+
+
+
+
+--8<-- "includes/abbreviations.ar.txt"
diff --git a/i18n/ar/advanced/communication-network-types.md b/i18n/ar/advanced/communication-network-types.md
new file mode 100644
index 000000000..33accb6ec
--- /dev/null
+++ b/i18n/ar/advanced/communication-network-types.md
@@ -0,0 +1,104 @@
+---
+title: "Types of Communication Networks"
+icon: 'material/transit-connection-variant'
+---
+
+There are several network architectures commonly used to relay messages between people. These networks can provide different privacy guarantees, which is why it's worth considering your [threat model](../basics/threat-modeling.md) when deciding which app to use.
+
+[Recommended Instant Messengers](../real-time-communication.md ""){.md-button}
+
+## Centralized Networks
+
+{ align=left }
+
+Centralized messengers are those where all participants are on the same server or network of servers controlled by the same organization.
+
+Some self-hosted messengers allow you to set up your own server. Self-hosting can provide additional privacy guarantees, such as no usage logs or limited access to metadata (data about who is talking to whom). Self-hosted centralized messengers are isolated and everyone must be on the same server to communicate.
+
+**Advantages:**
+
+- New features and changes can be implemented more quickly.
+- Easier to get started with and to find contacts.
+- Most mature and stable features ecosystems, as they are easier to program in a centralized software.
+- Privacy issues may be reduced when you trust a server that you're self-hosting.
+
+**Disadvantages:**
+
+- Can include [restricted control or access](https://drewdevault.com/2018/08/08/Signal.html). This can include things like:
+- Being [forbidden from connecting third-party clients](https://github.com/LibreSignal/LibreSignal/issues/37#issuecomment-217211165) to the centralized network that might provide for greater customization or a better experience. Often defined in Terms and Conditions of usage.
+- Poor or no documentation for third-party developers.
+- The [ownership](https://web.archive.org/web/20210729191953/https://blog.privacytools.io/delisting-wire/), privacy policy, and operations of the service can change easily when a single entity controls it, potentially compromising the service later on.
+- Self-hosting requires effort and knowledge of how to set up a service.
+
+## Federated Networks
+
+{ align=left }
+
+Federated messengers use multiple, independent, decentralized servers that are able to talk to each other (email is one example of a federated service). Federation allows system administrators to control their own server and still be a part of the larger communications network.
+
+When self-hosted, members of a federated server can discover and communicate with members of other servers, although some servers may choose to remain private by being non-federated (e.g., work team server).
+
+**Advantages:**
+
+- Allows for greater control over your own data when running your own server.
+- Allows you to choose whom to trust your data with by choosing between multiple "public" servers.
+- Often allows for third-party clients which can provide a more native, customized, or accessible experience.
+- Server software can be verified that it matches public source code, assuming you have access to the server or you trust the person who does (e.g., a family member).
+
+**Disadvantages:**
+
+- Adding new features is more complex because these features need to be standardized and tested to ensure they work with all servers on the network.
+- Due to the previous point, features can be lacking, or incomplete or working in unexpected ways compared to centralized platforms, such as message relay when offline or message deletion.
+- Some metadata may be available (e.g., information like "who is talking to whom," but not actual message content if E2EE is used).
+- Federated servers generally require trusting your server's administrator. They may be a hobbyist or otherwise not a "security professional," and may not serve standard documents like a privacy policy or terms of service detailing how your data is used.
+- Server administrators sometimes choose to block other servers, which are a source of unmoderated abuse or break general rules of accepted behavior. This will hinder your ability to communicate with members of those servers.
+
+## Peer-to-Peer Networks
+
+{ align=left }
+
+P2P messengers connect to a [distributed network](https://en.wikipedia.org/wiki/Distributed_networking) of nodes to relay a message to the recipient without a third-party server.
+
+Clients (peers) usually find each other through the use of a [distributed computing](https://en.wikipedia.org/wiki/Distributed_computing) network. Examples of this include [Distributed Hash Tables](https://en.wikipedia.org/wiki/Distributed_hash_table) (DHT), used by [torrents](https://en.wikipedia.org/wiki/BitTorrent_(protocol)) and [IPFS](https://en.wikipedia.org/wiki/InterPlanetary_File_System) for example. Another approach is proximity based networks, where a connection is established over WiFi or Bluetooth (for example, Briar or the [Scuttlebutt](https://www.scuttlebutt.nz) social network protocol).
+
+Once a peer has found a route to its contact via any of these methods, a direct connection between them is made. Although messages are usually encrypted, an observer can still deduce the location and identity of the sender and recipient.
+
+P2P networks do not use servers, as peers communicate directly between each other and hence cannot be self-hosted. However, some additional services may rely on centralized servers, such as user discovery or relaying offline messages, which can benefit from self-hosting.
+
+**Advantages:**
+
+- Minimal information is exposed to third-parties.
+- Modern P2P platforms implement E2EE by default. There are no servers that could potentially intercept and decrypt your transmissions, unlike centralized and federated models.
+
+**Disadvantages:**
+
+- Reduced feature set:
+- Messages can only be sent when both peers are online, however, your client may store messages locally to wait for the contact to return online.
+- Generally increases battery usage on mobile devices, because the client must stay connected to the distributed network to learn about who is online.
+- Some common messenger features may not be implemented or incompletely, such as message deletion.
+- Your IP address and that of the contacts you're communicating with may be exposed if you do not use the software in conjunction with a [VPN](../vpn.md) or [Tor](../tor.md). Many countries have some form of mass surveillance and/or metadata retention.
+
+## Anonymous Routing
+
+{ align=left }
+
+A messenger using [anonymous routing](https://doi.org/10.1007/978-1-4419-5906-5_628) hides either the identity of the sender, the receiver, or evidence that they have been communicating. Ideally, a messenger should hide all three.
+
+There are [many](https://doi.org/10.1145/3182658) different ways to implement anonymous routing. One of the most famous is [onion routing](https://en.wikipedia.org/wiki/Onion_routing) (i.e. [Tor](tor-overview.md)), which communicates encrypted messages through a virtual [overlay network](https://en.wikipedia.org/wiki/Overlay_network) that hides the location of each node as well as the recipient and sender of each message. The sender and recipient never interact directly and only meet through a secret rendezvous node so that there is no leak of IP addresses nor physical location. Nodes cannot decrypt messages, nor the final destination; only the recipient can. Each intermediary node can only decrypt a part that indicates where to send the still encrypted message next, until it arrives at the recipient who can fully decrypt it, hence the "onion layers."
+
+Self-hosting a node in an anonymous routing network does not provide the hoster with additional privacy benefits, but rather contributes to the whole network's resilience against identification attacks for everyone's benefit.
+
+**Advantages:**
+
+- Minimal to no information is exposed to other parties.
+- Messages can be relayed in a decentralized manner even if one of the parties is offline.
+
+**Disadvantages:**
+
+- Slow message propagation.
+- Often limited to fewer media types, mostly text, since the network is slow.
+- Less reliable if nodes are selected by randomized routing, some nodes may be very far from the sender and receiver, adding latency or even failing to transmit messages if one of the nodes goes offline.
+- More complex to get started, as the creation and secured backup of a cryptographic private key is required.
+- Just like other decentralized platforms, adding features is more complex for developers than on a centralized platform. Hence, features may be lacking or incompletely implemented, such as offline message relaying or message deletion.
+
+--8<-- "includes/abbreviations.ar.txt"
diff --git a/i18n/ar/advanced/dns-overview.md b/i18n/ar/advanced/dns-overview.md
new file mode 100644
index 000000000..909de2acb
--- /dev/null
+++ b/i18n/ar/advanced/dns-overview.md
@@ -0,0 +1,307 @@
+---
+title: "DNS Overview"
+icon: material/dns
+---
+
+The [Domain Name System](https://en.wikipedia.org/wiki/Domain_Name_System) is the 'phonebook of the Internet'. DNS translates domain names to IP addresses so browsers and other services can load Internet resources, through a decentralized network of servers.
+
+## What is DNS?
+
+When you visit a website, a numerical address is returned. For example, when you visit `privacyguides.org`, the address `192.98.54.105` is returned.
+
+DNS has existed since the [early days](https://en.wikipedia.org/wiki/Domain_Name_System#History) of the Internet. DNS requests made to and from DNS servers are **not** generally encrypted. In a residential setting, a customer is given servers by the ISP via [DHCP](https://en.wikipedia.org/wiki/Dynamic_Host_Configuration_Protocol).
+
+Unencrypted DNS requests are able to be easily **surveilled** and **modified** in transit. In some parts of the world, ISPs are ordered to do primitive [DNS filtering](https://en.wikipedia.org/wiki/DNS_blocking). When you request the IP address of a domain that is blocked, the server may not respond or may respond with a different IP address. As the DNS protocol is not encrypted, the ISP (or any network operator) can use [DPI](https://en.wikipedia.org/wiki/Deep_packet_inspection) to monitor requests. ISPs can also block requests based on common characteristics, regardless of which DNS server is used. Unencrypted DNS always uses [port](https://en.wikipedia.org/wiki/Port_(computer_networking)) 53 and always uses UDP.
+
+Below, we discuss and provide a tutorial to prove what an outside observer may see using regular unencrypted DNS and [encrypted DNS](#what-is-encrypted-dns).
+
+### Unencrypted DNS
+
+1. Using [`tshark`](https://www.wireshark.org/docs/man-pages/tshark.html) (part of the [Wireshark](https://en.wikipedia.org/wiki/Wireshark) project) we can monitor and record internet packet flow. This command records packets that meet the rules specified:
+
+ ```bash
+ tshark -w /tmp/dns.pcap udp port 53 and host 1.1.1.1 or host 8.8.8.8
+ ```
+
+2. We can then use [`dig`](https://en.wikipedia.org/wiki/Dig_(command)) (Linux, MacOS etc) or [`nslookup`](https://en.wikipedia.org/wiki/Nslookup) (Windows) to send the DNS lookup to both servers. Software such as web browsers do these lookups automatically, unless they are configured to use encrypted DNS.
+
+ === "Linux, macOS"
+
+ ```
+ dig +noall +answer privacyguides.org @1.1.1.1
+ dig +noall +answer privacyguides.org @8.8.8.8
+ ```
+ === "Windows"
+
+ ```
+ nslookup privacyguides.org 1.1.1.1
+ nslookup privacyguides.org 8.8.8.8
+ ```
+
+3. Next, we want to [analyse](https://www.wireshark.org/docs/wsug_html_chunked/ChapterIntroduction.html#ChIntroWhatIs) the results:
+
+ === "Wireshark"
+
+ ```
+ wireshark -r /tmp/dns.pcap
+ ```
+
+ === "tshark"
+
+ ```
+ tshark -r /tmp/dns.pcap
+ ```
+
+If you run the Wireshark command above, the top pane shows the "[frames](https://en.wikipedia.org/wiki/Ethernet_frame)", and the bottom pane shows all the data about the selected frame. Enterprise filtering and monitoring solutions (such as those purchased by governments) can do the process automatically, without human interaction, and can aggregate those frames to produce statistical data useful to the network observer.
+
+| No. | Time | Source | Destination | Protocol | Length | Info |
+| --- | -------- | --------- | ----------- | -------- | ------ | ---------------------------------------------------------------------- |
+| 1 | 0.000000 | 192.0.2.1 | 1.1.1.1 | DNS | 104 | Standard query 0x58ba A privacyguides.org OPT |
+| 2 | 0.293395 | 1.1.1.1 | 192.0.2.1 | DNS | 108 | Standard query response 0x58ba A privacyguides.org A 198.98.54.105 OPT |
+| 3 | 1.682109 | 192.0.2.1 | 8.8.8.8 | DNS | 104 | Standard query 0xf1a9 A privacyguides.org OPT |
+| 4 | 2.154698 | 8.8.8.8 | 192.0.2.1 | DNS | 108 | Standard query response 0xf1a9 A privacyguides.org A 198.98.54.105 OPT |
+
+An observer could modify any of these packets.
+
+## What is "encrypted DNS"?
+
+Encrypted DNS can refer to one of a number of protocols, the most common ones being:
+
+### DNSCrypt
+
+[**DNSCrypt**](https://en.wikipedia.org/wiki/DNSCrypt) was one of the first methods of encrypting DNS queries. DNSCrypt operates on port 443 and works with both the TCP or UDP transport protocols. DNSCrypt has never been submitted to the [Internet Engineering Task Force (IETF)](https://en.wikipedia.org/wiki/Internet_Engineering_Task_Force) nor has it gone through the [Request for Comments (RFC)](https://en.wikipedia.org/wiki/Request_for_Comments) process, so it has not been used widely outside of a few [implementations](https://dnscrypt.info/implementations). As a result, it has been largely replaced by the more popular [DNS over HTTPS](#dns-over-https-doh).
+
+### DNS over TLS (DoT)
+
+[**DNS over TLS**](https://en.wikipedia.org/wiki/DNS_over_TLS) is another method for encrypting DNS communication that is defined in [RFC 7858](https://datatracker.ietf.org/doc/html/rfc7858). Support was first implemented in Android 9, iOS 14, and on Linux in [systemd-resolved](https://www.freedesktop.org/software/systemd/man/resolved.conf.html#DNSOverTLS=) in version 237. Preference in the industry has been moving away from DoT to DoH in recent years, as DoT is a [complex protocol](https://dnscrypt.info/faq/) and has varying compliance to the RFC across the implementations that exist. DoT also operates on a dedicated port 853 which can be blocked easily by restrictive firewalls.
+
+### DNS over HTTPS (DoH)
+
+[**DNS over HTTPS**](https://en.wikipedia.org/wiki/DNS_over_HTTPS) as defined in [RFC 8484](https://datatracker.ietf.org/doc/html/rfc8484) packages queries in the [HTTP/2](https://en.wikipedia.org/wiki/HTTP/2) protocol and provides security with HTTPS. Support was first added in web browsers such as Firefox 60 and Chrome 83.
+
+Native implementation of DoH showed up in iOS 14, macOS 11, Microsoft Windows, and Android 13 (however, it won't be enabled [by default](https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1833144)). General Linux desktop support is waiting on the systemd [implementation](https://github.com/systemd/systemd/issues/8639) so [installing third-party software is still required](../dns.md#encrypted-dns-proxies).
+
+## What can an outside party see?
+
+In this example we will record what happens when we make a DoH request:
+
+1. First, start `tshark`:
+
+ ```bash
+ tshark -w /tmp/dns_doh.pcap -f "tcp port https and host 1.1.1.1"
+ ```
+
+2. Second, make a request with `curl`:
+
+ ```bash
+ curl -vI --doh-url https://1.1.1.1/dns-query https://privacyguides.org
+ ```
+
+3. After making the request, we can stop the packet capture with CTRL + C.
+
+4. Analyse the results in Wireshark:
+
+ ```bash
+ wireshark -r /tmp/dns_doh.pcap
+ ```
+
+We can see the [connection establishment](https://en.wikipedia.org/wiki/Transmission_Control_Protocol#Connection_establishment) and [TLS handshake](https://www.cloudflare.com/learning/ssl/what-happens-in-a-tls-handshake/) that occurs with any encrypted connection. When looking at the "application data" packets that follow, none of them contain the domain we requested or the IP address returned.
+
+## Why **shouldn't** I use encrypted DNS?
+
+In locations where there is internet filtering (or censorship), visiting forbidden resources may have its own consequences which you should consider in your [threat model](../basics/threat-modeling.md). We do **not** suggest the use of encrypted DNS for this purpose. Use [Tor](https://torproject.org) or a [VPN](../vpn.md) instead. If you're using a VPN, you should use your VPN's DNS servers. When using a VPN, you are already trusting them with all your network activity.
+
+When we do a DNS lookup, it's generally because we want to access a resource. Below, we will discuss some of the methods that may disclose your browsing activities even when using encrypted DNS:
+
+### IP Address
+
+The simplest way to determine browsing activity might be to look at the IP addresses your devices are accessing. For example, if the observer knows that `privacyguides.org` is at `198.98.54.105`, and your device is requesting data from `198.98.54.105`, there is a good chance you're visiting Privacy Guides.
+
+This method is only useful when the IP address belongs to a server that only hosts few websites. It's also not very useful if the site is hosted on a shared platform (e.g. Github Pages, Cloudflare Pages, Netlify, WordPress, Blogger, etc). It also isn't very useful if the server is hosted behind a [reverse proxy](https://en.wikipedia.org/wiki/Reverse_proxy), which is very common on the modern Internet.
+
+### Server Name Indication (SNI)
+
+Server Name Indication is typically used when a IP address hosts many websites. This could be a service like Cloudflare, or some other [Denial-of-service attack](https://en.wikipedia.org/wiki/Denial-of-service_attack) protection.
+
+1. Start capturing again with `tshark`. We've added a filter with our IP address so you don't capture many packets:
+
+ ```bash
+ tshark -w /tmp/pg.pcap port 443 and host 198.98.54.105
+ ```
+
+2. Then we visit [https://privacyguides.org](https://privacyguides.org).
+
+3. After visiting the website, we want to stop the packet capture with CTRL + C.
+
+4. Next we want to analyze the results:
+
+ ```bash
+ wireshark -r /tmp/pg.pcap
+ ```
+
+ We will see the connection establishment, followed by the TLS handshake for the Privacy Guides website. Around frame 5. you'll see a "Client Hello".
+
+5. Expand the triangle ▸ next to each field:
+
+ ```text
+ ▸ Transport Layer Security
+ ▸ TLSv1.3 Record Layer: Handshake Protocol: Client Hello
+ ▸ Handshake Protocol: Client Hello
+ ▸ Extension: server_name (len=22)
+ ▸ Server Name Indication extension
+ ```
+
+6. We can see the SNI value which discloses the website we are visiting. The `tshark` command can give you the value directly for all packets containing a SNI value:
+
+ ```bash
+ tshark -r /tmp/pg.pcap -Tfields -Y tls.handshake.extensions_server_name -e tls.handshake.extensions_server_name
+ ```
+
+This means even if we are using "Encrypted DNS" servers, the domain will likely be disclosed through SNI. The [TLS v1.3](https://en.wikipedia.org/wiki/Transport_Layer_Security#TLS_1.3) protocol brings with it [Encrypted Client Hello](https://blog.cloudflare.com/encrypted-client-hello/), which prevents this kind of leak.
