13 files changed, 353 insertions, 14 deletions
diff --git a/content/apps/daybyday.md b/content/apps/daybyday.md
index 8760620..46cb4d6 100644
--- a/content/apps/daybyday.md
+++ b/content/apps/daybyday.md
@@ -6,7 +6,8 @@ weight = 5
 [extra]
 link = "https://github.com/krazywarez/daybyday"
 link_label = "Source"
-appstore = "https://apps.apple.com/app/day-by-day/id000000000"
+appstore = "https://apps.apple.com/us/app/daybyday-learn/id6760321939"
+privacy = "/privacy/daybyday/"
 +++
 
 Day by Day is a gentle, ad-free iOS app that helps children learn days, weeks,
diff --git a/content/apps/domain-dig.md b/content/apps/domain-dig.md
index e83d3e2..496895f 100644
--- a/content/apps/domain-dig.md
+++ b/content/apps/domain-dig.md
@@ -6,9 +6,60 @@ weight = 2
 [extra]
 link = "https://github.com/krazywarez/domain-dig"
 link_label = "Source"
-appstore = "https://apps.apple.com/app/domain-dig/id000000000"
+appstore = "https://apps.apple.com/us/app/domaindig/id6760368004"
+privacy = "/privacy/domain-dig/"
 +++
 
-Domain Dig is an iOS app for inspecting DNS records and SSL certificates on the
-go. Look up A, AAAA, MX, TXT, and more, and check certificate chains — no
-account, no tracking.
+See how any domain is really configured and served.
+
+Domain Dig is a fast, native iOS app for inspecting a domain end to end. enter a
+name and get a full report: DNS records, email-security posture, the live TLS
+certificate and chain, HTTP headers, IP geolocation, and reachable ports — no
+account, no tracking, everything rendered in plain monospace.
+
+## why it exists
+
+the answers you need about a domain are scattered across a dozen web tools. Domain
+Dig pulls them into one screen you can run from your phone: reachability, records,
+certificates, and headers in a single scrollable report.
+
+## what it does
+
+- run a full lookup on any domain from one screen
+- read every DNS record type: A, AAAA, MX, TXT, NS, SOA, CNAME, SRV, CAA, DS, PTR
+- confirm DNSSEC and check reachability and the redirect chain
+- audit email security: SPF, DMARC, DKIM, MTA-STS, and BIMI
+- inspect the SSL/TLS certificate, SANs, validity, cipher, and full chain
+- review HTTP response headers with a security grade
+- geolocate the resolved IP and scan common ports
+- look up registration and ownership via RDAP
+- monitor domains and get alerts via webhook or Slack
+
+## interface
+
+everything about a domain on one report — tap through the certificate chain,
+email checks, and open ports.
+
+<div class="shots">
+<figure><img loading="lazy" src="https://img.cleberg.net/apps/domaindig/screenshots/iPhone/01.png" alt="Lookup and DNS records"><figcaption>run a lookup, see everything</figcaption></figure>
+<figure><img loading="lazy" src="https://img.cleberg.net/apps/domaindig/screenshots/iPhone/02.png" alt="Record types and email security"><figcaption>every record type and email check</figcaption></figure>
+<figure><img loading="lazy" src="https://img.cleberg.net/apps/domaindig/screenshots/iPhone/03.png" alt="SSL certificate and chain"><figcaption>full TLS certificate and chain</figcaption></figure>
+<figure><img loading="lazy" src="https://img.cleberg.net/apps/domaindig/screenshots/iPhone/04.png" alt="IP location and open ports"><figcaption>IP geolocation and open ports</figcaption></figure>
+<figure><img loading="lazy" src="https://img.cleberg.net/apps/domaindig/screenshots/iPhone/05.png" alt="Saved domains"><figcaption>save the domains you watch</figcaption></figure>
+<figure><img loading="lazy" src="https://img.cleberg.net/apps/domaindig/screenshots/iPhone/06.png" alt="Lookup history"><figcaption>history, kept on device</figcaption></figure>
+<figure><img loading="lazy" src="https://img.cleberg.net/apps/domaindig/screenshots/iPhone/07.png" alt="Resolver settings"><figcaption>choose your DNS resolver</figcaption></figure>
+</div>
+
+## details that matter
+
+- DNSSEC validation and a live TLS version and cipher-suite readout
+- certificate chain depth, expiry countdown, and a jump to crt.sh
+- email-security checks that flag missing SPF, DMARC, DKIM, MTA-STS, or BIMI
+- a port scan that knows when a host sits behind Cloudflare's proxy
+- pick your resolver: Cloudflare, Google, Quad9, or a custom server
+
+## on your device
+
+- save domains you watch and revisit past lookups from history
+- everything is stored locally; nothing syncs to us
+- optional iCloud sync (off by default) carries settings and history across your devices via your own iCloud account
diff --git a/content/apps/hutch.md b/content/apps/hutch.md
index 223842a..323cd88 100644
--- a/content/apps/hutch.md
+++ b/content/apps/hutch.md
@@ -1,14 +1,74 @@
 +++
 title = "Hutch"
-description = "A native iOS client for Sourcehut."
