Privacy Policy for "Inks / 见字"

Version: v1.3

Effective Date: August 28, 2026

📋 Basic Information

• Developer: Wenpeng Wang (Indie Developer)
• Contact Email: hachineko@yeah.net
• Contact WeChat: nekooohachi
• Scope: The Inks app and official website. The app is currently available on the Apple App Store in Mainland China, the United States, the United Kingdom, Australia, and Canada.
• System Support: iOS 17.0 or later. Requirements may vary by the version currently available on the App Store.

🎯 Important Notes

We value your privacy. This app adopts a "Local First" design:

• ✅ Letter content is stored only on your device by default and is never automatically uploaded to servers
• ✅ No user tracking: We do not use advertising identifiers (IDFA) and do not conduct cross-app or cross-site tracking
• ✅ No data selling: We will never sell your personal information to third parties
• ✅ You are in control: You can disable analytics at any time and use the export, deletion, and account-management controls available in the current version

📊 Data Collection Overview

The table below summarizes the types of data we may collect. None of the collected data is used for tracking purposes.

📌 Key Notes:

• Data marked “Yes” is linked to your Inks account, device authorization, or analytics identity. This does not mean cross-app tracking. We do not associate these identifiers with other companies' apps or websites.
• The local profile identifier and analytics identifier are used separately. The local profile identifier is created on first launch to keep on-device profile data. During cloud sign-in, it is sent to the developer's self-hosted service to identify which local profile initiated the sign-in, but it is not used to create the analytics identifier.
• While you are signed out and analytics is enabled, Inks uses a random analytics identifier that is not already linked to a cloud account. If you later sign in, records from before and after sign-in may be associated so that use before and after sign-in can be understood as one continuous period. This is why the table marks the data as linked to you.
• In-app analytics requires you to actively enable the Data Analytics/Sharing toggle. You can turn it off at any time. Basic website traffic analytics is described in Section 1.8.
• Letter content (body text and attachments) is excluded from analytics. Relevant content is processed only when you actively choose to share, export, or upload a related resource.
• Live location and unlock snapshots used by location locks are processed only on the device. They are not uploaded to the developer or analytics services and are therefore not treated as collected Location data in Apple's privacy label.

1. Information We Process (Details)

1.1 Content You Create (Letters/Writing)

Corresponding Apple Data Type: Other User Content

What is collected:

• Letter body text, titles, handwritten doodles, text blocks, stickers, and related letter information
• Letter lists, writing content, letter access configurations, etc.

Storage location:

• ✅ Stored only on your device by default
• ❌ Never automatically uploaded to our servers

How it is used:

• Writing your first letter, local browsing, viewing statistics, and other basic experiences can be completed without signing in
• Creating additional letters requires using Sign in with Apple to register a cloud account (but letter content remains local only)
• Letters protected by a password or security question are encrypted using the password or answer you set. Letters without access protection should not be understood as strongly encrypted by default.

When it may be transmitted:

• When you actively choose to export, use the system share sheet, or upload custom resources
• Related files or resources will be processed locally or transmitted over the network according to the action you choose

What we do NOT do:

• ❌ Do not automatically upload your letter content as cloud backup
• ❌ Do not read or report letter body text through analytics
• ❌ Do not transmit letter content without your explicit action

File access:

• This app supports File Sharing, allowing you to manage locally stored .mbx files via iTunes/Finder

1.2 Cloud Account & Sync Data

Corresponding Apple Data Types:

• Email Address
• Name — corresponds to the "Nickname" you set
• User ID
• Device ID

When it is collected:

When you actively use the following cloud features:

• Apple Sign-In
• Cloud account profile management
• Badge system
• Restoring purchased access
• Custom avatar or custom sticker upload

What it includes:

• Apple Sign-In information: Sign-in confirmation from Apple, Apple user identifier, and email (if provided by Apple)
• Account profile: Nickname, birthday, motto, avatar
• Purchase and subscription status: Purchased access, subscription status, device authorization, feature trial allowance, badges
• Custom resources: Custom avatars, custom stickers you actively upload
• Technical information: Device identifier, device model, system version, app version, language, time zone

