docs(android): record M8 step 2, the data-safety audit

runicgateway.com#44 declares everything the app sends as collected,
not shared, encrypted in transit and required, after an audit of
data/api/ on edge. Account deletion is left open for the org lead.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

android/PLAN.md

@@ -1042,7 +1042,17 @@ push, and Play (M6–M8) follow the designed app.
       `s22_ultra` emulator against a local site whose relay was `ntfy.sh`: the service ran as
       `specialUse` (`types=0x40000000`), a tickle arrived, and push came back by itself after a
       reboot and after an update. After a sign-out and a reboot it stayed off.
-   2. **Data safety** (runicgateway.com): the audit and the generator. One PR.
+   2. **Data safety** (runicgateway.com): the audit and the generator. One PR. **Built
+      2026-10-29** as `runicgateway.com#44` (its D84). The audit read every request body, query
+      and header in `data/api/` on `edge` and found more leaving the phone than the old notes
+      listed: the sign-in, the phone's make and model on a trusted-device request, the
+      User-Agent, game-account links and in-app game-account creation, the Contact form, staff
+      posts and moderation, notification read state and preferences, and search text. All of it
+      is declared collected, not shared, encrypted in transit, required. The server address
+      and the inbox snapshot stay on the phone. Step 3 adds its own rows when it lands.
+      **Open:** the form's account-deletion questions. The app starts accounts (the sign-up
+      link to the deployment's website, and in-app game-account creation), and the platform has
+      no self-service account deletion.
    3. **Report, block and hide** across `website`, `Module-Rust`, the kit and this app
       (`USER_SAFETY.md` §7).
    4. **The cutover**, `edge` → `main`, once 1-3 have landed, so the first Play bundle carries