+description = "A native iOS client for SourceHut."
 weight = 1
 
 [extra]
 link = "https://github.com/krazywarez/hutch"
 link_label = "Source"
-appstore = "https://apps.apple.com/app/hutch/id000000000"
+appstore = "https://apps.apple.com/us/app/hutch-for-sourcehut/id6760742299"
+privacy = "/privacy/hutch/"
 +++
 
-Hutch is a fast, focused iOS client for [Sourcehut](https://sr.ht) — browse
-repositories, read tickets, and follow activity without leaving your phone.
-Built to be minimal and offline-friendly.
+SourceHut workflows, built for mobile.
+
+Hutch is a fast, native iOS app for working with [SourceHut](https://sr.ht) when
+you're away from your desk. it focuses on what matters on mobile: triaging work,
+reviewing patches, monitoring builds, following discussions, and managing
+repositories and tickets — without a browser. available now on the App Store for
+iPhone.
+
+## why it exists
+
+SourceHut is intentionally simple, efficient, and workflow-focused. Hutch brings
+that same philosophy to iOS: an interface designed for quick decisions and real
+work on the go, not a stripped-down viewer. it's built to read, respond, create,
+and manage work across the SourceHut ecosystem.
+
+## what it does
+
+- review patch threads and browse mailing lists
+- manage trackers, tickets, assignees, labels, and comments
+- browse Git and Mercurial repositories, files, refs, commits, and diffs
+- submit, monitor, retry, and inspect builds and logs
+- follow projects linking repositories, trackers, and lists
+- manage profile settings, SSH keys, PGP keys, and access tokens
+
+## interface
+
+from patch review to trackers, builds, and repositories, Hutch is built to make
+SourceHut feel at home on iOS.
+
+<div class="shots">
+<figure><img loading="lazy" src="https://img.cleberg.net/apps/hutch/screenshots/iphone/01_patch.jpg" alt="Patch review"><figcaption>review patches anywhere</figcaption></figure>
+<figure><img loading="lazy" src="https://img.cleberg.net/apps/hutch/screenshots/iphone/02_thread.jpg" alt="Threaded inbox"><figcaption>stay on top of discussions</figcaption></figure>
+<figure><img loading="lazy" src="https://img.cleberg.net/apps/hutch/screenshots/iphone/03_builds.jpg" alt="Builds"><figcaption>monitor builds in real time</figcaption></figure>
+<figure><img loading="lazy" src="https://img.cleberg.net/apps/hutch/screenshots/iphone/04_tickets.jpg" alt="Tickets"><figcaption>manage issues on the go</figcaption></figure>
+<figure><img loading="lazy" src="https://img.cleberg.net/apps/hutch/screenshots/iphone/05_repo.jpg" alt="Repository diff"><figcaption>explore your code</figcaption></figure>
+<figure><img loading="lazy" src="https://img.cleberg.net/apps/hutch/screenshots/iphone/06_projects.jpg" alt="Projects"><figcaption>everything in one place</figcaption></figure>
+<figure><img loading="lazy" src="https://img.cleberg.net/apps/hutch/screenshots/iphone/07_actions.jpg" alt="Build submission"><figcaption>take action instantly</figcaption></figure>
+</div>
+
+## major features
+
+- home dashboard with projects, assigned tickets, recent builds, and inbox shortcuts
+- unread-first inbox with thread detail, patch rendering, and reply via Apple Mail
+- Git and Mercurial repository browsing, settings, ACLs, and creation flows
+- tracker and ticket workflows: comments, assignees, resolutions, and labels
+- build submission, history, log viewing, cancellation, and rebuild flows
+- project views linking repositories, trackers, and mailing lists into one hub
+
+## built for sourcehut users
+
+- native Swift interface with no analytics, ads, or tracking SDKs
+- deep links for repositories, tickets, and builds via `hutch://`
+- share actions across repositories, files, commits, tickets, builds, and profiles
+- pull-to-refresh, loading, empty, and error states across major screens
+- Keychain-backed auth with secure SourceHut personal access tokens
+
+## resources
+
+- [project homepage](https://sr.ht/~ccleberg/Hutch/)
+- [issue tracker](https://todo.sr.ht/~ccleberg/Hutch/)
+- [hutch-devel mailing list](https://lists.sr.ht/~ccleberg/hutch-devel)
+- [hutch-announce mailing list](https://lists.sr.ht/~ccleberg/hutch-announce)
diff --git a/content/apps/solar.md b/content/apps/solar.md
index 40e4d2a..7604d93 100644
--- a/content/apps/solar.md
+++ b/content/apps/solar.md
@@ -6,6 +6,7 @@ weight = 3
 [extra]
 link = "https://github.com/krazywarez/solar"
 link_label = "Source"
+privacy = "/privacy/solar/"
 +++
 
 Solar is an iOS client for [Cloudflare](https://cloudflare.com) — manage DNS,
diff --git a/content/privacy/_index.md b/content/privacy/_index.md
new file mode 100644
index 0000000..e271ced
--- /dev/null
+++ b/content/privacy/_index.md
@@ -0,0 +1,13 @@
++++
+title = "Privacy"
+description = "Privacy policies for krazy warez iOS apps."
