XYZPhoto 隐私政策 / Privacy Policy
更新及生效日期 / Updated and effective: 2026-10-13

简体中文

1. 范围与联系我们

本政策说明 XYZTech 开发与维护的 XYZPhoto iOS 应用如何处理信息。开发者身份以 App Store 产品页为准。隐私问题、访问、更正、删除或撤回请求请联系 XYZTechFeedBack@gmail.com。本政策适用于应用；你选择访问的外部网站、Apple 服务及其他接收方另适用其政策。

2. 照片、识别结果与本地数据

核心编辑、美颜、抠图、OCR、面部候选识别、打码、取色、元信息处理及 Core ML 增强在本机执行。应用会按你选择读取照片像素、照片内已有 EXIF/GPS 等属性、文字或面部区域，用于展示和处理；当前不把这些内容上传到我们的服务器或发送给统计／广告 SDK，也不使用照片、面部地标或识别文字建立身份识别档案或训练我们的远端模型。面部候选识别用于编辑或打码，不是身份认证。

为恢复及继续编辑，应用可在自身目录保存源图像素副本、编辑参数和历史。选择编辑器的放弃草稿操作可删除对应草稿；清理网页缓存不会删除草稿。应用也会保存工具偏好、隐私选择、必要的购买权益状态及生成中的临时文件。保存到相册／文件或已分享的副本由该位置单独管理，删除草稿不会删除这些副本。

照片可能包含位置、人物、文字等敏感信息。元信息清理只处理支持的字段；识别和打码不能保证发现全部敏感内容或完全匿名，请在交付前检查结果。

3. 权限及你主动触发的联网

  • 相册：选择和读取你授权的照片，并在你保存时添加结果；可在系统中限制照片访问范围。iCloud 资源可由 Apple 按需下载。
  • 相机：用于 AR 画廊等需要相机的功能。核心照片编辑不要求持续访问相机。
  • 剪贴板：你选择粘贴时读取图片，不为统计收集剪贴板内容。
  • 附近传图：通过 Apple 附近连接服务发现设备并建立加密会话，可能需要本地网络／蓝牙权限；使用随机显示名，只有经交互确认的连接才传送所选照片。对方设备会取得照片副本，请确认接收人。
  • 网页与地图：网页提图访问你输入的网页和图片地址，对方服务器可收到 IP、请求地址等网络信息；照片地图使用已有 GPS 和地图服务，不等于获取当前设备 GPS。地图提供方可处理所请求地图区域等服务数据。
  • 分享与购买：分享会把你选择的结果交给目标应用／设备；StoreKit 向 Apple 查询商品、处理付款及验证权益。我们不收集银行卡完整资料。

可在 iOS 设置管理系统权限；拒绝某项权限只影响依赖它的功能。上述联网由功能操作触发；下述可选统计与广告另有触发和控制条件。

4. 地区服务与可选使用统计

应用根据 Apple App Store 商店市场选择服务：大陆市场使用友盟，其他已识别市场使用 Firebase Analytics；同一进程固定提供方，市场未确定时不启动这些地区 SDK。该判断不使用实时 GPS 或界面语言。Firebase 与友盟统计各自默认关闭，选择独立保存；同意其中一个不自动授权另一个。你可在应用“设置 → 使用情况统计”开启或撤回当前提供方的统计；拒绝不影响核心编辑或已购买权益。撤回停止后续统计收集，不自动删除已经送达服务端的历史记录。

我们主动发送四类使用事件：页面及页面类别、所选工具、编辑完成入口、导出格式及数量范围。字段为固定类别或数量分组，不含照片、文字识别内容、文件名、EXIF 或照片 GPS。SDK 还会处理会话、首次使用、参与度、广告测量及相关运行数据，并可能通过设备或应用范围标识关联多次使用；这些数据不应理解为完全匿名。

