Privacy Policy

1. Introduction

Qinghongco ("we", "us", "our", or the "Company") is committed to protecting your privacy. This Privacy Policy (the "Policy") describes how we collect, use, disclose, and safeguard information when you visit our website at qinghongco.com, download and use our mobile applications (each, an "App") published under the Qinghongco developer name on the Apple App Store, Google Play Store, Mac App Store, or any other application distribution platform (collectively, the "Platforms"), or otherwise interact with us.

This Policy applies to all our websites, applications, products, and services (collectively, the "Services"). It also explains your privacy rights and how the law protects you.

By accessing or using our Services, you agree to the terms of this Privacy Policy. If you do not agree with the terms of this Policy, please do not access or use the Services.

2. Definitions

• Personal Data: Any information relating to an identified or identifiable natural person.
• Processing: Any operation performed on Personal Data, including collection, storage, use, disclosure, or deletion.
• Data Controller: The entity that determines the purposes and means of processing Personal Data.
• Data Processor: The entity that processes Personal Data on behalf of the Data Controller.
• User / You: Any individual who accesses, downloads, or uses our Services.
• Device: Any electronic device used to access our Services, including smartphones, tablets, computers, or smartwatches.
• SDK: A Software Development Kit integrated into our Apps that provides specific functionality.
• Advertising ID: A unique, user-resettable identifier provided by the operating system for advertising purposes (e.g., Apple's Identifier for Advertisers — IDFA; Google's Advertising ID — GAID).
• EEA: The European Economic Area.
• UK: The United Kingdom.

3. Data Controller

The Data Controller responsible for your Personal Data is:

Qinghongco
Bristol & Bath Science Park
United Kingdom
Email: contact@qinghongco.com

For all data protection matters, including inquiries about your rights under applicable data protection laws, please contact our Data Protection team at the email address above.

4. Scope & Application

This Policy applies to:

• Our Website: All pages at qinghongco.com and any subdomains.
• Our Mobile Applications: All Apps published under the Qinghongco developer name on the Apple App Store, Google Play Store, Mac App Store, visionOS App Store, watchOS App Store, and any other distribution Platforms.
• Our Desktop Applications: All macOS applications distributed through the Mac App Store or our website.
• Our Wearable Applications: All watchOS, Wear OS, and similar wearable Apps.
• Customer Support Communications: Any communication you have with us regarding our Services.
• Marketing Communications: Where you have explicitly opted in to receive them.

This Policy does NOT apply to:

• Third-party websites or services linked from our Services.
• Third-party applications or services integrated with our Apps through user-initiated actions.
• Information collected by Platform providers (Apple, Google, etc.) independently of our Apps.

5. Information We Collect

We collect different categories of information depending on how you interact with our Services.

5.1 Information You Provide Directly

• Contact Information: Name, email address, phone number (when you contact us or fill out forms).
• Account Information: Username, password (hashed), profile data if you create an account.
• Communications: Any content of messages you send to us, including support requests and feedback.
• Payment Information: For premium features, payments are processed by Apple, Google, or other Platform providers — we do not directly collect or store your payment card details.

5.2 Information Collected Automatically

• Device Information: Device model, operating system version, unique device identifiers, mobile carrier, language settings.
• Usage Information: Features used, time spent in App, crash logs, performance data.
• Log Data: IP address, browser type (for website), referring/exit pages, timestamps.
• Approximate Location: Country/region level location derived from IP address (we do not collect precise GPS location).

5.3 Application-Specific Data (Local-First)

The following types of data are collected and processed entirely on your device unless you explicitly enable cloud sync (where available):

• LocalFlow: Automation scripts, workflow definitions, triggers.
• CollectionIQ: Collection entries, valuation history, category metadata.
• PosturePro: Sensor readings (accelerometer, gyroscope), posture analysis results.
• EstateVault: Encrypted documents, vault metadata, biometric authentication references.
• Inkstone: Notes, ideas, semantic links, organizational structures.
• CadenceBudget: Budget entries, transaction records, financial categories.

