隐私政策 Privacy Policy
会音会签 隐私政策
生效日期：2026 年 9 月 29 日 最后更新：2026 年 10 月 3 日
本隐私政策适用于「会音会签」（以下简称「本应用」）iOS 版本，包括本应用主程序、桌面小组件、锁屏实时活动、Apple Watch 应用及其表盘复杂功能。本政策说明我们如何处理你的信息，以及你对自己信息享有的权利。
请在使用本应用前完整阅读本政策。你下载、安装、启动或以任何方式使用本应用，即表示你已阅读、理解并同意本政策所述的信息处理方式。如你不同意本政策的任何内容，请停止使用并卸载本应用。
一、关于我们
本应用由个人开发者独立开发与运营（以下简称「我们」或「开发者」）。
- 开发者名称：尼森与海
- 联系邮箱：
huayanming2019@gmail.com - 支持页面：应用内「关于 → 帮助与支持」，或邮件 huayanming2019@gmail.com
我们不是《中华人民共和国个人信息保护法》意义上的「个人信息处理者」之外的第三方受托方，也未委托任何第三方代为处理你的个人信息。
二、核心结论（请先读这一段）
本应用是一款纯本地工具。我们不设立账号体系、不运营服务器、不收集、不上传、不出售你的任何内容。
- 你创建的待办、清单、日历事项、文字便签、语音便签、录音文件、专注记录、外观与主题设置，全部只保存在你自己的设备上（应用私有目录与设备钥匙串），不会传输给我们或任何第三方。
- 我们没有你的姓名、手机号、邮箱、通讯录、位置、照片、设备标识符（IDFA/IDFV）或任何可直接识别你身份的信息。
- 办公工具里的「扫描取字」「图片取字」与 PDF 处理全部在你的设备上完成：你拍摄或选择的文件不会被上传，处理结束即从临时目录删除。
- 本应用不含任何广告 SDK、数据分析 SDK、崩溃统计 SDK、行为埋点或跨应用追踪组件，不做用户画像，不进行任何形式的定向推送。
- 因此，本应用不需要「应用跟踪透明度（ATT）」授权，也不存在把数据卖给第三方的情形。
三、我们处理的信息、目的与方式
3.1 仅保存在你设备上的信息
以下信息由你在使用过程中产生，仅存储在你的设备本地，我们无法访问：
| 信息类型 | 具体内容 | 处理目的 | 存储位置 |
|---|---|---|---|
| 待办与清单 | 任务标题、日期、时刻、清单名称、备注、完成状态、优先级、重复规则 | 实现待办管理与提醒 | 设备本地数据库（加密字段） |
| 日历与课程 | 日历事项、课程表、纪念日/倒计时 | 实现日历视图与倒计时 | 设备本地数据库（加密字段） |
| 便签内容 | 文字便签、当日记事、语音便签的波形与时长 | 实现便签与留声功能 | 设备本地数据库与文件目录 |
| 录音文件 | 你通过「语音便签/留声资产」录制的音频文件 | 播放、管理、导出你本人的录音 | 设备本地文件目录 |
| 专注与会话 | 专注计时记录、每日会话统计、连续打卡天数 | 展示专注统计 | 设备本地数据库（加密字段） |
| 设置与外观 | 主题、强调色、字体、小组件与锁屏版式、语言、录音时长等偏好 | 保存你的个性化设置 | 设备本地数据库与偏好存储 |
| 备份文件 | 你主动导出的加密备份文件 | 由你自行保管与迁移数据 | 由你选择的位置（本地/你指定的分享目标） |
3.2 需要系统权限的功能
本应用仅在实现对应功能时申请必要权限；拒绝授权只会使该功能不可用，不影响其他功能。
| 权限 | 用途 | 触发时机 | 拒绝后果 |
|---|---|---|---|
| 麦克风 | 录制语音便签、把你说的话转成待办文字 | 你首次按住录音/语音输入时 | 无法录音与语音输入，可改用键盘输入 |
| 语音识别 | 把语音转写为文字待办 | 你首次使用语音输入时 | 无法语音转文字，可改用键盘输入 |
| 通知 | 在待办到点、纪念日到点时提醒你 | 你首次创建带提醒的任务时 | 不发送到点提醒 |
| 闹钟（AlarmKit，iOS 26 及以上） | 对「闹钟类」任务在到点时全屏响铃，绕过静音以确保不错过 | 你为任务设置闹钟时 | 仅保留普通通知提醒 |
| 相机（仅 iOS 版） | 拍摄纸质文档并识别成文字 | 你在「扫描取字」中点击「拍照扫描」时 | 无法拍照取字，可改用「从相册选图」 |
| 运动与健身传感器（重力感应） | 仅在专注会话页与锁屏页用于界面视差微动效 | 进入相关页面时 | 无动效，功能不受影响 |
关于语音识别的重要说明：语音转文字通过 Apple 系统提供的语音识别服务完成。为实现转写，你按住的这段语音会由 Apple 按其自身隐私政策处理；我们不接收、不存储、不出售这些音频与识别结果，也不会将其用于转写以外的任何用途。若你希望音频完全不出设备，可以不使用语音输入而改用键盘输入；语音便签的录制、存储与播放全程在本机完成，不涉及该服务。
关于相册与相机：本应用不申请相册权限。选择图片走的是系统提供的独立选择器（iOS 的 PHPicker / Android 的系统照片选择器），你选中的图片由系统直接交予本应用，本应用无法读取你选择之外的任何照片。相机权限仅在 iOS 版、且由你主动使用「扫描取字 → 拍照扫描」时申请（使用系统文档扫描器）；Android 版的拍照由系统相机应用完成，本应用不申请相机权限。
