Mobile crash reporting: opt-in reporter behind errorBus + privacy/store updates

[kevinthelago]

Behavior

Crashes and unhandled errors from released builds are visible to the maintainer. Today there is an in-app errorBus and no external telemetry, which is fine for a local-first single-user tool but leaves a store-released app on two platforms with no failure signal at all.

Edge case: reporting must never transmit a credential, a repo path, or tunnel plaintext.

Approach

The reporting posture is a user decision, not an agent decision - default OFF (opt-in), surfaced in More > Security. This preserves the local-first promise while giving a path to diagnose real failures. Wire the reporter behind the existing errorBus rather than adding a second error path.

Whichever posture is chosen, this is a data-collection change and touches the privacy policy, the App Store review notes, and the Play Data Safety form.

Tools: expo-updates, Sentry

Acceptance criteria

• The reporting posture is decided and recorded; the default state matches that decision explicitly rather than by omission.
• No credential, token, repo path, or tunnel payload can reach the reporter - covered by a test over the scrubber.
• The setting is discoverable in More > Security and takes effect without a restart.
• The privacy policy, review notes, and Play Data Safety declaration are updated in the same change.
• A forced crash in a release build produces a usable report with a symbolicated stack.

Owned paths: src/lib/errorBus.ts, app/(more)/security.tsx, src/components/security/, src/lib/alerts/
stream: mobile-crash-reporting