5.4 Information from Third Parties

• Platform Providers: Apple, Google may provide us with aggregated analytics, crash reports, and App Store download metrics.
• Analytics Providers: Anonymous usage statistics, with privacy-preserving settings enabled.
• Advertising Partners: Anonymous ad performance metrics (see Advertising Networks section).

6. Legal Basis for Processing (GDPR)

Under the EU General Data Protection Regulation (GDPR) and UK GDPR, we rely on the following legal bases for processing your Personal Data:

• Performance of a Contract: Where processing is necessary to provide our Services to you.
• Legitimate Interests: Where we have a legitimate interest that is not overridden by your fundamental rights, such as improving our Services and ensuring security.
• Consent: Where you have given explicit consent, such as for marketing communications or non-essential cookies. You may withdraw consent at any time.
• Legal Obligation: Where we need to comply with applicable laws and regulations.
• Vital Interests: Where processing is necessary to protect someone's life.

7. How We Use Information

We use collected information for the following purposes:

• Service Delivery: To provide, maintain, and improve our Apps and website.
• Personalization: To remember your preferences and settings (stored locally).
• Customer Support: To respond to your inquiries and provide technical support.
• Analytics & Improvements: To understand how users interact with our Services and improve them.
• Advertising: To display relevant advertisements in our free Apps (see Advertising Networks).
• Security: To detect, prevent, and address fraud, security issues, and abuse.
• Legal Compliance: To comply with applicable laws, regulations, and legal processes.
• Communications: To send you service-related notices, with your consent for marketing communications.

8. Local-First Processing Architecture

Our applications are built on a foundational principle: your data stays on your device unless explicitly required otherwise.

• On-Device Computation: All sensitive computations — including document encryption, posture analysis, budget calculations, and note organization — are performed locally on your device.
• Local Storage: User-generated content (documents, notes, financial data) is stored locally using platform-native secure storage (Apple Keychain, Android Keystore, etc.).
• No Server Escrow: We do not maintain copies of your encrypted data on our servers. Encryption keys are derived from your device or passphrase and never transmitted.
• Optional Sync: Where cloud sync is offered, it is strictly opt-in and uses end-to-end encryption with keys only you control.
• Telemetry Opt-In: All usage analytics and crash reporting are opt-in and fully anonymized.

9. App Store & Application Data

When you download our Apps from a Platform (Apple App Store, Google Play, etc.), the Platform provider may collect information about you independently. We have no control over such collection and recommend reviewing the Platform's privacy policy:

• Apple: Apple's Privacy Policy applies to all data collected by Apple, including App Store downloads, in-app purchases, and any Apple ID-linked information. Apple's privacy choices are managed through iOS Settings > Privacy & Security.
• Google Play: Google's Privacy Policy applies to data collected by Google Play. Privacy controls are available through your Google Account settings.
• Mac App Store: Apple's macOS Privacy controls apply, managed through System Settings > Privacy & Security.

9.1 In-App Purchases

All in-App purchases and subscriptions are processed by the Platform provider. We receive only limited information: anonymous purchase confirmation, transaction ID, and product identifier. We do not receive your payment card details or billing address.

9.2 Subscription Data

Subscription status is managed by the Platform. We store only an anonymous, non-transferable entitlement token on your device to unlock premium features.

10. Advertising Networks & AdMob Integration

Some of our free Apps display advertisements through third-party advertising networks. This section provides comprehensive disclosure of our advertising practices and integrations, in compliance with the Apple App Store guidelines, Google Play Store policies, GDPR, CCPA, ePrivacy Directive, and all applicable advertising regulations.

10.1 Advertising in Our Apps

To support the free tier of our Apps, we integrate advertising SDKs that may display the following types of ads:

• Banner Ads: Standard inline display advertisements shown at designated areas of the App interface.
• Interstitial Ads: Full-screen advertisements displayed at natural transition points (e.g., between levels, after completing a task).
• Rewarded Video Ads: Video advertisements that users can choose to watch in exchange for in-App rewards (e.g., unlocking a feature, receiving virtual currency).
• Splash / Open Screen Ads: Full-screen advertisements displayed when the App is launched.
• Native Ads: Advertisements designed to match the visual style and format of the surrounding content.
• MREC (Medium Rectangle) Ads: Medium-sized banner-style ads that fit within content feeds.