+sort_by = "weight"
+template = "section.html"
+page_template = "page.html"
+
+[extra]
+plain = true
++++
+
+Privacy policies for our iOS apps. The short version: we don't collect anything,
+there are no accounts, and your data stays on your device.
diff --git a/content/privacy/daybyday.md b/content/privacy/daybyday.md
new file mode 100644
index 0000000..92963a7
--- /dev/null
+++ b/content/privacy/daybyday.md
@@ -0,0 +1,41 @@
++++
+title = "Day by Day — Privacy Policy"
+description = "Privacy policy for Day by Day, the calendar-learning app for children."
+weight = 4
++++
+
+_last updated: 2 august 2026_
+
+Day by Day is an educational app that helps children learn days, weeks, months,
+and seasons. it is built to be safe for young children.
+
+## what we collect
+
+nothing at all. Day by Day has no accounts, no analytics, no advertising, no
+in-app purchases, and no third-party trackers or SDKs.
+
+## network connections
+
+none. Day by Day works entirely offline. it makes no network requests and sends
+no data anywhere.
+
+## data on your device
+
+any progress or settings stay only on your device and never leave it. deleting
+the app removes them.
+
+## children's privacy
+
+Day by Day is designed for children and does not knowingly collect any personal
+information from anyone, including children under 13. because the app collects
+no data and has no network access, there is nothing to share, sell, or expose.
+this is consistent with the U.S. Children's Online Privacy Protection Act
+(COPPA) and Apple's Kids Category requirements.
+
+## changes
+
+if this policy changes, the updated version will be posted here with a new date.
+
+## contact
+
+questions: [[email protected]](mailto:[email protected]).
diff --git a/content/privacy/domain-dig.md b/content/privacy/domain-dig.md
new file mode 100644
index 0000000..ac798a3
--- /dev/null
+++ b/content/privacy/domain-dig.md
@@ -0,0 +1,46 @@
++++
+title = "Domain Dig — Privacy Policy"
+description = "Privacy policy for Domain Dig, the DNS and SSL inspector for iOS."
+weight = 2
++++
+
+_last updated: 2 august 2026_
+
+Domain Dig inspects DNS records, SSL/TLS certificates, ownership, and related
+signals for domains you enter. every lookup runs from your device. we operate no
+servers, and we receive none of your data.
+
+## what we collect
+
+nothing. no account, no analytics, no ads, no third-party trackers or SDKs.
+
+## what stays on your device
+
+recent lookups and their results are stored locally on your device so you can
+revisit them. deleting the app removes the local copy. if you turn on iCloud
+sync (off by default), your settings, monitoring configuration, domain notes,
+and history metadata are stored in your own private iCloud account so they carry
+across your devices — that data goes to Apple's iCloud, never to us, and you can
+turn it off in Settings.
+
+## network connections
+
+to answer a lookup, Domain Dig queries public DNS resolvers and connects to the
+hosts you inspect in order to read their certificates. it also contacts a few
+third-party lookup services to enrich the results — an IP-geolocation provider
+(ipapi.co), RDAP registries (via rdap.org), Certificate Transparency logs
+(crt.sh), and the HSTS preload list (hstspreload.org). the domains and IP
+addresses you look up are therefore visible to these resolvers and services, and
+may be logged by them under their own policies. we do not see or record any of
+it.