Why this data is needed:

• Account identification: Distinguish between different users and provide a personalized experience
• Purchase access management: Record your purchase status and restore purchased access across devices
• Resource sync: Provide cloud storage for supported features (such as avatars, custom stickers)

Important notes:

• ✅ Account profile sync is only used for cloud account details, purchase and subscription access, badges, avatars, custom stickers, and other cloud-connected features
• ❌ The current version does not automatically upload letter body text, attachments, or letter resources as cloud backup

1.3 Usage Analytics

When you enable "Data Analytics/Sharing", we may collect and send usage information that does not include letter content, to improve the app and purchasing experience, such as:

• Feature usage: Which features or visual effects are used and how often.
• Settings changes: Whether "Data Analytics/Sharing" is turned on or off.
• Purchase-page activity: Where the page was opened from, time spent, and page actions.
• These records may also include necessary information such as the device model, system version, and app version (see 1.5 for details).

Analytics does not collect or upload any letter body, letter list, or private text.

How analytics is handled across App Store regions:

• App Store region set to Mainland China: analytics data is sent to the developer's self-hosted AnalyticsHub.
• App Store region set to the United States, United Kingdom, Australia, or Canada: analytics data is sent to PostHog US.
• If the App Store region cannot be confirmed, or the app cannot be confirmed as a supported App Store release, analytics does not start for that use.
• The analytics service is selected only from the App Store region, not the app language, device language, or device region. AnalyticsHub and PostHog each process data for their listed regions and do not forward it to the other service.

When the device is offline: Usage records may be temporarily stored on the device and sent automatically when the connection is restored. If you disable "Data Analytics/Sharing", Inks stops sending new usage records.

1.4 In-App Purchases

• Purchases and payments are processed by Apple. We do not collect payment information such as bank card numbers.
• We may send purchase records, transaction information, or purchase status provided by Apple to the developer's self-hosted service to confirm purchases, link cloud-account access, restore access, and authorize devices.
• When you enable "Data Analytics/Sharing", we send information about purchase-related actions, such as viewing the purchase page, purchase success or failure, and restoring purchases. We use this information to understand the purchase process and improve the experience. It does not contain card numbers or other sensitive payment details; it includes only necessary information such as the selected product and where the purchase page was opened.

1.5 Technical Information & Identifiers (For Analytics, Account, and Security)

When Data Analytics/Sharing is enabled, or when you use cloud account, purchase verification, or privacy request features, we may process the following technical information to provide analytics, account services, and security:

• Device & App Information: Device model, system version, app version, language, time zone, etc.
• Identifiers:
• Local profile identifier: Randomly generated on first launch and stored in the local database and Keychain to keep on-device profile data. During cloud sign-in, it is sent to the developer's self-hosted service to identify which local profile initiated the sign-in. It is not your cloud-account identity and is not used to create the analytics identifier.
• Cloud account user ID: Used for account profiles, purchase and subscription access, and related cloud features after sign-in.
• Analytics identifier: Used only after you enable analytics. While signed out, it is randomly generated, with development, test, and production data kept separate. It is not created from the local profile identifier, Apple user identifier, or hardware identity. After sign-in, analytics records use the cloud account user ID, and records from before and after sign-in may be associated.
• Device identifier: Created or loaded locally on first launch. Inks uses the system-provided Identifier for Vendor (IDFV) where available; otherwise it uses a random identifier stored in Keychain. It is transmitted only after you enable analytics or use cloud sign-in, purchase verification, device authorization, or another related cloud feature.
• Session identifier: A temporary identifier created for one usage session after analytics is enabled.
• Network Information: When your device sends data to our servers, your Internet Protocol (IP) address is automatically recorded in server logs as part of a standard HTTP request. We collect IP addresses for:
• Prevention of abuse and abnormal access detection (e.g., frequent requests, malicious attacks);
• Technical troubleshooting and service stability monitoring.

We do not actively use IP addresses to identify you, and we do not convert them into precise or coarse location profiles. Server logs are cleaned regularly, and IP addresses are typically retained for no more than 90 days.