10.2 Consent Management

For users in the EEA, UK, and Switzerland, we obtain explicit consent before:

• Storing or accessing information on your device (e.g., cookies, Advertising IDs).
• Processing Personal Data for behavioral advertising purposes.
• Sharing data with advertising partners for personalized advertising.

You can withdraw consent at any time through the App's privacy settings or your device's privacy controls.

10.3 Children's Privacy

We do not direct advertising to children under 13 (or higher age where required by local law). All advertising SDKs we integrate are configured to:

• Treat known users under 13 as children.
• Disable behavioral advertising for children.
• Comply with COPPA, GDPR-K, and other applicable children's privacy laws.

11. Ad Formats & Technologies

The following ad formats may be displayed through our integrated advertising SDKs. Each format has specific technical and compliance considerations:

11.1 Banner Ads

• Static or animated image banners displayed in fixed positions within the App UI.
• Common sizes: 320×50 (mobile banner), 728×90 (leaderboard), 300×250 (medium rectangle).
• Refresh intervals comply with platform policies (typically 30-60 seconds minimum).
• No interaction without user tap; no auto-redirects.

11.2 Interstitial Ads

• Full-screen ads displayed at natural app transition points.
• Frequency capped to comply with platform policies.
• Always include a clearly visible close button.
• Not displayed during active user input or critical App functions.

11.3 Rewarded Video Ads

• User-initiated — the user chooses to watch in exchange for a reward.
• Clearly labeled as advertisements.
• Reward granted only after ad completion, not upon click.
• Skip button (if available) provided after platform-required minimum duration.

11.4 Splash / Open Screen Ads

• Full-screen ads shown when the App is first launched.
• Always closeable within platform-required time limits.
• Not displayed on subsequent App foregrounds within a short time window.

11.5 Native Ads

• Ads designed to match the look and feel of the surrounding content.
• Clearly identified as "Sponsored", "Advertisement", or "Ad" with prominent disclosure.

12. Third-Party Ad Networks

Our Apps may integrate the following advertising networks and SDKs. Each network has its own privacy practices that govern the data they collect:

12.1 Google AdMob (Google LLC)

Purpose: Primary ad serving, mediation, and analytics.

• Data Collected: Advertising ID (IDFA/GAID), device information, IP address, app usage, ad interaction data, coarse location.
• Compliance: Google AdMob is certified under the EU-US Data Privacy Framework, GDPR compliant, supports CCPA opt-out signals, COPPA-compliant when configured for child-directed content.
• Privacy Policy: https://policies.google.com/privacy
• Opt-out: iOS Settings > Privacy > Tracking; Android Settings > Google > Ads.

12.2 Meta Audience Network (Facebook)

Purpose: Display and video ad serving.

• Data Collected: Advertising ID, device info, app events, conversion data.
• Compliance: GDPR compliant with consent flow; CCPA opt-out supported.
• Privacy Policy: https://www.facebook.com/policy.php

12.3 Unity Ads (Unity Technologies)

Purpose: Video and playable ad serving, especially for gaming apps.

• Data Collected: Advertising ID, device data, IP address, app usage.
• Privacy Policy: https://unity.com/legal/privacy-policy

12.4 AppLovin (AppLovin Corporation)

Purpose: Programmatic ad mediation and bidding.

• Data Collected: Advertising ID, device identifiers, behavioral data.
• Privacy Policy: https://www.applovin.com/privacy/

12.5 ironSource (now Unity)

Purpose: Ad mediation and rewarded video.

• Privacy Policy: https://www.is.com/privacy-policy/

12.6 Vungle (Liftoff Mobile)

Purpose: Video ad serving and rewarded ads.

• Privacy Policy: https://vungle.com/privacy/

12.7 Chartboost (now LoopMe)

Purpose: In-app programmatic advertising.

