Align privacy, notices and release gate; keep downloads out of backups

- PRIVACY.md describes the Japanese dictionary download, the temporary
  pronunciation recording and the backup exclusions, and no longer
  describes the removed clip downloader.
- THIRD_PARTY_NOTICES.md lists Kuromoji and reproduces the
  mecab-ipadic notice.
- Backup and device-transfer rules leave out the downloaded Japanese
  dictionary and the F-Droid translation models, which could push a
  backup past Android's 25 MB quota.
- The release gate requires all four Android CI jobs by name, and a
  test keeps the list equal to the workflow's jobs.
- The PR #87 spec records its phone test and the v1.3.1 release.

Spec: docs/specs/2026-09-30-docs-backup-ci-alignment.md

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CKhgrZwwyTSRbNNCiRGy6s

Author: claude

AGENTS.md

@@ -30,12 +30,12 @@ Android app (`:app`, package `com.kienhoang.dualsubreplay`) with a separate test
 - Follow explicit owner release intent; otherwise preserve **patch**, including docs/workflow PRs. Recommend alternatives if useful, but do not silently infer minor/major/skip. A docs-only PR uses skip when the owner requests it.
 - Apply and verify the actual GitHub label or standalone exact-version PR-body directive. Prose/specs/checkboxes do not apply labels. Keep at most one release label OR one directive; remove superseded overrides without disturbing unrelated labels. If required metadata cannot be applied, report the missing action and do not call the PR ready to merge.
 - State intent, reason, and expected version (or why skipped/unavailable). Inspect stable tags, releases including draft reservations, and the Gradle baseline before estimating. Bump-derived numbers are estimates until reserved; exact versions must exceed all existing/reserved stable versions. Do not manually change Gradle versions or create release tags in normal PRs.
-- Before calling a PR ready to merge, verify its latest final-head Android CI run: both `verify-build` and `managed-device-tests` must succeed. New commits need fresh checks; report pending/failed/skipped/unavailable checks explicitly.
+- Before calling a PR ready to merge, verify its latest final-head Android CI run: all four jobs (`verify-build`, `managed-device-tests`, `fdroid-build`, `fdroid-device-tests`) must succeed. New commits need fresh checks; report pending/failed/skipped/unavailable checks explicitly.
 - Handoff: owner reviews the preview and green checks, then manually merges; existing automation publishes unless skipped. Green PR CI is not proof of release publication. Verify the release workflow/assets if asked to confirm publication; use existing reservation/retry recovery below.
 
 ## Releases happen automatically after an approved PR merge
 
-- When `hoangkien1703` merges a PR into `main`, `release-on-main.yml` checks the latest Android CI run for the PR's final head and requires both `verify-build` and `managed-device-tests` to succeed. Direct pushes and other mergers do not release.
+- When `hoangkien1703` merges a PR into `main`, `release-on-main.yml` checks the latest Android CI run for the PR's final head and requires all four Android CI jobs (`verify-build`, `managed-device-tests`, `fdroid-build`, `fdroid-device-tests`) to succeed. Direct pushes and other mergers do not release.
 - Default: bump the highest existing/reserved stable patch version and monotonically increase Android `versionCode`. **Do not manually bump Gradle version constants in feature PRs.**
 - Before merge, apply at most one GitHub label (`release:patch`, `release:minor`, `release:major`, `release:skip`) OR a standalone `Release-Version: X.Y.Z` in the PR description. Conflicting instructions fail closed. `release:skip` keeps the rolling preview only.
 - Release versions live in a release-only commit/tag based on the exact merge; only the two Gradle version constants change. `main` keeps development defaults. No bot commits to `main` or branch-protection bypass is needed.

