SimpleDay 1.3.0

Fixed

• A day could end up with two entries: with today's entry already saved, + still opened an empty editor for the same date. Both entry points — the button and the daily reminder — now reopen the existing entry, ready to edit. Tapping a card in the list still opens read-only. Duplicates an older version created are left untouched and stay readable.
• WebDAV sync over plain http:// could not work at all. With targetSdk 36 and no cleartext policy in the manifest, Android blocked the connection before it left the device, and the dialog blamed the URL and credentials. Self-hosted servers on a LAN are reachable again, and the failure now names cleartext as the cause when it is.
• Entries started between midnight and the UTC offset were filed under the previous day. Dates are now taken in the device's timezone.

Security

• WebDAV entries are authenticated with HMAC-SHA256 over the ciphertext (encrypt-then-MAC), with the tag verified before decryption and subkeys derived separately from the stored key. A malicious or compromised server could previously alter stored entries; only PKCS#7 padding stood in the way.
  Existing entries stay readable and are rewritten in the new format the next time you save them. To migrate everything at once, use Upload to Server.
• Corrected the encryption documentation, which claimed "AES-256-CBC with PBKDF2". No KDF was ever involved — the stored key is already 256 random bits. The unused per-entry salt is no longer written.
• Entry contents are encrypted before upload, but WebDAV credentials travel in a Basic auth header. Settings now warns about this when the server URL is http://.

Changed

• Removed 20 launcher-badge permissions (Samsung, HTC, Sony, Huawei, Oppo, Everything and others) pulled in by the ShortcutBadger AAR that expo-notifications depends on. SimpleDay never sets a badge.

Downloads

simpleday-1.3.0.apk is the universal build. The per-ABI splits are smaller — pick arm64-v8a for any recent device.