• Privacy Policy: https://www.chartboost.com/legal/privacy-policy/

12.8 InMobi (InMobi Technology Services)

Purpose: Mobile ad serving and programmatic mediation.

• Data Collected: Advertising ID, precise location (with permission), device data.
• Privacy Policy: https://www.inmobi.com/privacy-policy

12.9 Tapjoy (Tapjoy, Inc.)

Purpose: Rewarded video and offerwall advertising.

• Privacy Policy: https://www.tapjoy.com/legal/advertisers/privacy-policy/

12.10 Pinterest Ads (Pinterest, Inc.)

Purpose: Display and shopping ad serving.

• Privacy Policy: https://policy.pinterest.com/en/privacy-policy

12.11 TikTok Ads (ByteDance Ltd.)

Purpose: Display and video advertising for TikTok audience network.

• Privacy Policy: https://www.tiktok.com/legal/privacy-policy

12.12 Snap Ads (Snap Inc.)

Purpose: Display and AR advertising.

• Privacy Policy: https://snap.com/en-US/privacy/privacy-policy

12.13 Twitter / X Ads (X Corp.)

Purpose: Display and promoted content advertising.

• Privacy Policy: https://twitter.com/en/privacy

12.14 LinkedIn Ads (Microsoft Corporation)

Purpose: B2B-oriented advertising.

• Privacy Policy: https://www.linkedin.com/legal/privacy-policy

12.15 Amazon Publisher Services / Amazon Ads

Purpose: Display advertising and header bidding.

• Privacy Policy: https://www.amazon.com/gp/help/customer/display.html

12.16 Mintegral

Purpose: Programmatic mobile ad mediation.

• Privacy Policy: https://www.mintegral.com/en/privacy

12.17 Pangle (ByteDance)

Purpose: Video and rewarded advertising.

• Privacy Policy: https://www.pangleglobal.com/privacy

12.18 BidMachine

Purpose: Programmatic header bidding for mobile.

• Privacy Policy: https://bidmachine.io/privacy-policy/

12.19 Digital Turbine

Purpose: Mobile ad mediation and monetization.

• Privacy Policy: https://www.digitalturbine.com/privacy-policy/

12.20 Smaato (now Verve Group)

Purpose: Programmatic real-time bidding.

• Privacy Policy: https://www.smaato.com/privacy/

13. Cookies & Tracking Technologies

Our website uses cookies and similar tracking technologies. We classify cookies into the following categories:

13.1 Essential Cookies

These cookies are strictly necessary for the website to function. They enable basic features like page navigation, security, and accessibility. The website cannot function properly without these cookies.

• Session cookies: Maintain your session state during navigation.
• Security cookies: Detect and prevent security threats.
• Preference cookies: Remember your settings (e.g., cookie consent choice).

13.2 Analytics Cookies (Optional)

These cookies help us understand how visitors interact with our website by collecting anonymous information. We use privacy-respecting analytics with IP anonymization enabled.

13.3 Marketing Cookies

We do not use marketing cookies on our website. Our marketing efforts are conducted through direct, opt-in channels.

13.4 Mobile Advertising Identifiers

Our Apps respect platform-level controls for advertising identifiers:

• iOS: Apple's App Tracking Transparency (ATT) framework. Users see a permission prompt and can opt out.
• Android: Google Play Services Advertising ID. Users can opt out via Settings > Google > Ads.

14. Data Sharing & Disclosure

We do not sell your Personal Data. We may share information in the following limited circumstances:

• Service Providers: With vendors who help us operate our Services (analytics, hosting, customer support). These providers are contractually obligated to protect your data.
• Advertising Partners: As described in the Ad Networks section, with appropriate consent.
• Legal Requirements: When required by law, court order, or to protect our legal rights.
• Safety: To protect the safety of any person.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, with appropriate confidentiality protections.
• With Your Consent: For any other purpose disclosed at the time of collection.