+
+Governments, in particular [China](https://www.zdnet.com/article/china-is-now-blocking-all-encrypted-https-traffic-using-tls-1-3-and-esni/) and [Russia](https://www.zdnet.com/article/russia-wants-to-ban-the-use-of-secure-protocols-such-as-tls-1-3-doh-dot-esni/), have either already [started blocking](https://en.wikipedia.org/wiki/Server_Name_Indication#Encrypted_Client_Hello) it or expressed a desire to do so. Recently, Russia has [started blocking foreign websites](https://github.com/net4people/bbs/issues/108) that use the [HTTP/3](https://en.wikipedia.org/wiki/HTTP/3) standard. This is because the [QUIC](https://en.wikipedia.org/wiki/QUIC) protocol that is a part of HTTP/3 requires that `ClientHello` also be encrypted.
+
+### Online Certificate Status Protocol (OCSP)
+
+Another way your browser can disclose your browsing activities is with the [Online Certificate Status Protocol](https://en.wikipedia.org/wiki/Online_Certificate_Status_Protocol). When visiting an HTTPS website, the browser might check to see if the website's [certificate](https://en.wikipedia.org/wiki/Public_key_certificate) has been revoked. This is generally done through the HTTP protocol, meaning it is **not** encrypted.
+
+The OCSP request contains the certificate "[serial number](https://en.wikipedia.org/wiki/Public_key_certificate#Common_fields)", which is unique. It is sent to the "OCSP responder" in order to check its status.
+
+We can simulate what a browser would do using the [`openssl`](https://en.wikipedia.org/wiki/OpenSSL) command.
+
+1. Get the server certificate and use [`sed`](https://en.wikipedia.org/wiki/Sed) to keep just the important part and write it out to a file:
+
+ ```bash
+ openssl s_client -connect privacyguides.org:443 < /dev/null 2>&1 |
+ sed -n '/^-*BEGIN/,/^-*END/p' > /tmp/pg_server.cert
+ ```
+
+2. Get the intermediate certificate. [Certificate Authorities (CA)](https://en.wikipedia.org/wiki/Certificate_authority) normally don't sign a certificate directly; they use what is known as an "intermediate" certificate.
+
+ ```bash
+ openssl s_client -showcerts -connect privacyguides.org:443 < /dev/null 2>&1 |
+ sed -n '/^-*BEGIN/,/^-*END/p' > /tmp/pg_and_intermediate.cert
+ ```
+
+3. The first certificate in `pg_and_intermediate.cert` is actually the server certificate from step 1. We can use `sed` again to delete until the first instance of END:
+
+ ```bash
+ sed -n '/^-*END CERTIFICATE-*$/!d;:a n;p;ba' \
+ /tmp/pg_and_intermediate.cert > /tmp/intermediate_chain.cert
+ ```
+
+4. Get the OCSP responder for the server certificate:
+
+ ```bash
+ openssl x509 -noout -ocsp_uri -in /tmp/pg_server.cert
+ ```
+
+ Our certificate shows the Lets Encrypt certificate responder. If we want to see all the details of the certificate we can use:
+
+ ```bash
+ openssl x509 -text -noout -in /tmp/pg_server.cert
+ ```
+
+5. Start the packet capture:
+
+ ```bash
+ tshark -w /tmp/pg_ocsp.pcap -f "tcp port http"
+ ```
+
+6. Make the OCSP request:
+
+ ```bash
+ openssl ocsp -issuer /tmp/intermediate_chain.cert \
+ -cert /tmp/pg_server.cert \
+ -text \
+ -url http://r3.o.lencr.org
+ ```
+
+7. Open the capture:
+
+ ```bash
+ wireshark -r /tmp/pg_ocsp.pcap
+ ```
+
+ There will be two packets with the "OCSP" protocol: a "Request" and a "Response". For the "Request" we can see the "serial number" by expanding the triangle ▸ next to each field:
+
+ ```bash
+ ▸ Online Certificate Status Protocol
+ ▸ tbsRequest
+ ▸ requestList: 1 item
+ ▸ Request
+ ▸ reqCert
+ serialNumber
+ ```
+
+ For the "Response" we can also see the "serial number":
+
+ ```bash
+ ▸ Online Certificate Status Protocol
+ ▸ responseBytes
+ ▸ BasicOCSPResponse
+ ▸ tbsResponseData
+ ▸ responses: 1 item
+ ▸ SingleResponse
+ ▸ certID
+ serialNumber
+ ```
+
+8. Or use `tshark` to filter the packets for the Serial Number:
+
+ ```bash
+ tshark -r /tmp/pg_ocsp.pcap -Tfields -Y ocsp.serialNumber -e ocsp.serialNumber
+ ```
+
+If the network observer has the public certificate, which is publicly available, they can match the serial number with that certificate and therefore determine the site you're visiting from that. The process can be automated and can associate IP addresses with serial numbers. It is also possible to check [Certificate Transparency](https://en.wikipedia.org/wiki/Certificate_Transparency) logs for the serial number.
+
+## Should I use encrypted DNS?
+
+We made this flow chart to describe when you *should* use encrypted DNS:
+
+``` mermaid
+graph TB
+ Start[Start] --> anonymous{Trying to be anonymous?}
+ anonymous--> | Yes | tor(Use Tor)
+ anonymous --> | No | censorship{Avoiding censorship?}
+ censorship --> | Yes | vpnOrTor(Use VPN or Tor)
+ censorship --> | No | privacy{Want privacy from ISP?}
+ privacy --> | Yes | vpnOrTor
+ privacy --> | No | obnoxious{ISP makes obnoxious redirects?}
+ obnoxious --> | Yes | encryptedDNS(Use encrypted DNS with 3rd party)
+ obnoxious --> | No | ispDNS{Does ISP support encrypted DNS?}
+ ispDNS --> | Yes | useISP(Use encrypted DNS with ISP)
+ ispDNS --> | No | nothing(Do nothing)
+```
+
+Encrypted DNS with a third-party should only be used to get around redirects and basic [DNS blocking](https://en.wikipedia.org/wiki/DNS_blocking) when you can be sure there won't be any consequences or you're interested in a provider that does some rudimentary filtering.
+
+[List of recommended DNS servers](../dns.md ""){.md-button}
+
+## What is DNSSEC?
+
+[Domain Name System Security Extensions](https://en.wikipedia.org/wiki/Domain_Name_System_Security_Extensions) (DNSSEC) is a feature of DNS that authenticates responses to domain name lookups. It does not provide privacy protections for those lookups, but rather prevents attackers from manipulating or poisoning the responses to DNS requests.
+
+In other words, DNSSEC digitally signs data to help ensure its validity. In order to ensure a secure lookup, the signing occurs at every level in the DNS lookup process. As a result, all answers from DNS can be trusted.
+
+The DNSSEC signing process is similar to someone signing a legal document with a pen; that person signs with a unique signature that no one else can create, and a court expert can look at that signature and verify that the document was signed by that person. These digital signatures ensure that data has not been tampered with.
+
+DNSSEC implements a hierarchical digital signing policy across all layers of DNS. For example, in the case of a `privacyguides.org` lookup, a root DNS server would sign a key for the `.org` nameserver, and the `.org` nameserver would then sign a key for `privacyguides.org`’s authoritative nameserver.
+
+Adapted from [DNS Security Extensions (DNSSEC) overview](https://cloud.google.com/dns/docs/dnssec) by Google and [DNSSEC: An Introduction](https://blog.cloudflare.com/dnssec-an-introduction/) by Cloudflare, both licensed under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/).
+
+## What is QNAME minimization?
+
+A QNAME is a "qualified name", for example `privacyguides.org`. QNAME minimisation reduces the amount of information sent from the DNS server to the [authoritative name server](https://en.wikipedia.org/wiki/Name_server#Authoritative_name_server).
+
+Instead of sending the whole domain `privacyguides.org`, QNAME minimization means the DNS server will ask for all the records that end in `.org`. Further technical description is defined in [RFC 7816](https://datatracker.ietf.org/doc/html/rfc7816).
+
+## What is EDNS Client Subnet (ECS)?
+
+The [EDNS Client Subnet](https://en.wikipedia.org/wiki/EDNS_Client_Subnet) is a method for a recursive DNS resolver to specify a [subnetwork](https://en.wikipedia.org/wiki/Subnetwork) for the [host or client](https://en.wikipedia.org/wiki/Client_(computing)) which is making the DNS query.
+
+It's intended to "speed up" delivery of data by giving the client an answer that belongs to a server that is close to them such as a [content delivery network](https://en.wikipedia.org/wiki/Content_delivery_network), which are often used in video streaming and serving JavaScript web apps.
+
+This feature does come at a privacy cost, as it tells the DNS server some information about the client's location.
+
+--8<-- "includes/abbreviations.ar.txt"
diff --git a/i18n/ar/advanced/tor-overview.md b/i18n/ar/advanced/tor-overview.md
new file mode 100644
index 000000000..508d5e6a6
--- /dev/null
+++ b/i18n/ar/advanced/tor-overview.md
@@ -0,0 +1,81 @@
+---
+title: "Tor Overview"
+icon: 'simple/torproject'
+---
+
+Tor is a free to use, decentralized network designed for using the internet with as much privacy as possible. If used properly, the network enables private and anonymous browsing and communications.
+
+## Path Building
+
+Tor works by routing your traffic through a network comprised of thousands of volunteer-run servers called nodes (or relays).
+
+Every time you connect to Tor, it will choose three nodes to build a path to the internet—this path is called a "circuit." Each of these nodes has its own function:
+
+### The Entry Node
+
+The entry node, often called the guard node, is the first node to which your Tor client connects. The entry node is able to see your IP address, however it is unable to see what you are connecting to.
+
+Unlike the other nodes, the Tor client will randomly select an entry node and stick with it for two to three months to protect you from certain attacks.[^1]
+
+### The Middle Node
+
+The middle node is the second node to which your Tor client connects. It can see which node the traffic came from—the entry node—and to which node it goes to next. The middle node cannot, see your IP address or the domain you are connecting to.
+
+For each new circuit, the middle node is randomly selected out of all available Tor nodes.
+
+### The Exit Node
+
+The exit node is the point in which your web traffic leaves the Tor network and is forwarded to your desired destination. The exit node is unable to see your IP address, but it does know what site it's connecting to.
+
+The exit node will be chosen at random from all available Tor nodes ran with an exit relay flag.[^2]
+
+
+ 
+ 
+ Tor circuit pathway
+
+
+## Encryption
+
+Tor encrypts each packet (a block of transmitted data) three times with the keys from the exit, middle, and entry node—in that order.
+
+Once Tor has built a circuit, data transmission is done as follows:
+
+1. Firstly: when the packet arrives at the entry node, the first layer of encryption is removed. In this encrypted packet, the entry node will find another encrypted packet with the middle node’s address. The entry node will then forward the packet to the middle node.
+
+2. Secondly: when the middle node receives the packet from the entry node, it too will remove a layer of encryption with its key, and this time finds an encrypted packet with the exit node's address. The middle node will then forward the packet to the exit node.
+
+3. Lastly: when the exit node receives its packet, it will remove the last layer of encryption with its key. The exit node will see the destination address and forward the packet to that address.
+
+Below is an alternative diagram showing the process. Each node removes its own layer of encryption, and when the destination server returns data, the same process happens entirely in reverse. For example, the exit node does not know who you are, but it does know which node it came from, and so it adds its own layer of encryption and sends it back.
+
+
+ 
+ 
+ Sending and receiving data through the Tor Network
+
+
+Tor allows us to connect to a server without any single party knowing the entire path. The entry node knows who you are, but not where you are going; the middle node doesn’t know who you are or where you are going; and the exit node knows where you are going, but not who you are. Because the exit node is what makes the final connection, the destination server will never know your IP address.
+
+## Caveats
+
+Though Tor does provide strong privacy guarantees, one must be aware that Tor is not perfect:
+
+- Well-funded adversaries with the capability to passively watch most network traffic over the globe have a chance of deanonymizing Tor users by means of advanced traffic analysis. Nor does Tor protect you from exposing yourself by mistake, such as if you share too much information about your real identity.
+- Tor exit nodes can also monitor traffic that passes through them. This means traffic which is not encrypted, such as plain HTTP traffic, can be recorded and monitored. If such traffic contains personally identifiable information, then it can deanonymize you to that exit node. Thus, we recommend using HTTPS over Tor where possible.
+
+If you wish to use Tor for browsing the web, we only recommend the **official** Tor Browser—it is designed to prevent fingerprinting.
+
+- [Tor Browser :material-arrow-right-drop-circle:](../tor.md#tor-browser)
+
+## Additional Resources
+
+- [Tor Browser User Manual](https://tb-manual.torproject.org)
+- [How Tor Works - Computerphile](https://invidious.privacyguides.net/embed/QRYzre4bf7I?local=true) (YouTube)
+- [Tor Onion Services - Computerphile](https://invidious.privacyguides.net/embed/lVcbq_a5N9I?local=true) (YouTube)
+
+--8<-- "includes/abbreviations.ar.txt"
+
+[^1]: The first relay in your circuit is called an "entry guard" or "guard". It is a fast and stable relay that remains the first one in your circuit for 2-3 months in order to protect against a known anonymity-breaking attack. The rest of your circuit changes with every new website you visit, and all together these relays provide the full privacy protections of Tor. For more information on how guard relays work, see this [blog post](https://blog.torproject.org/improving-tors-anonymity-changing-guard-parameters) and [paper](https://www-users.cs.umn.edu/~hoppernj/single_guard.pdf) on entry guards. ([https://support.torproject.org/tbb/tbb-2/](https://support.torproject.org/tbb/tbb-2/))
+
+[^2]: Relay flag: a special (dis-)qualification of relays for circuit positions (for example, "Guard", "Exit", "BadExit"), circuit properties (for example, "Fast", "Stable"), or roles (for example, "Authority", "HSDir"), as assigned by the directory authorities and further defined in the directory protocol specification. ([https://metrics.torproject.org/glossary.html](https://metrics.torproject.org/glossary.html))
diff --git a/i18n/ar/android.md b/i18n/ar/android.md
new file mode 100644
index 000000000..6ddd08015
--- /dev/null
+++ b/i18n/ar/android.md
@@ -0,0 +1,353 @@
+---
+title: "Android"
+icon: 'simple/android'
+---
+
+{ align=right }
+
+The **Android Open Source Project** is an open-source mobile operating system led by Google which powers the majority of the world's mobile devices. Most phones sold with Android are modified to include invasive integrations and apps such as Google Play Services, so you can significantly improve your privacy on your mobile device by replacing your phone's default installation with a version of Android without these invasive features.
+
+[:octicons-home-16:](https://source.android.com/){ .card-link title=Homepage }
+[:octicons-info-16:](https://source.android.com/docs){ .card-link title=Documentation}
+[:octicons-code-16:](https://cs.android.com/android/platform/superproject/){ .card-link title="Source Code" }
+
+These are the Android operating systems, devices, and apps we recommend to maximize your mobile device's security and privacy. To learn more about Android:
+
+- [General Android Overview :material-arrow-right-drop-circle:](os/android-overview.md)
+- [Why we recommend GrapheneOS over CalyxOS :material-arrow-right-drop-circle:](https://blog.privacyguides.org/2022/04/21/grapheneos-or-calyxos/)
+
+## AOSP Derivatives
+
+We recommend installing one of these custom Android operating systems on your device, listed in order of preference, depending on your device's compatibility with these operating systems.
+
+!!! note
+
+ End-of-life devices (such as GrapheneOS or CalyxOS's "extended support" devices) do not have full security patches (firmware updates) due to the OEM discontinuing support. These devices cannot be considered completely secure regardless of installed software.
+
+### GrapheneOS
+
+!!! recommendation
+
+ { align=right }
+ { align=right }
+
+ **GrapheneOS** is the best choice when it comes to privacy and security.
+
+ GrapheneOS provides additional [security hardening](https://en.wikipedia.org/wiki/Hardening_(computing)) and privacy improvements. It has a [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc), network and sensor permissions, and various other [security features](https://grapheneos.org/features). GrapheneOS also comes with full firmware updates and signed builds, so verified boot is fully supported.
+
+ [:octicons-home-16: Homepage](https://grapheneos.org/){ .md-button .md-button--primary }
+ [:octicons-eye-16:](https://grapheneos.org/faq#privacy-policy){ .card-link title="Privacy Policy" }
+ [:octicons-info-16:](https://grapheneos.org/faq){ .card-link title=Documentation}
+ [:octicons-code-16:](https://grapheneos.org/source){ .card-link title="Source Code" }
+ [:octicons-heart-16:](https://grapheneos.org/donate){ .card-link title=Contribute }
+
+GrapheneOS supports [Sandboxed Google Play](https://grapheneos.org/usage#sandboxed-google-play), which runs [Google Play Services](https://en.wikipedia.org/wiki/Google_Play_Services) fully sandboxed like any other regular app. This means you can take advantage of most Google Play Services, such as [push notifications](https://firebase.google.com/docs/cloud-messaging/), while giving you full control over their permissions and access, and while containing them to a specific [work profile](os/android-overview.md#work-profile) or [user profile](os/android-overview.md#user-profiles) of your choice.
+
+Google Pixel phones are the only devices that currently meet GrapheneOS's [hardware security requirements](https://grapheneos.org/faq#device-support).
+
+### DivestOS
+
+!!! recommendation
+
+ { align=right }
+
+ **DivestOS** is a soft-fork of [LineageOS](https://lineageos.org/).
+ DivestOS inherits many [supported devices](https://divestos.org/index.php?page=devices&base=LineageOS) from LineageOS. It has signed builds, making it possible to have [verified boot](https://source.android.com/security/verifiedboot) on some non-Pixel devices.