  • Google Analytics for Firebase（Google LLC 及其关联方；Firebase Analytics 12.19.0）：仅在对应市场且开启统计后，用于了解功能使用及改进产品。处理应用实例标识、应用版本、设备型号／系统版本、语言、网络信息及使用事件。网络连接涉及 IP；Google Analytics 官方说明不记录或存储 IP。当前应用关闭 Analytics 的 IDFA、IDFV、自动页面采集与广告相关同意项。政策：Google 隐私政策；Firebase 隐私说明。
  • 友盟移动统计（友盟同欣（北京）科技有限公司；UMCommon 7.6.8 / UMDevice 3.6.0）：仅大陆市场开启统计后，用于使用统计和产品改进。处理 IDFV、UMID 等 SDK 设备标识、设备／系统／应用版本、网络与 IP 信息及统计事件。当前关闭 PI（归因相关能力）、ASA、SKAN 和自动页面上报；这些设置不代表不处理统计所需的设备信息。友盟总政策还列有北京锐讯灵通科技有限公司，详情见 友盟隐私政策。

5. 广告、隐私选择与 SDK

只有已确认免费用户具备广告展示资格，Pro 用户免应用内广告。应用支持横幅、插屏及用户主动选择的取色激励广告。当前请求非个性化广告；广告仍可处理设备／应用／网络信息、曝光及点击等信息，用于广告投放、效果衡量、稳定性及反作弊，不能理解为不处理任何个人信息。

  • AdMob / Google Mobile Ads（Google LLC 及其关联方；13.10.0）：其他已识别市场，在隐私流程允许且符合展示条件时，处理 IP（可用于估算粗略地区）、设备或应用范围标识、广告交互以及性能／诊断信息。当前关闭广告个性化及 publisher first-party ID，不主动请求 ATT，也不向广告提供方提交照片或识别文字。SDK 数据说明；Google 隐私政策。
  • Google User Messaging Platform（Google LLC 及其关联方；3.1.0）：用于更新广告隐私状态、在需要时展示同意表单及适用隐私选项，并确定是否允许广告请求；处理隐私选择、请求及基础设备／网络等必要信息。可在应用“广告隐私”入口使用当地适用的选项，并非所有地区都有相同开关。UMP 说明。
  • 穿山甲广告 SDK（北京巨量引擎网络技术有限公司；Ads-CN / BUAdSDK 7.8.0.7）：大陆广告与统计分开征求同意，默认未授权，可在应用“广告隐私”入口改变选择。仅配置启用且你同意后，才用于广告投放、监测、诊断和反作弊，涉及设备／应用／网络信息、IP、IDFV 等设备范围标识及广告交互数据。当前禁用个性化广告和 IDFA，不提供精确位置、Wi-Fi BSSID 或运动信息。截至本政策更新，三个穿山甲代码位尚未配置，SDK 不启动广告请求；实际启用前仍须满足上述条件。穿山甲 SDK 隐私政策。

供应商 SDK 的完整声明可能覆盖比当前开启功能更广的数据类别；禁用 IDFA 或个性化不代表没有任何标识或网络处理。具体选择与设备／地区适用控制共同决定实际处理。

6. 信息接收、安全与保留

我们仅为本政策所述目的及适用合法依据处理信息。照片本机处理不需要你注册我们的账号。你同意的统计和获准的广告会向上述相应供应商传送所需数据，Apple 或你选择的网页、设备及分享目标会接收对应功能数据。不会把照片或识别文字作为广告定向资料提供给这些 SDK。法律要求的披露，以及依法进行的业务变更，须遵守适用法律和必要的信息保护要求。

本地草稿保留用于恢复编辑，直到你放弃相应草稿或删除应用数据；“卸载 App”保留数据与“删除 App”不同。系统备份由你的 Apple 设置和 Apple 规则控制，已导出或接收的副本不随应用数据删除。网络缓存可在应用设置清理。统计／广告数据仅按相关目的所需、服务后台适用保留设置及法律要求保留，期满按适用机制删除或汇总；如需了解与你请求有关的保留及删除方式，请联系上述邮箱。我们不承诺撤回开关可立即删除供应商历史记录。

本地数据受 iOS 应用隔离及设备保护机制管理，附近传图使用加密会话，统计及广告使用供应商网络机制；没有系统能保证绝对安全。不要把未检查的含敏感信息照片发送给不信任的目标。

Google 及其服务基础设施可能在你所在国家或地区之外处理数据；友盟及穿山甲按其政策说明处理相关数据。选择大陆服务不等于应用一切联网均限于境内，你主动访问的网页、Apple、地图或分享接收方可能位于其他地区。对需要另行告知或单独同意的跨境处理，应在满足适用要求后进行。

