Privacy

[Company Name] ("we", "us") operates the application and website you are using. This Privacy Policy explains what personal data we collect, why, and the choices you have. For questions, contact us at [privacy@example.com].

Account data: email address, display name, and authentication identifiers (including OAuth provider IDs when you sign in with Google or GitHub).

Usage and content: prompts and generations you create, credit transactions, and support messages.

Payment data: orders and subscription status. Card details are handled by our payment processors (e.g. Stripe, RevenueCat) and are not stored on our servers.

Technical data: IP address, device information, and diagnostics used for security, fraud prevention, and reliability (including crash/error monitoring).

To provide and secure the service: authentication, credits and billing, AI features, and abuse prevention.

To communicate with you about your account, transactions, and important changes.

To comply with legal obligations and enforce our terms.

We do not sell your personal data.

Where applicable (e.g. GDPR), we process data to perform our contract with you, for our legitimate interests in operating and securing the service, to comply with the law, and with your consent where required.

We share data with service providers that help us run the product, such as hosting, database, object storage, email, payment, AI inference, and error-monitoring providers. Each app is isolated; your data is scoped to the app you used.

We may disclose data if required by law or to protect rights, safety, and the integrity of the service.

Depending on which features are enabled in the build you use, the app and website embed the following third-party SDKs, which may collect the data listed below. [Template note: keep this list in sync with the SDKs your app actually enables and delete the rest — China app-store review compares it against the binary.]

In the mobile app (each present only when the feature is enabled):

Umeng U-App Analytics — provider: Umeng Tongxin (Beijing) Technology Co., Ltd.; purpose: usage statistics; data: device identifiers (Android ID / OAID / IDFA), device and network information. Policy: https://www.umeng.com/page/policy

JPush — provider: Shenzhen Hexun Huagu Information Technology Co., Ltd.; purpose: push notifications (Android in China); data: device identifiers, network information. Policy: https://www.jiguang.cn/license/privacy

WeChat Open SDK — provider: Shenzhen Tencent Computer Systems Co., Ltd.; purpose: WeChat sign-in; data: device identifiers, network status. Policy: https://weixin.qq.com/cgi-bin/readtemplate?t=weixin_agreement&s=privacy

Sentry — provider: Functional Software, Inc.; purpose: crash and error monitoring; data: device information, crash logs, IP address. Policy: https://sentry.io/privacy/

PostHog — provider: PostHog, Inc.; purpose: product analytics; data: device information, in-app usage events. Policy: https://posthog.com/privacy

RevenueCat — provider: RevenueCat, Inc.; purpose: in-app purchase and subscription management; data: purchase receipts, app user ID, device information. Policy: https://www.revenuecat.com/privacy

Google Sign-In — provider: Google LLC; purpose: account sign-in; data: Google account identifier, email address. Policy: https://policies.google.com/privacy

Expo (EAS Update / notifications) — provider: 650 Industries, Inc.; purpose: app updates and push delivery; data: device information, push token. Policy: https://expo.dev/privacy

On the website:

Google Analytics and Microsoft Clarity — providers: Google LLC / Microsoft Corporation; purpose: site analytics, session replay and heatmaps; data: usage data, device information, cookies. Policies: https://policies.google.com/privacy / https://privacy.microsoft.com/privacystatement

Umeng U-Web and SensorsData (China site build) — purpose: site analytics; data: usage data, device information. Policies: https://www.umeng.com/page/policy / https://www.sensorsdata.cn

Stripe.js on checkout pages — provider: Stripe, Inc.; purpose: payment processing; data: payment details you enter, device information. Policy: https://stripe.com/privacy

We keep personal data for as long as your account is active or as needed to provide the service, then for a limited period to meet legal, accounting, or security requirements. Deleted accounts are marked as deleted and purged on a scheduled basis.

Depending on your location, you may have rights to access, correct, export, or delete your personal data, and to object to or restrict certain processing. You can delete your account from settings, or contact [privacy@example.com].

We use industry-standard safeguards including password hashing (Argon2id), hashed tokens, access controls, rate limiting, and audit logging. No method of transmission or storage is 100% secure.

The service is not directed to children under the age required by your jurisdiction, and we do not knowingly collect their data.

We may update this policy from time to time. Material changes will be notified through the service or by email. Continued use after changes means you accept the updated policy.