+
+ [:octicons-home-16: Homepage](https://divestos.org){ .md-button .md-button--primary }
+ [:simple-torbrowser:](http://divestoseb5nncsydt7zzf5hrfg44md4bxqjs5ifcv4t7gt7u6ohjyyd.onion){ .card-link title="Onion Service" }
+ [:octicons-eye-16:](https://divestos.org/index.php?page=privacy_policy){ .card-link title="Privacy Policy" }
+ [:octicons-info-16:](https://divestos.org/index.php?page=faq){ .card-link title=Documentation}
+ [:octicons-code-16:](https://github.com/divested-mobile){ .card-link title="Source Code" }
+ [:octicons-heart-16:](https://divested.dev/index.php?page=donate){ .card-link title=Contribute }
+
+DivestOS has automated kernel vulnerability ([CVE](https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) [patching](https://gitlab.com/divested-mobile/cve_checker), fewer proprietary blobs, and a custom [hosts](https://divested.dev/index.php?page=dnsbl) file. Its hardened WebView, [Mulch](https://gitlab.com/divested-mobile/mulch), enables [CFI](https://en.wikipedia.org/wiki/Control-flow_integrity) for all architectures and [network state partitioning](https://developer.mozilla.org/en-US/docs/Web/Privacy/State_Partitioning), and receives out-of-band updates. DivestOS also includes kernel patches from GrapheneOS and enables all available kernel security features via [defconfig hardening](https://github.com/Divested-Mobile/DivestOS-Build/blob/master/Scripts/Common/Functions.sh#L758). All kernels newer than version 3.4 include full page [sanitization](https://lwn.net/Articles/334747/) and all ~22 Clang-compiled kernels have [`-ftrivial-auto-var-init=zero`](https://reviews.llvm.org/D54604?id=174471) enabled.
+
+DivestOS implements some system hardening patches originally developed for GrapheneOS. DivestOS 16.0 and higher implements GrapheneOS's [`INTERNET`](https://developer.android.com/training/basics/network-ops/connecting) and SENSORS permission toggle, [hardened memory allocator](https://github.com/GrapheneOS/hardened_malloc), [exec-spawning](https://blog.privacyguides.org/2022/04/21/grapheneos-or-calyxos/#additional-hardening), [JNI](https://en.wikipedia.org/wiki/Java_Native_Interface) [constification](https://en.wikipedia.org/wiki/Const_(computer_programming)), and partial [bionic](https://en.wikipedia.org/wiki/Bionic_(software)) hardening patchsets. 17.1 and higher features GrapheneOS's per-network full [MAC randomization](https://en.wikipedia.org/wiki/MAC_address#Randomization) option, [`ptrace_scope`](https://www.kernel.org/doc/html/latest/admin-guide/LSM/Yama.html) control, and automatic reboot/Wi-Fi/Bluetooth [timeout options](https://grapheneos.org/features).
+
+DivestOS uses F-Droid as its default app store. Normally, we would recommend avoiding F-Droid due to its numerous [security issues](#f-droid). However, doing so on DivestOS isn't viable; the developers update their apps via their own F-Droid repositories ([DivestOS Official](https://divestos.org/fdroid/official/?fingerprint=E4BE8D6ABFA4D9D4FEEF03CDDA7FF62A73FD64B75566F6DD4E5E577550BE8467) and [DivestOS WebView](https://divestos.org/fdroid/webview/?fingerprint=FB426DA1750A53D7724C8A582B4D34174E64A84B38940E5D5A802E1DFF9A40D2)). We recommend disabling the official F-Droid app and using [Neo Store](https://github.com/NeoApplications/Neo-Store/) with the DivestOS repositories enabled to keep those components up to date. For other apps, our recommended methods of obtaining them still apply.
+
+!!! warning
+
+ DivestOS firmware update [status](https://gitlab.com/divested-mobile/firmware-empty/-/blob/master/STATUS) and quality control varies across the devices it supports. We still recommend GrapheneOS depending on your device's compatibility. For other devices, DivestOS is a good alternative.
+
+ Not all of the supported devices have verified boot, and some perform it better than others.
+
+## Android Devices
+
+When purchasing a device, we recommend getting one as new as possible. The software and firmware of mobile devices are only supported for a limited time, so buying new extends that lifespan as much as possible.
+
+Avoid buying phones from mobile network operators. These often have a **locked bootloader** and do not support [OEM unlocking](https://source.android.com/devices/bootloader/locking_unlocking). These phone variants will prevent you from installing any kind of alternative Android distribution.
+
+Be very **careful** about buying second hand phones from online marketplaces. Always check the reputation of the seller. If the device is stolen, there's a possibility of [IMEI blacklisting](https://www.gsma.com/security/resources/imei-blacklisting/). There is also a risk involved with you being associated with the activity of the previous owner.
+
+A few more tips regarding Android devices and operating system compatibility:
+
+- Do not buy devices that have reached or are near their end-of-life, additional firmware updates must be provided by the manufacturer.
+- Do not buy preloaded LineageOS or /e/ OS phones or any Android phones without proper [Verified Boot](https://source.android.com/security/verifiedboot) support and firmware updates. These devices also have no way for you to check whether they've been tampered with.
+- In short, if a device or Android distribution is not listed here, there is probably a good reason. Check out our [forum](https://discuss.privacyguides.net/) to find details!
+
+### Google Pixel
+
+Google Pixel phones are the **only** devices we recommend for purchase. Pixel phones have stronger hardware security than any other Android devices currently on the market, due to proper AVB support for third-party operating systems and Google's custom [Titan](https://security.googleblog.com/2021/10/pixel-6-setting-new-standard-for-mobile.html) security chips acting as the Secure Element.
+
+!!! recommendation
+
+ { align=right }
+
+ **Google Pixel** devices are known to have good security and properly support [Verified Boot](https://source.android.com/security/verifiedboot), even when installing custom operating systems.
+
+ Beginning with the **Pixel 6** and **6 Pro**, Pixel devices receive a minimum of 5 years of guaranteed security updates, ensuring a much longer lifespan compared to the 2-4 years competing OEMs typically offer.
+
+ [:material-shopping: Store](https://store.google.com/category/phones){ .md-button .md-button--primary }
+
+Secure Elements like the Titan M2 are more limited than the processor's Trusted Execution Environment used by most other phones as they are only used for secrets storage, hardware attestation, and rate limiting, not for running "trusted" programs. Phones without a Secure Element have to use the TEE for *all* of those functions, resulting in a larger attack surface.
+
+Google Pixel phones use a TEE OS called Trusty which is [open-source](https://source.android.com/security/trusty#whyTrusty), unlike many other phones.
+
+The installation of GrapheneOS on a Pixel phone is easy with their [web installer](https://grapheneos.org/install/web). If you don't feel comfortable doing it yourself and are willing to spend a bit of extra money, check out the [NitroPhone](https://shop.nitrokey.com/shop) as they come preloaded with GrapheneOS from the reputable [Nitrokey](https://www.nitrokey.com/about) company.
+
+A few more tips for purchasing a Google Pixel:
+
+- If you're after a bargain on a Pixel device, we suggest buying an "**a**" model, just after the next flagship is released. Discounts are usually available because Google will be trying to clear their stock.
+- Consider price beating options and specials offered at physical stores.
+- Look at online community bargain sites in your country. These can alert you to good sales.
+- Google provides a list showing the [support cycle](https://support.google.com/nexus/answer/4457705) for each one of their devices. The price per day for a device can be calculated as: $\text{Cost} \over \text {EOL Date}-\text{Current Date}$, meaning that the longer use of the device the lower cost per day.
+
+## General Apps
+
+We recommend a wide variety of Android apps throughout this site. The apps listed here are Android-exclusive and specifically enhance or replace key system functionality.
+
+### Shelter
+
+!!! recommendation
+
+ { align=right }
+
+ **Shelter** is an app that helps you leverage Android's Work Profile functionality to isolate or duplicate apps on your device.
+
+ Shelter supports blocking contact search cross profiles and sharing files across profiles via the default file manager ([DocumentsUI](https://source.android.com/devices/architecture/modular-system/documentsui)).
+
+ [:octicons-repo-16: Repository](https://gitea.angry.im/PeterCxy/Shelter#shelter){ .md-button .md-button--primary }
+ [:octicons-code-16:](https://gitea.angry.im/PeterCxy/Shelter){ .card-link title="Source Code" }
+ [:octicons-heart-16:](https://www.patreon.com/PeterCxy){ .card-link title=Contribute }
+
+ ??? downloads
+
+ - [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=net.typeblog.shelter)
+
+!!! warning
+
+ Shelter is recommended over [Insular](https://secure-system.gitlab.io/Insular/) and [Island](https://github.com/oasisfeng/island) as it supports [contact search blocking](https://secure-system.gitlab.io/Insular/faq.html).
+
+ When using Shelter, you are placing complete trust in its developer, as Shelter acts as a [Device Admin](https://developer.android.com/guide/topics/admin/device-admin) to create the Work Profile, and it has extensive access to the data stored within the Work Profile.
+
+### Auditor
+
+!!! recommendation
+
+ { align=right }
+ { align=right }
+
+ **Auditor** is an app which leverages hardware security features to provide device integrity monitoring for [supported devices](https://attestation.app/about#device-support). Currently, it only works with GrapheneOS and the device's stock operating system.
+
+ [:octicons-home-16: Homepage](https://attestation.app){ .md-button .md-button--primary }
+ [:octicons-eye-16:](https://attestation.app/privacy-policy){ .card-link title="Privacy Policy" }
+ [:octicons-info-16:](https://attestation.app/about){ .card-link title=Documentation}
+ [:octicons-code-16:](https://attestation.app/source){ .card-link title="Source Code" }
+ [:octicons-heart-16:](https://attestation.app/donate){ .card-link title=Contribute }
+
+ ??? downloads
+
+ - [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=app.attestation.auditor.play)
+ - [:simple-github: GitHub](https://github.com/GrapheneOS/Auditor/releases)
+ - [:material-cube-outline: GrapheneOS App Store](https://github.com/GrapheneOS/Apps/releases)
+
+Auditor performs attestation and intrusion detection by:
+
+- Using a [Trust On First Use (TOFU)](https://en.wikipedia.org/wiki/Trust_on_first_use) model between an *auditor* and *auditee*, the pair establish a private key in the [hardware-backed keystore](https://source.android.com/security/keystore/) of the *Auditor*.
+- The *auditor* can either be another instance of the Auditor app or the [Remote Attestation Service](https://attestation.app).
+- The *auditor* records the current state and configuration of the *auditee*.
+- Should tampering with the operating system of the *auditee* happen after the pairing is complete, the auditor will be aware of the change in the device state and configurations.
+- You will be alerted to the change.
+
+No personally identifiable information is submitted to the attestation service. We recommend that you sign up with an anonymous account and enable remote attestation for continuous monitoring.
+
+If your [threat model](basics/threat-modeling.md) requires privacy, you could consider using [Orbot](tor.md#orbot) or a VPN to hide your IP address from the attestation service. To make sure that your hardware and operating system is genuine, [perform local attestation](https://grapheneos.org/install/web#verifying-installation) immediately after the device has been installed and prior to any internet connection.
+
+### Secure Camera
+
+!!! recommendation
+
+ { align=right }
+ { align=right }
+
+ **Secure Camera** is a camera app focused on privacy and security which can capture images, videos and QR codes. CameraX vendor extensions (Portrait, HDR, Night Sight, Face Retouch, and Auto) are also supported on available devices.
+
+ [:octicons-repo-16: Repository](https://github.com/GrapheneOS/Camera){ .md-button .md-button--primary }
+ [:octicons-info-16:](https://grapheneos.org/usage#camera){ .card-link title=Documentation}
+ [:octicons-code-16:](https://github.com/GrapheneOS/Camera){ .card-link title="Source Code" }
+ [:octicons-heart-16:](https://grapheneos.org/donate){ .card-link title=Contribute }
+
+ ??? downloads
+
+ - [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=app.grapheneos.camera.play)
+ - [:simple-github: GitHub](https://github.com/GrapheneOS/Camera/releases)
+ - [:material-cube-outline: GrapheneOS App Store](https://github.com/GrapheneOS/Apps/releases)
+
+Main privacy features include:
+
+- Auto removal of [Exif](https://en.wikipedia.org/wiki/Exif) metadata (enabled by default)
+- Use of the new [Media](https://developer.android.com/training/data-storage/shared/media) API, therefore [storage permissions](https://developer.android.com/training/data-storage) are not required
+- Microphone permission not required unless you want to record sound
+
+!!! note
+
+ Metadata is not currently deleted from video files but that is planned.
+
+ The image orientation metadata is not deleted. If you enable location (in Secure Camera) that **won't** be deleted either. If you want to delete that later you will need to use an external app such as [ExifEraser](data-redaction.md#exiferaser).
+
+### Secure PDF Viewer
+
+!!! recommendation
+
+ { align=right }
+ { align=right }
+
+ **Secure PDF Viewer** is a PDF viewer based on [pdf.js](https://en.wikipedia.org/wiki/PDF.js) that doesn't require any permissions. The PDF is fed into a [sandboxed](https://en.wikipedia.org/wiki/Sandbox_(software_development)) [webview](https://developer.android.com/guide/webapps/webview). This means that it doesn't require permission directly to access content or files.
+
+ [Content-Security-Policy](https://en.wikipedia.org/wiki/Content_Security_Policy) is used to enforce that the JavaScript and styling properties within the WebView are entirely static content.
+
+ [:octicons-repo-16: Repository](https://github.com/GrapheneOS/PdfViewer){ .md-button .md-button--primary }
+ [:octicons-code-16:](https://github.com/GrapheneOS/PdfViewer){ .card-link title="Source Code" }
+ [:octicons-heart-16:](https://grapheneos.org/donate){ .card-link title=Contribute }
+
+ ??? downloads
+
+ - [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=app.grapheneos.pdfviewer.play)
+ - [:simple-github: GitHub](https://github.com/GrapheneOS/PdfViewer/releases)
+ - [:material-cube-outline: GrapheneOS App Store](https://github.com/GrapheneOS/Apps/releases)
+
+## Obtaining Applications
+
+### GrapheneOS App Store
+
+GrapheneOS's app store is available on [GitHub](https://github.com/GrapheneOS/Apps/releases). It supports Android 12 and above and is capable of updating itself. The app store has standalone applications built by the GrapheneOS project such as the [Auditor](https://attestation.app/), [Camera](https://github.com/GrapheneOS/Camera), and [PDF Viewer](https://github.com/GrapheneOS/PdfViewer). If you are looking for these applications, we highly recommend that you get them from GrapheneOS's app store instead of the Play Store, as the apps on their store are signed by the GrapheneOS's project own signature that Google does not have access to.
+
+### Aurora Store
+
+The Google Play Store requires a Google account to login which is not great for privacy. You can get around this by using an alternative client, such as Aurora Store.
+
+!!! recommendation
+
+ { align=right }
+
+ **Aurora Store** is a Google Play Store client which does not require a Google Account, Google Play Services, or microG to download apps.
+
+ [:octicons-home-16: Homepage](https://auroraoss.com/){ .md-button .md-button--primary }
+ [:octicons-code-16:](https://gitlab.com/AuroraOSS/AuroraStore){ .card-link title="Source Code" }
+
+ ??? downloads
+
+ - [:simple-gitlab: GitLab](https://gitlab.com/AuroraOSS/AuroraStore/-/releases)
+
+Aurora Store does not allow you to download paid apps with their anonymous account feature. You can optionally log in with your Google account with Aurora Store to download apps you have purchased, which does give access to the list of apps you've installed to Google, however you still benefit from not requiring the full Google Play client and Google Play Services or microG on your device.
+
+### Manually with RSS Notifications
+
+For apps that are released on platforms like GitHub and GitLab, you may be able to add an RSS feed to your [news aggregator](/news-aggregators) that will help you keep track of new releases.
+
+   
+
+#### GitHub
+
+On GitHub, using [Secure Camera](#secure-camera) as an example, you would navigate to its [releases page](https://github.com/GrapheneOS/Camera/releases) and append `.atom` to the URL:
+
+`https://github.com/GrapheneOS/Camera/releases.atom`
+
+#### GitLab
+
+On GitLab, using [Aurora Store](#aurora-store) as an example, you would navigate to its [project repository](https://gitlab.com/AuroraOSS/AuroraStore) and append `/-/tags?format=atom` to the URL:
+
+`https://gitlab.com/AuroraOSS/AuroraStore/-/tags?format=atom`
+
+#### Verifying APK Fingerprints
+
+If you download APK files to install manually, you can verify their signature with the [`apksigner`](https://developer.android.com/studio/command-line/apksigner) tool, which is a part of Android [build-tools](https://developer.android.com/studio/releases/build-tools).
+
+1. Install [Java JDK](https://www.oracle.com/java/technologies/downloads/).
+
+2. Download the [Android Studio command line tools](https://developer.android.com/studio#command-tools).
+
+3. Extract the downloaded archive:
+
+ ```bash
+ unzip commandlinetools-*.zip
+ cd cmdline-tools
+ ./bin/sdkmanager --sdk_root=./ "build-tools;29.0.3"
+ ```
+
+4. Run the signature verification command:
+
+ ```bash
+ ./build-tools/29.0.3/apksigner verify --print-certs ../Camera-37.apk
+ ```
+
+5. The resulting hashes can then be compared with another source. Some developers such as Signal [show the fingerprints](https://signal.org/android/apk/) on their website.
+
+ ```bash
+ Signer #1 certificate DN: CN=GrapheneOS
+ Signer #1 certificate SHA-256 digest: 6436b155b917c2f9a9ed1d15c4993a5968ffabc94947c13f2aeee14b7b27ed59
+ Signer #1 certificate SHA-1 digest: 23e108677a2e1b1d6e6b056f3bb951df7ad5570c
+ Signer #1 certificate MD5 digest: dbbcd0cac71bd6fa2102a0297c6e0dd3
+ ```
+
+### F-Droid
+
+{ align=right width=120px }
+
+==We do **not** currently recommend F-Droid as a way to obtain apps.== F-Droid is often recommended as an alternative to Google Play, particularly in the privacy community. The option to add third-party repositories and not be confined to Google's walled garden has led to its popularity. F-Droid additionally has [reproducible builds](https://f-droid.org/en/docs/Reproducible_Builds/) for some applications and is dedicated to free and open-source software. However, there are [notable problems](https://privsec.dev/posts/android/f-droid-security-issues/) with the official F-Droid client, their quality control, and how they build, sign, and deliver packages.