7. 你的选择与权利

你可拒绝或撤回可选统计、管理适用广告隐私选项、限制系统权限、放弃本地草稿、清理网络缓存，并在相册／文件或接收服务中管理已导出内容。可联系上述邮箱申请了解、访问、更正、删除或限制相关个人信息处理及行使适用法律赋予的其他权利；为避免误删或泄露，我们可能需要核实请求及必要身份关联信息。我们会按适用法律处理请求并说明不能处理的原因，不要求你发送照片或密码作为普通咨询前提。取消订阅请使用 Apple 管理订阅渠道。

8. 未成年人及政策变化

未达到所在地独立个人信息同意年龄的用户应在监护人指导及必要同意下使用；监护人如认为有未经允许的相关收集，可联系我们处理。更新会在本页列明日期；对目的、数据类别或接收方的重大变化，我们会提供适当通知，需要重新同意时另行取得同意。

English

1. Scope and contact

This policy covers XYZPhoto for iOS, developed and maintained under the XYZTech name; the developer is identified on the App Store listing. Contact XYZTechFeedBack@gmail.com for privacy questions or access, correction, deletion and withdrawal requests. Apple, websites and other destinations you choose have their own policies.

2. Photos and local data

Core editing, beauty, cutout, OCR, face-candidate detection, redaction, palette extraction, metadata tools and Core ML enhancement run on-device. The app reads selected pixels, embedded EXIF/GPS, text or face regions for the requested tool. It does not currently upload this content to our servers or send it to analytics/ad SDKs, create an identity profile from faces/text, or use it to train our remote models. Face detection supports editing/redaction, not identity authentication.

Local drafts may retain source pixels, parameters and edit history for recovery. Discarding the relevant editor draft deletes that draft; clearing web cache does not. The app also stores preferences, privacy choices, necessary entitlement state and temporary working files. Photos/Files exports and copies sent elsewhere are managed separately and survive draft deletion. Metadata cleanup and redaction do not guarantee complete anonymity or detection of every sensitive detail; review outputs.

3. Permissions and transfers you initiate

Photo permission lets you select authorized images and save results; Apple may download iCloud assets. Camera access serves AR features. Clipboard images are read when you paste. Nearby transfer may require local-network/Bluetooth access, uses a random display name and encrypted session, and sends selected images only through a confirmed connection; the recipient obtains a copy.

Web extraction visits chosen page/image addresses, whose servers can receive your IP and request details. Maps use existing photo GPS and map-service requests, rather than current device GPS. Sharing gives selected content to your destination. StoreKit sends product, payment and verification requests to Apple; we do not collect full card details. Manage permissions in iOS Settings; refusal affects dependent features. Optional analytics and ads have separate conditions below.

4. Regional and optional analytics

Apple App Store storefront determines the provider: mainland China uses Umeng; other recognized markets use Firebase Analytics. A provider is fixed per app process, and unresolved markets do not start these regional SDKs. This decision does not use live GPS or interface language. Analytics is off by default with separate saved choices for Firebase and Umeng. Consent to one does not authorize the other. Enable or withdraw the current provider in Settings → Usage Analytics. Refusal does not affect core editing or purchased rights. Withdrawal stops subsequent collection, without automatically erasing historical server records.

Our four custom event categories cover page/class, tool selection, editing-completion entry and export format/count range. Fixed categories and buckets exclude photos, recognized text, file names, EXIF and photo GPS. SDKs also process session, first-use, engagement, advertising measurement and related operational data, and may associate uses with app/device identifiers; these data are not necessarily anonymous.

  • Google Analytics for Firebase (Google LLC and affiliates; 12.19.0): after analytics consent in applicable markets, processes app-instance identifiers, app/device/OS versions, language, network information and usage events to understand and improve the app. Connections involve IP; Google Analytics states that it does not log or store IP addresses. Current app configuration disables Analytics IDFA/IDFV collection, automatic screen reporting and advertising consent categories. Google Privacy Policy; Firebase privacy information.
  • Umeng mobile analytics (友盟同欣（北京）科技有限公司; UMCommon 7.6.8 / UMDevice 3.6.0): after mainland analytics consent, processes SDK identifiers such as IDFV/UMID, device/OS/app/network/IP information and events for usage analysis and improvements. PI (attribution-related capability), ASA, SKAN and automatic page reporting are disabled; this does not eliminate basic statistical device information. Umeng’s general policy also names 北京锐讯灵通科技有限公司. Umeng Privacy Policy.