+
+if you configure a Webhook or Slack integration, Domain Dig sends alerts to the
+URL you provide; that destination is chosen and controlled by you.
+
+## changes
+
+if this policy changes, the updated version will be posted here with a new date.
+
+## contact
+
+questions: [[email protected]](mailto:[email protected]).
diff --git a/content/privacy/hutch.md b/content/privacy/hutch.md
new file mode 100644
index 0000000..397f9dc
--- /dev/null
+++ b/content/privacy/hutch.md
@@ -0,0 +1,58 @@
++++
+title = "Hutch — Privacy Policy"
+description = "Privacy policy for Hutch, the Sourcehut client for iOS."
+weight = 1
++++
+
+_last updated: 2 august 2026_
+
+Hutch is a native iOS client for [Sourcehut](https://sr.ht). it talks to
+Sourcehut directly from your device. we have no user accounts, and we never
+receive your Sourcehut credentials. the one exception — a small first-party
+service used to draw contribution graphs — is described below.
+
+## what we collect
+
+we have no krazy warez account system, no analytics, no ads, and no
+third-party trackers or SDKs. the only data that ever reaches a server we
+operate is described under "the Hutch Stats service" below, and it is limited
+to the public Sourcehut usernames you ask to see contribution graphs for.
+
+## what stays on your device
+
+your Sourcehut personal access token is stored in the iOS Keychain on your
+device. cached repositories, tickets, and activity are stored locally so the
+app stays fast and works offline. deleting the app removes all of it.
+
+## network connections
+
+most of Hutch connects only to the Sourcehut instance you point it at — sr.ht
+by default, or a self-hosted instance you configure. those requests carry your
+access token, go straight to that server, and are governed by its own terms and
+privacy policy. we are not a party to that traffic and never see it.
+
+## the Hutch Stats service
+
+to render contribution graphs (the calendar-style activity charts on user
+profiles), Hutch asks a small first-party service, `hutch-stats.krz.sh`, for a
+person's public Sourcehut activity. this happens when you open a profile,
+including your own.
+
+each request sends the public Sourcehut **username** you are viewing and a date
+range. it does **not** send your access token or any Sourcehut credentials; the
+only header is a generic `Hutch/<version>` user-agent that contains no device or
+account identifiers. as with any web request, the service also sees the network
+(IP) address it came from. we use this data only to answer the request and do
+not build profiles from it or share it.
+
+if you would rather not use this service, contribution graphs are the only
+feature that depends on it. advanced users and self-hosters can point Hutch at a
+different stats endpoint via the `HUTCH_STATS_BASE_URL` setting.
+
+## changes
+
+if this policy changes, the updated version will be posted here with a new date.
+
+## contact
+
+questions: [[email protected]](mailto:[email protected]).
diff --git a/content/privacy/solar.md b/content/privacy/solar.md
new file mode 100644
index 0000000..d8b8626
--- /dev/null
+++ b/content/privacy/solar.md
@@ -0,0 +1,37 @@
++++
+title = "Solar — Privacy Policy"
+description = "Privacy policy for Solar, the Cloudflare client for iOS."
+weight = 3
++++
+
+_last updated: 2 august 2026_
+
+Solar is a native iOS client for [Cloudflare](https://cloudflare.com). it talks
+to the Cloudflare API directly from your device. we run no servers of our own,
+and we receive none of your data.
+
+## what we collect
+
+nothing. no krazy warez account, no analytics, no ads, no third-party trackers
+or SDKs.
+
+## what stays on your device
+
+your Cloudflare API token or key is stored in the iOS Keychain on your device
+and is sent only to Cloudflare. zone data such as DNS records, analytics, and
+settings that Solar fetches for display may be cached locally. deleting the app
+removes all of it.
+
+## network connections
+
+Solar connects only to Cloudflare's API. that traffic is governed by
+Cloudflare's own [privacy policy](https://www.cloudflare.com/privacypolicy/). we
+are not a party to it.
+
+## changes
+
+if this policy changes, the updated version will be posted here with a new date.