+
+Due to their process of building apps, apps in the official F-Droid repository often fall behind on updates. F-Droid maintainers also reuse package IDs while signing apps with their own keys, which is not ideal as it gives the F-Droid team ultimate trust.
+
+Other popular third-party repositories such as [IzzyOnDroid](https://apt.izzysoft.de/fdroid/) alleviate some of these concerns. The IzzyOnDroid repository pulls builds directly from GitHub and is the next best thing to the developers' own repositories. However, it is not something that we can recommend, as apps are typically [removed](https://github.com/vfsfitvnm/ViMusic/issues/240#issuecomment-1225564446) from that respository when they make it to the main F-Droid repository. While that makes sense (since the goal of that particular repository is to host apps before they're accepted into the main F-Droid repository), it can leave you with installed apps which no longer receive updates.
+
+That said, the [F-Droid](https://f-droid.org/en/packages/) and [IzzyOnDroid](https://apt.izzysoft.de/fdroid/) repositories are home to countless apps, so they can be a useful tool to search for and discover open-source apps that you can then download through Play Store, Aurora Store, or by getting the APK directly from the developer. It is important to keep in mind that some apps in these repositories have not been updated in years and may rely on unsupported libraries, among other things, posing a potential security risk. You should use your best judgement when looking for new apps via this method.
+
+!!! note
+
+ In some rare cases, the developer of an app will only distribute it through F-Droid ([Gadgetbridge](https://gadgetbridge.org/) is one example of this). If you really need an app like that, we recommend using [Neo Store](https://github.com/NeoApplications/Neo-Store/) instead of the official F-Droid app to obtain it.
+
+## Criteria
+
+**Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you.
+
+!!! example "This section is new"
+
+ We are working on establishing defined criteria for every section of our site, and this may be subject to change. If you have any questions about our criteria, please [ask on our forum](https://discuss.privacyguides.net/latest) and don't assume we didn't consider something when making our recommendations if it is not listed here. There are many factors considered and discussed when we recommend a project, and documenting every single one is a work-in-progress.
+
+### Operating Systems
+
+- Must be open-source software.
+- Must support bootloader locking with custom AVB key support.
+- Must receive major Android updates within 0-1 months of release.
+- Must receive Android feature updates (minor version) within 0-14 days of release.
+- Must receive regular security patches within 0-5 days of release.
+- Must **not** be "rooted" out of the box.
+- Must **not** enable Google Play Services by default.
+- Must **not** require system modification to support Google Play Services.
+
+### Devices
+
+- Must support at least one of our recommended custom operating systems.
+- Must be currently sold new in stores.
+- Must receive a minimum of 5 years of security updates.
+- Must have dedicated secure element hardware.
+
+### Applications
+
+- Applications on this page must not be applicable to any other software category on the site.
+- General applications should extend or replace core system functionality.
+- Applications should receive regular updates and maintenance.
+
+--8<-- "includes/abbreviations.ar.txt"
diff --git a/i18n/ar/assets/img/account-deletion/exposed_passwords.png b/i18n/ar/assets/img/account-deletion/exposed_passwords.png
new file mode 100644
index 0000000000000000000000000000000000000000..5295c902cdff975b9360a77e1dc5e04e9dfd6c70
GIT binary patch
literal 27902
zcmZ^}1yox>^EMv5Xp!PtBv=axF2#yNiWjH26)j$*1a}RR;7}Y|q!cN|-L<$CcT$S$
zm%i`slXL#(f6v3--Pye}JM+wL!sbS4s3{WS(cl39077LYIV}JH69NFBe|&<0l7uwA
ztwc4>G$1B#*u3%v?J#lcgL%D=TK-w&b1@g`cXDeb{?;g
zk0>+$l>HMRQG&Z6xOcBQJA~xpS$Xrx#&h=?y4Py@v9$W=Z)iMjpNA1@vG{7
zWNAAR-iS=BMn+a6p{2;kQlu+<*C%fmnzw6~xN8UBwM*P}&D&Liu4$kUxvP&t;x47h
z5|!~1mDw7T*&2u48pw4`+GkA!1ylvP#$>ma*N)6dQmT2{p6o>c&RYWZV1u`^U$}Q3a}o
z5}?GWj?(HzlynZo>)P%bieMDW$g5rC;~I(u6tCms$nkz;KML*0_C{oTJF>AFS&c#|
zvNUfu55Ak1hx}J2?!psy6C-yMp}UbN`0PSaaNYHBUGuS9b49^yO-W=;LwZeLY0XSy
z%}#&K&TP$0e@$O{O+#b}BC@P1Iu{8Y&&wNcY+UQlTkD6fwI{B%N3JzO*BT?|8liKI
zK6BMRbES6UdHUm}W^>hcbJebGpD5a)RPFytruImV{(k`VC!!$I50~ywlpcqppfsMR
zvD=@wJB~u>T00zBowo~*M1=;9q70q~hr<)$a40m=2MTqC&$UM~u`;Tg0s!_s%5pL~
zK4^#2!e~%wVnDTfS8sfz%fkq0>fjyXM)ZyJqszp>aTZ^(!YxEBWVZOiNNsnM`g@(g35tV7OUI
z1RS$tb6WRKR-A8x81@t|IB&l9kJRgzbeeRu50A0RvZ9h|qCfQ*z92Pc>J^WwKuSTDdIdvX?bRp$Eqzx#_mM4(FDT;j8`#
z^%NQA45ge9l}C-EynQ-?m&=Rm`4z~O5{jsa=;o~kzGN;?fs&NqbpqENXL3qJOO
zmpOWxecs4gxpGEnPCPbawCYs8Uqp&qnpk7+vP|^>=NCJNZi2mqcaq}G`+r`sT)A32
zk1D0Avcs)j$UUIgot7XeD$P7K-2KjYVZ)dgbb7G!Wqn0lP)il6DJ+?{`x(HhnMQ=
z1S^9BZQ-v~q;kNg@8-QE-+?BlRZ&@*_|i0HvAADOj$_y2@oenx`K^0#v4UbH;<9}k
zz#^r}@#-{WX`B?{VOT~6w$qk!i%x#r
zc6m=~0{~^ZEM!h@wf<%N@7J)emt?4vk$CpiIdtoL|FMsnvhIdQuyl6_9s{iy#}L!l
zAA3s+SR6+cz;7T=5CRBzF(D$^0Ex%tO6XxU{Na;i(9pP
zSlRP|eEFFDftu{lqLUoA#tM)P>=8jQDfvroTh|^gygqO{@U{tNG_wut?pBy+6}LyP2J}znEm|M
zT`TUp10WP_eOC4~Hiw(j>sGL4H`%7XmFC8cF2?tBDXhgHZY
zudp&Gc2Y|fi%O;9i%(=!aszoz`o2J>wwGS=ySGEfVBoA(`L&T`dvfXo;Tp3w?^yG5
zAZ_iukeHBW=AAG1j1Rm&jB(nsaeWHT;c1jg>*4j*&fs7A#cZ5UIZ1WE8&@qShYOV2
zo{=#X5zX~j$>JYc*I{b#7XBP1AGbqT4S|8XS>wESV;MtKrCEtT=q=En=|I1vT#rO!7QCaUp1@l$TaWrBpx(S-X4OUR;{Vb#l
zH-ikWS|(p@(YVwVpqr*@61pokh%_W!iq
z*eNk9VGMpn{on!k*(#A`!Tq{zNCQ|)_^NiH>DfSmEHOk{g7RaCj04A(eJ^IiPMbw-
z(t{{B31&yPD=@6S>Fp+-Spita>wy^dt7kl!JeUcd<7=HVRc{6n2I^W=-3X)tAoElwLU9&5B2u?V_BfOfuj
zao1#^$=8i7Y{Xi){h0q}vu)%e`=1^7{|KL7^~MB_tT*zQ1*t+qTtTsR}FdMX(;EUqOkB)GUQQvUd*4ZJAb
zZVS-+?M@47EKE{+;<$fnZ?<>Im;YHxF<--K(z5Sf4537HvHieql?;n8*V5s*(~5@t
zBtNT4iQ*55YtMTKg)D*Q0CW4zvVL68S|LdTcSDTs7j&xa=j#1($qf&;uuNuHTQoC_
znaq&*5f1sp^sz@C7*Q#qK?>9=!f=t(F$svSAF^UV
z$MLIJWz`dHf+W}k$RQ&7KWVe-WN+*`e|$#x9oSoB$trfk7xp?yxi~tD>*tmR8v?#o
z|A!_?@B`M<7OVt&SM`wRk^U+2AXzzHHgTqmmCv`*!05;qKPQN4L~-6TJG#6gNQ!{l
z0J^PcybA`m`#+4VR7i*mlL(^a3kQjFdS?UYBQNL?)y#-v-yyhL3irVuo8R61PSBG#
zONtX;hi8Nvh(0XVhqXdbA+F``BIRUfTVg)Q9|))Z{hry7rNn~BEpA3-|FS%ii~YQ5
zOC<}L1F;b)n+Fb+iQ`PdSxsdKIyk2g6}Hdij6~Wl7JIuH73zN4!J_uDPRnBc^U~8^FgyXwGQ$k(
zR8Nd@N1JH6E(oH6%9!wwvG^*K=JMH7OXl6mRfuwjEXwXMr9~#x&I08~TUex1y@
zxmeLL_(av-7IeLADfrb_ovQ@g
zG~0VYh8_tt=HyqRt{6ZQN-gMhT`sd)=u_=N&{}w#&WO{|qqA+JA=kqRSw`kcEfk;W
zZ>3jL_sU?n-8TvtJE1MjR>7JB456(y^_D4wMnClEGjscOthBD8`1Z`Eq`Qo5Tqk=&
zuTlmuSGmp+sBja5v;AW5lI$csfMdVRk=eV^NjXdTZLF{iOPH;Q7&hrXPjtNQS>eQB
zOp3xy=&`45ZH^eM%bj?HqUK|&f07<|#IY<$pC~&@+zW_W!?`bE3}OvT$9$b9Rodkd
zkZHj2qB<)qO_t1!tv-^q(zS0gq14VcTwT6$Z{WtY|1=+R3>vF0kwyRu)C|zWn4;mp
zrTDLQzvKCuB))oITS=ijy1cIM@JJru=|uZ$X%lZ?b$Y=k!{qz=6-maBz!1eOx&S_Ky
z(G$AUAi6;eZ*f+JhjVbZ^*!~xi{R7r)7cmeN|OZPd{ZZEmeox{fR0wTv#ejA3l{o(
zKjfcxwDK}JS39MyDG=z9kN2u%Rrv--DY{-6Y7m7yRp_hf-&Ew})BL>ASN#3D+WzH-
zOed>A?c7u0FW*6|cL^rVLi$)w&_Ruj9?{+EL{8{0Q>btQ(|c^S&JJZ6=fKLG?W=n|
ztXPpza3~yAFaa%?fv9^VZX|A^D&!Q+0{y>TxTqVzBKavXjOSHhBNKQ4$0JjH?GB9g
z0~=Sw78`dIArtIwlL&sd`%rbWfhwG(%nCi9yNx>!kA^TkoLQYK+a7PtqRDB8lg3_hC
zQ1ThfHbJ?~3yB09w35Sm&lD`ROt*Wj5OlELMqq>JfvLViO2uYUO+;nEi^qh%p{avm
z53x#l$05g?64G<2Z+~)3{`S{o>scV#l`h`V_hQrOh{d?REA4w4h>!W=Z0H(0&N-JW
zRq0)fh~p)mj<#X^Gr%O!iiz#Tv`ccap
zYq{RWZFKY_f>-YH<*8_;Djhd~wI+1ru;{t#r~@PcOgeLz=2CQ9
zz%(U713EeLO^PxkpeD9DFJ~{6$^%}1wQ@)usLcQI2jeJY>F2}+=w;Btd$<_m4chwe
zPTZ-D3hRiX^IshNnkNQL%hQGiN9CF3Vb)DZPM^g9i7L>D1Cl0xAP-Hz-SlI|^Q+de
z+(3q1Y}W|yqrCZmgS$QF5KBa!ebb>^$#UbE2ex4mzn+0RIUZaDa(TEdZ
z6@S#Zapa@;vh`aat&6w8OE!%!%IwaDs{9iXkN|RL)^;)UF0OFuN^D#KKA1kqVH(2m
zTVH^}n7x|EDsyfwb_N`^j
z?|^fr4qUXV)p{-H6p$GuIm{J|`D9>2o4AWWHw2RgF#vOM5`yt#yXN96rS7)MJtV7y
zvVuuzgpQW2l*2fBbn0_cj1B{gehB5`o-b3c
z0=e9{D?A0Kdl#1R->5!rz7aipAG&}>XeX9;C?Cw
zrFZO=i+8H-RN{qD&S@ibjs5G$N7hRD^-8et@%1EUwXJzAX}P_FJ@5upq5q^>J<=Sz
zLI#~MT2#8t#y{i;dP}J&>K%y5@J-IfU(Uu2WcH{E?^k(#d!nyt32w~g}1ZwK)NIde)HYU
zJjwqHGjEtI)*_!^dj2=a6JK}@A3ZxaWH1X%Z
z)@54pmTM?y;%3vC(q)?cTKcptb3l^M`Mz
z6t&XXX8I!&RRe7nqnhy=&Da7j*CxYe5U+G{*QC%cB5ii8-t}z{td^RB`!J@k36`4!
z=-i_C(Q`QMZtAA9t=B;Qq%LH@WY
zPV$;5&Pg<273ZH`VySL)!LtG9L@oHT<^5lN?Jd{0*AuwD;K!WeHG3+}B0w#`B-JV~
zbW{;?H|{MNi!rx-EShZVt`m9z2qSgLOI_&N+!ZyRTz8K|C1Sija7EU
zkKCQPjhicGq(vDFE8y3t
z>oA@y?N4C?O@(Fg87bs*@0W>tTMOx1gp@xwz#)ZhxHJ7{2R}3ABjc&?2$a8Mb2A4f>v!5*7<9dA
z8~S0BSHOB<>|RTlq+w8wVXpF}JtgAb;-+4rd{1iy)UeaH7&l*7zqN9@#K=_MLJOux
zo=Gpy7rhX6RPU-5e))Zv75_r5RTiVYk&|ve@F!%%diTZTW8mZcrAOYm)Pp$B-nrlX
zJ3}eAVVN=aRgCKRK{q2Qlf!$D0yvB|X0zFdX*Q=!0LJ$(nIMmCBb%2uEuU!k%chQq
z4w_tcn$--x#&18Fcy&!#z5O@Dl-0DiQLi;eI7}9yjK~-oHz0V<$c(O(_PSz6@jnWEGKhOt;$>*NXjH!BWyIKdTa33dLg7|60*5Q>fz}DXtKwM
zN^Dj9bI9k$5O+An|?dI}th8FQ7~
z;uYAh`IUK{naPVBio#34`FPo=Po;u#Z#tM2Gfu>E`fvT-H?&Fw!~o!t&bHb!WowqC
zxH)AtrPYgPVU|%(i+Qq^IJHyJtWpH7?SseGaObkn1lY-5MW18an9Lgp-h`{1$rl!Q
zNW3Z%0P5sdfj2*Y12@6@JLK`^4+X^>Nmz@yyzj-wJPP<6UT8;(0zYK8UNmt)BXl-ox+yvI}H7-+GSaiH|Hol>3oEm_|5y*-3OX@|<~S26hcD7CRM
z-tBJCQe8{Tb3m5;3zSlq$FycV~*!NP`w)=t(#`d+&JWw1Mvk2y_>J800)e#y!pSAB=L`*$Cdu}?p<7zf!?bM>{i{2^=(b|Ju&CywSQTa2n_ev|JVkN
zQ|3#W>hjt5icHGfh7-pP+Ovyk3KWR~t)fJMp&4kW9mW5dr?i?fEEjl1kVE`fc2L#Z
zjq?00`_`<;##cfx
zLoE?Yty_MDU){oJsMPl;)bbrg6*Oe@Whs;H#Vo1+x6q=2X%?pB@S}QqttQE-CavO9
z4t~tMQ~_0T#SM(3yr2^S=EFn3aGR6I^|BVH^kSNSbN^)GWc&@MbKCfKWGj88VJZgk
z3HfD}d0P#jQS~HmHv6&zdTuHKMA`m9ud?H(;}kZY9rX6ue8bx&m*^Nos}aULoK6DG
zqmKMZ<>NkBQ^j(UqWu)V{Q~|_;yVEy!>;K4~8z@^g5j)^DTbD`Netr6@TGsK%
z;bGh`fJYiY&pyjQs2|wRV!E=jB9)VW+0a1AA(+N17VP(f#nkrOSc2`YyO3X))}sLp
zY~JzW58eGEDMt}_0&WNS$6o;|Dwsj2y$-eO+5g+4ma_jfqW*QEm?w*iLQz-o(D#-8
zP^kQyIbERe>UXog4r{Q|GuJ2aQ{!iTr|7KoHav-EeCpDyPPY7?M}cB}kA$SY(_892
zYU)?_x4c%R9i}B+w>{lEf8oPTN-8baED+KktgYe7uUXTu9uGi&u3rJ&9kiOF{z`Sp
zISSF<%0oh5GV@(&J-v*L8ruO=izh$C*SvehN#Y5pB)zfr<-ry=U+2h`SyS!bB_A>P
zn`X@65oTZhLSx4^AJ43c_bK)vQ}SInE`Qt04jayunFgm!Os%%cy~uF6xM(jCHZ4~6
zyo6lYfje33kI&G>*}`-E6W~{`fRDFN&x{~5o1kAXu3={M91icj0$Jr%p(a{zncN`%
z6Q@NXGS>U`)CK{^Wzh7TmLnOLd6^HNc-{I0^+JBZxXn5X@HgNXKYen@GZS-5s6s(D
z%lJ@pJW9675T{&$5i{y{FoRRwlL^i3XgUU%`0&mnKlM;)i$$%i8YKZec-D%T=v514
z2~)XL7NYyJFg2pfTs5tU73T}p6LNz4Ttre#hJoVl-ji-&$ik=wcI))y{*Sm(_EuK@
zvl=0#XX0E4dZ&r0ZCA7N-csvG32GZ3$T2v#&+0`$-==utlsAPyT8$ETMpYsM6tb38
z0eq_?VR72IG+~obQ1Zhh`IAMrz(u&r&KOR$oPEf`uDdk$UoT$HGB_F5_lH02GGh*6
z@k>-^(}15!XmZa*p1+-DfcXuh2;x6;>%rs){y8YR2*gQ;>suget4umKo0P@s70)FMs
z0IP{ExZwx-mVR_Bqk_j)TS-}JC6ez&4n)r
zIUEN8awrQDOF3ZHIFB93m^5L2eRw+=KsG{evHtfXq`2`(7{M|jSsno;pJb3;*ZPsY
z@2ZMP+oN3^%X|S*gpF$E_4`I+HN8$Fw%|T8Bwf^=*L;q=;X|-;Ntjzwlk*7EXn;h9
z4Vo;rbfyXkBiK^wk`MGTQf=su%gTQ|*>qW)d|W?qm2A^{q8%5j>XCgYN^K|-TI
znkw)oWJRb72~Y(NAH_orTDgiHYMc4{xD;i~kKU+%M@Z(qem(UwJayp(aMaM@DsW?8
z&a~-9n>ixzt)OCSi1A+p0h
zoQU`V^}-%yDgL(MTX?kGuWImVDd5Nb7+Z6K^+y>ear4e;8p>m(W%79PVRIqQ7x1rY
zqi5{>*?t@aJ&+l?a#K+L>OMQ!@zCYTpx%VU`(|7ivIt%6b{~(Erh39!uu&K89LlH`
z`({PBp{^kq_i`*D>V;-!q3bAhbv`)J5L&%vd&)CKE@f%4L4SmKtReiRjT+LpB$e8*
zGIfttRR1U#!R&)SPz4V?fzRcFf7h7?2W^|_>q1H!5~8$t(?Der8zfqF8Xi)u+m&#g
z%A##w%tcWu2?1OrH!u|y%0R+P!5Ma~SBBnSnZo9W%?-fHD>QDvE9xg91~gCmSk6p(
ztt65`n)`2_*6D^a!;fo!|*#1)JT<(sS*n5
z4FZ3g5~3vHa5Sc9V4O<0gX^EVR=k+cJnczl;~aJ@d?(9hJ)hQOApkH588I0c4Gbnl
zev@QD1EbvyDur#yEpBmh1{M>3!?rEJCSM6h;RxGd(#ds)3SIk`@Ruiozh{n
zm@F=0%0}4}oy{o3;-*0Von-zyu7sjaGm#Du;{PiDXQLYvECZ2-bYphQL1q@kg5XFO
zh?>!20snL0&$*_M<+@Z3f_AaTmS-VbkT0^#R?eQTch$Oy1t!
