/upload-google-play@v1
+        if: startsWith(github.ref, 'refs/tags/')
         with:
           serviceAccountJsonPlainText: ${{ secrets.SERVICE_ACCOUNT_JSON }}
           packageName: net.helcel.cowspent
           releaseFiles: app/build/outputs/bundle/signedRelease/app-signedRelease.aab
-          tracks: 'internal' # ${{ startsWith(github.ref, 'refs/tags/') && 'production' || 'beta' }}
-          status: completed
+          tracks: ${{ startsWith(github.ref, 'refs/tags/') && 'production' || 'alpha' }}
+          status: completed
+          whatsNewDirectory: tmp/whatsnew

PRIVACY.md

@@ -1,12 +1,74 @@
-# Cowspent Privacy Policy
+# Privacy Policy for Cowspent
 
-Cowspent does not collect any personal data.
-This is a Free/Libre software so you can verify no data is collected
-by reading the source code or asking someone to do it.
+**App:** Cowspent (`net.helcel.cowspent`)
+**Developer:** Helcel
+**Effective date:** 19 September 2026
 
-Members and bills are synchronized with
-the Cospend server of your choice.
+## What we collect
 
-CAMERA permission is used to read QR-codes.
+Nothing. We operate no servers and receive no data from the app. Cowspent
+contains no analytics, advertising, or tracking libraries.
 
-GET\_ACCOUNTS permission is used by Single-Sign-On library to access accounts from Nextcloud Files app.
+## Data you enter and where it goes
+
+Cowspent stores your projects, members, bills, categories, and app settings on
+your device.
+
+If you connect the app to a Cospend or IHateMoney server, this data is
+synchronised with **the server you choose**: either your own or one operated by
+a third party. That server's operator controls that copy of your data and their
+privacy policy applies to it. We are not involved in that transfer and cannot
+access it.
+
+Your server address, username, and password or access token are stored on your
+device and sent only to the server you configured, over the connection it
+provides. If you sign in through the Nextcloud Files app, authentication is
+handled by that app's Single Sign-On and we never see your password.
+
+## Sharing projects
+
+Project share links and QR codes are generated by your server. Anyone who
+obtains a link or code may be able to access the project, so share them only
+with people you trust.
+
+## Permissions
+
+- `INTERNET`, `ACCESS_NETWORK_STATE` — synchronising with your chosen server.
+- `CAMERA` — scanning QR codes to import a project. Images are processed on the
+  device, never stored or transmitted.
+- `GET_ACCOUNTS` — used by the Nextcloud Single Sign-On library to list accounts
+  from the Nextcloud Files app.
+
+## Retention and deletion
+
+Data on your device remains until you delete it. Clearing the app's data in
+Android Settings, or uninstalling Cowspent, removes the local copy and the
+stored credentials. Data already synchronised to a server must be deleted on
+that server, by you or its administrator.
+
+## Children
+
+Cowspent is suitable for all ages and collects no data from any user, including
+children.
+
+## Security
+
+Credentials and project data are held in the app's private storage, protected by
+the Android sandbox. Use an HTTPS server address so that synchronisation is
+encrypted in transit.
+
+## Open source
+
+Cowspent is released under the GNU General Public License v3.0. The full source
+is available at https://github.com/helcel-net/cowspent, so these statements can
+be independently verified.
+
+## Changes
+
+Any change affecting privacy will be published in this document before or with
+the release that introduces it.
+
+## Contact
+
+Email: net-helcel+privacy@gmail.com
+Issues: https://github.com/helcel-net/cowspent/issues

README.md

@@ -60,13 +60,23 @@ Extra Features:
 
 <div style="display: flex; justify-content: center; align-items: center; flex-direction: row;">
     <a href="https://apt.izzysoft.de/fdroid/index/apk/net.helcel.cowspent">
-        <img width="200" height="80" alt="Izzy Download" src=".github/images/izzy.png">
+        <img width="200" height="84" alt="Izzy Download" src=".github/images/izzy.png">
     </a>
     <a href="https://github.com/helcel-net/cowspent/releases/latest">
         <img width="200" height="84" alt="APK Download" src=".github/images/apk.png">
     </a>
+    <a future-href="https://f-droid.org/en/packages/net.helcel.cowspent">
+        <img width="200" height="84" alt="Fdroid Download" src=".github/images/fdroid.png">
+    </a>
+    <a href="https://play.google.com/store/apps/details?id=net.helcel.cowspent">
+        <img width="200" height="84" alt="GooglePlay Download" src=".github/images/playstore.png">
+    </a>
 </div>
 
+Note:
+ - Fdroid: requested, see https://gitlab.com/fdroid/rfp/-/work_items/4412
+ - PlayStore: alpha test restriction by Google. To access, join https://groups.google.com/g/helcel-android-test
+
 ## ⚙️ Permissions
 
 - `CAMERA`: recommended for scanning barcodes from camera