textos: decir la verdad sobre privacidad tras quitar AdMob y Firebase

La app ya no lleva ningún SDK de publicidad, analítica ni crash reporting,
así que la web deja de afirmar cosas que no eran ciertas y empieza a
describir lo que realmente pasa.

- privacy.html: el resumen y "qué datos recogemos" decían que se recogían
  datos de uso e identificadores para medir publicidad, y que podían
  compartirse con socios publicitarios. Ahora: no se recoge nada, las
  etiquetas de privacidad declaran ninguno, y se menciona el manifiesto
  PrivacyInfo.xcprivacy. Backups descritos como JSON legible sin cifrar.
- security.html: "end-to-end encryption" en las tres metadescripciones →
  sincronización por iCloud cifrada por Apple. Nueva sección "No tracking,
  no advertising" y la de backups deja claro que no están cifrados.
- manual-portfolio-tracker.html: quitado "end-to-end" y "nadie, ni nosotros,
  puede ver tus saldos"; ahora dice que no tenemos servidores ni SDKs.
- index.html: la FAQ "Do you track me?" distingue la app (nada) del sitio
  web (Plausible, sin cookies).
- app-ads.txt: borrado, ya no hay AdMob que autorizar.

No desplegado: queda en el repo para que Alexandre lo suba cuando quiera.

Refs alexandrev/InvestmentTrackerApp#52

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F1u4K16xy7eQVtgsYNZ9Vn

app-ads.txt

@@ -1 +0,0 @@
-google.com, pub-1549720748100858, DIRECT, f08c47fec0942fa0

index.html

@@ -137,7 +137,7 @@
         "name": "Do you track me?",
         "acceptedAnswer": {
           "@type": "Answer",
-          "text": "We use privacy-friendly website analytics to understand page usage and improve the experience. No personal data is shared with third parties."
+          "text": "The app does not: it ships with no analytics, advertising or crash-reporting SDK, and never asks for tracking permission. This website uses Plausible, a cookie-less analytics tool that counts page views without personal data or cross-site profiles."
         }
       }
     ]
@@ -447,7 +447,7 @@
           <div class="faq-item">
             <button class="faq-question" aria-expanded="false">Do you track me?</button>
             <div class="faq-answer">
-              <div class="faq-answer-inner">We use privacy-friendly website analytics to understand page usage and improve the experience. No personal data is shared with third parties.</div>
+              <div class="faq-answer-inner">The app does not: it ships with no analytics, advertising or crash-reporting SDK, and never asks for tracking permission. This website uses Plausible, a cookie-less analytics tool that counts page views without personal data or cross-site profiles.</div>
             </div>
           </div>
         </div>

manual-portfolio-tracker.html

@@ -150,7 +150,7 @@
           <p>That's five minutes a month for a complete, private record of your financial life — plus a <a href="investment-journal.html">journal of your decisions</a> you can learn from later.</p>
 
           <h2>Privacy by architecture, not by policy</h2>
-          <p>Portfolio Journal is offline-first: your data lives on your iPhone or iPad, protected by Face ID, with optional end-to-end iCloud sync between your own devices. There is no server, no account, and no way for anyone — including us — to see your balances. You can <a href="security.html">read more about the security model</a> or export everything to CSV/JSON at any time.</p>
+          <p>Portfolio Journal is offline-first: your data lives on your iPhone or iPad, protected by Face ID, with optional iCloud sync between your own devices through your own private iCloud database, encrypted by Apple. There is no server of ours, no account, and no analytics or advertising SDK in the app &mdash; we never receive your balances. You can <a href="security.html">read more about the security model</a> or export everything to CSV/JSON at any time.</p>
 
           <h2>Manual vs. automatic tracking at a glance</h2>
           <div class="cards-grid">

privacy.html

@@ -77,36 +77,37 @@
             <ul>
               <li>Your portfolio data and journal notes stay on your device by default.</li>
               <li>iCloud sync is optional and only enabled by you.</li>
-              <li>We collect usage data and device identifiers for product performance and advertising measurement.</li>
+              <li>We collect nothing: no analytics, no advertising, no identifiers, no accounts.</li>
-              <li>Some identifiers and usage data may be used to track you across apps and websites.</li>
+              <li>Nothing you enter is ever used to track you across apps or websites.</li>
               <li>Deletion is instant inside the app, with additional steps for iCloud.</li>
             </ul>
           </div>
 
           <h2>What data we collect</h2>
           <p>Portfolio Journal collects the data you choose to enter into the app, such as portfolio sources, snapshots, contributions, categories, goals, and journal notes. This information is stored locally on your device unless you enable iCloud sync or export your data.</p>
-          <p>We also collect usage data and device identifiers. This includes product interaction data, device ID, other usage data, and advertising data.</p>
+          <p>We collect nothing else. There is no account, no analytics SDK, no advertising SDK and no crash-reporting SDK in the app, and no usage data or device identifier is sent anywhere.</p>
 
           <h2>How we use your data</h2>
-          <p>Your data is used to provide app functionality: portfolio calculations, charts, progress tracking, and reminders. Usage data and identifiers are also used to understand performance and measure advertising effectiveness.</p>
+          <p>What you enter is used only to run the app on your device: portfolio calculations, charts, progress tracking, and reminders. It never reaches us.</p>
 