zh|uvHzV6U1EV4GeeL7BDSb}P2;ij-b?IFk@1^~w#X?15KRi_#gt*@gVCVPtB7uAnB
z_d$~qXWQ)_f}baP(~Bofe%yqf;Y&Sb5;b5w!sf=MsP9VlJp+K%MaXmcqX?%r=c%1<
z#yrDT)&pw*Bq%LoN@TXLFiY2oSrNIpRn(xBvO^zpmeqETVH^n#skQ>+;xJ<=a
z9Kw`?|3A7%4ji8M930qG+cHD{Y}OeVabyn+5CBs6A*r99x5u-Z(m?V&C5YdBVaLzg
zY&jI|C~9Ro(qaAF7jEhN8xgZX2dIB>;74y?)UlZ+v*PQkT1~m9KH1kz+h-7gTW|cF
z%{=*32JVkrGNqzhqD^&q3Bl}7brhDr2QvDHv8`e{Z#j)^)^x~;LEa@?WJ
z3RFcS`mW4FJ5(Khg>(R5qS*lWpShVG^>_DU`nomfW_xJuujqJqzkCU**}qC7=u0ok
zJJ(l|1nfOm7)ju!lU2_*-)7y2@IL
z*=KSH9XV!ApaMs?E+^jeZbR}ybWQv2AieIeLL)E-fl3&+CNN1!J|zlWzweh8P!yok
z0q~5NnBROyvaBLDizH?mD}XR3JuiR|eSxTPBk0y?HX2|5WvV&mQwI{JVEr1cfy|6L
zOFsUvxMo5K+&8act;pGZ`fJj!z^A*$_o$im&PGOZ)HLAh!*VB&d*kcubiU`h#%2o;
za~MfP<2t!0q8&Hm++y2$vPo^v|5BmEv60fK!2mmO=7UCaTl@6N*F&}eo20w=Ga-C-
zSWyOTKcgpjB;FLL`knE9Z_~%>bdrFZjM^B;JG6D}
zz5L>PT#guhHD)=g{-vWWqKMIP?T)UTDaRQgf)6W=@gs?7#keQS+pt_8@ep_^Bc}PP
z@dRVdS|Nq-WOU1yPJwnwK8qfI@wzpVr}ZbJwaeN8^Uq<4d#KA!HgjeZKy4jub@ic<
z*W+&?b}_e^U_OIFz6%p~(0ue!=wH_O6*NzwcxGGi`?TH$9+CSOqY`z|6ds{!DetJx
z2?2{e1D2kqS&3
z=Oyh4D`cNco0tZCcjvgZB2}*x2zL3#YE6
z`uE32QqTt}f8?jofzv-&m2;HU3xy!gmPgnr-_@RZ?T_%^nmf;;16>Q^IC&)i7nICP
zSz@O5<_B&GE`*umNU<-&TziXZkFU5c3P4HSWY15iT-^G+e)d6lr2cSSApLqB3GiSa
z^a_P>%qGy3hiosla!t@KWX*hHjcC~C=-cJORRLF2Xp4m>RDndbUc=YM6>nq|ce{@}
zJ$d{W`Hq?Hu@>A?#EWl&Q%xc|fAs%;$U2U*U6Bhv;&`0>^`ee`&E7sStvLEItUT?e
zHjO=?-I=JQ2N%;}**TzoeKr`9e#R4Owy6~%X!m+=q0uOgn$vf*VqV|8V4e$-6+sa^
z+(qb+h3vlrFVpvr(?AzQQ|_5gJUP5R8A|k5)*KHN2sL-w*@Cw_P1w)qda&bP61@Mzp6V6?|)SbaYB64KetJ}()r{CZ?x=Vb*4wXcOW83o)klb
z2jdbjTmRwNq{?*B@7+G$S;+XcoBJJOdm)#cm8c~x{+V-7reH`;B(#$itf2^~WY>@%
zJ2Eo21`?^QGc&s_J*va0N)L6)3BE8;#NUc(TIh8*leR~D_QpFKtWc5E)XH~ebntmS
znIWBRcO3A#!xO+?RKo|FNYAc*eFmJ)SMv3aYjX4WZ$@b;9!v-2Vfafak}==BnCvzV
z$1cYP9yyN8ji^J{FyXv=!$DGA^#pYamOD7}O6$QlzT+0lt6$|=Zwe6-xQ>&$jPG`%
z$Fo+Nukofwc(GtO&Y0;HIPf{fFPxAwMTa9`n6fBcz>~DosjkrVzcyUSx>Xn*Z7K|-
zoOrNix;5YBA4@#M0jw{B-Z4TiSA(|h06_1JK4q*$lJNismsas?2I{b=mmj0<-Swx$
z1ML~xR~0MW@)?XxOF|xlmBX`dzEeVC>dM~BC`M*q?JMu5;#a=}6sQ;tGf8~t9;7h%
znKa&FlF8jii|-ofZ2O*~zJ(A*?phOZj=Z@!RdQh?o$)kZuiDc2pLmQ@R|TyJR{xYI
zD~JtW1a5z(0}(=qYU!Wyp#`^9(mf7KLemK9X6oIUj4rOvd=G6hW34Sm$=Yb3uULAf-pcbb9YU2L<1`?G(
zduS4c4rnqZ^tDDF=+!lrJP9NkX
zshCf4?LMg?YpKy3a@2-aPf{dFt%S4b*84YKdAwY`bK?q(C8Pk7Nq-x^zy><_$qH+}
zY@IV7EY9N3r`jz0}S`KiXfG?jHpzZS7`@7}d343WfxM6!>b3oP&3!_KeK_mu;xnTn(1!`MG0RXkbo_I$-l0P`0
zWoRJ<@Ndz>CE9qI&0+LXk)acwSf`rYdTr1^Y7nobqLG|jD`8D-kyLhm6=c8eV&zmTcE;3*b9eIQHM7N}iX{(A
z&60gz7$v*<9tDcARu*Ww&P1sasl+Kn9
z&g@laFoM^u&!Vdt*5ZdUy=3&7&Pa6K>F*o=1uyckUHTmZO4?9n=?m~hTNF*q|6ZSs
zF@F-UF-pdLq&WoqdPF+tbJXaqzz^Fqn!P3?&y!sGl4Skd#!wLS?~~yWbWKQxzPj=j
z>YLX65rZsChKh(T@nqhv#-T%Qw7{pe0hHgW3=9kk!%Z>x+54x<=k%Hw*k_QO-Tw`g
zFaGu2g6){^Pi!&G!$1b8_^^V+BQCH}_`_4E3Dpm=RHvj(&jp?Dc`P0USw%NRTS9Y1
ze>!E1>R}?M^g0*vT;t7r7bly7Ud1Tap(f?R(**0KQxdf|09G2n6kz$QWaicPwM&^`
z%iyAWF^V^KB)wCDG=Dc(`i~WOJ1_^vG)1RBX5|b75q$Z6NH=)loNVE~F@Ih3%VPPj
zZ?YV|ea`T!*24zvl-lgHTWQAmM~P#K7PIZp&K6)1`X{g77$xo)r_v9YPFEfF#X)kv9Q9
zKfh>FS4|*Kn}yHpXQj*7yV)4N(U-y*nziF5pYq3)cS1PEKhrDzOy77lZJt(qZdD)X
z3K~@VMi~W$KHa?^-S|9Z`xIfI;g2_0^JZ&Uj2)W-d}u|RAiua~(cb$UHmo3^P(3_9
zmQV5~^@VZ;=EAi}TGqDdJ0K}187CRjn7i`VjSX?G=h>fw8R(Bzd&hEq|HqJGdaC5H
zHUp^*8X*RR!_@wJqmH|DOqy)ry1B<+PIQjY1>g;q>$o{-?XO6eug8%Naq~lg^SRlGpID@le
z1qkN<>%x+=oN)E9_CyfL8%pns8*+91r;B5j8iSidEY{4{>));Vnzk!+UW+N_GaQLn
zbbc)Ddhw>D9v!X2FLxKU$AYfLZ)M_A#-*+~Uk
z$4A?+ECj}VpFT0l`2NVpdcCfMP(mci=Im@Q8}YJa8zl7dvt&hx4P!2DM90Uk0!S6!
zAf=@_xZjQ~3|cj{K=!dIYQDh+u=VQ*d9WRaA#NR!7cBbQhdb?&#U?3HpR*&LSE{x$
zX#ur>{l6qud`0)@_9wb3%n{P`+rnRjN0im%m3-214slclF;Np0-&;_lTJ$bQ_!ML~
zLggc@(NS~V3?_*qX+u$oio*^n4%}@n7kJ)*2CV||&$JSn(l8&GAUIJ?*@>(NiTK_n)N
z6$dxYT_=7yI-c%R#3oy3Y)StjA+6eL#LJeA@9PmDF+cQyVIS1C7vB{U(#6)J_AMd@
ztihBLfIxDZ^{MX-3C&jgHwDcmWDo!$8=$B_0XW#YI(I&@_#S?Ca-O;u*)qA`t4@$Jlw7s0`VB@E(vW
z(0K6)_OQ*v4pS)_WTjX8Fh{K^l8}K9^_#2w35w;u2XDj@0!kd-{hL}6dkjnFTH3;aPrFcn
z1G4Fu%E{?H43UL@>SuMAub5P)``s__yOu@`5;&ocWXFJdbMMW3$R*7xQ
zkRZP)D;h;14uT!NLdk986qNwmNpyS!p~h~IxS}i#lRJOZ*-PC|d<$a%0Rx-B8i3a@
zD?du7NN=3ODL#(JA+&Q(n@D<$2;TIWe1Dvd?>RLA@pY8@v%I3L!M8xYVl75@5Nz_N
z)%uY(5aeFm7-k<(a=(zC4x#a16P2K_q5Hj)=vho(xN&No@H(OMPcvlvZ1Bo|7;GTS
z^ucr$9DlQU={rwUXm@Z8w@Sh$37;~`kS%jaX8N3bQd
zREOCz{B+zcg=JZKLNCRCO7ffXWs98)w4WM|4t2KyPkatQM$YW<1AlX?J
z&xW6O2oU(ZTlae}M6k@X=`(9;^=~$q?)M&{vSM+%sjMyAL8s}v(tq>37Z3OyS+T|u
zID2yDa=27O*a>JyhF3V8!2~2fI9ub1GTgR;GSTVzU1^2mW^>hM^9j(NKrN|04r{
z2MFzE#@=ZE1o+g^<9cl?apb@Os9QC^VsN%7DKTsbHU4lo$;>t$Q{0`E2?#|=RaWMw
z!(E(kz?`HOT1C^0KeiOX)LQ$O+IKRLg_QVaZJ(0;?#;*NKwhr{=7Ep&(Vwq02QIWE
zZES3Ii3FTFKwhbPTrsYW^MAw1eQ!XT)~9eL$u6VENu=JSn9|T{xbjyIJ%vDQVE%=n
z{dHJIASq0p_xe1$#r#)~H-B$$Jw6$h?{8Ucm2KI1G=q@z=*?q-5IC!`C3+osU6YRB
zfqgEm@>|0YlQZI8pD3k*=f*S1d1Of)Ek8RkBQ19Ewe_p_G?dC^!cqq?s-s>Ok+57#
zg$-=YpE0-n_$&z2+hGA(E=DWsVVCoycCkjK)DLDame0n`w|DD~<8URKNqjNfGT48%
z?glMjOZc8%NK6q`73Hq3*xPal!nLf^{}q*BLO@(Xyxsav7td(BMe+XW10<*I#vjwQ
zPHMibBW!kRpyQ+33LQhM#8X~Vz}Sl0hf_1j%+;+wzpZZ2po$4!Y_D(F0rb_od`tN+3_I
zR1Z5NP+?R3Mw=i7cv|vQ%_VE+y5sv)GxGQS-oWA*E&TA)kN%K7tejT!<#Q5PjZ>GL
zRgzul@a1~xzp4|bneMSYz)i+xyRWaHb4laox*qhgWSgkdP4_(
zq0D{h?Y>;^zUR(6g#JYPQF*r1v=4O+Q~u2fFv3b~;w!rjf0vT+>gSpH%ecl3o^if7~lKNn#yD*uAj{ekfWVrEI<$L2s?&!*6xm>P#7
zugmJ;bXcHM+USAf@0#x7a!#K^8bp)LG4@3KscEHWg4t7D2pzCaJQuxzGDZs}crOm}
z^4_!Qm)mU23$X`n3*ji-da!Ot%i=%$oh#maTjG>S*3EieZpkc|oMuu>%gjy~?iA%q
zfX{+40{_X_y{SIdvl&YX^LqwccIrA}qRply(>K6n`^+&wA`FkLU)jNAONiS+S#6K{iHPr|>Yo{e5!l?9A$cOv+9=2=+Pko!