15. International Data Transfers

As a UK-based company serving a global audience, we may transfer Personal Data to countries outside your country of residence, including:

• United Kingdom: Primary data hosting and processing location.
• European Union: For users in the EEA, we ensure GDPR-compliant transfer mechanisms (Adequacy Decisions, Standard Contractual Clauses).
• United States: Some service providers may process data in the US under EU-US Data Privacy Framework.

We rely on the following transfer mechanisms to ensure adequate protection:

• UK ICO International Data Transfer Agreement (IDTA).
• EU Standard Contractual Clauses (SCCs).
• EU-US Data Privacy Framework (DPF).
• UK Extension to the DPF.
• Adequacy Decisions issued by the European Commission or UK ICO.

16. Data Retention

We retain Personal Data only as long as necessary to fulfill the purposes for which it was collected, including:

• Account Data: Until you delete your account, plus a reasonable period for backup retention.
• Support Communications: Up to 3 years for quality assurance and training purposes.
• Analytics Data: Aggregated, anonymized data may be retained indefinitely.
• Legal Obligations: As required by applicable law (e.g., tax, accounting).

App-specific local data is retained only on your device and is under your control. Uninstalling the App removes all locally stored data (subject to backup retention by your device or Platform).

17. Security Measures

We implement industry-standard technical and organizational security measures to protect your Personal Data, including:

• Encryption in Transit: TLS 1.3 for all data transmission.
• Encryption at Rest: AES-256 encryption for stored data.
• End-to-End Encryption: For sensitive data where applicable.
• Secure Enclaves: Apple's Secure Enclave and Android Keystore for key management.
• Access Controls: Strict role-based access to production systems.
• Regular Audits: Periodic security assessments and penetration testing.
• Employee Training: Regular privacy and security training for all staff.
• Incident Response: Documented procedures for security incident handling and breach notification.

Despite our efforts, no security measure is 100% secure. We encourage you to use strong, unique passwords and enable two-factor authentication where available.

18. Children's Privacy (COPPA, GDPR-K, etc.)

We are committed to protecting children's privacy and comply with all applicable children's privacy laws, including:

• COPPA (Children's Online Privacy Protection Act) — United States.
• GDPR-K — United Kingdom and European Union.
• AADC (Age Appropriate Design Code) — United Kingdom.
• COPPA 2.0 / APRA (proposed) — United States.
• Other regional children's privacy laws as applicable.

18.1 Our Policy on Children

• Our Apps are not directed to children under 13 (or higher where required by local law).
• We do not knowingly collect Personal Data from children under 13.
• If we become aware that we have collected Personal Data from a child under 13 without verifiable parental consent, we will delete it promptly.
• All advertising SDKs integrated in our Apps are configured to disable behavioral advertising for known children.

18.2 Age-Screen

Where required by applicable law, we display age-screening prompts to identify users under the age threshold and apply appropriate privacy protections.

19. Age Restrictions

The minimum age to use our Services is determined by the jurisdiction in which you reside:

If you are under the minimum age in your jurisdiction, you may only use our Services with the verifiable consent of a parent or legal guardian.

20. Regional Privacy Rights

Depending on your location, you may have specific rights regarding your Personal Data. We honor these rights for users worldwide, regardless of their jurisdiction, to the extent permitted by applicable law.

• Right of Access: Request access to the Personal Data we hold about you.
• Right of Rectification: Request correction of inaccurate or incomplete data.
• Right of Erasure: Request deletion of your Personal Data.
• Right to Restrict Processing: Request limitation of how we process your data.
• Right of Data Portability: Receive your data in a structured, commonly used, machine-readable format.
• Right to Object: Object to processing based on legitimate interests or for direct marketing.
• Right to Withdraw Consent: Where processing is based on consent, withdraw it at any time.
• Right to Lodge a Complaint: Lodge a complaint with your local data protection authority.

21. GDPR (EEA / UK) Specific Provisions

21.1 Lawful Basis

For users in the EEA and UK, we process Personal Data under the following lawful bases: consent, contract performance, legal obligation, vital interests, public task, or legitimate interests (per Article 6 GDPR).

21.2 International Transfers

Personal Data may be transferred outside the EEA/UK only with appropriate safeguards in place, as detailed in the International Data Transfers section.