           <h2>App Store privacy labels</h2>
-          <p>For transparency, our App Store privacy labels include:</p>
+          <p>For transparency, our App Store privacy labels declare:</p>
           <ul>
-            <li>Data used to track you: Identifiers, Usage Data.</li>
+            <li>Data used to track you: none.</li>
-            <li>Data not linked to you: Identifiers, Usage Data.</li>
+            <li>Data linked to you: none.</li>
+            <li>Data not linked to you: none.</li>
           </ul>
-          <p>These data types include product interaction, device ID, other usage data, and advertising data.</p>
+          <p>The app also ships a privacy manifest (<code>PrivacyInfo.xcprivacy</code>) that declares no tracking, no tracking domains and no collected data types.</p>
 
           <h2>Data storage and sync</h2>
           <p>By default, all content is stored on-device. If you enable iCloud sync, your data is stored in your iCloud account and synced across devices signed in with the same Apple ID. Portfolio Journal does not operate separate servers for user data.</p>
 
-          <h2>Exports</h2>
+          <h2>Exports and backups</h2>
-          <p>You can export your data in CSV or JSON format at any time. Exported files are stored wherever you choose (Files app, local storage, or another provider you control).</p>
+          <p>You can export your data in CSV or JSON format at any time, and Premium can write automatic JSON backups. These files are plain, readable JSON &mdash; the app does not encrypt them. They are stored wherever you choose (Files app, local storage, or your iCloud Drive), and anyone who can open the file can read your balances.</p>
 
           <h2>Third-party services</h2>
-          <p>Usage data and device identifiers may be shared with advertising and analytics partners for measurement and attribution. This data may be used to track you across apps and websites owned by other companies.</p>
+          <p>None. Portfolio Journal does not share anything with advertising or analytics partners, because it does not collect anything to share. Purchases are handled by Apple through the App Store, and optional sync uses your own iCloud account; we see neither.</p>
-          <p>We also collect usage data and identifiers that are not linked to your identity for analytics and product improvement.</p>
+          <p>Crash and hang diagnostics are collected on-device by iOS (MetricKit) and kept in the app container. They are never uploaded; sharing one from Settings is the only way a report leaves your device.</p>
 
           <h2>Data retention</h2>
           <p>Your data is retained on your device until you delete it. If you enable iCloud, data is retained in your iCloud account until you delete it from the app or remove it in iCloud settings.</p>

security.html

@@ -4,12 +4,12 @@
   <meta charset="utf-8">
   <meta name="viewport" content="width=device-width, initial-scale=1">
   <title>Security — Portfolio Journal</title>
-  <meta name="description" content="How Portfolio Journal protects your investment data with on-device storage, optional iCloud end-to-end encryption, and Face ID authentication.">
+  <meta name="description" content="How Portfolio Journal protects your investment data: on-device storage, optional iCloud sync encrypted by Apple, Face ID, and no tracking or advertising SDKs.">
   <link rel="canonical" href="https://portfoliojournal.app/security.html">
 
   <meta property="og:type" content="article">
   <meta property="og:title" content="Security — Portfolio Journal">
-  <meta property="og:description" content="How Portfolio Journal protects your investment data with on-device storage, optional iCloud end-to-end encryption, and Face ID authentication.">
+  <meta property="og:description" content="How Portfolio Journal protects your investment data: on-device storage, optional iCloud sync encrypted by Apple, Face ID, and no tracking or advertising SDKs.">
   <meta property="og:url" content="https://portfoliojournal.app/security.html">
   <meta property="og:image" content="https://portfoliojournal.app/assets/images/og-image.jpg">
   <meta property="og:image:width" content="1200">
@@ -17,7 +17,7 @@
 
   <meta name="twitter:card" content="summary_large_image">
   <meta name="twitter:title" content="Security — Portfolio Journal">
-  <meta name="twitter:description" content="How Portfolio Journal protects your investment data with on-device storage, optional iCloud end-to-end encryption, and Face ID authentication.">
+  <meta name="twitter:description" content="How Portfolio Journal protects your investment data: on-device storage, optional iCloud sync encrypted by Apple, Face ID, and no tracking or advertising SDKs.">
   <meta name="twitter:image" content="https://portfoliojournal.app/assets/images/og-image.jpg">
 
   <link rel="icon" href="assets/icons/favicon.svg" type="image/svg+xml">
@@ -72,10 +72,13 @@
           <p>Portfolio Journal can use iOS security features, including device passcodes and Face ID, to keep your data protected from unauthorized access.</p>
 
           <h2>iCloud sync</h2>
-          <p>If you enable iCloud sync, your data is stored and synced through your Apple ID. iCloud uses Apple-managed encryption in transit and at rest.</p>
+          <p>If you enable iCloud sync, your data is stored in your own private CloudKit database and synced between devices signed in with your Apple ID. The encryption is Apple-managed, in transit and at rest &mdash; we do not add a second layer of our own, so we do not describe it as end-to-end encrypted. We operate no servers of our own and never hold a copy of your data.</p>
+
+          <h2>No tracking, no advertising</h2>
+          <p>Portfolio Journal ships with no advertising SDK, no third-party analytics SDK and no crash-reporting SDK. The app never asks for App Tracking Transparency permission, because there is nothing to track. Crash and hang diagnostics are collected on-device by iOS (MetricKit); they stay in the app container unless you choose to share one.</p>
 
           <h2>Backups and exports</h2>
-          <p>You can export CSV or JSON files for manual backups. We recommend storing backups in a trusted location and keeping your Files app secured.</p>
+          <p>You can export CSV or JSON files, and Premium can write automatic JSON backups. These files are plain, readable JSON &mdash; the app does not encrypt them. Anyone who can open the file can read your balances, so keep them somewhere you trust and keep your Files app secured.</p>
 
           <h2>Best practices</h2>
           <ul>