Say on the privacy page that search stays on the phone, and why there is no index

An index is built from messages in readable form, so it is a second copy
of everything somebody has written — one that would need protecting as
carefully as the first and could be forgotten about. Not having one is a
decision worth stating rather than an absence.

Also: the query itself is never kept. What somebody searched for is
often more telling than what they found.

Refs paulhitt/flamenet-messenger-ios#25

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Resources/Views/privacy.leaf

@@ -75,6 +75,19 @@
       anybody: it gets the conversation's own protection rather than being left somewhere
       more convenient, it never leaves the device, and signing out removes it along with
       everything else.
+
+    <h2>Searching your messages</h2>
+    <p>
+      Searching happens entirely on your device, over the messages already there.
+      Nothing you type into the search box is sent anywhere, and nothing is kept: the
+      words you searched for are often more telling than what you found, so they are not
+      written down, not even on your own phone.
+    </p>
+    <p>
+      There is also deliberately no search index. An index is built from your messages in
+      readable form, so it would be a second copy of everything you have ever written &mdash;
+      one that would have to be protected just as carefully as the first, and could be
+      forgotten about. The app searches what it already has instead.
     </p>
 
     <h2>Unencrypted conversations</h2>