z6)IS0139ehe&+m#8)H+CJ*+H&M!MWZHz>#I|;&FzxTGEt6Tr_Y%X4=d?BCnBPXXp`~~nC
zEV111i9ReC{k0bN$pMKe6U)`D&18_ck4hH*hg$HAx4LxK9YIAenDQ((gsS4h)kQ%rK?tT(B{7|82
zkyL9WMJ!&o{nhg*aJ|pUQfen)>XXs_-2_Vmg*Y8iPID*v_Kv1^`m&%-uxtS}4m6VX
z_`~Y)5n&rYBjMObMzag`n1O_AM^>+0u#~{B4=B43Ljnj<*)y_Jx5cbf!&TUQ#79EK
znWu6-E{&5RjJ9&r`$I`9=Uq5UEWcH%7-9C6FU`6hiGy1iMxVZM3C|qM^tLKC`TePq
zhK_U_)V$q?>2B@u>uKn++v++g1*4p30{z!9w@;76J%!&W3`o&5V>n9xD4XK`^HSnm
zY-fsiHjvQ$XY6}Nm>yVLakJx8%;GmyBbC8l%UT*4fmdufud+?&+OtIF
zJ&$9aOWdr+Hvb4b<>MC|^%>2tx)tvr@0o#}ZeOB5{^@TLF2R4ThcqTolfTkV%8;KR
zV4!=Spxm9g)yK*_+Qb)toM4fpBqz)~E`WQ?F_Xb^e9H2D6L1fy@_Ee;;86@~f*vD^
zng6S_vkq&kTho4UDNrQ1LrBp=aCdD}XbZ(PP^1)hD_V*aC{hTnh2n0-B}j2=@#0e4
z9VWc*d*+-o*PJsm-?#rruARO1&RWT{?)_W$l0B1B{T^|$vAC+N+|kiX(($A|sXjT`wLhw-ND1ZQ>iT{%>0e*J#&{6#@|IJAK2|4gYxNCF*G1qZ
z-tWfR+76g3!~yK{MnBrdWwb4lFf6o;P@;$YMM-A&9qMVScGZ$*yN|)v?q#(0x&PI2
z+s&#ZH+Z7i%}ZT4Fw6)6C
zqhr{szTa4CJEv}s9^djxzWcCvd7jGM*41+TyI9KC?dX&ukY7-;{9)!yt!I1!q*8>~qzts#1aLZs+I3ofcTRSGWV6t6
ziz-8>v_ZYlg`7=rv1jPe-1%5uuqGVmMouaWhe3=*2@_f68r+&+pWDLTzFpEg6_AJS
zqW&ydE)}w!y~fR)X+7C$l{#xW8JL_r$Nwa;&w(wxe$0W*3Kk>pTxn=%Z85lea!7}A
z8bKawcLVqSB25gb$I)+D>s}GWo_fFv=HBbGZcS}4ZXNK+#KG*EHa!&Rs6K@&8{Lr_
zGk5_I@>6JrR?wUS-}y!t@;fT}77YDlu!~|iD5!)_7sMC@lf};5`begt{3shvD7zt=tw1dMlaedu&y<8=IE;TLObvk@
z{%Rm*w1YzVsY_*5b78x#L6V6;H(a+*_2%
z_6`asv+F{aX2RijR
zv-y3Yw!#=Lsw&X~m`(6#;DnGL1}F7W20w#%I3dIKGs>tYGtPz}sKcB^4u#_hXY`?I
zR)J-BDDEU~B_4yGSp_}<8-kEwf4Jd^6T|j2nB_gMhjib{YaCD6m!r9}DYyF2C!Qgz
zE||{}hV&j#4ALC-q+fhh4mc_|^f-*asM9?X=evcVgl
zvYFGcUxHT6EXe>*9~fecB|{(|Q`k{-#?*r}(Vr`0IYqNErFABglgP4yL*_K@Ka<*o<~&gsf{XO>@YRyea2#$)5xvS~s?P4n;ia&+GB}z5B~u^e6Vy&snXl3T9fD)1^KCX|J`ATSh@Ae;wOmsZ0LRmp
zobo+xr$qj0nF@lbB3>5{q)5{7eFcO3r9R^M&PVMH88mq|)1RN80VGAE+7@HA6iZWD
zHw!zM$;(!cf2jXaNt=a4SA-Vbm>=!opDg#UckiVF9$#NI?F|_rfg~>h)4|aUK%XWT
zeg;cm3WALWizpOs@LX4^XH(Ef66jwNwzuvR1~EqC;~7f)AdCHlN+EfwFLkN(p-hZO
z7Gh=k=#|=Nm)f^$BKuoT9#7Qv5j89ZZwI3G^}K1ABe1o{ZrYUB{y^?i6D)h}_RSk=
zV63Wc&bYF!Yp-oc3O_{+%WnwhM?8Mh!*_(SQWE5`e1_27n_m#hI%iC?(n)*YSI9F6
zbj_F<(Kt(VRbG(1-OCPFdOtE&H#xgTV>h!#)2+izu|5quY}15da^KRK4SlU|DWF2+
zIFVTu@&e2sf%3l=2-XOA@+#x1Mx;=PzXMuu(`?aGVK@6Vp{Lv~GXw|Ez#QKk&-?v~
zc|cE3iYa}Hex{`e*-TLYC!<6&=>0Y$o)Hnj9co%UJ81jrYkj`mv;SV^*w^vo_oJIu
zFAF85A)iUI*t0==qk~`P`F7Z5L!D+AvU4{&E}UWM_bg`B{BC7#pJex2BgeKUdtu3p
zz)rI<+u``hapRl`5^RDrCS+TafIz~-KGRV#sXO;Ph|WEKm4DOmSZYcMrjK2n4A>fM
zq5#o(^cW1W{}2O%ztfck{sW0!AHt!`O5778a8?*+V*GSK6@$N49QNk`uL#
zApOk~*it=x;UO<9i}gdUP)7;RhbaLmFq|X1@EyZ;{1sV3**U{^k8OLO_@k>2qDcCQ
zjlmAlm6wT7yL`g1lF*%#XSnW-0$&&CKj1BxV?rJ2;E0}#Euh|d&=T(XHnvp2^ktje
zpzl|yHrOAibxUCBe+9ugVmChr#y1cVn414?%~tv_(lmGht*S&q$qTSVqyZd{_5R{!
zNe`Y9GUjLYTRfN8M&u-yLc6oXPhG2Z4agw*7!Vy`^}YsV0wc3f0!#$aKQ$#L+S5&x
zJl`Nn5AQ1Q{uT}!H3^48J(s=&|CRtt_i$XIy0Xm99obd~mt0r|Ny%TJ(3NQZ@Vauh
zb1#?d_>-x|O|jP2ey<*8x!2b;&(j)`1a3`gdrE>US%3CTJo$KpbwWArVQ2RN5d>R;
zUXIr>&HTpbJt*lDkx0^py4*ZhNOeQBtDQU6$wD@(6a@M1E2JkN)z?ChE
z>D8pK_k-&T!F?lNe}*XLV|@E%qt?1>w^CuFfNc@#Qc3Xf!<+dWh3~4p(f+BOE4!(7
zl+DQ$)XC@ZKKMkj4XxE%=UWlfLM^fzg7!C}`$Il2DMQ(6WFTZec
zcm4lT(&P?Oq#MPpuG59=<`6Ai-F7HH!C-LCDROu_MT6ix8Oe47ALM|{l@EFI3HmhH
zGU&)#)8ROp7J`G6?ry(F2ImNf3IYY_#0UsoafPVN_yymQizM(>76hcnYPh=H-vofX
zfS4&vKvSIoloKPY{Mp|Sr>4VH78?;n>8dys2e{`Lw5Jq`FHu+GOum-!160ZGF@`WO
zHw`PpGS`s*HFg*qilQW%vWSN@Y9FZ!-*S~|0jbr4DKtn6d7!l((+}pbkBC!NT
zvolcIJ;PQlAWwc|g8<$0P{5)lR9hBpQ~?mo?1;_~O?X7v`Zvx2AmJ&nurBV|j9(0&
zM1@iGDO?-CIhKu;{gMxiz~dDx;&*Nk@LvT2-por`=|MHdV)26i&Ne{xKsp_&ASlrR
zh!sp5{v0X`7Eh{Wjt+qP>3HHkiEJCAi+%ZHNXD8F1K&~;`x6vl_Ngho7)J*B@?s&!
z1`^7=@DK~~VkL)aJKj5qv@>ToOeFv|T91tY)lDb9coUA(T0y|~lrSI_&)5P0tbr|2
zj8+C_nnORS`bA@R|eXs+P~bJV?>jdlVhN;wRHk@V2(PR^Y1~Xng?)T#K
zkki(16wKJ6k{q1N|3MGp9}fugv?s6sM7B<#`ugjrCbaV+3>Z5o!wODS<7jSIxD{e-
zAb$56NOB+H$achEFJvnBP$c|UTLM|7{+mX}=*6F{4rEHg!#B^NaS{u!x>rWKC+k~M
zUt3smAxmm^_xP90$yN@==&pB_3CEJfYk
zO0O6!wby;NUSfD6>E?ay1)xvuUfA#D$ktL_IG$LHelY3y8yEGDhL5+M^F~#|hhGsX
zjY8v5eChNpZm4zpduPp3zV%$-bVI7n-e?qWcLFXYZf}6B>!UCgu{B_ER>%IBY6Q&w
zT-bh74jZjQjxbnWkjMQ*TMzo~f$=%=?J(VGebd;n74JQ;4@I5?Nsucy9R|sMEHQs;6aVe
zphJoT+Je3wRMK4%e8bT2Y{2K{4f4;^$@xDTTZEB!doB1hS4IgkuC%oz&yj=pqI=Dy
zK|S%JiJh*hk?l_Z3wMiwra_$ddW!zCoZ|&llVN-={Z)4shlW>&&x9Mp@&2R59=V_D
zkwF%7C(L`n>GtoWXqtx%GAn+6GZ@=_5YMD$pf)r^ONPW~=0OS+$wAT}1>q6Nc?rFh8u?ea^-oS$e$R}LlBPVANy3}T`oS%JW`yL6&uoT@
zMeP@uJUh5faDyY$fO_6hF>+KwH!XIX(bQAov5NYxKdJjl!p?+T#faB*mrRaw*
zS^qG*9<+*=nnWhN*okzclV~IkmB=q)CX4j%7Q9HJkHwEm;5phDA^yGl27P2dj-qi7
zVHSAz+&2I*(Q|KlwVdfJyo0tkhEYnsU$qVDfG3LXZ;Y5YmpVz3>=eO~l~^UplpKtP
z+w&CZ>N%Oo(JMW^TOL7|9G=Lj2)QnN&Dc?n&QiUhNk2{~@Pk2H7J|*1!3yO?YWq+3492t$T6e>7eQ=^r@&&Q3^
zVK@M>tyIML5rFS4SF*#k6Wnuz`Z<5)M*58l0(}5qHKy$a*M0S{(vm~?=$v`YCRF~3
zm9v|WUWC6p?(-+m(L=vn_6oFafbmvO9!kz3EEq`}H9YDbWU(4@f-K_nB*lzu-!S5z
zLbP>)V_v{&7DG@5;uDWVr4j)@a`K42-#I_E4XwOcH@JT7eNE7Dav)|D5aD|E-%+o_SkC9ct8zPKR+RiM$iXJRR)^Ec+ocr4^WcyOavUmxI-`|YX@ObKUpfybwCd=dJxSrr_&E(L7*F5
zb#`X`s{@u;NUsoHYqMVKq~t06FI3-V{Og}a3_Z)(K4`P&<~Rlu7#gO!Tp^jh
z8|&Tj9};jFa?E*kCi-N&pcy*zpOE0fi(2#8YfsZm$Gped@3a39FFy0neL4wIZB@*S
zwP-GsvL=)-XfV{C|1%GBBT@LChXcq>nWz;q4q(tC{!t88n0YvbR?^<-1`~t%pnv!G
zo(jX(A38}p%Bv<-FeVpysB3$8ubZ2{Z^P~96$#XBYHskaOUT6&e-O-(r0(57RId$T
zMfi?5_%^#B%Zvv*vlyLWdVr0RmqzYQS10Btn_p|n09iYE
zXmcaxZ2bew*;(==W8)$Tuo0iWbyVo_i4h8B#rg}VY;H$bFs@llg+_px=zwXyGp@A0
z8|VwR8bpuy6xVZA3!
z2_iGkqoIcp7iR^!NvQBGf^(o69~33pw8r*&j1C}+Li~|T7ZUxE2{gguLd|KhW!{DI
z{MZg33xYE^4}mZSIp4Z~r_06u;1xn7`y)Z-ua_!iB+ab&QvKZ?#Wt`&e)y+7df!UW
z`iQhcgSMXl5JAZE|2W8sY`sfEkbrzoEq~fU_nd9{CfD`fzLj^A!QcauTeZKRC6{p
z{C`V7&(@n;>Dj6y6i@;Utq#B`jS@8}lPQ2#T>qxxi=2n)m_XfqDfy>5=}dJFKQ$xN=0!
z>xAv#9+f~7y)3$p_8w_I@E#WAV$2C5vW!@nKZ1w|ae9k-6PP`mviD`7PNlgIToM=~
zGkUk5F-Jdd8uBO7_KWZBBd!Y0+0e8Owwa7!R;*-MgAX1-tW;mu0|P(5W~F2?r;el;
zew!##dJwDfZ;Y=gK0{%o@g>7Ye-??Gp85@|;sdh8D#h8RFMC=OY69TrP)fQv9=u9`
z^ix!OXFJbt0?er&l)}-J$&t}s?QYH9Cj#I_7~3+lU~&RVA>bNzG-FrUn6QF3rh3_r
z0&^C|dqUfml^jmn%WpINktW2`)=en_m}MOoI8Sj8pFw&iMWXv=!WlVJeG}Sc*@aw-
z77EU5%_e`1_;KWCj#37VnomN?nI)b2k)ITT$1$QNUt~&(qQANcW%Z;BG=&#}KK1fZ
z?BrnY3-?|8mZ*n{H+mfwO2OQCS$DC8T2h->^I~G6p1U12@J2V=b6kWOclY0|wJoK2
ze5pk#>4lQ#Ixcf1R>&o0qVr1f)^~&$z$&D!g2&sjD*CY~>Q**R&v^mGb=4oNlFLbB
zVR}&BiXw7d_2j?wuj$8sI&hz~-oyTK;PP!X(~Qf5^PeEXdmZ1lxvU#PiK4_;N-RjX
zXz581WkhPIJ-XPG0A8|;6~m9A2>=|+G(h5r3v=PwWzAn6LZW-f{!()M1HJ=i!5UqqRH;Kl8URxX
z{N!H)qf)ng43Hxk9rqguf&U<8lP5<5oCp2lVm;XlN^bi@H^-Aqs9D%REriH;EY9c5
zV|yvy*H~X=Y?1LeTQp*A$(C?
zdsk8TV`4s96dkSNndmy-h-z4`HN*6XPPoRsF}P2ErzYlhHa?zuj>H=Y9-UB_>mEgXGQ9)!C`C!g*6tfb)3T0nW*%P=`ZQ7d2so`IAk2|X6#s*6^m
zEVPW9-9W|t8)KYXjI=ytTbxYDX~wqHzON7=;vi#aT?LC7D4}|2?PUGz2kx+->raAi
zGn6Tq=8#7aoO>{nb#|9M9LF@~qfVBoz^Occd}le+WBff2A(yBIzphdABK-t1J=M~f
zv3dSpy4urIeS;s?U7+=2(aPz9gQPLM_EizBu+UuQLP`h`B|`m9QR&6F*9vVp<9Y!n
z_#;kQ7bgjE%!n|%f1OpaUy7^vslF`VYFtD?IL@9L*=Pu)GUfSLGm
zA{s^cck4!C;<{XB8M>Z!#CSUq6~X&hxkZ`Q%mPN7JRm7MS*&*nFnXePqBb=RBIDRk
zvo7BqBPMjVm>C2TW=44K1=*65rt{Nd7zP7f^7s9gAzEb-or~PKaMFj1#jRDfw4x^xCeX+cX?mWR0CcGZQ(l!GVCd}j%iO-IgyUXXZC7B>_JFW}EgP^?vb#&?JH`k1Y8(91pm~XU(o+yJz0>|4_`{5
zz#pUb7OlVL0@g}By;|O2K6b$jG@yMAsUKhU1q7CIEci}3;5dt##(c>9dZVOJL{$n?
z(j*g5w^bke%{RSQ#MWY&+m(x~%_3PN!cUeUa`+*ULg3xi)t^ccDg;xsZ>b+rr;$F>
zyYvYPs$k_G1J@LCfa5|CUB(_%d@Rz=jS!XfBc{NeXM2VycQ4~epXHE>aCN3}3cb0^
zBTwy{*7TW+B#oUDWo)E;Mq+`Yz$aEjeb?d9EYnMFZ*o<{M8+c(_1?xzGhQH}5`MbI-6K*<8jDw>S)`D`
z!ueJQ()N<<1W{QLe^OFn;xf+`l$Tk@&^fe@%q;(FbkHT9TDB>q4|rd;2t*bkM{5PE
zv5Hw{LyD|0^23#PC%iSpM7Gj)G;RlV#qQWJzcndq8474_pD-nCJSpFgP=
zrpaJ~ItGx;Bsg25I~7Mh%E&<%h#AkiHHMXeV=Y4n4si(e?pg+>fen5NeS`zc3Md6}
zMdSNSv#@D(?p1lzx=L#Uo+8+=bQ_snlH^|3Z*iOyf7SBP56-SddryvM8~ayX!zctexcdd21Bb
zxB1F(IvG5*{9`_?u+MVf_(%5JAV$oxAS^(%6cu>S`gb}k@gC;Ur?U)80i#h9)MKN5}a
zB!cm>p?syqY_A@z9czVRpD$wIxspbz81GADO#AYN^8uD*S~?&in^-qJX(>;p{j)nk
z0=!&{9w3@X=uuW~n&1<`Fjv
zj=cQcU~V%tmFi+s0Rfs%v~s5=U91LZHZLB5Ud(iNlWMTfsOA`UdVm!Yq8sQ>Ml-csVstk%pq1b)EG_TcaCB?RLGtUo#p=UeDau{8
zdE@WjJ56JF-WM2tdTzr@EvF3U3+%SXmuPc5J}xBk@-6kiw=Kx$7;yVrSMChd-F&q<
zWgosd*)9}2>w}Ftm16uvm2`H_?DSohS$M}0vau2yGqf}mLoB)LNyv38xL}BdC+RDO
zx1%UHJnHp@6P%8=Z*(C5E|xemx)7x^L?udf4h{Wk#pECL&G$jw7!G=AJk?_0;(-AL
zodHt6Is97FeUWQX4RQKOQ>)TXb6JwUnp7ZVoVk@3hkTwCa;)H9?9lbP4))t)04F?!
zT+C#`X9Z1py@bJ~o{v%7?Md?pcHWR`Jrl^haS&sOP*^5G&SNpD-L0Vt5VAirhL33q
z_FKuV+W-uZS~vARrghz~^o&=Pmfez6OL`(hew;x1$;X+uLs=u}lC187D{;=T~rr%pYdk^
z&%h=3viYzs)h^z7gWmABX|bILmYiYGLmpuD-Pe#;
z%dfV3zGs<#w|S%Mqj;4nuu48KKB@5C6|KuKeMg9-mFkJ9PJ!(G*HxQvo6nYA8a98AN!~>
zfdG*uFig?D=*oF1+}~>_JS4<=f%^Du`m0Xln9B09i2m;tYmQ`N^Vb+6>ou^LwjW{D
z*i}LAxj4Yu-?N(CHGfphPY4tZioM_G2a*S!Uw9)koBPpEK7G;3nbSNG6z}rXqNcYXx#297>nqy2p@Z;zq_muXroUO}XqF7W-
zfeuBPZbuI&Fq7FDArEOz97@qMB7dqH^_chM6&VTDf1+;)I}b{7f$5%e#$;%=&uPBL>r7%K8Q
z`!`JX0B-f`V6Iz__Zny42bWvJMP9Z=loy~vOCiB`696U!cmqk1(s3Y2H6UQ$R
zIQ%mzAuv!b+djze_T7TPPGYaUHZA%AZUC<=wxNvl7r3|@O8QCEbibQ)5;_l`4Z^Gn
zQ;-=fC+(X~8cP@wa@+H-Ava{>*VMS1TnAgD)`Uq0H*x6Xchi`#psVo;c!n#8SOksf
eUv8ppw-0-$1cc&BHuUcw3ZkN*DqkXN9Pl4@qA7#`
literal 0
HcmV?d00001
diff --git a/i18n/ar/assets/img/android/rss-apk-dark.png b/i18n/ar/assets/img/android/rss-apk-dark.png
new file mode 100644
index 0000000000000000000000000000000000000000..974869a4e44719fa559f3b966b8012e04e0c7993
GIT binary patch
literal 51238
zcmce;byQqWw>FpnAwVOIySqbhC%6TdCTK%&2=49>HO|}
z@4V}qxof_=X3hLtU8nY`+I60-Pe-aM%c7wWp}cza3Qb;4O8wQV*I!<}f~P=&gN+15
z6!g7%)psN>^jLvGA;?f?C#!fBmSGSud=IwZ*R!NyiR}f#dmhP
z@2usAD!RI&t+0Su^;*u)y6i`@n~|K)`Z3RC@~SLK3JTbtu?LMLWsf-A;~gc?s~r+FP5fafv^85w?C=hMqV
zH>IUk>$z+rpJma>J6+alI-UW}cr*~xhtG5Se*(Mi?`6)b&M#0-mRjQZnW?DmuK<7?
