Correct key-storage and platform claims: name only platforms that ship

The README contradicted itself. Line 11's platform badge advertised
`Linux | macOS | Android | iOS` while line 87 of the same file said
`### macOS . iOS -- Coming soon`. Neither macOS nor iOS has ever shipped.

Three claims named iOS Keychain and macOS Keychain as active key stores:

- README "Key storage" said "On every platform ... (iOS Keychain, macOS
  Keychain, Android Keystore)" -- for a product whose platform list ends at
  Android.
- privacy-policy.md named `Android Keystore / iOS Keychain` for both
  credential storage and PGP private keys, which has it doubly wrong: it
  names a platform that does not ship and omits the two that do.

Verified against the implementation rather than reworded from memory.
mailcore uses the Rust `keyring` crate v3 with the `sync-secret-service`
feature (mailcore/Cargo.toml:58); the Flutter side uses
`flutter_secure_storage` ^10.0.0. So on the shipped platforms the stores
are Windows Credential Manager, Android Keystore, and the Secret Service
(libsecret) on Linux -- now what the docs say.

privacy-policy "last updated" moved to 30 September 2026.

README.md

@@ -8,7 +8,7 @@
   **PGP-First Email. Private by Default.**
 
   [![License: PolyForm Noncommercial](https://img.shields.io/badge/license-PolyForm%20Noncommercial-blue)](LICENSE)
-  [![Platform](https://img.shields.io/badge/platform-Linux%20%7C%20macOS%20%7C%20Android%20%7C%20iOS-lightgrey)]()
+  [![Platform](https://img.shields.io/badge/platform-Linux%20%7C%20Windows%20%7C%20Android-lightgrey)]()
   [![Status](https://img.shields.io/badge/status-Beta-orange)]()
 
 </div>
@@ -187,7 +187,7 @@ The PGP/Sequoia integration, advanced privacy features, the proprietary Rust eng
 
 ## Security
 
-**Key storage:** Private keys are never written to SQLite or disk in plaintext. On every platform, they are stored in the OS secure enclave (iOS Keychain, macOS Keychain, Android Keystore).
+**Key storage:** Private keys are never written to SQLite or disk in plaintext. On the platforms that ship, they go to the OS credential store — Windows Credential Manager, Android Keystore, or the Secret Service (libsecret) on Linux.
 
 ## Notices
 

privacy-policy.md

@@ -1,6 +1,6 @@
 # Korax Privacy Policy
 
-_Last updated: 22 May 2026_
+_Last updated: 30 September 2026_
 
 ## Who we are
 
@@ -13,7 +13,7 @@ Korax connects directly to your email provider using the IMAP and SMTP protocols
 | Data | Purpose | Where it is stored |
 |------|---------|-------------------|
 | IMAP/SMTP server addresses, port, and TLS settings | Connect to your mail server | On-device SQLite database |
-| Email account credentials (username and password) | Authenticate with your mail server | OS secure credential store (Android Keystore / iOS Keychain) |
+| Email account credentials (username and password) | Authenticate with your mail server | OS secure credential store (Windows Credential Manager / Android Keystore / Secret Service on Linux) |
 | Email message content (headers, body, attachments) | Display your mail | On-device SQLite cache |
 | Email addresses of senders and recipients | Display contacts and compose mail | On-device SQLite database |
 | PGP keys you generate or import | Encrypt and decrypt mail | On-device SQLite database |
@@ -38,7 +38,7 @@ All data is stored locally on your device. To delete your data, remove your acco
 
 - Credentials are stored in the OS secure credential store and are not accessible to other apps.
 - All connections to mail servers use TLS encryption.
-- PGP private keys are stored in the OS secure enclave (Android Keystore / iOS Keychain) and never written to disk in plaintext.
+- PGP private keys are stored in the OS secure credential store (Windows Credential Manager / Android Keystore / Secret Service on Linux) and never written to disk in plaintext.
 
 ## Children