隱私政策

EnDiary is developed and operated by ThinksView. This policy describes the iOS and Android apps and our cloud service. Writing locally does not require a registered account.

1. Local writing and optional backup

Entries are stored in your device’s database. iOS supports syncing with your private iCloud database; Android does not use iCloud. If you choose cloud backup, the app encrypts the snapshot before uploading it to Cloudflare R2. Keys are managed on your device; iOS can sync supported keys through iCloud Keychain. Android keys are device-bound. Uploading a backup does not guarantee that a key can be recovered after reinstalling or changing devices.

2. Cloud AI and text in results

Some eligible iOS devices can process supported AI tasks locally. Full cloud corrections and writing assistance send the text you submit, relevant writing context, level and language preferences through our Cloudflare service to the DeepSeek API. Current apps send writing statistics and error categories for weekly reports. Older apps may also submit saved phrases; the current service ignores those phrases and does not forward them to the AI provider. Everyday curated topic suggestions can be selected offline.

Correction results include rewritten text and may include original sentences or excerpts. These results are text-bearing data, rather than anonymous error labels. We do not keep a separate diary input field in the cloud database.

3. Retention in our service

• Review result caches expire 24 hours after successful completion. Expired results are unavailable through both the app API and administrative reads, even if cleanup is delayed. Scheduled cleanup removes result text in bounded batches.
• Server-side weekly reports expire after 30 days and are removed by scheduled cleanup. Results already saved on your device remain there until you remove them.
• Random cloud identity, request fingerprints, job status, consent records, quota and token counts, subscription references, device/app metadata and error-category statistics are retained to operate the service until you delete your cloud data. Signup security metadata includes a hashed IP address and client information. Request fingerprints and status can remain after result text expires to prevent duplicate processing.
• Optional encrypted backups remain until you delete them or your cloud data. Infrastructure recovery copies and third-party data have their providers’ retention lifecycles; the app’s result-cache expiry is not a promise of immediate erasure from every recovery system.

4. Providers, analytics and payments

Cloudflare provides cloud execution, database and encrypted object storage. DeepSeek processes cloud AI requests. Their processing can occur outside your region. We cannot promise zero retention or that submitted content is excluded from provider training without verified terms covering our API usage. DeepSeek’s public policy is not evidence of a separate no-training agreement for EnDiary.

We use Firebase Analytics for product events such as feature use, review outcomes and purchases, together with SDK device/app and approximate-region metadata. Our custom events and application logs do not include diary text or payment credentials. Debug analytics are disabled. Anonymous identifiers are service identifiers, not a guarantee that information is legally anonymous.

Apple App Store and Google Play process subscriptions. We receive transaction or purchase references and subscription status to verify entitlements; we do not receive your payment card details. We do not sell personal information. Information may be disclosed when required by applicable law.

Provider information: Cloudflare, DeepSeek API terms, DeepSeek public privacy policy, Firebase.

5. Your choices and deletion

You can write offline without requesting cloud corrections, writing assistance or weekly reports. Current apps enable cloud fallback for supported AI actions; a separate Local Only setting is not currently available. You can export entries as Markdown. Me → Cloud Data → Delete Cloud Data removes our active cloud identity linkage, sessions, statistics, result caches, consent records and encrypted backups. A stripped deletion marker remains to reject the deleted identity. Local entries remain on your device. Deleting cloud data does not cancel a store subscription; manage cancellation in App Store or Google Play. It does not delete provider-held analytics or copies governed by providers’ recovery policies.

Contact smile@thinksview.com to ask about access, correction, deletion or other privacy rights available where you live. Requests may require enough information to locate the relevant cloud identity without collecting diary content.

6. Children and policy changes

EnDiary is not directed at children under 13. Contact us if a child has supplied personal data so that we can address it. We update this page when our processing changes; the date above identifies this version.