3.3 设备间同步（系统行为）
本应用通过 Apple 提供的应用组（App Group）在你的同一台设备上为主程序、桌面小组件、锁屏实时活动与 Apple Watch 应用共享必要数据（例如今日待办与进度）。该共享发生在你的设备内部。
若你开启了 iCloud 设备备份或 iTunes/Finder 本地备份，你的设备数据（含本应用数据）会按 Apple 的规则进入该备份。这属于 Apple 系统的备份行为，我们无法访问你的备份内容，相关处理请参阅 Apple 的隐私政策。若你的备份未包含本应用用于加密的密钥，则恢复后加密内容可能无法解开（详见第七条）。
3.4 日历订阅（你主动发起的网络访问）
本应用支持你自行填写一个 iCalendar（.ics）订阅地址，以导入你选择的日历源。此时：
- 该请求由你的设备直接发向你填写的地址所在服务器，我们不经手、不中转、不记录；
- 该服务器可能因此获知你的 IP 地址等信息，其处理行为由其运营者负责，与 Apple 无关，也与我们无关；
- 你可以随时删除该订阅地址，本应用将停止后续拉取。
3.5 版本更新检查（向 Apple 查询，只读）
本应用在联网时可能向 Apple 官方的 iTunes 查询接口（https://itunes.apple.com/lookup）查询本应用自身的最新版本信息，用于在有新版本时向你发出更新提示：
- 请求仅包含本应用在 App Store 的公开应用标识（bundleId），不包含你的任何待办、便签、录音、账号信息或设备标识符；
- 该请求由你的设备直接发往 Apple，我们不经手、不中转、不记录；Apple 对该请求的处理适用 Apple 的隐私政策；
- 检查结果仅用于展示更新提示，并按天进行网络节流；在断网、应用尚未上架或查询失败时一律静默跳过，不影响任何功能；
- 本应用不据此收集信息，也不进行强制升级。
除你主动配置的日历订阅拉取（3.4）与上述向 Apple 查询版本更新（3.5）外，本应用不进行任何其他网络请求（不含广告、不含统计、不含内容分发、不含任何自动上报）。
3.6 本地崩溃诊断日志（仅存本机，需你主动导出）
当应用发生异常时，本应用可能在你的设备本地（应用私有目录 crashes/）写入一份经过脱敏的崩溃日志，内容仅包含错误类型、调用栈、应用版本号与经脱敏的异常摘要，不含你的待办、便签、录音内容或任何个人信息：
- 写入前统一脱敏：URL 查询串、令牌 / 密码 / 签名等凭据，以及异常摘要里被引号包裹的输入片段均被遮蔽；本应用自身代码也不会把任务标题、便签正文或录音内容写入日志；
- 该日志只保存在你的设备本地，不会自动上传；本应用不接入任何第三方崩溃统计或上报服务；
- 只有当你在「设置 - 诊断」中主动选择导出或分享时，该日志才会经由你指定的系统分享渠道离开设备；
- 你可以随时在诊断页删除全部本地崩溃日志。
3.7 办公文档工具（扫描 / 识别 / PDF）
办公工具中的「扫描取字」「图片取字」「PDF 转文本」「PDF 转图片」「图片转 PDF」全部在你的设备上完成：
- 拍摄或选择的图片只在应用私有临时目录中存在，用于识别与合成，处理结束即删除：不写入你的数据库，不进入备份，也不参与任何统计；
- 文字识别（OCR）、PDF 文字抽取、页面渲染与合成均由设备本地能力完成（iOS 使用系统 Vision 与 PDFKit；Android 使用随安装包分发的离线识别模型与系统 PDF 能力），不联网、不上传文件；
- 识别出的文字与生成的图片 / PDF 只交给你下一步操作（复制、分享），本应用不留存副本；
- 本应用不提供把文件上传到服务器做「转 Word / Excel / PPT」等需要云端版式还原的转换。
3.8 内购
本应用提供一次性买断（非消耗型内购项目）以解锁完整功能。支付与交易由 Apple 通过 App Store 处理，我们不会收到你的姓名、卡号、账单地址或任何支付凭证。我们仅从 Apple 收到「是否已购买该商品」的结果，用于在你的设备上解锁功能。你可随时通过 App 内「恢复购买」重新校验该结果。
四、我们不做的事
- 不收集或上传你在本应用内创建的任何内容；
- 不收集设备标识符（IDFA、IDFV）、不进行跨应用/跨网站追踪；
- 不收集精确或粗略位置、通讯录、短信、通话记录、健康数据、照片库；
- 不使用 Cookie 或类似技术进行追踪；
- 不出售、不出租、不交换你的任何信息；
- 不向你推送营销信息或第三方推广内容。
五、信息的共享、转让与公开披露
我们不共享、不转让、不公开披露你的个人信息，因为我们在技术上无法访问它们。以下情形除外：
- 你主动导出/分享：当你使用备份导出或系统分享面板将文件发送给他人或其它应用时，属于你自主决定的行为，请自行评估接收方的可信度；
- Apple 平台服务：内购交易、iCloud 设备备份、App Store 分析（聚合且匿名）由 Apple 按其政策处理；
- 法律法规要求：如果我们依法必须配合有权机关的要求，我们只能提供我们实际持有的信息，而如前所述，我们并不持有你的内容数据。
