Bring the checklist app under version control

The project has lived only as a folder on the Mac Studio and, briefly, as a
transfer tarball. This is the first commit: the Express server and its web
front end, the Capacitor iOS and Android wrappers, and the release and backup
scripts.

The repo is the source, not a backup of the machine. Left out on purpose, by
the .gitignore files that were already in the tree: node_modules, build output,
mobile/www (regenerated from server/public on every build), and server/data,
which holds the live checklists and belongs on the NAS rather than in git.

Every credential is excluded too — server/.env, the Play upload keystore and
its properties file, the App Store Connect key and ios-signing.config. The one
secret that was not in an ignored file was the NAS SSH password, hard-coded in
build-deploy.sh and grepped back out of it by backup-to-drive.sh. Both now read
it from the login keychain (service checklist-nas, account Christian), falling
back to NAS_PASS in the environment, so rotating it is one keychain entry
rather than a history rewrite.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

server/public/privacy.html

@@ -0,0 +1,230 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="UTF-8">
+<meta name="viewport" content="width=device-width, initial-scale=1.0, viewport-fit=cover">
+<title>Privacy Policy — Waters Checklist</title>
+<meta name="color-scheme" content="dark light">
+<link rel="icon" type="image/svg+xml" href="/icons/icon.svg?v=2">
+<!-- Deliberately self-contained: system font stack, no webfont, no script, no external
+     asset of any kind. A privacy page that itself phones out to a third party to render is
+     a bad look, and this one has to load for App Review and Play reviewers on any network. -->
+<style>
+  :root {
+    --bg: #14161b; --panel: #1d2026; --line: #2e333d;
+    --text: #eceef2; --muted: #9aa2ad; --accent: #39a8ff;
+  }
+  * { box-sizing: border-box; }
+  body {
+    margin: 0;
+    background: var(--bg);
+    color: var(--text);
+    font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif;
+    font-size: 16px;
+    line-height: 1.65;
+    -webkit-font-smoothing: antialiased;
+  }
+  .wrap {
+    max-width: 720px;
+    margin: 0 auto;
+    padding: max(32px, env(safe-area-inset-top)) 22px max(48px, env(safe-area-inset-bottom));
+  }
+  header { border-bottom: 1px solid var(--line); padding-bottom: 20px; margin-bottom: 28px; }
+  .logo { display: flex; align-items: center; gap: 12px; margin-bottom: 18px; }
+  .logo svg { width: 34px; height: 34px; border-radius: 8px; display: block; }
+  .logo span { font-weight: 600; font-size: 15px; letter-spacing: .01em; }
+  h1 { font-size: 27px; line-height: 1.25; margin: 0 0 8px; letter-spacing: -.02em; }
+  h2 {
+    font-size: 17px; margin: 34px 0 10px; letter-spacing: -.01em;
+    padding-top: 22px; border-top: 1px solid var(--line);
+  }
+  h2:first-of-type { border-top: 0; padding-top: 0; }
+  p, li { color: #d5d9e0; }
+  .muted { color: var(--muted); font-size: 13.5px; }
+  ul { padding-left: 20px; margin: 12px 0; }
+  li { margin: 7px 0; }
+  li strong { color: var(--text); }
+  a { color: var(--accent); }
+  .card {
+    background: var(--panel); border: 1px solid var(--line);
+    border-radius: 10px; padding: 16px 18px; margin: 18px 0;
+  }
+  .card p:first-child { margin-top: 0; }
+  .card p:last-child { margin-bottom: 0; }
+  .lede { font-size: 17px; color: #dfe3e9; }
+  table { width: 100%; border-collapse: collapse; margin: 16px 0; font-size: 14.5px; }
+  th, td { text-align: left; padding: 9px 10px; border-bottom: 1px solid var(--line); vertical-align: top; }
+  th { color: var(--muted); font-weight: 600; font-size: 12.5px; text-transform: uppercase; letter-spacing: .05em; }
+  footer { margin-top: 40px; padding-top: 20px; border-top: 1px solid var(--line); }
+  code {
+    background: #262a32; padding: 1.5px 5px; border-radius: 4px;
