diff --git a/Resources/Views/comparison.leaf b/Resources/Views/comparison.leaf
index b7d9d62..241626d 100644
--- a/Resources/Views/comparison.leaf
+++ b/Resources/Views/comparison.leaf
@@ -96,14 +96,14 @@
           </tr>
           <tr>
             <th scope="row">Independent security audit</th>
-            <td class="mine"><strong class="part">Not yet</strong><br><small>The scope for one is written and public, and donations pay for it. Until then the code is open and heavily tested.</small></td>
+            <td class="mine"><strong class="part">Planned</strong><br><small>The scope for one is written and public, and donations pay for it. Until then the code is open and heavily tested.</small></td>
             <td><strong class="yes">Yes</strong></td>
             <td><strong class="part">Partly</strong><br><small>Its protocol has been examined externally, with mixed findings.</small></td>
             <td><strong class="yes">Yes</strong><br><small>PQ3 was formally analysed by outside academics.</small></td>
           </tr>
           <tr>
             <th scope="row">You can install it today</th>
-            <td class="mine"><strong class="part">Android yes</strong><br><small>Android is out and you can install it from this site today. The iPhone app is with Apple &mdash; this row changes the day it opens, and not before.</small></td>
+            <td class="mine"><strong class="part">Android yes</strong><br><small>Android is out and you can install it from this site today. The iPhone app is built and being prepared for the App Store &mdash; this row changes the day it opens, and not before.</small></td>
             <td><strong class="yes">Yes</strong></td>
             <td><strong class="yes">Yes</strong></td>
             <td><strong class="yes">Yes</strong></td>
diff --git a/Resources/Views/get.leaf b/Resources/Views/get.leaf
index c7cf0ec..37193a5 100644
--- a/Resources/Views/get.leaf
+++ b/Resources/Views/get.leaf
@@ -62,12 +62,10 @@
       something and chosen a password is a worse way to learn it.
     </p>
     <p class="fineprint">
-      <strong>If you installed the version that was here before, please replace
-      it.</strong> That build had two faults we would not want anyone to meet:
-      answering a call could close the app, and messages sent from Android were
-      not arriving. We took it down rather than leave it up, and this one —
-      version 0.8 — fixes both. Installing it over the old one keeps your
-      account and your conversations. The iPhone app is still with Apple.
+      <strong>Installed an earlier build? Replace it.</strong> Version 0.8 fixes
+      two problems in it &mdash; answering a call could close the app, and
+      messages sent from Android did not always arrive. Installing over the top
+      keeps your account and your conversations.
     </p>
     <p class="fineprint">
       <!-- Said before somebody waits for something they cannot install. The
diff --git a/Resources/Views/landing.leaf b/Resources/Views/landing.leaf
index 8eb0a6e..dd914bc 100644
--- a/Resources/Views/landing.leaf
+++ b/Resources/Views/landing.leaf
@@ -252,7 +252,7 @@
         <a class="card-link" href="/metadata">See exactly what's kept</a>
       </article>
       <article class="honest-card">
-        <h3>An outside audit hasn't happened yet</h3>
+        <h3>An outside audit is still ahead of us</h3>
         <p>
           The code is open and heavily tested, and the design is published so anyone can
           review it. A paid review by a security firm is a different kind of assurance,
diff --git a/Resources/Views/metadata.leaf b/Resources/Views/metadata.leaf
index 8cc8001..fa689b4 100644
--- a/Resources/Views/metadata.leaf
+++ b/Resources/Views/metadata.leaf
@@ -46,7 +46,7 @@
         <tr><td>Buddy list — <strong>until you take it off</strong></td><td>Presence is shown only to people on your list, so the server holds it to enforce that. Settings offers "Take my contact list off the server": the list then lives only in your devices' encrypted stores (and rides your encrypted history export), and the honest cost is that buddies see you as offline — a presence design that needs no stored graph is the planned replacement.</td></tr>
         <tr><td>Blocks</td><td>The server enforces them, so it has to know them. It cannot enforce one against a message that does not name its sender — blocking someone also cancels the passes you gave them, which is the part that can be aimed at one person.</td></tr>