+
+## contact
+
+questions: [[email protected]](mailto:[email protected]).
diff --git a/sass/main.scss b/sass/main.scss
index 8c9d15b..402c8c1 100644
--- a/sass/main.scss
+++ b/sass/main.scss
@@ -135,6 +135,29 @@ a:hover { text-decoration: underline; text-underline-offset: 3px; }
 .back { font-size: 0.9rem; margin: 0 0 1.5rem; }
 .back a { color: var(--muted); }
 
+// ---- App page: actions + screenshots ---------------------------------------
+.app-actions { display: flex; gap: 0.75rem; flex-wrap: wrap; margin: 2rem 0 1rem; }
+.privacy-link { font-size: 0.9rem; margin: 0.25rem 0 0; }
+
+.shots {
+  display: flex;
+  gap: 0.85rem;
+  overflow-x: auto;
+  margin: 1.5rem 0 0.5rem;
+  padding-bottom: 0.75rem;
+  scroll-snap-type: x mandatory;
+  -webkit-overflow-scrolling: touch;
+}
+.shots figure { flex: 0 0 auto; width: 11rem; margin: 0; scroll-snap-align: start; }
+.shots img {
+  display: block;
+  width: 100%;
+  height: auto;
+  border: 1px solid var(--border);
+  background: var(--surface);
+}
+.shots figcaption { color: var(--dim); font-size: 0.8rem; margin-top: 0.55rem; line-height: 1.4; }
+
 // ---- Plain list (services / apps) ------------------------------------------
 .plainlist { list-style: none; padding: 0; margin: 1.5rem 0 0; }
 .plainlist li {
diff --git a/templates/base.html b/templates/base.html
index 09c565d..5a2fda6 100644
--- a/templates/base.html
+++ b/templates/base.html
@@ -24,7 +24,7 @@
   </main>
 
   <footer class="site-footer">
-    <p class="foot-links"><a href="mailto:{{ config.extra.email }}">{{ config.extra.email }}</a> · <a href="{{ config.extra.github }}">github</a> · &copy; {{ now() | date(format="%Y") }} · public domain</p>
+    <p class="foot-links"><a href="mailto:{{ config.extra.email }}">{{ config.extra.email }}</a> · <a href="{{ config.extra.github }}">github</a> · <a href="{{ get_url(path="/privacy/") | safe }}">privacy</a> · &copy; {{ now() | date(format="%Y") }} · public domain</p>
   </footer>
 </body>
 </html>
diff --git a/templates/page.html b/templates/page.html
index 32b1607..0682a66 100644
--- a/templates/page.html
+++ b/templates/page.html
@@ -9,8 +9,14 @@
   <h1 class="page-label">{{ page.title }}</h1>
   {% if page.description %}<p class="lede">{{ page.description }}</p>{% endif %}
   {{ page.content | safe }}
-  {% if page.extra.link %}
-  <p><a class="btn btn-primary" href="{{ page.extra.link }}">{{ page.extra.link_label | default(value="source") | lower }} &rarr;</a></p>
+  {% if page.extra.appstore or page.extra.link %}
+  <p class="app-actions">
+    {% if page.extra.appstore %}<a class="btn btn-primary" href="{{ page.extra.appstore }}">app store &rarr;</a>{% endif %}
+    {% if page.extra.link %}<a class="btn" href="{{ page.extra.link }}">{{ page.extra.link_label | default(value="source") | lower }} &rarr;</a>{% endif %}
+  </p>
+  {% endif %}
+  {% if page.extra.privacy %}
+  <p class="privacy-link"><a href="{{ get_url(path=page.extra.privacy) | safe }}">privacy policy &rarr;</a></p>
   {% endif %}
 </article>
 {% endblock content %}
diff --git a/templates/section.html b/templates/section.html
index c3a9489..091d7de 100644
--- a/templates/section.html
+++ b/templates/section.html
@@ -14,14 +14,16 @@
   {% for page in section.pages %}
   <li>
     <span class="pl-main">
-      <span class="pl-name">{{ page.title }}</span>
+      <a class="pl-name" href="{{ page.permalink | safe }}">{{ page.title }}</a>
       {% if page.description %}<span class="pl-desc">— {{ page.description }}</span>{% endif %}
     </span>
+    {% if not section.extra.plain %}
     <span class="pl-links">
       {% if page.extra.appstore %}<a class="pl-link" href="{{ page.extra.appstore }}">app store &rarr;</a>
       {% else %}<span class="pl-link pl-link-off" aria-disabled="true">app store — soon</span>{% endif %}
       {% if page.extra.link %}<a class="pl-link" href="{{ page.extra.link }}">{{ page.extra.link_label | default(value="source") | lower }} &rarr;</a>{% endif %}
     </span>
+    {% endif %}
   </li>
   {% endfor %}
 </ul>