1.6 Privacy Request Contact Information (Export/Delete Request)

When you initiate an export or deletion request for statistical data in the App Settings page, we process the following additional information:

• Contact Email: Used to notify you of the processing results.
• Request Note (optional): Used to assist manual processing.
• Request Information: Such as request time, device identifier, user identifier, region information, and app version.

The above information is used only to process your data export or deletion request and keep necessary processing records. It is not used for advertising.

1.7 Biometric Features (FaceID / TouchID)

When you use security features like "App Lock" or "Hidden Letters", we may invoke the iOS local authentication framework.

• Local Validation Only: The validation process takes place entirely within your device's Secure Enclave.
• No Collection: We cannot access, store, or upload your raw biometric data (face, fingerprint). The app only receives a "Success" or "Failure" result returned by the system.

1.8 Basic Website Traffic Analytics

Optional website analytics are off by default. Only after you choose “Allow analytics” does the site send basic page-view events to the developer's self-hosted AnalyticsHub in Mainland China. We use this information to check that pages work and understand which help content is visited most often. Declining does not affect the website.

The information may include:

• page path and title;
• the path of a referring page on this site, or the domain of an external referring site;
• browser language;
• visit time;
• a randomly generated website visitor identifier (ah_did);
• the IP address and necessary server logs produced by a standard network request.

The site does not send URL query parameters or page fragments. After you allow analytics, AnalyticsHub sets an HttpOnly first-party cookie named ah_did. It is limited to the current website host and lasts for up to 180 days. If the network is unavailable, up to 50 usage records created within the previous 24 hours may be kept temporarily in the browser.

Necessary local storage remembers whether you allowed or declined analytics for up to 180 days. This preference is not used for analytics. You can reopen Analytics settings from the website footer at any time. When you withdraw consent, the site stops sending new usage records, clears records that have not yet been sent, and asks AnalyticsHub to remove ah_did from your browser. Withdrawal does not affect aggregate processing already completed.

The website visitor ID is not linked to letters, cloud accounts, or purchase records in the Inks app. It is not used for advertising, profiling, or cross-site tracking. Website analytics is processed by AnalyticsHub in Mainland China, so visits from other countries or regions may involve an international data transfer. You can use the contact details in this policy to ask questions or request access to or deletion of identifiable data associated with this ID.

2. Permissions Usage

Photo Library Usage Description:

When you choose to save statistical cards, letter screenshots, exported images, or Live Photos to your album, the app requests add-only photo library permission. When you actively select images for avatars, custom stickers, or letter decoration, the app reads only the images you choose. We only process content that you actively select or save.

FaceID / Biometric Usage Description:

We use FaceID/TouchID to protect your letter privacy, used only for locally unlocking the app or hidden content. When you enable App Lock or access hidden content, the app requests authentication. This permission is used only for local verification to protect your privacy; we do not acquire your biometric data.

Motion Usage Description:

We use device motion sensors to provide dynamic lighting effects for stickers.

Location Usage Description:

We need your location information only while you are using the app to provide location-based letter unlocking, such as arrival or stay conditions. The conditions you set are stored locally with the letter's access settings, and your device determines whether they are met. We do not upload your real-time location or movement history to any server.

3. Information Sharing & Third-Party Services

We do not sell your personal information. In-app analytics runs only after you enable Data Analytics/Sharing. Website analytics runs only after you allow it. Relevant service providers include:

• PostHog Cloud (US region): For product analytics when the App Store region is the United States, United Kingdom, Australia, or Canada.
• AnalyticsHub (the developer's self-hosted service in Mainland China): For product analytics when the App Store region is Mainland China, and for basic website analytics that a visitor has allowed.
• The developer's self-hosted privacy request system: For receiving export or deletion requests, recording progress, and sending results.
• Apple: For Sign in with Apple, App Store in-app purchases, subscription management, refunds, and other system features.
• Developer's self-hosted cloud services: For cloud account sign-in, account profiles, avatars, custom stickers and other cloud-connected custom resources, badges, purchase and subscription access, purchase confirmation, device authorization, and remote configuration.