PRIVACY.md

@@ -8,18 +8,20 @@ DualSub Replay is designed without an application account, analytics SDK, advert
 - The app requests public caption data from YouTube to build the replayable subtitle timeline.
 - Google ML Kit may download the language models you select. Translation then runs on the device.
 - The F-Droid build does not include ML Kit. It downloads Mozilla's Firefox Translations models from Mozilla's servers the first time you translate a language, then translates on the device. Only model files are downloaded; subtitle text is not sent.
+- The first time Japanese subtitles load, the app downloads the Japanese word dictionary (the unchanged 13 MB Kuromoji IPADIC file) from Maven Central (`repo1.maven.org`) or, if that fails, Google's mirror of it (`maven-central.storage-download.googleapis.com`). The request asks only for that file; no subtitle text is sent. The file is checked against a pinned SHA-256 checksum, kept in the app's private storage, and used to split Japanese text into words on the device.
 - The app stores the last Browse URL, target language, subtitle text size, and landscape split ratio in local Android preferences.
 - Saved words, meanings, subtitle context, video IDs, timestamp ranges, and review schedules are stored in a local SQLite database. They are not sent to an application server. Android's normal app backup may include this database and preferences.
 - Progress stores, per day and language, how long videos played in the app and how many videos were watched, in a separate local SQLite database, plus your daily goal in local preferences. Video IDs and titles are not stored for Progress, and nothing is sent to an application server. Android's normal app backup may include this database.
-- Optional offline clip downloads send video requests to YouTube and its media hosts using the bundled yt-dlp downloader. Downloads do not copy cookies from the browsing WebView. Clip files are stored privately and excluded from Android backups. Restored cards may require their clips to be downloaded again.
-- Pronunciation sends the selected word and language to the device's preferred Android text-to-speech engine and, if needed, other installed speech engines. It prefers installed offline voices but may try a supported online voice when local speech fails or is unavailable. Online voices process the word according to the speech engine provider's settings and privacy policy.
+- Saved words replay their moment in the same embedded YouTube page. The app no longer downloads video clips; the offline clip downloader of earlier versions has been removed.
+- Pronunciation sends the selected word and language to the device's preferred Android text-to-speech engine and, if needed, other installed speech engines. It prefers installed offline voices but may try a supported online voice when local speech fails or is unavailable. Online voices process the word according to the speech engine provider's settings and privacy policy. The spoken word is recorded to a temporary file in the app's cache so it can replay instantly. It is deleted when you select or pronounce another word or close the app, and any file left behind is removed the next time a word is spoken.
+- The Japanese dictionary and the F-Droid build's translation models are excluded from Android backups and device transfers, because they can be downloaded again. Saved words, Progress, and preferences stay in backups.
 - If you use the experimental Google/YouTube sign-in flow, authentication occurs inside YouTube's embedded web experience and WebView cookies persist locally. Google may reject embedded-WebView sign-in.
 
 ## What the project does not do
 
 - It does not require an API key or DualSub Replay account.
 - It does not send subtitle text or translation requests to a server operated by this project.
-- It does not download media automatically during browsing; users explicitly request offline vocabulary clips.
+- It does not download video or audio from YouTube.
 - It does not intentionally collect analytics, advertising identifiers, or crash telemetry.
 
 Deleting the app clears its local app data under Android's normal uninstall behavior. You can also clear the app's storage from Android Settings.

README.md

@@ -181,7 +181,7 @@ Pull requests use the committed wrapper to run formatting and complexity checks,
 
 ### Automatic official releases
 
-When **hoangkien1703 merges a PR into `main`**, the **Release merged PR** workflow checks that the latest Android CI run for the PR's final commit succeeded, including both `verify-build` and `managed-device-tests`. It then builds the preview and a production-signed official APK. Direct pushes and merges by other accounts do not publish releases.
+When **hoangkien1703 merges a PR into `main`**, the **Release merged PR** workflow checks that the latest Android CI run for the PR's final commit succeeded, including all four jobs: `verify-build`, `managed-device-tests`, `fdroid-build` and `fdroid-device-tests`. It then builds the preview and a production-signed official APK. Direct pushes and merges by other accounts do not publish releases.
 
 By default, each eligible merge increments the highest existing or reserved stable patch version: `1.0.4 → 1.0.5` (and `1.0.9 → 1.0.10`). It also increments Android's internal `versionCode` above all prior stable releases and reservations. Preview tags do not affect official version selection. **Do not manually bump the Gradle constants in feature PRs.**
 

THIRD_PARTY_NOTICES.md

@@ -19,6 +19,7 @@ Current releases bundle only:
 - Google ML Kit Translate: Google APIs Terms of Service / Apache-2.0.
 - Square OkHttp: Apache-2.0.
 - Kotlin / Coroutines: Apache-2.0.
+- Kuromoji 0.9.0 (`com.atilika.kuromoji:kuromoji-ipadic`, code only): Apache-2.0, copyright 2010-2015 Atilika Inc. and contributors. Its license and notice files are kept in the APK under `META-INF/`.
 