六、信息的存储期限与安全措施
6.1 存储期限
你的数据保存在你的设备上，直至你自行删除（删除单条内容、清空数据、或卸载本应用）。卸载本应用会一并删除应用私有目录下的数据；设备级系统备份中的副本按 Apple 的备份策略到期清理。
6.2 安全措施
- 字段级加密：待办、便签、专注记录等文本内容在写入本地数据库前使用 AES-256-GCM 加密；
- 密钥托管：加密主密钥保存在 iOS 钥匙串（Keychain） 中，不写入明文文件、不随应用数据一起导出；
- 备份文件加密：你导出的备份文件使用 PBKDF2-HMAC-SHA256（600,000 轮）派生密钥 + AES-256-GCM 加密，且口令由你掌握，我们无法解密。早期版本曾以 150,000 轮派生密钥，本应用仍可正常解密这些旧备份；自当前版本起，新导出的备份统一使用 600,000 轮；
- 最小权限：仅申请实现功能所必需的权限，不申请任何与功能无关的权限。
尽管我们采取了上述措施，任何本地存储都无法保证绝对安全。请妥善保管你的设备解锁密码与备份口令；若你的设备被他人解锁使用，对方可能看到本应用内的内容（本应用提供「隐私模式」用于临时遮蔽主页内容）。
七、你的权利
由于数据都在你的设备上并由你直接掌控，你可以随时在应用内直接行使以下权利，无需向我们申请：
| 权利 | 实现方式 |
|---|---|
| 查阅、更正 | 在应用内直接查看与编辑任何内容 |
| 删除 | 删除单条内容、使用「回收站」清理、或在系统中卸载本应用以删除全部数据 |
| 复制/导出（可携带） | 使用「备份」导出加密备份文件，或通过系统分享面板导出你的录音 |
| 撤回同意 | 在「设置 → 隐私」中关闭对应系统权限，或在应用内关闭相关功能 |
| 注销账号 | 不适用：本应用没有账号体系，不存在账号注销问题 |
如你认为我们在处理你的信息时违反了法律，你可以通过本政策第九条的联系方式与我们联系；你也有权向有管辖权的监管部门投诉或举报。
关于删除的特别提醒：本应用提供「回收站」用于误删恢复；回收站中的内容在你手动清空后不可恢复。卸载应用或清除应用数据后，未导出的内容将永久丢失，请务必定期导出备份。
八、未成年人保护
本应用是一款效率工具，不面向 14 周岁以下的儿童设计，也不会主动收集儿童的任何个人信息。
- 若你是不满 14 周岁的儿童，请在监护人的陪同下阅读本政策，并在取得监护人同意后使用本应用；
- 本应用没有账号体系，也不收集任何个人信息，因此不存在「儿童个人信息」的收集、存储或共享，也不存在需要我们代为删除的儿童数据；
- 本应用不含广告、不含行为追踪、不做推荐算法，不会基于未成年人的使用行为推送任何内容，也不会引导消费（应用内购买是一次性解锁，需由成年人在系统支付环节完成）；
- 若你是监护人，请指导并监督未成年人使用；如需清除未成年人在本应用内创建的内容，在应用内删除、或在设备上卸载本应用即可——所有内容只存在这台设备上，卸载即彻底清除；
- 若监护人认为我们以任何方式接触到了未成年人的信息（本应用不会主动收集），可通过第十节的方式联系我们，我们将在 15 个工作日内答复；
- 由于我们无法访问你的数据，我们无法代你删除设备上的内容。
九、隐私政策的变更
- 若本政策发生实质性变更（例如新增数据收集类型、新增第三方 SDK、新增云端能力），我们会在应用内以显著方式提示，并在更新版本时同步修订本政策；
- 重大变更会同时更新「生效日期」与「最后更新」日期，必要时在应用内再次取得你的同意；
- 你可以随时在应用内或本页面查阅最新版本。若你不同意变更内容，请停止使用并卸载本应用。
十、联系我们
如你对本政策或你的信息处理有任何疑问、意见或投诉，请通过以下方式联系我们：
- 邮箱：
huayanming2019@gmail.com - 支持页面：应用内「关于 → 帮助与支持」，或邮件 huayanming2019@gmail.com
我们会在收到你的请求后 15 个工作日内 予以回应。
十一、附：本应用使用的开源与系统组件
为透明度目的，逐项列出本应用实际使用的组件及其用途（均为通用基础库，不含广告、统计、追踪或内容分发类组件；下表可与本应用代码仓库的依赖清单逐条核对）：
| 组件 | 用途 | 是否产生网络请求 |
|---|---|---|
| drift / sqlite3 | 本地数据库（待办、便签、账目、声音资产） | 否 |
| flutter_secure_storage | 密钥与会员凭据存入系统钥匙串（Keychain） | 否 |
| encrypt / pointycastle | 字段级 AES-256-GCM 加密与摘要算法 | 否 |
| flutter_local_notifications / timezone | 本地提醒与闹钟（由系统在你的设备上弹出） | 否 |
| record / just_audio | 录音与播放；音频文件只存在本机 | 否 |
| speech_to_text | 语音转文字；转写由 Apple 系统语音识别完成（见 3.2） | 由系统提供 |