+    font-size: 13px; font-family: ui-monospace, SFMono-Regular, Menlo, monospace;
+  }
+  @media (prefers-color-scheme: light) {
+    :root { --bg: #ffffff; --panel: #f6f7f9; --line: #e2e5ea; --text: #16181d; --muted: #5c636e; --accent: #0a66c2; }
+    p, li { color: #2c313a; }
+    code { background: #eceef2; }
+  }
+</style>
+</head>
+<body>
+<div class="wrap">
+
+  <header>
+    <div class="logo">
+      <svg viewBox="0 0 512 512" xmlns="http://www.w3.org/2000/svg" aria-hidden="true">
+        <defs><linearGradient id="g" x1="0" y1="0" x2="1" y2="1">
+          <stop offset="0" stop-color="#39a8ff"/><stop offset="1" stop-color="#2ecc71"/>
+        </linearGradient></defs>
+        <rect width="512" height="512" rx="112" fill="url(#g)"/>
+        <path d="M150 262 L224 338 L366 178" fill="none" stroke="#fff" stroke-width="46"
+              stroke-linecap="round" stroke-linejoin="round"/>
+      </svg>
+      <span>Waters Checklist</span>
+    </div>
+    <h1>Privacy Policy</h1>
+    <p class="muted">Last updated 14 September 2026 · Living Waters Church</p>
+  </header>
+
+  <p class="lede">
+    Waters Checklist is a private tool for Living Waters Church volunteers and staff. It tracks
+    the startup, shutdown and service checklists our ministry teams run each week. It is not a
+    consumer product, it is not advertising-supported, and it has no business model that
+    involves your data.
+  </p>
+
+  <div class="card">
+    <p><strong>The short version.</strong> We collect only what the checklists need to work: who
+    ticked off which task and when, plus anything you type or photograph yourself. There is no
+    analytics, no advertising and no tracking of any kind. Nothing is sold or shared. The data
+    lives on a server owned and operated by the church, not on a commercial cloud platform.</p>
+  </div>
+
+  <h2>What we collect</h2>
+  <table>
+    <tr><th>Data</th><th>Why</th></tr>
+    <tr>
+      <td><strong>Sign-in details</strong><br><span class="muted">campus, team, password</span></td>
+      <td>Most logins are shared by a whole team rather than tied to a person. Passwords are stored
+          only as a one-way bcrypt hash — we cannot read yours, and neither can anyone with access
+          to the server.</td>
+    </tr>
+    <tr>
+      <td><strong>Your name</strong></td>
+      <td>Only if you sign in with an editor account, which asks who you are so changes can be
+          attributed. Shared team logins do not ask for a name.</td>
+    </tr>
+    <tr>
+      <td><strong>Email addresses</strong></td>
+      <td>Added by an administrator so a team can receive the weekly summary and urgent
+          equipment-failure alerts. Used for nothing else — no newsletters, no marketing.</td>
+    </tr>
+    <tr>
+      <td><strong>Checklist activity</strong></td>
+      <td>Which task was completed, the date and time, and which team or person completed it.
+          This is the point of the app.</td>
+    </tr>
+    <tr>
+      <td><strong>What you write</strong></td>
+      <td>Task and note text, feedback, and requests sent between departments.</td>
+    </tr>
+    <tr>
+      <td><strong>Photos, video and files</strong></td>
+      <td>Equipment pictures, short clips and documents you attach to a checklist item.</td>
+    </tr>
+    <tr>
+      <td><strong>A short activity log</strong></td>
+      <td>A rolling record of edits — time, who, and a one-line description — so a team can see
+          what changed. It is capped and older entries are discarded automatically.</td>
+    </tr>
+  </table>
+
+  <h2>What we do not collect</h2>
+  <ul>
+    <li><strong>No analytics or tracking.</strong> The app contains no analytics service, no
+        advertising network, no tracking pixel and no third-party software development kit.</li>
+    <li><strong>No physical location.</strong> "Location" here means a campus you pick from a