After you submit an export or deletion request, the developer will process it manually in the service that stores the relevant data (AnalyticsHub or PostHog), then record and notify you of the result through the privacy request system.

Shared data does not contain letter content or private text. We take reasonable measures to limit the scope of data use.

When the App Store region is the United States, United Kingdom, Australia, or Canada, app analytics data is processed by PostHog US. Website analytics is processed by AnalyticsHub in Mainland China. Each is enabled only after the relevant choice is made, and you can withdraw that choice in app settings or website Analytics settings.

4. Data Security & Storage

• Letter content is stored ONLY on your local device by default.
• Analytics data storage and transmission: When the App Store region is Mainland China, app analytics and website analytics are processed by AnalyticsHub in Mainland China. When the App Store region is the United States, United Kingdom, Australia, or Canada, app analytics is processed by PostHog US. All network transmission uses HTTPS.
• Cloud account profiles, avatars, custom stickers and other cloud-connected custom resources, badges, purchase and subscription status, purchase confirmation, device authorization, and related data are stored in the developer's self-hosted cloud services to provide account and purchase-access features that you actively enable.
• Privacy request numbers, processing status, contact email, and notes are stored in the developer's self-hosted database to track progress and keep necessary records.
• Privacy request data is retained for the period needed to complete the request, keep necessary records, and comply with legal requirements. It is deleted or anonymized after that period unless the law requires otherwise.
• We take reasonable security measures (such as transmission encryption, access control, etc.), but internet transmission does not guarantee absolute security.
• This app does not use encryption features that require additional export-compliance reporting.

5. Your Rights & Choices

• Disable Data Analytics/Sharing: You can disable this feature in Settings; reporting stops immediately upon disabling.
• Withdrawal of Consent: Turning off "Data Analytics/Sharing" stops new analytics data from being sent; it does not affect lawful processing completed before withdrawal. Export or deletion requests and their necessary processing records are deleted or anonymized after the legally required or otherwise necessary retention period.
• Website Analytics: Open Analytics settings from the website footer to allow or decline analytics. Withdrawing clears records that have not yet been sent and asks AnalyticsHub to remove the analytics ID from your browser. Declining does not affect the website.
• Request Export of Analytics Data: You can submit an export request in Settings. You will receive an email when processing is complete.
• Request Deletion of Analytics Data: You can submit a deletion request in Settings. You will receive an email when processing is complete.
• Export Letter Content: You can export a letter as .mbx. If it has no access protection, you can also export images, PDF, video, or Live Photo. A complete local-data package export is not currently available in Settings.
• Delete Local Content: You can delete individual or selected letters in the App. One-step deletion of all App data is not currently available in Settings. Deleting the App will still remove its local data, so back up important letters first.
• Delete Local Data (System Level): You can also delete local data by deleting the app; re-installing will generate a new local user identifier.
• Cloud Account Data: You can manage your cloud account profile, avatar, and related content in the App profile/account pages. You can also use the contact methods in this policy to request changes to cloud account information, custom stickers and other cloud-connected resources, or purchase access records. We process these requests according to the account status, legal requirements, and necessary processing records.
• Cloud Account Deletion: You can delete your cloud account and associated cloud personal data in the App. Deleting a cloud account does not cancel App Store subscriptions. Subscription cancellation, refunds, and payment records must still be handled through your Apple account or Apple Support.

We handle requests to access, correct, delete, withdraw consent, or object to processing as required by applicable law, and respond within the applicable time limit. Users in the United Kingdom may also complain to the Information Commissioner's Office (ICO). Users in Australia or Canada may contact their local privacy regulator.

6. Protection of Minors

This app is intended for general users and is not specifically directed at children under 13. We do not knowingly collect personal information from children under 13; if discovered, we will delete it as soon as possible.

7. Updates to Policy

We may update this Privacy Policy from time to time. Major changes will be notified via in-app prompts or accessible locations.

8. Contact Us

Email: hachineko@yeah.net

WeChat: nekooohachi

*This document was updated to v1.3 on August 28, 2026 to reflect current availability and regional analytics services, explain website analytics choices and how long its cookie and choice record are kept, and clarify exports for letters with access protection.*