| sensors_plus | 水平仪工具读取设备姿态传感器 | 否 |
| lunar | 农历、节气与农历重复规则换算 | 否 |
| intl / flutter_localizations | 日期、数字、货币的本地化格式 | 否 |
| path_provider / file_picker / share_plus | 本地文件读写、选择文件、调用系统分享面板 | 否 |
| uuid | 在本地生成记录标识 | 否 |
| http | 仅用于你主动发起的日历订阅拉取（见 3.4） | 是（你发起时才用） |
| in_app_purchase | 应用内购买；交易由 Apple 处理，本应用不接触支付信息 | 由系统提供 |
| in_app_review | 调用系统评分弹窗 | 由系统提供 |
| 版本更新检查 | 仅向 Apple 公开接口查询本应用自身的版本号（见 3.5） | 是（只读，仅 Apple） |
| 系统文档能力（iOS：Vision / PDFKit；Android：PdfRenderer / PdfDocument） | 图片取字与 PDF 渲染、合成（见 3.7） | 否 |
| ML Kit 文本识别（仅 Android 版） | 图片取字；识别模型随安装包分发，端上离线运行 | 否 |
| PDFBox-Android（仅 Android 版） | 抽取 PDF 文字层（见 3.7） | 否 |
以上组件均在你的设备本地运行。其中内购、语音识别引擎、iCloud 备份、评分弹窗由 Apple 提供，受 Apple 隐私政策约束；http 组件本身不指向任何我方服务器——本应用没有服务器。
*本政策的解释与适用以中华人民共和国法律为準据；如你位于其他司法辖区，我们会同时遵循当地强制性法律规定。*
SoundNote Privacy Policy
Effective date: September 29, 2026 Last updated: October 3, 2026
This Privacy Policy applies to "SoundNote" (the "App"), an iOS application, including its main app, home screen widgets, Lock Screen Live Activity, Apple Watch app and watch-face complications. It explains how your information is handled and what rights you have.
Please read this policy in full before using the App. By downloading, installing, launching, or otherwise using the App, you confirm that you have read, understood, and agreed to this policy. If you do not agree, please stop using the App and uninstall it.
1. Who we are
The App is independently developed and operated by an individual developer ("we", "us", "the developer").
- Developer: 尼森与海 (Nisen & Sea)
- Contact email:
huayanming2019@gmail.com - Support page: in-app "About → Help & Support", or email huayanming2019@gmail.com
We do not act as a data processor on behalf of any third party, and we have not engaged any third party to process your personal information.
2. Summary — please read this first
The App is a purely local tool. There are no accounts, no servers operated by us, and we do not collect, upload, or sell any of your content.
- Your tasks, lists, calendar entries, notes, voice memos, audio recordings, focus records, appearance and theme settings are stored only on your own device (the App's private container and the device Keychain). They are never transmitted to us or to any third party.