z!^)V7KjWo5uIzgX#FU$Na>@!%`_WZ-iFSJKWj|~L1O@#)4yhk69_R7XQJb5ZmhbP`
zkWf&`Jg?$h4b8|zd
zkIRLMvFE&WkFx)H^O=E_2Y%YmeS!-(~;-gUOV+xngNq#OQWAh(7Em
zqH1DZ-dVr>!2wbA-qQp6^Z5gDjs_@#9ut&@iNE6P2^+It2d=^ww
z85mug+0a0CUZX)j8ZkGxw4{)Zj6Od&+xKEthwy&jt~QlS?7pGC*n=A^Nzb1(7+m3Qu&Q^M)e7!c0+{MJxXt{M;6bhc`o_7t(gBH^65%=d|%dPb-Hb=+Oo(4$Y0lFFY>_u*=$MGN&sr?@1ya
z(q@7;Y*g+t6FeAYz5A^?PnZ9P|Ms``_OF+je*m3>&n%Qv)4YC8dy}xQ!L&6Wyx4fG
z6rlpO2$i=$@7R8Tj7cRBLv@=4?*6W&Fg0BtQu}$eh2E*FC=73{T!qcRlhBPbI$FWj_OLtjI_J29(&7rELm6DU8FuFxN+S99Mc6=a_)E>MVw{}1`pQAIAr-X01T=zN4~W{8AX6}ywz5y9qI9*v
zbtlvG2c?B8W7eBSs%NikD3$>)KSyzWVRk|Im)Y}zyg}L{z6${Xen7&Xn7!pHT^I_z
zBl8Hiay`*#?{!D|ipFTDJVwg0a%^xs$i?_OUObol1~MC1Pn
zLZ7n%h6cuI87#3*&oA!=pgB3B`H;ZC>bkM6E@Rvn(t83W`i*BDaW@0(Wbr(tuPX?23=o
zhza;G%M^NLUTwPg8JydZvS7aR
zdOTe`uTg+mF_Z%|6Z6#o)zRZ@@1DftO2g_;qm@qu=Ar+*jE%U_>h5ObBvnpXWo5ES
zWmVN`FI1@UxV6<&9R#zW_6P|H;~2+cfo7te_k}Lx!3_<^mD%2*@#bj5MgP2V#A4M<
zrJ>lqeGm*(BAOwOm$DYJD_^8x#u(gg&B9V%<$E34bil+(sr#JV(6BPioV)Qu7Na9F
zUh(_i1q`{63jQK$lz{hrP+VNcVB=6~1(w1>6F7RX(EXncXzc_)T>DXc=i=wE_!RiP
zJL$oloRQt$*UaWX{2wvAZNk3CD}EGy>))9T$ji11kSpD)Pry3v#%Lof_N>W2SzJ6Rg}L62md)dL&o}gG$>E1*s~H$4fI3yD@|HSFr=XW
zN8kIZk53VjeW5lftOlHJq6`cy40u&H4=}5xtjzY$ewe9fX!P51Po9@$DZfH{YolNW
zsyMX@1-qWR@jvzu0fV$mzT*JNxAAdj7Id1RI)_q_&1j{swe?5f%rAJ^ZmhlO6Ht@=
z$y*b!zAc>WE7%QXH-jR?zC8H9AU<9|d^Zt2g;N(MyzKkz?*oV3r;(YQZDBaQ
zRCayE*i5P}#KT<&#a5v2!HKEPkBjrOUa8xULwmz>aby5jxV5caIlonFU1SIK|L~ji
z`&Q*jLeG^VBrjxGCS5Of0$~0v@p0d?A+95fECfnatY4RDemw7bJ-Vp!^7@aY?@gQ$
z0}+yq@iaa2wXk0`G)lQNEZ&J}NBD=hg7U*k^vePEc>CQhNBlWm#
z=MPrM*6X~ld?a_WQ;}P(qfhR>vuJ1aN(Q%O(Hh?a4Zi(`6XLIV>I<$ySC
zZ=Yzu`YZkC^;|J*#{4Hfnv0y(tS`>Vc}%^?d8nZ7tB;OzP0ww$lRp>
zFTows;3f+e{^q?oG4D6s!~_|mhTd9?|~(E&asTfH72314(D*)Oi~*<}y8&C`wO4{fp9~u%crB!$eYd1>)2y
zfz#!6*f%@Hyw@bzk*
z;$|I=Q#3f6JQi6?oU@?kC`zEZD|3CBcB)8?*~2XFI^PlSts)lQ$5w}-S@RTSlb+Ja
z#&7a?Gi+jr3N2y1MGYSna#I@1Wiow(5?k?eQ6d?osQZ9;>qUvZTPY34R7#63k47IY
ze2uL(;yA4DgD}8sW}KvR)Gc8LN%{dmI}I$Zxg%Vr=WpN}YLIjXY--LZwab9D;
zEo<}Cx)^TnxBPg2Qy~8F*+ui6_p;WU#rAnL>?XwnwT(gBBV7Kr#KI8{<_nJ-4CLvW
z$J?aM7l*kY5z&q5B!d*)mwIOW&ll2Z$|Eu7$BeWGlvp%%G>n?A4&G!|b%`cIOeU?>
zYQBRBQN;BQFkYU9aq)Zn2HrDp`#y(f#=jiIyrKV6w6~Y3SJf|mAt_9CSzT4lGGVx
zsQr!sC`e?M)dnp=5FDwN7C3j15_NmXV)a0Clb*z#ApsDL*Wh$-_9uIVL%ic;a%gAXpG~I@%Et+$^evTW->jH
zyhcVS3!dGR*T}t1{}7&Ct3cECpejy5>16$G5)kiQ)p3tSL(XmdQSmb%0ez;z+Ne09
zAEl@(o=|$3)H(jM@V&~+wc%*Y>u~C-GXP+y8h7f1I18@gXO6>e$wOQbl~@lOy;)p;;^U@_
zG6w9}qo>+N%!E$fgqcP9w|Gb!kEHUl;X|!6nsr!mo7X1@pc7MLIkm_86WQ)OQ#?|4
z%?D!m&@x-2&WqvP#9Fd<#Tv-?pPE|84XaLo1WxfL$!z;!ktW$-9;Q;tkPH3d7bi
zGm%-dzg+V*BeOMr9@gjDJ?!4dkqPi2h4L5%6`Z@}+))={=QF*0x$M}&=kS&^1;oZw
z=#byK%~w7czD6FHw@dqIilq2>jF_qEZtLIxU@Ox@l}85iTpi6j-edeyYsQ=Te6=h@
zfkVmSNJ*ZDHnkzdDXo7)sPEllVN%oPnQUi+$)HtNE>n&`PetZ<5m)DWIq$cRQLAm_
zc8$uM*7Axc1}7yY#c(!1UR5keNRik*xjjeF7ZAjwd9X*$XZL)zyz{KL8RG<|{BU6C
z(^6^E`nZkycGmb7(_3=_!p&3)XLI*KA=sMO+ubyE9GNX=ZHx8Cmpc<|1|!Wzg!Dh_
zc6``$eBU^M!Wd|RPAZzSm@
zTGg34EVckRVA=5EZBJOi3wH+OGYXh;P&}ggX5HxQ2sYH@FcgdHjSD?Ljh3bf9cVk7
z6U(DH)R^utY$MqGTtF?qM{v!zOIxFj9ZH(r
ztN)02Em>|!JTY7-biz94V;TZ+F;%zuGdAMcrY#j3;m#LO0HJ&sI|mO5fAN;h)tef9p1vn-3kY6I7^tDy6kHv
zE8Oe&l?&u2z_7Hy)O?R50fd*V`Pu4#veS29nO>0Bx2&R|Dlnn2H1uoJ-uTj>7L5i<
zUfMiyCb~iD_%x416XsWSyU$xDmbP{##|&ml5!69cHJ6tkPLrQc-)zf|NBvW8RD-l=sa68z=PUq*;9&R6V
z=>aVBDr>7bfLJ9fKmb`VFV9Oda@4l`c&^FkCRppCb9z$e5rX7?$s%BCzIG|GpQ}F=
zd_PNi-+D*f>2sWUg=w`tJG}FY3TLJ&yL=)YGO&KsNNwg$-1al8B;O28U799y<^8C?
zo!mTGkrgZuT=43TsWV!z!L5^iQW4{o`X|o@b8=w^`ajR?W3-Cn4cS`D_X_;wDX__(`ve;dV;#A!|~c1SAdav714es!7ibV&7R}s
zSI7K{3i=mfW$Mo9@p1C{fNQRlP8+ED?AXdw{oVP!3VT)O`9RAM`LF;1ej11Mz-n2k
zfuXyn*+CiK_btOX(Te6HnL)9Z3ldQJ!pgGm$t@J)ff>=zV^QJj;7BF^jpfURo{;@X
zcD;T61C6ruJ1j1)q3@dmzrIq1#86SKqo6ROL^BoSV^h*4LzR_3r|aI)7V^vs^cb!@
zPdF(ux7J-ACQj_PJx+X!1fMiPrnu{rSwuaZ24uOSTFtdDyL5MS47gRF=ih%u
zQR`mUx@_dsX#S^;Wm!x4;y`A6aIlTvdtIyfsogZ1M=lNqoCYW73n$kr76uj!^+`wBOdloOPdHeg<$w*a;DnZq)M(Ox-HGN8!R3P97dkVddab$h^a!z1-
z$c20T1ofo9rt-8Vp07bO!P38FA}B_(w)nYcP_C0ljteH;3{*3(e^VXuPFtKFYpg<4O1y-!<5dG&us|JKo%?Uq2mzc|1%X~@;{e7>xiOoYfh
zX(yQKHB*S&3>{bwSamHqH{J|KWu5Q-+#vN8%B;zh7ROvCM7*-yTM2W;=V9q+-0674
z!s>Rko8(#RHolR+ZQ!p)AOx;sMo1>@v1G-S9$4;arm4mx0f~E{F{c9%jBVDk(6?vJ
z?+Q`YP#fy~7Q#xu9*hwrlg6J%dqQ3?sTh-w;E>+XT|qR;;i#A99I*!jARQ}y*qK~B
zb+=9ju2P^|H`fQEUHN0A@7`a=Gp_3k48vd#e;)q)dGPc6a_7!c)CC9*yoMSmH@Hgs
zXXLn*RiL6D?`C+x-QzidGY%TIM_gz)nCoqe!WH
zdKR80JreoY>N{C4;8<1kmmuJTL4XB$5E_=vMH+s8>qxE);?}rdTN`C^_yltKNR
zVK^0PuhUSWjfuw_CAV|>STLc*bcpob%F2ZF5c7Pxfp|Ad(ix+`4+#k#0Bvd7HuVv|
zjeIIos_4ZV-=@BZk8{L)%G{5xY7#8p)1@3=Yg-mJ)gw_Bh7FbhP|U%V7hr&O|4N>-WmM|tyYv)`Vl-X)&>
z5s1CLIiZ2CZG?rXt#2$m!H2*PGhu-*VV<(am2Sx{l5BG*J|W+fa_pJAtM8m0D@1A&^FAoi0+W@CJO&^4@1tnUkj7a=r<`eBYuE~JavCDe!WWDH0$&v=Rqf^M|gHSU;
zq5H(e_Cd8{#5Xsh0pEJ!U(NZlG`AgV@FNKY?IP!VT&TO8$WU={z4Xm~OlmCx;=!%J
za5i>fbe*A`052uIdTTm1O7R@28wg%r@XUmIErujh?+yI?Nh8+D!pp1c&7U}!mc{%=
z8>!|`Y1R_fBcGust>5kXlN8Iq@2+#ET?~tE_s8CGq?7*0&%Y$aa&=qHLzHFszd>3n
zWL@v476x4XMxNIPInP;)it~uYH9Ow)=fP|t#}?48Fx)&Mnvp@w)rnQXYr$JyF9t0_
zb|KVue7IkIi~jNUCj$H1ty0NR0>Yo0oKOdXmz*Hn+!#mqq
zDTllI)mGBL9l|iJKLBrlY;rp@v#+z9YN(MC@
zPj5pBW2$R4N7Cg1v0gD{=Q`p?Rq#d=`h}`#@T|_=k<9nc2>tKkJ*DbZ-?Qk8g@<{{Dgwwzb{f-7U*!!nMmo
z70L#lXM~!Wn20u1ATUT;U`iMkLr_s;`b?PzbnowdRD)r^hnSgea472`cMCBfQEqAh
z6pdDIE#?(Co+*ZwmYi0W-dt?6adVS+ahHB?vb~$o8cMCiVKJzo`Y9ICmk1MCTn&Nv
zp@Y*i^85K=Q@ZLkC#0enw$^(WW4C&XpE!RAr20f#9@z`nMx*8yu7@W3G=w@5C7-!4e0Rjz6J8o)Rfa9
zijYu|Slf#f9P%Gnzk>hepUkYoC0H$mz0$zm>N7TNLBYoHif5Di=xZ`XSRKm|QP*pu
zv-wwV?=$_Xn3c83@$ojJgXM>ZI5f1FE-2N>s_*UHbd|OBeogTvsn9v4
z3*Ft{zK$nuLBacm2K0?P$I~5{Vn2MifSqRl!*^m?Z|{5i)wb|7K$*m2{byEoV_13W
z>5+d33f?3P_LGgA*N(3%N6H%I=@ZjsO)LyG?;Vl@;ZBNKHzE35kE=z66jr!+Y=
zb=O=EOOAgpRPl_hLWLD26;*Qce>^aK#!lyE^ih}V)^kjXjZt#c&pDClRQomO5x4f<
zFBS?FXJjm8VyjG&QL?hC@AN;d9rX6Pmk=Ml=VfDSt}c}{JB8`JzD`+3SmB9l(cIE<
zVp#;Hg>_fgxaeqao!Nk%(^h7~eKiKAvY%?Vw8?4dy1YEDhzQCP>K!2kMMc%^?X4B<
z#4l)Qu|9zn^))qJj-E5*2R-Ls#`+!ihhf>O{i&kLV_mKmMC&460fFZB8nBTnC?ze8
z?s;#6SXFPa+{ya#0#MWFUIbZT;i$>XEJhpt2*ku>P7!AVgU4&mZZv(=v<<(e>QHs=
z7>YX3f(P)+kN`ho9Q)eZBq&+1H2_IE>8}Q9@2O`=buUU5i3H|zM4nLlG;B3xc=ZZJ
z&KDp;qxaT_D6~;g%-bV+OmWmvSC=EbNzON?h@qfBa}
zAT1dYl!&P!m0TDC*xH|bvN%BqR?3{AuPAvu9bO^!ESD9z2QgfwDRB8b1$lYBJvt<*
z&TF`?Oqx^1%dG5iYoShTf?=c;_r^C}TAG-_|6;kPlU+d|omHll5f*%HeSLLV+0nW^-@7-3
z)F=J%k@B`DyE(kRbWpUcV+s}o{&|7W?8$owrTNiAgepXgR)V{+*iOtVP
zM+P8*+%HVl02CBEtMsr$jiSxelxbrsa9(Dsj-+X;Wlli>a|#HwpgGHJg6uZa$EUhN
zW@=h{9#uL>k5Uc{$HPr7umc%vbqjeqDSy(;x{Wb6X6N7>E1ctYZmMd_nYFC`muZj@bfvnMWI3jCq1hQ`|o
zA6U(us_4UfmqroJpC+W*Z_1A1(TYsf2+7o{86p;(BYJ`FDH*E@VL#x$Ialn)lh)MJS`IKb9xJP3HFX*pe)c5r(AB+T5O89Hm3}oq2?^C&(^tUP
zak0RZ=4Mx&n^z|0K0gJ3W-eE#q}lp52N|5M6j@nKZ?H{0REj*i$u>n
z?0}k`lCoE#iiKxR^l4{n%fjX$fR>PO{ygQ6-f(q5fU%PKR91RAY<@=lD{9>0%cVAx
z7&T5i4i}C-A0Ifd$}k&C_hw%sP*v&^3l)GymX23zqMe8&PgkBP-;avMPfYc6
zP>1ytVPk1HB7ON1<;qzPadiREPhcM)cQL>12{_IG19;fF}v@?kAw>CA!