5. Advertising and controls

Only confirmed free users are eligible for in-app ads; Pro is ad-free. Supported placements are banners, interstitials and optional palette rewarded ads. Current requests are non-personalized, but necessary device/app/network, impression/click and diagnostic data can still be processed for delivery, measurement, stability and fraud prevention.

  • AdMob / Google Mobile Ads (Google LLC and affiliates; 13.10.0): in other recognized markets when privacy conditions and eligibility permit, processes IP (including coarse-region estimation), device/app-scope identifiers, ad interactions and performance/diagnostic information. Personalization and publisher first-party ID are disabled, the app does not actively request ATT, and photos/recognized text are not supplied. SDK disclosure; Google policy.
  • Google UMP (Google LLC and affiliates; 3.1.0): updates ad-privacy status, displays required forms/options and determines whether ads may be requested. It processes choices and necessary request/device/network information. Use applicable options in the app’s Ad Privacy entry; controls vary by region. UMP information.
  • CSJ / 穿山甲 (北京巨量引擎网络技术有限公司; Ads-CN/BUAdSDK 7.8.0.7): mainland ad consent is separate from analytics and defaults to not granted; change it in Ad Privacy. Only configured service with consent can process necessary device/app/network/IP, device-scope identifiers such as IDFV, ad interaction and diagnostic data for delivery, measurement and fraud prevention. Current configuration disables personalization and IDFA and supplies no precise location, Wi-Fi BSSID or motion data. As of this update all three placements are unconfigured, so the SDK does not start ad requests. CSJ SDK Privacy Policy.

A supplier’s full SDK declaration may include capabilities beyond enabled features. Disabling IDFA or personalization does not eliminate all identifiers or networking. Actual processing depends on configuration, choices and applicable controls.

6. Recipients, retention and security

We process information for the purposes above on applicable lawful grounds. Local photo processing does not require an account with us. Consented analytics and permitted ads send necessary data to the relevant providers. Apple and your chosen websites, peers and sharing destinations receive corresponding feature data. Photos/recognized text are not supplied for ad targeting. Legally required disclosures and lawful business changes remain subject to applicable safeguards.

Local drafts support recovery until you discard the relevant draft or delete app data. Offloading an app retains data and differs from deleting it. System backups depend on your Apple settings/rules; exported and received copies are managed independently. Clear network cache in app settings. Analytics/ad data are retained according to purpose necessity, applicable service-backend retention settings and legal requirements, then deleted or aggregated under applicable mechanisms. Contact us for retention/deletion information relevant to your request; withdrawal does not promise immediate erasure of provider history.

iOS isolation/device protections govern local data; nearby sessions are encrypted and analytics/ads use supplier networking mechanisms. No system guarantees absolute security. Review sensitive images before sending to a destination you do not trust.

Google and its infrastructure may process data outside your country. Umeng and CSJ process data as described in their policies. Mainland provider selection does not restrict all network activity to China; Apple, maps and your chosen websites/destinations may operate elsewhere. Transfers requiring additional notice or separate consent must satisfy applicable requirements before occurring.

7. Choices and rights

Decline/withdraw optional analytics, manage applicable ad choices and OS permissions, discard local drafts, clear web cache and manage exports at their destinations. Contact us to request information, access, correction, deletion, restrictions or other rights available under applicable law. We may need to verify a request and necessary identity/record association to prevent disclosure or incorrect deletion, and will handle requests or explain limitations under applicable law. Ordinary inquiries do not require sending photos or passwords. Cancel subscriptions through Apple.

8. Minors and changes

Users below the local age of independent data consent should use it with guardian guidance and required permission. Guardians may contact us about unauthorized collection. Revisions carry a date here; material changes to purposes, data or recipients will be notified appropriately and fresh consent obtained where required.