         <tr><td><strong>Who is in each group</strong></td><td>For every group on this server today, yes &mdash; it holds the list of members, and that is the largest single thing it knows about you. What changed is that it no longer has to. The server can now keep that list encrypted instead, with no account numbers in it anywhere: members are known to it only by random tokens it cannot tie back to anybody, and the list itself is a blob it has no key to. That much is built and running here. What is missing is the other half &mdash; the apps do not make groups that way yet, so every group that exists right now is still the old kind, held in the clear. We would rather tell you that than let &ldquo;supported&rdquo; be read as &ldquo;you are protected&rdquo;. When the apps do catch up, here is the honest shape of what it buys. It protects you from a copy of this database being stolen, or being handed over &mdash; which is the ordinary way this kind of thing actually goes wrong, and worth having. It does not hide your groups from whoever is running the server while it runs, because messages are addressed to each device: watching who receives a group&rsquo;s traffic still gives the group away. So the promise this earns is &ldquo;a dump of this database does not reveal your groups&rdquo;, and not &ldquo;the server cannot see who you talk to&rdquo;. Those two sound alike and are not, and we are not going to blur them.</td></tr>
-        <tr><td><strong>What each group is called</strong></td><td>Not held. It used to be, and it should not have been: the name sat in a column the server never actually used for anything, so &ldquo;Chemotherapy support&rdquo; or the name of a union drive was sitting on a machine that can be broken into or handed a court order, and it bought nobody anything. It is gone, and the names that were already stored were deleted rather than just stopped. The only places the name can live now are the phones of the people in the group, which tell each other over the same encryption everything else uses. Two things follow, and neither is hidden from you. The app half of this is out now on Android, in version 0.6, and comes to iPhone once Apple approves that build &mdash; until it reaches your phone, every group reads as &ldquo;Group&rdquo;, which is the server declining to answer rather than anything lost. And a group you made before the change shows as &ldquo;Group&rdquo; until somebody in it renames it, because the old name was deleted here and no phone had ever been given a copy: there is nothing left to restore it from. Renaming arrived in that same version, for exactly this reason.</td></tr>
+        <tr><td><strong>What each group is called</strong></td><td>Not held. It used to be, and it should not have been: the name sat in a column the server never actually used for anything, so &ldquo;Chemotherapy support&rdquo; or the name of a union drive was sitting on a machine that can be broken into or handed a court order, and it bought nobody anything. It is gone, and the names that were already stored were deleted rather than just stopped. The only places the name can live now are the phones of the people in the group, which tell each other over the same encryption everything else uses. Two things follow, and neither is hidden from you. The app half of this is out now on Android, and comes to iPhone once Apple approves the build that carries it &mdash; until it reaches your phone, every group reads as &ldquo;Group&rdquo;, which is the server declining to answer rather than anything lost. And a group you made before the change shows as &ldquo;Group&rdquo; until somebody in it renames it, because the old name was deleted here and no phone had ever been given a copy: there is nothing left to restore it from. Renaming arrived in that same version, for exactly this reason.</td></tr>
         <tr><td>Presence</td><td>Coarsened to the online window before it is written, never to the second</td></tr>
         <tr><td>Delivery-key digest</td><td>The hash only. The key itself never reaches the server except inside a sealed submission</td></tr>
         <tr><td>Per-device last-activity stamp</td><td>Coarsened to the hour before it is written. It exists so a device that falls silent for #(retention.deviceExpiryDays) days can be expired — its keys unpublished, its queued mail deleted — rather than staying addressable for ever. An account's newest device is never expired, and an account holds at most #(retention.maxDevices) devices.</td></tr>
diff --git a/Resources/Views/roadmap.leaf b/Resources/Views/roadmap.leaf
index 9a59118..c53ec41 100644
--- a/Resources/Views/roadmap.leaf
+++ b/Resources/Views/roadmap.leaf
@@ -13,7 +13,7 @@
     <p>
       Blocking a single sender used to mean changing the key everyone uses and handing the
       new one to every contact you still wanted to hear from — so in practice nobody ever
-      did it. From Android 0.6, out now, each contact gets their own book of one-use tickets, and
+      did it. On Android, out now, each contact gets their own book of one-use tickets, and
       cutting one person off is tearing up their book. Nobody else notices, and the server
       sees a different ticket every time rather than one name it can follow you by.
     </p>