- We do not hold your name, phone number, email address, contacts, location, photos, advertising identifier (IDFA/IDFV), or any data that directly identifies you.
- The document tools ("Scan to Text", "Text from Image", and the PDF tools) run entirely on your device: files you capture or select are never uploaded, and temporary copies are deleted as soon as processing finishes.
- The App contains no advertising SDKs, no analytics SDKs, no crash-reporting SDKs, no behavioural tracking, and no cross-app tracking. We do not build user profiles and do not send targeted marketing.
- Because of this, the App does not require App Tracking Transparency (ATT) authorization, and no data is ever sold.
3. Information we handle, and why
3.1 Information stored only on your device
The following is created by you while using the App and is stored locally on your device only. We have no ability to access it:
| Category | Examples | Purpose | Storage |
|---|---|---|---|
| Tasks & lists | Titles, dates, times, list names, notes, completion state, priority, repeat rules | Task management and reminders | Encrypted fields in the local database |
| Calendar & schedule | Calendar entries, class schedule, countdowns/anniversaries | Calendar views and countdowns | Encrypted fields in the local database |
| Notes | Text notes, daily notes, voice-note waveform and duration | Notes and voice-memo features | Local database and files |
| Audio recordings | Audio you record via voice notes / voice library | Playback, management, export of your own recordings | Local file directory |
| Focus sessions | Focus timer history, daily session totals, activity streak | Focus statistics | Encrypted fields in the local database |
| Settings & appearance | Theme, accent colour, fonts, widget and Lock Screen layouts, language, recording length | Persisting your preferences | Local database and preferences store |
| Backups | Encrypted backup files you explicitly export | Your own data portability | Wherever you choose to keep them |
3.2 System permissions
Permissions are requested only for the features that need them. Declining a permission disables only that feature.