 The F-Droid build (`-Pdistribution=fdroid`) leaves out Google ML Kit Translate and contains only free software. Instead it bundles a native translation engine built from the git submodules in `app/src/fdroid/cpp`:
 - Bergamot translator and Marian (mozilla/translations `inference/`): MPL-2.0 and MIT.
@@ -27,6 +28,75 @@ The F-Droid build (`-Pdistribution=fdroid`) leaves out Google ML Kit Translate a
 
 It downloads Mozilla's Firefox Translations models, which are distributed under MPL-2.0.
 
+## Japanese dictionary (downloaded on first use)
+
+The IPADIC dictionary that Kuromoji uses is not bundled in the APK. The first time Japanese subtitles load, the app downloads the same `kuromoji-ipadic-0.9.0.jar` from Maven Central, checks its size and SHA-256, and stores it in the app's private storage (see [PRIVACY.md](PRIVACY.md)). The jar contains data from `mecab-ipadic-2.7.0-20070801` ([source archive](http://atilika.com/releases/mecab-ipadic/mecab-ipadic-2.7.0-20070801.tar.gz)), distributed under this notice:
+
+    Nara Institute of Science and Technology (NAIST),
+    the copyright holders, disclaims all warranties with regard to this
+    software, including all implied warranties of merchantability and
+    fitness, in no event shall NAIST be liable for
+    any special, indirect or consequential damages or any damages
+    whatsoever resulting from loss of use, data or profits, whether in an
+    action of contract, negligence or other tortuous action, arising out
+    of or in connection with the use or performance of this software.
+
+    A large portion of the dictionary entries
+    originate from ICOT Free Software.  The following conditions for ICOT
+    Free Software applies to the current dictionary as well.
+
+    Each User may also freely distribute the Program, whether in its
+    original form or modified, to any third party or parties, PROVIDED
+    that the provisions of Section 3 ("NO WARRANTY") will ALWAYS appear
+    on, or be attached to, the Program, which is distributed substantially
+    in the same form as set out herein and that such intended
+    distribution, if actually made, will neither violate or otherwise
+    contravene any of the laws and regulations of the countries having
+    jurisdiction over the User or the intended distribution itself.
+
+    NO WARRANTY
+
+    The program was produced on an experimental basis in the course of the
+    research and development conducted during the project and is provided
+    to users as so produced on an experimental basis.  Accordingly, the
+    program is provided without any warranty whatsoever, whether express,
+    implied, statutory or otherwise.  The term "warranty" used herein
+    includes, but is not limited to, any warranty of the quality,
+    performance, merchantability and fitness for a particular purpose of
+    the program and the nonexistence of any infringement or violation of
+    any right of any third party.
+
+    Each user of the program will agree and understand, and be deemed to
+    have agreed and understood, that there is no warranty whatsoever for
+    the program and, accordingly, the entire risk arising from or
+    otherwise connected with the program is assumed by the user.
+
+    Therefore, neither ICOT, the copyright holder, or any other
+    organization that participated in or was otherwise related to the
+    development of the program and their respective officials, directors,
+    officers and other employees shall be held liable for any and all
+    damages, including, without limitation, general, special, incidental
+    and consequential damages, arising out of or otherwise in connection
+    with the use or inability to use the program or any product, material
+    or result produced or otherwise obtained by using the program,
+    regardless of whether they have been advised of, or otherwise had
+    knowledge of, the possibility of such damages at any time during the
+    project or thereafter.  Each user will be deemed to have agreed to the
+    foregoing by his or her commencement of use of the program.  The term
+    "use" as used herein includes, but is not limited to, the use,
+    modification, copying and distribution of the program and the
+    production of secondary products from the program.
+
+    In the case where the program, whether in its original form or
+    modified, was distributed or delivered to or received by a user from
+    any person, organization or entity other than ICOT, unless it makes or
+    grants independently of ICOT any specific warranty to the user in
+    writing, such person, organization or entity, will also be exempted
+    from and not be held liable to the user for any such damages as noted
+    above as far as the program is concerned.
+
+The F-Droid build downloads the same dictionary.
+
 ## Obtain and build this application's source
 
 The complete application source and build scripts are available without charge at https://github.com/hoangkien1703/dual-sub-replay. For a PR preview, select the PR's exact commit; for a tagged release, select that tag. GitHub provides downloadable source archives for both commits and tags. Keep these source links beside redistributed APKs and retain upstream notices and access to the corresponding dependency sources.

