Pact & Purr Privacy Policy

Version and effective date: October 16, 2026. Controller and individual operator: HuDeYao (胡德耀), 3176167989@qq.com. This covers the app and website. Read before consenting; sensitive, child and AI data need additional consent where required. Agreement is not unlimited unrelated permission. The Chinese text prevails in case of differences, subject to mandatory law and your rights.

1. Data and retention

Data is processed for relevant features; refusing optional access does not stop unrelated features. Guest data primarily stays on the device; public requests still require network/security processing.

Accounts: email, verification records, account ID, Apple identity and returned name/email, sessions and security records support authentication. Hide My Email is supported. Codes/sessions expire; account data is retained for necessary periods and deleted or lawfully de-identified on deletion. Apple revocation credentials serve authentication management.

Features/family: nickname, child nickname/minor flag, goals, focus/completion, companions, rooms, inventory, adventures and notifications support records, sync and rewards. No exact birthday is required. These last for necessary account/feature periods and are cleaned on relevant deletion.

Purchases: product/order/transaction IDs, verified Apple transactions, membership duration and fish/creation-resource changes support delivery, restoration, duplicate-charge prevention, refunds and accounting. We do not obtain full bank cards or Apple payment passwords. Retention is limited to delivery, accounting, actual disputes and law; necessary retained records are isolated and restricted.

Selected media/AI: pet images, selected video content/necessary frames, companion images, instructions and results support optional separately authorized creation; faces/identity are not required. Submitted materials follow account/task retention and cleanup on resource/account deletion. Unsubmitted action-learning uploads enter cleanup after 24 hours; third-party retention is separate.

Tap audio: uploaded audio and format/duration support your companion preview/playback, without microphone access or AI cloning/analysis/synthesis. It is retained during use; replaced/reset sounds enter cleanup after 24 hours and deletion removes them. Membership expiry pauses use while retaining resources for renewal.

Device/network/push: device identifiers, OS/app version, necessary IP, security logs and enabled push IDs support communication, safety, notices and troubleshooting, not cross-app advertising. Retention follows necessary feature/security/legal periods; disabled/expired notifications stop, and deletion removes bindings.

Local: language, guest drafts, playback/download caches and login state support offline use and continuity. Necessary data syncs after login. Device/app cleanup rules apply. Exported copies on albums/other devices cannot be remotely deleted by account deletion.

Support: volunteered email, issue, necessary order/task IDs and screenshots support resolution; do not send passwords, full codes or irrelevant private data. Retain only for support, follow-up, actual disputes or law, then delete/anonymize.

Apple authorization security: actual grant issue times, necessary event watermarks and hashed subject/event identifiers help prevent repeated or delayed notices from affecting newer sign-ins. Account deletion detaches the user and removes grants and deletable state; minimum hashes and watermarks remain restricted only while necessary for replay prevention and other security purposes, with retention necessity reviewed. Full notification bodies are not stored. Hashing does not automatically anonymize data; this policy still protects it.

2. Basis and permission

Processing relies on your requested service, contract, valid consent or another lawful basis. Camera/photos/notifications are requested in context. Current features do not request contacts, precise location, IDFA or cross-app tracking. System withdrawal affects future access, not existing uploads; see Permission Usage. We do not sell private uploads or use them for our own model training. New purposes, ad tracking or non-essential SDKs require prior notice and necessary authorization.

3. Providers

Only necessary minimum data goes to providers with purpose/security limits. A selector does not grant the whole library. Apple independently handles its account/payment information; voluntary shares follow recipient rules.

Apple: external identity, verification, product and transaction data support sign-in, verification, delivery, restoration, refund notices and revocation when requested; no Apple password. Apple Privacy Policy.

Aliyun: uploaded/generated image/video/audio and resource IDs support storage and controlled access. Private media uses access control/temporary URLs. Aliyun Privacy Policy.

Image/multimodal processing: Vision and multimodal analysis use PPTOKEN OpenAI-compatible APIs for selected images, companion images, necessary action frames and instructions. Companion image creation primarily uses Ark Seedream. If the primary service clearly does not accept a request, explicitly fails, or returns an unusable result and safe fallback conditions are met, the same references and instructions may be sent to PPTOKEN for image generation; rollback settings and historical image tasks may also use that API directly. PPTOKEN's legal operator, regions, retention and downstream chain remain unconfirmed. OpenAI's official policy is a model-provider reference, not proof that it binds the intermediary or entire chain. OpenAI Privacy Policy, OpenAI Services Agreement, Data Processing Addendum (DPA), API Data Controls. These official documents do not automatically cover the current intermediary.

Companion images and video: Seedream images and Seedance video are accessed through the Volcengine Ark platform of Beijing Volcengine Technology Co., Ltd., with the currently configured Beijing mainland-China endpoint. Affiliates may provide models. Account data-authorization settings, review/troubleshooting logs and actual retention must be verified separately; a 24-hour generated download URL does not mean all request data is deleted in 24 hours. Volcengine Privacy Policy.

Runtime/push/email: uni-app/DCloud supports app operation; enabled platform push handles identifiers/payloads, email handles recipients and verification/service messages. Marketing needs separate choice; actual channels depend on platform/service. DCloud Privacy Policy.

Other disclosure needs authorization, legal duty or a lawful necessary basis. Publishing private content, independent-purpose disclosure or transfer requires appropriate notice/consent or other legal conditions. Operator/asset changes require lawful notice about recipients and processing obligations.

4. Regions

A domestic endpoint does not guarantee domestic processing. Model brands or domestic servers do not establish the entire chain's location; intermediaries/downstream providers may process outside mainland China. Before exporting personal information, we must disclose recipient/contact, purpose, methods, data, retention and rights routes, obtain required separate consent and complete applicable procedures. Related personal data should not be sent before these requirements are met. Declining an optional AI feature leaves unrelated services available.

5. Retention and security

Only the shortest necessary period applies; active accounts do not justify indefinite unnecessary retention. Minimum legal, accounting, in-flight or actual-dispute records are restricted until their need ends. Temporary/replaced resources enter scheduled cleanup; failures may delay it and require retries. Local deletion is not simultaneous provider deletion; actual third-party security retention needs disclosure. HTTPS, access controls, encrypted/hashed authentication, temporary URLs and cleanup retries are reasonable safeguards, not zero-risk guarantees. Incidents require lawful remedy, reporting and notice without excluding responsibility.

6. Rights

Request lawful access, copies, correction, supplementation, deletion, withdrawal, explanations, account deletion or transfer where statutory conditions apply. Use app controls or email for complete copies, AI withdrawal or manual requests. Withdrawal stops future relevant work without invalidating prior lawful processing; dependent features may stop, unrelated services remain. Proportionate checks prevent impersonation without unnecessary sensitive proof. We normally reply within 15 working days after receipt/verification, explain complex delays and follow stricter law. Reasonable requests are generally free; excessive/repeated/unsupported requests receive lawful explanation. Regulatory complaints and legal remedies remain available.

7. Children and updates

Under-14 information is sensitive and requires lawful guardian consent; see Children's Privacy. Do not send unnecessary child identity/faces/private data to AI. Material purpose/data/recipient/region/rights changes receive prominent notice and renewed consent where necessary. Silent changes do not expand authority. Website text is current; the app provides packaged offline text. New processing requires necessary actual disclosure and valid consent.