| Permission | Purpose | When it is requested | If declined |
|---|---|---|---|
| Microphone | Record voice memos; dictate tasks | First time you record or dictate | Recording and dictation unavailable; keyboard input still works |
| Speech Recognition | Transcribe speech into task text | First time you use voice input | Dictation unavailable; keyboard input still works |
| Notifications | Remind you when a task or countdown is due | First time you create a task with a reminder | No due-time notifications |
| AlarmKit (iOS 26+) | Full-screen alarm for alarm-type tasks, bypassing silent mode | When you set an alarm on a task | Standard notification only |
| Camera (iOS only) | Photograph a paper document and read its text | When you tap "Scan with Camera" in Scan to Text | In-camera capture unavailable; "Choose from Photos" still works |
| Motion sensors (accelerometer) | Subtle parallax effect on the focus session and Lock Screen pages only | When those pages are open | No parallax; everything else works |
Important — how speech-to-text works. Speech-to-text is performed by Apple's system speech recognition service. To transcribe your speech, the audio you dictate is processed by Apple under Apple's own privacy policy. We do not receive, store, or sell that audio or the transcription results, and we do not use them for anything other than transcription. If you prefer that no audio ever leaves your device, simply use keyboard input instead. Recording, storing, and playing back voice memos happens entirely on your device and does not involve that service.
Photos and camera. The App does not request photo library access. Images are selected through the system's own out-of-process picker (PHPicker on iOS, the system photo picker on Android), which hands only the image you selected to the App — it cannot read any other photo. Camera access is requested on iOS only, and only when you actively tap "Scan with Camera" (the App uses the system document scanner). On Android, capture is performed by the system camera app and the App requests no camera permission.
3.3 Sharing between your own apps on the same device
The App uses an Apple App Group to share the minimum data required (for example today's tasks and progress) between the main app, home screen widgets, the Lock Screen Live Activity, and the Apple Watch app. This sharing happens entirely inside your device.
If you enable iCloud device backup or a local Finder/iTunes backup, your device data (including the App's data) is included according to Apple's rules. This is Apple's system backup behaviour; we cannot access your backups. Please refer to Apple's privacy policy. If your backup does not include the encryption key used by the App, encrypted content may not be readable after a restore (see section 7).
3.4 Calendar subscriptions (network access you initiate)
The App lets you enter an iCalendar (.ics) subscription URL to import a calendar feed you choose. In that case:
- The request is made directly from your device to the server you entered. We do not proxy, relay, or log it.
- That server may learn your IP address and similar technical information. Its handling is the responsibility of that server's operator — not Apple, and not us.
- You can delete the subscription at any time and the App will stop fetching it.
3.5 Version-update checks (read-only queries to Apple)
When online, the App may query Apple's official iTunes lookup endpoint (https://itunes.apple.com/lookup) for the App's own latest version information, in order to show an update prompt when a new version is available:
- The request contains only the App's public App Store identifier (bundleId). It does not contain any of your tasks, notes, recordings, account information, or device identifiers.
- The request is made directly from your device to Apple. We do not proxy, relay, or log it. Apple's handling of that request is governed by Apple's privacy policy.
- The result is used only to show update prompts and is network-throttled to about once per day. When offline, not yet published, or if the query fails, the App skips it silently; no feature is affected.
- The App collects no information from this and never forces an upgrade.
Other than the calendar-subscription fetch you configure (3.4) and the version-update query to Apple described above (3.5), the App performs no other network requests (no ads, no analytics, no content delivery, and no automatic reporting of any kind).
3.6 Local crash diagnostic logs (on-device only; exported only by you)
When the App encounters an error, it may write a redacted crash log locally on your device (in the App's private crashes/ directory). The log contains only the error type, call stack, app version number, and a redacted error summary, and contains none of your tasks, notes, recordings, or any personal information:
- Everything is redacted before writing: URL query strings, credentials (tokens / passwords / signatures), and any quoted input fragment in the error summary are masked; our own code never writes task titles, note bodies, or recording content into the log either.