app/src/main/AndroidManifest.xml

@@ -9,12 +9,15 @@
 
     <application
         android:allowBackup="true"
+        android:dataExtractionRules="@xml/data_extraction_rules"
+        android:fullBackupContent="@xml/backup_rules"
         android:icon="@mipmap/ic_launcher"
         android:label="@string/app_name"
         android:roundIcon="@mipmap/ic_launcher_round"
         android:supportsRtl="true"
         android:theme="@style/Theme.DualSubReplay"
-        android:usesCleartextTraffic="false">
+        android:usesCleartextTraffic="false"
+        tools:targetApi="31">
 
         <meta-data
             android:name="android.webkit.WebView.EnableSafeBrowsing"

app/src/main/res/xml/backup_rules.xml

@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+    Android 11 and lower. Leaves out downloads the app can fetch again, so backups stay small:
+    the Japanese dictionary (13 MB) and the F-Droid build's translation models. Keep these paths
+    in sync with data_extraction_rules.xml and the directories AppViewModel creates.
+-->
+<full-backup-content>
+    <exclude domain="file" path="japanese-dictionary/" />
+    <exclude domain="file" path="translation-models/" />
+</full-backup-content>

app/src/main/res/xml/data_extraction_rules.xml

@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+    Android 12 and higher. Leaves out downloads the app can fetch again: the Japanese dictionary
+    (13 MB) and the F-Droid build's translation models. Keep these paths in sync with
+    backup_rules.xml and the directories AppViewModel creates.
+-->
+<data-extraction-rules>
+    <cloud-backup>
+        <exclude domain="file" path="japanese-dictionary/" />
+        <exclude domain="file" path="translation-models/" />
+    </cloud-backup>
+    <device-transfer>
+        <exclude domain="file" path="japanese-dictionary/" />
+        <exclude domain="file" path="translation-models/" />
+    </device-transfer>
+</data-extraction-rules>

app/src/test/java/com/kienhoang/dualsubreplay/ui/BackupRulesTest.kt

@@ -0,0 +1,54 @@
+package com.kienhoang.dualsubreplay.ui
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertTrue
+import org.junit.Test
+import org.w3c.dom.Element
+import java.io.File
+import javax.xml.parsers.DocumentBuilderFactory
+
+/** Backups leave out the large downloads the app can fetch again, on every Android version. */
+class BackupRulesTest {
+    private val regenerable = setOf("japanese-dictionary/", "translation-models/")
+
+    @Test
+    fun everyBackupPathLeavesOutTheDownloadedDictionaryAndModels() {
+        assertEquals(regenerable, excludedPaths(rules("backup_rules.xml")))
+        val extraction = rules("data_extraction_rules.xml")
+        for (section in listOf("cloud-backup", "device-transfer")) {
+            val element = extraction.getElementsByTagName(section).item(0) as Element
+            assertEquals(section, regenerable, excludedPaths(element))
+        }
+    }
+
+    @Test
+    fun excludedFoldersAreTheOnesTheAppDownloadsInto() {
+        val viewModel = File("src/main/java/com/kienhoang/dualsubreplay/ui/AppViewModel.kt").readText()
+        for (path in regenerable) {
+            assertTrue(path, "File(application.filesDir, \"${path.removeSuffix("/")}\")" in viewModel)
+        }
+    }
+
+    @Test
+    fun theManifestUsesBothRuleFiles() {
+        val manifest = File("src/main/AndroidManifest.xml").readText()
+        assertTrue("android:fullBackupContent=\"@xml/backup_rules\"" in manifest)
+        assertTrue("android:dataExtractionRules=\"@xml/data_extraction_rules\"" in manifest)
+    }
+
+    private fun rules(name: String): Element =
+        DocumentBuilderFactory
+            .newInstance()
+            .newDocumentBuilder()
+            .parse(File("src/main/res/xml/$name"))
+            .documentElement
+
+    private fun excludedPaths(parent: Element): Set<String> {
+        val excludes = parent.getElementsByTagName("exclude")
+        return (0 until excludes.length)
+            .map { excludes.item(it) as Element }
+            .onEach { assertEquals("file", it.getAttribute("domain")) }
+            .map { it.getAttribute("path") }
+            .toSet()
+    }
+}