Say on the privacy page what stays on the phone

A draft is the one piece of text in the app somebody has not decided to
share with anybody, and drafts now persist — so the page should say so
rather than let people find out. Covers the history file in the same
section, which was also only described in the spec.

Deliberately not touching the "Unencrypted conversations" section
below it: that turns out to be accurate about the SERVER while the
comparison page is accurate about the APPS, and reconciling the two is
its own decision. Filed as #50.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Resources/Views/privacy.leaf

@@ -62,6 +62,21 @@
       are never transmitted.
     </p>
 
+    <h2>What stays on your phone</h2>
+    <p>
+      Your conversation history is kept on your device so that closing the app does not
+      lose it. It is sealed there with a key that lives only in that device's secure
+      storage &mdash; never in a backup, never on another device, and never here.
+    </p>
+    <p>
+      A message you have started writing and not sent is kept the same way, so that
+      switching apps or being interrupted does not lose it. That is worth saying out loud
+      because it is the one piece of text in the app you have not decided to share with
+      anybody: it gets the conversation's own protection rather than being left somewhere
+      more convenient, it never leaves the device, and signing out removes it along with
+      everything else.
+    </p>
+
     <h2>Unencrypted conversations</h2>
     <p>
       Messages in a conversation with encryption turned off are stored encrypted at rest,