21.3 Supervisory Authority

Users in the EEA/UK have the right to lodge a complaint with their local data protection authority. UK users may contact the Information Commissioner's Office (ICO) at ico.org.uk.

21.4 EU Representative

In accordance with Article 27 GDPR, our EU representative can be contacted through contact@qinghongco.com.

22. CCPA / CPRA (California) Specific Provisions

22.1 Your California Rights

Under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), California residents have the following rights:

• Right to Know: Request information about categories and specific pieces of Personal Data collected, sources, purposes, and third-party sharing.
• Right to Delete: Request deletion of Personal Data we have collected.
• Right to Correct: Request correction of inaccurate Personal Data.
• Right to Opt-Out of Sale/Sharing: We do NOT sell your Personal Data. We also allow you to opt out of any "sharing" for cross-context behavioral advertising.
• Right to Limit Use of Sensitive Personal Information: Limit our use of sensitive Personal Data to that necessary to provide the Services.
• Right of Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

22.2 How to Exercise CCPA Rights

California residents may exercise their rights by emailing contact@qinghongco.com. We will respond to verifiable requests within 45 days.

22.3 Shine the Light

California Civil Code Section 1798.83 permits California residents to request information about the categories of Personal Data shared with third parties for those third parties' direct marketing purposes. We do not share Personal Data for third-party direct marketing.

23. PIPL (China) Specific Provisions

For users in the People's Republic of China, we comply with the Personal Information Protection Law (PIPL):

• We process Personal Data only with consent or other lawful bases as defined in PIPL.
• We provide clear notice of data processing activities.
• Personal Data transfers outside China occur only with PIPL-compliant mechanisms (security assessment, standard contract, certification).
• Users have rights to access, correct, delete, and port their Personal Data.
• We appoint a Personal Information Protection Officer responsible for PIPL compliance.

24. LGPD (Brazil) Specific Provisions

For users in Brazil, we comply with the Lei Geral de Proteção de Dados (LGPD):

• All processing is based on one of the ten lawful bases defined in LGPD Article 7.
• Brazilian users have rights to confirmation, access, correction, anonymization, portability, deletion, and information about sharing.
• The Brazilian National Data Protection Authority (ANPD) is the supervisory authority.
• International transfers follow LGPD standards equivalent to GDPR.

25. App Privacy Report (Apple) & Data Safety (Google)

We publish App Privacy Report information on Apple's App Store and Data Safety information on Google Play for each of our Apps. These disclosures include:

• Categories of data collected.
• Whether data is linked to user identity.
• Whether data is used for tracking.
• Categories of data shared with third parties.

Our privacy practices are consistent with these disclosures. We commit to updating App Store privacy information as our practices evolve.

26. Your Rights & Choices

26.1 How to Exercise Your Rights

You may exercise your privacy rights by:

• Emailing us at contact@qinghongco.com.
• Using in-app privacy controls (where available).
• Adjusting device-level privacy settings (iOS Settings > Privacy, Android Settings > Privacy).
• Opting out of advertising personalization via the relevant ad network settings.

26.2 Response Times

We will respond to verifiable requests within the timeframes required by applicable law:

• GDPR: 1 month (extendable by 2 months for complex requests).
• CCPA/CPRA: 45 days (extendable by 45 days with notice).
• LGPD: 15 days.
• PIPL: 30 days.

26.3 Verification

To protect your privacy, we may need to verify your identity before processing your request. We will only use the information provided for verification for that purpose.

27. Changes to this Policy

We may update this Policy from time to time. When we do, we will:

• Update the "Last updated" date at the top of this Policy.
• Notify you through our website, Apps, or email (where appropriate) of material changes.
• Where required by law, obtain your renewed consent before applying changes.

We encourage you to review this Policy periodically to stay informed about our privacy practices.

28. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Qinghongco — Privacy Team
Bristol & Bath Science Park
United Kingdom
Email: contact@qinghongco.com
Subject line: Privacy Inquiry

We will respond to your inquiry within 30 days.