Notifications and sending songs to friends

Reactions to your songs, new followers, and songs sent to you are now
notifications: a bell on the feed (app and website) with an unread
count that updates live, and a list that marks them read. "Send ✉" on
a song sends it to people who follow you, with an optional note.
Settings picks which kinds to be notified about.

Push delivery uses no third-party accounts:
- Android: UnifiedPush through a distributor app (ntfy), pointed at
  our own ntfy server (docker-compose.ntfy.yml). Works the same in
  the F-Droid build; no Firebase.
- Browsers: standard Web Push from the existing service worker.
Both use Web Push encryption with a VAPID key pair the server makes
and keeps in the database. Push addresses are checked like any other
user-supplied URL. Setup is in docs/PUSH.md; the privacy page covers
the new data.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

apps/web/src/app/privacy/page.tsx

@@ -3,7 +3,7 @@ import Link from 'next/link';
 
 export const metadata: Metadata = { title: 'Privacy policy · musicshare' };
 
-const UPDATED = 'October 6, 2026';
+const UPDATED = 'October 14, 2026';
 const CONTACT = 'app@musicshare.binarygnome.com';
 
 export default function PrivacyPage() {
@@ -43,6 +43,11 @@ export default function PrivacyPage() {
         <li>
           <strong>People:</strong> who you follow, who you&apos;ve pinned, who you&apos;ve blocked, and reports you send.
         </li>
+        <li>
+          <strong>Notifications:</strong> reactions, new followers and songs (with any note) sent to you, and your
+          notification settings. If you turn on push notifications, we store the push address your browser or
+          phone gives us and its encryption keys.
+        </li>
         <li>
           <strong>Technical data:</strong> sign-in sessions (stored as hashes), and your IP address, which is used briefly
           to prevent abuse (like limiting sign-in attempts) and appears in server logs that are kept for a short time.
@@ -82,7 +87,13 @@ export default function PrivacyPage() {
         <li>
           <strong>Song matching:</strong> to build &ldquo;open in your app&rdquo; links we look up song titles and artists
           with Deezer, Apple&apos;s iTunes search, Spotify&apos;s catalog and Odesli (song.link). These lookups contain only
-          the song, never who listened to it.
+          the song, never who listened to it. Lyrics come from LRCLIB, looked up the same way: just the song.
+        </li>
+        <li>
+          <strong>Push notifications:</strong> if you turn them on, notifications are encrypted on our server and
+          delivered through your browser maker&apos;s push service (for example Google for Chrome, Mozilla for Firefox) or,
+          on Android, through the push server your ntfy app uses (ours, unless you chose another). They can&apos;t read
+          the contents.
         </li>
         <li>
           <strong>Our own servers:</strong> the app, database and email run on servers we manage ourselves.
@@ -97,6 +108,7 @@ export default function PrivacyPage() {
       <h2>How long we keep it</h2>
       <ul>
         <li>Recent plays: the latest 50. Older ones are deleted as new ones come in.</li>
+        <li>Notifications: until you delete your account. Push addresses are deleted when you turn push off or the device stops accepting them.</li>
         <li>
           Everything else: until you delete it or your account. Deleting your account (Settings &rarr; Delete account)
           removes your profile, picture, plays, follows and connected services right away. Database backups are kept for