- The log is stored only on your device and is never uploaded automatically. The App integrates no third-party crash-reporting or reporting service.
- It only leaves your device if you explicitly choose to export or share it in "Settings - Diagnostics", via the system share destination you choose.
- You can delete all local crash logs at any time from the Diagnostics page.
3.7 Document tools (scan / OCR / PDF)
"Scan to Text", "Text from Image", "PDF to Text", "PDF to Images" and "Images to PDF" run entirely on your device:
- Images you capture or select exist only in the App's private temporary directory while they are being recognised or merged, and are deleted as soon as processing finishes. They are never written to your database, never included in backups, and never counted in any analytics.
- Text recognition (OCR), PDF text extraction, page rendering and PDF assembly all use on-device capabilities (system Vision and PDFKit on iOS; an offline recognition model shipped inside the installed app plus system PDF APIs on Android). No network request is made and no file is uploaded.
- Recognised text and generated images/PDFs are handed to your next action (copy or share) only; the App keeps no copy.
- The App does not offer server-side "to Word / Excel / PPT" conversion, which would require uploading your file for cloud layout reconstruction.
3.8 In-app purchase
The App offers a one-time, non-consumable in-app purchase to unlock full functionality. Payment and transactions are handled by Apple through the App Store. We never receive your name, card details, billing address, or any payment credential. We only receive Apple's confirmation of whether the product has been purchased, which is used to unlock features on your device. You can re-verify at any time using "Restore Purchases" inside the App.
4. What we do not do
- We do not collect or upload any content you create in the App.
- We do not collect device identifiers (IDFA, IDFV) and do not track you across apps or websites.
- We do not collect location, contacts, messages, call history, health data, or photo library content.
- We do not use cookies or similar tracking technologies.
- We do not sell, rent, or trade any of your information.
- We do not send marketing or third-party promotional content.
5. Sharing, transfer, and disclosure
We do not share, transfer, or publicly disclose your personal information, because we cannot access it. The only exceptions are:
- Actions you take yourself — when you export or share a file through the system share sheet, the recipient is your choice; please assess their trustworthiness.
- Apple platform services — in-app purchases, iCloud device backup, and App Store analytics (aggregated and anonymous) are processed by Apple under Apple's policies.
- Legal requirements — if compelled by law, we can only provide what we actually hold. As explained above, we do not hold your content data.
6. Retention and security
6.1 Retention
Your data remains on your device until you delete it (deleting individual items, clearing data, or uninstalling the App). Uninstalling the App deletes the data in its private container. Copies inside device-level system backups expire according to Apple's backup policy.
6.2 Security measures
- Field-level encryption: Text content such as tasks, notes, and focus records is encrypted with AES-256-GCM before being written to the local database.
- Key management: The master encryption key is stored in the iOS Keychain; it is never written to a plain file and is never included in data exports.
- Encrypted backups: Backup files you export are encrypted with PBKDF2-HMAC-SHA256 (600,000 iterations) + AES-256-GCM, using a passphrase you control. We cannot decrypt them. Earlier app versions derived the key with 150,000 iterations; the App can still decrypt those older backups, while backups exported from the current version always use 600,000 iterations.
- Least privilege: Only the permissions required for the corresponding feature are requested.
No local storage can be guaranteed absolutely secure. Please protect your device passcode and your backup passphrase. If someone else can unlock your device, they may see the App's content (the App provides a Privacy Mode to temporarily mask the home content).
7. Your rights
Because your data lives on your device and is under your direct control, you can exercise the following rights in the App at any time, without contacting us:
| Right | How |
|---|---|
| Access / correct | View and edit any content directly in the App |
| Delete | Delete individual items, empty the in-app Trash, or uninstall the App to erase everything |
| Portability / export | Export an encrypted backup, or export your recordings via the system share sheet |
| Withdraw consent | Turn off the relevant system permissions in iOS Settings → Privacy, or disable the feature in the App |
| Account deletion | Not applicable — the App has no account system, so there is no account to delete |
If you believe we have handled your information unlawfully, you can contact us using the details in section 10, and you have the right to complain to your local data protection authority.