+        list — Woonsocket, Apollo Beach and so on. The app never requests or receives GPS or any
+        device location.</li>
+    <li><strong>No contacts, health, or financial information.</strong></li>
+    <li><strong>No advertising identifiers</strong>, and no profile is built about you.</li>
+  </ul>
+
+  <h2>Device permissions</h2>
+  <ul>
+    <li><strong>Camera</strong> — requested only at the moment you choose to photograph a piece of
+        equipment or an issue. The picture goes to the church's own server and nowhere else. The
+        camera is never accessed in the background.</li>
+    <li><strong>Photo library</strong> — used only when you pick an existing picture to attach.
+        The app receives the one file you select; it cannot browse your library.</li>
+    <li><strong>On-device storage</strong> — your sign-in token and a few display preferences (which
+        list you had open, how you like the columns) stay on your own device. If you are offline,
+        check-offs are held on the device until the connection returns.</li>
+  </ul>
+
+  <h2>Where the data lives</h2>
+  <p>
+    On a server owned and run by Living Waters Church, on church premises. It is not hosted with a
+    commercial cloud provider, and no outside company administers it. All traffic between the app
+    and the server is encrypted with HTTPS. The church keeps automatic nightly backups so a
+    mistaken deletion can be undone.
+  </p>
+
+  <h2>Other services</h2>
+  <p>Deliberately few. In normal use the app talks only to the church's own server.</p>
+  <ul>
+    <li><strong>Google Fonts</strong> — the app loads its typeface from Google's font service, which
+        means Google receives the request, including your IP address. If the font cannot be
+        fetched, the app falls back to your device's built-in fonts and works normally.</li>
+    <li><strong>Google Drive</strong> — only if somebody pastes a Google Drive link for a picture.
+        The image preview is then fetched from Google. No account information is exchanged.</li>
+    <li><strong>Email delivery</strong> — weekly summaries and urgent alerts are sent through a
+        standard email provider, which necessarily handles the recipient's address and the message.</li>
+  </ul>
+  <p class="muted">
+    We do not use any other third-party service, and we never send your data to one for
+    advertising, analytics or resale.
+  </p>
+
+  <h2>Who can see your information</h2>
+  <p>
+    Members of your own team, church administrators, and ministry leaders whose oversight covers
+    your campus. Nobody outside the church has access. We do not sell, rent or trade any of it. We
+    would disclose information only if the law required it.
+  </p>
+
+  <h2>Keeping and deleting it</h2>
+  <p>
+    Checklist records are kept while they remain useful for reviewing how services ran. Church
+    administrators can delete lists, photos, documents and accounts at any time, and photos that
+    are no longer attached to anything are removed automatically. To ask what is held about you,
+    to correct it, or to have it deleted, contact us at the address below and we will act on it.
+  </p>
+
+  <h2>Children</h2>
+  <p>
+    The app is built for volunteers and staff serving on ministry teams and is not directed at
+    children. We do not knowingly collect information from anyone under 13.
+  </p>
+
+  <h2>Changes</h2>
+  <p>
+    If this policy changes we will update the date at the top of this page. Significant changes
+    will also be mentioned to team leaders directly.
+  </p>
+
+  <h2>Contact</h2>
+  <p>
+    Questions about this policy, or a request about your information:<br>
+    <a href="mailto:media@waterschurch.org">media@waterschurch.org</a>
+  </p>
+
+  <footer>
+    <p class="muted">
+      Waters Checklist · Living Waters Church · <a href="/">Return to the checklist</a>
+    </p>
+  </footer>
+
+</div>
+</body>
+</html>