z?x9T4mipb^Uc0=6BOuBh1yvF#W8(mq^Ot)Ikn`6PESvckG~ONFEobYk72v{Z>C96=V4{R
zZD6a9!4n`d#85|kexJ>6%|U@EZ~c*O;kw*Wt3Z=14Eu6tZ7;ZuV28=V!o7~3Nzm^$
z~{A{!UI`N48hzMN+Z4fy-N@NG?$^Nl2TkUX(DdMD%9L*eEevd;y5-RZ+WMD{
z>JjiC6Zl@CgeBuVaj>x5;&Z}XkMz%>7Gv-FO%=SbfWcLvvtxm2YjageQv>{kk@aIQ
zzJuQ}R@XW1?h*6E-@h;Aw@ODV4k>wUD09hr|NgAGNNu7pqNk?jT;>C=fxZYF9Q~SY
zh%-SP9g6!6Y812nE`wt=#!I(EPd}lZ{(I0@F6Y9$2|%=>ddX>ue&eLrl1R+_{Q3zYGu#v`
zP}N}35Qr3AMA69ZeqRjK$?D7N5^QKxM8tdA`9Z{hfpmeixinXT1YF$u5?SSq`xA#k2f|nzP$=TY_359
z&|-=rkw+ruCce|{V9W1cDGq&;S3o{S8KFQS1bQ_isX==u0Y0xJh=({d74lMy{q*=r
zgD(oFS}TWaXG;R)n}!*fgI$p|%w~v#OlkT81L;}GTDNY?E?vBqnkX+XGT6Xeo2;zI
zBOvtQ?KX89REGm!^cw+{`}ZID%pnjNQk~uK%{69Kq%$cto;2{$L`GV@j6q90cp@>_hpl)Cqiuu`{_j`87*n2+BQvo6F4d
zNqkOr6aV^Jxdgj454^&>(5FQSj
zKnQ%IDuTAL%_4_XIdxlnl`NNHcpydgi14{I24u?0?$+_G3f8ui^usT
z%)bmEW$J(uSmBe5k3EjjkKnHW@+yd9hUw^AF;nt)7t2;)ikuTHH_Z|AiDV`L3Z0kG
zCns_JYhPqxNIpqT9qvcfEuPNhjvNxosHvtKo)=sl*Oe|n(qdY)#vw@PLr826A=;uSX{R2|`6
zs2LJ?OgPJ_wibY6W$W`U>Q^xTJT&b*x(Wq+g#;Ebu?P>v#psEDyh5q@lCP*FeHavh
z2@!B4MS0Wa3-|rt@|K?J-6iU^v=r#gAlG|ybG8nN-M}W?aBm1I@r|&ap<49$oG$F#pA;{#i0G8fIVj>-6!O7T
z?`77*mVh6$q(GAvQKY||E-|i|J=FO>l_A+#XJUqJ0L7P>>}14#e&!cvn4IJysCt}#
zef4c}j02UaP73LVHwd&_2+c2sW#5{D@)9+|Lf)ud|IP}Q6s~VT-tTkllSoQ^XSPca
zOhT=?!W%(mip(oDCbF*&^ZOQ;b0%_Y`>KDP;n4$?Bw_>*gw|16aFLLZ@aV;1{dU9G
zFas4Lc6@9|r3=I9ZkJF|4h1Q%&_NMl-|wq!jvwQqRUDnjw&I9;8r5!j=YNe$+XCqM
z@{kQgB*|A_sZm-h%PI9VW9D@>;
zl)>y$c4?@VWJDx*c(fz==c`w0#8H%AE(zUYP27cL29U-OISUYAjvRt0E^D_okScN&
zT<8pc4JX1<33^`xtzE}=uT#BO=wNe0V-`K&RRpcr-m01qZ3yFFXIh$aT^4tq{qpUe
zHajGWqj2Ip!w$T?g6{~38KaLNp$*=63_Qeo%{axLZR>ypTvSFym$YQ`bH&By!`uUX
zoR6Z!#QsV^oXWi)Z!?EE6>veaz_=U|>MQki%sV2Yuz=B5)h#KSfzD5w)K$N^#mo4W
zoE~O4L2H;R=VwPHm|ZOF3iOq#A|lKzCGkbD$r;QO`m2C`0Q?2S`Qz&5us+g{y1JIi
zj!@rs$~e%B86j(+tOq%sr!K{qWPae|n}jwTiNsulNMfhL9glZ`s-VqO(ZImSzMZL@
zg4H=>96awpSeSUWG?Ic%_S+~PQdfVqDP}AWASE@(HdxBN8ZHhEg{9$UM}5=ZfBK{!
zbcl(T?9GCLGNi9B(yNR
z(-k0%%hb82&6EQ^&aL!-YtY!b@jIKcala|Qj{E$GpWD~je0Ug?I8mn7sjf4d!Q0Mm
zTo>*wo0yTp$U_0M>07#lEcot$?Wo`_{G>8lwWSwWbEL7Am7d#P
zi{l!8VpdkdSB=YtQSL0S!f^YXcr~L4giu=14XNleBb`+Ra61a{yNk=Uu~)P=4(%g+
zkj3yW{^&6ynWu`f|9v=3j{#J4(7Vdl2kvx!e84qE2sI{V`1?gN4a;7=U2pI9#H6qU
z2qe9=C3Q=W2y2Z94_8q+`PS5~C``$)+!gz-*|R6O7C$OHN{fo$2hbd`W3>gix{Udr
znFFB|nV;E$*YQa)>X)@+z=%c$4-7?{AO&s4KNur>;o8Ld*kt=eK5|j%Yv!Nh?&BC-
zPPI*hl(TM4$Jw?`G~cV|#xJ}&dmW2I&$MNjR&ZYIJ*>Jk!e$gfC-2?}#=TQCm$5^R
zq9jVbi7$~wC6Eq9>^)aVYPSfgh?%RbzGT1(b6Fi0u(r;a==kFh@52+(7QS_qKsMWF
znRJslIQ|PW;T;Ag%T`BPe1;;^;x__K(-=XsP{e{tX7olMtS7HfGc&V;17f7e5+uMf
zJqZojP)63BX5Bk!wGQoj`We!zYVQ~i1nOmxU=fkv*w`Z~&!mu0q>}I76)>r;P)&U1
z7KH#{EzK#IH*%6GptGbNQxLJMq9%W0?CblZsT5ZsG2F^B&*i1MxR_m2Pgjdi9i*jo
zB`44Wf1j*%Wx|`1s`93UqzkVh_^3AcuAHoELFs#LEP$Xo)_RjPqmHP5M2?ygQu9|H$Rlbc&E;1&P?Vy
z+{4jh_zlsvu(Wwn!IRls-6`x`3*l)Cx1J%O5}TA54=>hQjlh?n+=n^Zqae&flY)Z*
zp*74iG4UPY(R)tKlEjhX@1LS}Ml~jD%E}IsF%U=JD>@vGiIt#WWA&Bf<)O(UWXF&)
zGF6HbtJ)bD03^;=It1qGf`hr3WHVpK0Z{mbTKRb0B9Qm?wqVW9bStmM7X%IF#o(#r
z8f$7Ki$7#9g#6A!-0G5nFX7_WJR>5!wDauIG^?*2^X3;EJZf0y5+sL5Yz=$1g@tcI
z_EtM}E8imXRB?O5c7Glo7Kd5N$um&Bs;1Ob9G@C&jE${%mZI3f$O`jzWJ7Q_2N~%anOlc?~
z^U7lQ*Dx%}t%_6S`g+zB?FIrqewy`hA9)Y~$!Sn+v=9yjnRw49pi1F4VMJgUMK1%&
z9}nsQ2}L5J#mR{p9E^i$-hp7zVQUhiX^z}r=p)#$I(0Y!y9ON8|loXoDrESNr
zka>AsBT^-eCtnr68zw>h<*{{;Q=QUelAI&@##z1jYWw?lZe|;y7|LD4Gp3!o^7&f)
z_aOcR6H5~lQ)9FdLzvA7sr;EEfd|5@ZPd*}CI%>GrleTa*Z+0`zptMxy2|5&MGzd7
zl{r+uqI_X$fC
zgZ-$4X2!;#F;ICpG#L#rH#e@En}bUrfDSR7@nqu&Hy#b@cz0KrZ#tP=^-;TbsCIm3
zoktWKH=pw;YbJbUW}2&8u1gA6D2}Xa{5?)&K`?^0ZDU5cr2k1LEm~1-b>=I1xSEu5%Ccbm7#{F6t5i{6cvYX
z$WfvP)#yidcTu>>CickF!rQU^a4;4Xj8Bu2rzto>_P&XoB}ELDNQUlG9f~5vil$b@
z^}l+EsN#6$l-FWgRt1%5@uL~=&uQRgJ$>ZOta11r8sW1h}VaYrKKee>yy25P&w1f|JQ
zr3CV8hR~Av;Z$QNKSViv>(Dy4{dkXq3*Or$Fot?~-fdh4K$M5sWM%P{G@HnR4drw_
zy-HH;@!P{ca5pM_RUSzjwcM8juSvSP!cPTLZ{1uL^fN)3SS#>UE+~Ft>LNo0r3?od
z2>KXoEt47V($qjm>>;7D%Fn0s2=8&W7bE0l3B&bEv{6gz&%RnekBW|dtL*jWO(8)&!E5SJTC#H7
zf)8!gQZ2ipG%R{=L*Q=%oZs;VPImO`o~qmtk8x6QQcy&*ZJBwPb&D#VA^B;xMM0#P
ziXWv}Fkf(>i7S@@XG|hv;c)A;8Yt;*7)>zGs|fiuGPtLQHWKbU`q&BV%D8$-VQ9}m
zQ{IBN7paec&IBde&q`#vjK7_hmwFu65&%fOmfL}0{BDAW8kO}7
zoe&kVe3$&2hb#R;05t$tMy3~qipm5Ssc7E=gkqiWV?))23s(h6pD2=LErXF17uXVS
z5};UcACwe=*TEk44NH-w`LB
zcoQ(Pkm#HV(#PO_SCarCbtc3$Gw?-?TE1F{{6$276SM|MvX`ky?zH@X1i%y`D!4_f
zD>I~_n;26w1lSCZu;I+sa)P_6Tm++R7I_ytUl?JU#x2KUc
zG{nh)D83~?ozy=O!gHBlMvq}J=L`386U8uchCz}}0^f&wL{L-F6{Ckt3+X+M1GBsx
zoO=Dh`&8JNRoMwt^|`bxN*v!g))R$WaP}bjB%ruc)esB<0Zad>Q>%hzPol8E2ntoy
zBg|TSfp_1-8e%C~&Wg}*y4XxRIZ(gU#4@pLN#8X0Tl8QL@f$^t2QHNAiW!=d!!F
z(6SO~)6--RfhPXTw9o7L#Mh+MXrvJs?58IL?RU^Y+0KX|ZvH}31?u6PPGbR?S4FRX
zf`Nn`+*XqlwcWHbNovR@v>Z#AwZ{E$F}9Q}{nbsMdVBw#dGC+8
za;**_V_3s_umbFtnVCI?7|dM0M{V`3LXz=-_sQg(^*AT&6(b{rPej_`=eQdL2JTlB!*ve6OVsAJKcELjcvY2K_O+3O_Kl-kni$sP4BXy>T^5EftG8-LZ*2r
zkO8syv$qs*A%1BSmTOa(P<0y7-;>=3deU|8K8%YQM4{X6lPDn5@1*EFGO*Yx>&M78
zh3thVLXwl%B?ln_UIY_;Ym)Vzo;?h&t_prJRnfo_h0Vx&1ZzkpZ)K%GQ8&LEnZ1!Y
z3(nUY@t9IqI*&JqBdW%1`|)uV#QZ2j2ubuA3e7n%7hWZAh?{bJ6HCT-ybll2dJF!5
zhhfURx>FDiLMHEClY}1|I6q>7B?(H#(&IYT&3M{_2XEZ<3j9b^1ISdHg=7VK%_A!)
zq>jkb*b^g*pHbdFswzZq>6e`orGyt_DE~M*TDIhkqvI{c(T?V3VP?v~!V@HP{@z@O
z?V7(O0XkRP$wysTOs;+PQSnJB2oy#c3X~_3
zU+-z1u&^@DLsh0`^1nqe#X%#uQh~-i!gF;og7e$ku}y$?tD;|0yJcX8J3DJhQ(Nbb
zi({g3J)1Q@RTI|sSQ#@%QYQUa0y2;#7br)vkZI8Gh$rYkLf{yXb^FsF7V9O2N;>{t3<2h*yKj&!%YDGrF+fHA&~1d6$VPNNo|PI3ocZB1
zCxLXpb6nGSp2HJT-Jj<08G~e%wZ|opQe5h0tC7Lg;!|zK-v{?D+pm@p2;o-H{
z&BCg`iKD!kyu8+*MS&e$d&77|m{+^=%8v)(Z8&v9{(mw(|J8f@-*MdktRXkUM-sdKzJjh-Io
z{1ZX5d4#R)1=exxlfli`uo-5_o+W>NX!sS(Zq;gyy<$}TuvR{uY6R=H$G_Ru{@oL9
zkzBgB)O1wvQrB=pq!OxI$R)HxW|w*O{*zOoW^ucsvBB)M)kPfsG%Kvjo5a+W)Brx|
z{lIp*H+D
zPIo!7x2NUrrcuC8D+?4LsP$IdV9+dprJPKKD53$#zaZbV}p1
zu0A>Jq>H(-3SN~Pe~_Jpc%LzrH+j9d>nT6J)y8ZYpBjT&y=rg24kmX{m~%buWd1nI
z(DO;KX?qez1&O#HhsMgj4D>MT>x_DAp9AKAc%Mb?$YHFVAI1J8J6LyDC_{rIljC-Y
zwH9-O?eP{B&)wrZ1TP^KA&|c$CKL0MV`5Xg6V~678UWeswSMT_RPWfFg21Yh(r;48
z(mdDF(x7ybixY<9MJy+8?SmuH0fBMe5BKjdBA*8A9}FZn*VphZ%nle$2&u7c?xOAy
z%}dB5_xVFZwF%SbBDPvuWTJSPe^Vh3%}wEDewpFnsNv>pOnol>VNti$<)7K{2Vthh
z9X&u4*3TcarJ?X}qkntwJiy)XVQ3@}66x*iOdOCs+fVpQ8H~BFx*4
zZZqv}FB_j1s=5LriMd?Fp~emNAjAJkDhe~V)W;m08kyTCg+==?#s&{heGpaAq42{_
zZ^v?$;^wR$8sO_&$}Sks$?+LqF$D6Ln+PNM(2W+EzGUg~yk$a;Wd(Vkx~Ek$6jT=R
zdLJdnHOrm~6qMLp1)da*zBs_>K~u`B*4Cdfo+$62K9Xphr92F#mbUYahmQ>!FU=Rj
z~ojbMl5TPlCG8ZhCrZeBn7cm4@ya5`7)7t!;(H)cQn{^&6lWId
zm?_UBuc^GXVR2+LbR1-JaprGD$Z!04D<%}ih#NGl3FL!u5ZCl!T!LLFbfD9Gp{TCS
ziuqb}#bJ|NY4|W-qwL!7@yB^aT;;;UN!8p1lHt!C7}?UB{rLpOI;b6b3&kERTbMN^
zE5cX0!H~~weRjS@!m`?5g!f8r&^71W4oV
zPVmM(NRZ&}5ZpuK7Tn$4-FM~t=bt?XGqbO2pVdLNR@Hi!Joobsv5=`@K?iAnRX+l-#&%$nr+cx9v^gH?074ke^@DNh=LSXTp+eEfYtD)(7zR
z?68!6Ql9)30Bx)**LqA@l6(!Q&v+6{Emsb!BjRY-`Qv6Tj27XJn7yIoYWK|@YnS6R}m!C
zeIm=7^n?$XNnwPn4Pd@T)BWg{H;1CkUVmRr42}QtRDz?Vw1Op*!o}@+sLFy|4Nr-e
z1ElWj)O76@T8*^e=Tl;50R)npb+*s6-jnOW@|up-cvp8k}ryYyWi#fA~-_TImPf@4t^_1(dUx
zKorI>aAYq(UGblTL5V!ILTuv17V||Wc}EhxTos}ih+LkJu$&6}zvWMY6&=%EKqLxRpj}TuQAX_57eX@`(
z)e6v)JSk&iWOTC94Aqsrid3*coc$gSlB8CbO(a7J)Ea+v*mwCQ4Inc0Rl&Yg36S?G
zYSG$+X&R+ZbPA~Kgz8#c7%TlX-!RQ$#^w(zY+ud{u*^DbYi7Nvxw3O}V;+L43Rrmj
zBS%MQP_{SO4-&#+M70V)(f{J}5_+Z)6c0ce6W|C2bfc-6R$LiMYYoK3LKQ%EEm7=m
zONI374`IFrZ)>@!f$u{UB}V}EEBFT#XGl^XBI*;K*ZA9JSsAV{I|yoD+Ap8JB(^pg
zJ~Mq+mYtoSon4$N*R1%f=4AmOYU9-TRCQ>7Y?E!nbG}(6&-s;OE$sQ`o;o2tVVSzc
zos`daQd3%Z64lfmgoSdri##;WX}&uzJgWbwZSAQy^am!-KNqF6$(NMc(sll`)^|D-
zvU~Oh$4=3*($-Nc`mcWT%#i82JxclhGsu_M*ht>P3Rx&Dz#LMn1^kVaFUt;Vt~f^J
z@;0%(-pqHy`NVImTYBpoasPF?+UMtm8;7_UQV>AYse+dcAzT2bJnv?K3l?F!3&E5PaWGZX$+KzY8_s+x;+5j1Onwk&a107-O3I<8A=G|7Z1(KR5*;c<0kkgJhxC
z#wQTs5sOaH&D6*oy`^7T6{_ptD)G-#&)C$(6zz!+#o)ec^btLQE+7N&x~nenPNyY}
z*8#?`F;%$yUnZMW7$IZ%kM&5vl4dnNUDj?Wlg(WRR%6e<;
zVYvL~tgMdo$#1$Ec`GuxmLNzkCu6LUf~VT#TL;o0Yd%=Lys*+qs!*en|Bl~*lwix;
zbUievLLaO2Mz9kKEXH$eyR3x7*s8S5z1e~@u42Ly3d{%oq;iBmOP%{6w=W=!AbmIV
z8p~DgjhoPne6wm|&aVD^1%_{Id9`!77fI6>ghzS-RVp6n(*8ii@8)zd4l08AlL(WY
zGKl)hOUuY2Y&A^-ke~dcLh8t(T-Sw0@}fRbF*`+VuNldT!io#GzNOhh&c*PZNIO-H
zPkGW;OEmWgh2|EPr3%SpGXeW6ug9zXntk*Y`s*;+1W2EaQR|jkDZK-*RrGZBZ{m7>!%^t!ZJ4P&5PY@CY+}c58IR^|63?EQQAT{DQ3w6H<>wm+%hM%
zZA+izHfNE7`)i-oy-u@FCmj!rbca_C+XeKqHx#ZM3pGCz4|%-?Vu$IW?zCt|D$2o8
z^?