Please note: the App provides an in-app Trash for accidental deletions; items become unrecoverable once you empty it. After uninstalling the App or clearing its data, anything not exported is permanently lost — please export backups regularly.
8. Children
The App is a productivity tool not directed to children under 14 (or the equivalent minimum age in your jurisdiction) and does not knowingly collect any personal information from children.
- If you are under 14, please read this policy with a parent or guardian and use the App only with their consent.
- The App has no account system and collects no personal information, so there is no children's data for us to collect, store, share — or to delete on your behalf.
- The App contains no advertising, no behavioural tracking and no recommendation algorithm. It does not push content based on a minor's usage, and it does not prompt spending (the in-app purchase is a one-time unlock completed by an adult through the system payment sheet).
- Parents and guardians should guide and supervise minors' use. To delete content a minor created in the App, do so on the device directly or uninstall the App — everything lives only on that device, so uninstalling removes it all.
- If a guardian believes we have somehow come into contact with a minor's information (we do not collect it), please contact us using section 10; we will respond within 15 business days.
- Because we cannot access your data, we cannot delete content from your device on your behalf.
9. Changes to this policy
- If this policy changes materially (for example, new categories of data, new third-party SDKs, or new cloud features), we will highlight the change in the App and update this policy with the release.
- Material changes will update both the "Effective date" and "Last updated" dates, and we will obtain your consent again in the App where required.
- The current version is always available in the App and on this page. If you do not agree with a change, please stop using the App and uninstall it.
10. Contact us
For any question, comment, or complaint about this policy or the handling of your information:
- Email:
huayanming2019@gmail.com - Support page: in-app "About → Help & Support", or email huayanming2019@gmail.com
We will respond within 15 business days.
11. Appendix — components used by the App
For transparency, the following lists item by item the components the App actually uses and what each is for. All are general-purpose building blocks; none of them are advertising, analytics, tracking, or content-distribution components. The list can be checked line by line against the dependency manifest in the App's source repository:
| Component | Purpose | Makes network requests |
|---|---|---|
| drift / sqlite3 | Local database (tasks, notes, ledger entries, voice assets) | No |
| flutter_secure_storage | Keeps encryption keys and purchase credentials in the system Keychain | No |
| encrypt / pointycastle | Field-level AES-256-GCM encryption and digest algorithms | No |
| flutter_local_notifications / timezone | Local reminders and alarms, raised by the system on your device | No |
| record / just_audio | Recording and playback; audio files never leave the device | No |
| speech_to_text | Speech-to-text; transcription is performed by Apple's system speech recognition (see 3.2) | Provided by the system |
| sensors_plus | Reads device orientation sensors for the bubble-level tool | No |
| lunar | Lunar calendar, solar terms and lunar repeat rules | No |
| intl / flutter_localizations | Locale-aware date, number and currency formatting | No |
| path_provider / file_picker / share_plus | Local file access, file selection, the system share sheet | No |
| uuid | Generates record identifiers locally | No |
| http | Used only to fetch a calendar feed you explicitly subscribe to (see 3.4) | Yes, only when you start it |
| in_app_purchase | In-app purchase; the transaction is handled by Apple, the App never sees payment details | Provided by the system |
| in_app_review | Invokes the system rating prompt | Provided by the system |
| Version-update check | Queries only Apple's public endpoint for the App's own version (see 3.5) | Yes, read-only, Apple only |
| System document capabilities (iOS: Vision / PDFKit; Android: PdfRenderer / PdfDocument) | Image OCR, PDF rendering and assembly (see 3.7) | No |
| ML Kit text recognition (Android only) | Image OCR; the model ships inside the installed app and runs offline on device | No |
| PDFBox-Android (Android only) | PDF text-layer extraction (see 3.7) | No |
All of these run locally on your device. In-app purchase, the speech-recognition engine, iCloud backup and the rating prompt are provided by Apple and governed by Apple's privacy policy. The http component points at no server of ours — the App has no server.
*This policy is governed by the laws of the People's Republic of China. If you are located elsewhere, we will also honour the mandatory provisions of your local law.*