Privacy Policy

What data we collect

Ziming collects only the data necessary to provide its core features:

• Account: email address (for sign-in and account recovery)
• Content: the records, keywords, favourites and notes you create in the app
• Preferences: language, difficulty, membership status, playback progress, UI preferences (stored locally)
• Device: device identifiers are used only when you contact support or request a membership redemption in the app

We do not collect precise location, contacts or advertising identifiers (IDFA), and we use no advertising or analytics SDKs.

How data is stored (local-first)

Ziming keeps your “personal layer” on your own device by default: your records, keywords, favourites, notes, local profile and the flywheel samples used to improve features are stored locally (app sandbox / IndexedDB).

To support “sign in and it syncs, switch devices without losing data”, once you sign in to your account those records, word cards and notes sync automatically to your cloud account space (provider Supabase, servers located in Tokyo, Japan) so they stay consistent across your devices. Signing out stops syncing immediately; local content remains fully usable and unaffected. On your first sign-in we ask for your separate consent to this cross-border transfer; if you decline, you can still sign in and use the app as usual — your content simply stays off the cloud.

If you are located in mainland China, using account sync means your records are transferred outside the region (to Tokyo, Japan).

You can turn account sync off at any time under “Settings → Multi-device sync”. Once off, nothing is uploaded from this device and records already in the cloud are kept; signing out also stops the transfer immediately, without affecting local content.

There is also one optional channel: only if you actively enable “end-to-end encrypted sync” in your iCloud settings will content sync between your own devices through Apple iCloud (CloudKit). Both in transit and at rest it is end-to-end encrypted, the keys are yours and live in your iCloud Keychain, and neither Apple nor we can read the plaintext. When it is off, this channel carries no data at all.

Language features such as translation, word lookup and the Roundtable call cloud models temporarily while in use, but we do not retain, train on or archive those requests (used once and discarded) — see “Language features & cloud processing” below.

Watch voice input: audio you record on the watch stays on the mobile device only. It is not uploaded, not synced to any service, and can be deleted at any time; the recognised text joins your content as an ordinary record.

Third-party services

• Supabase (servers in Tokyo, Japan): authentication and accounts, membership status, and the account-level record sync snapshot (records, word cards and notes synced automatically after sign-in for multi-device consistency; stops on sign-out)
• Alibaba Cloud Machine Learning Platform DashScope: our own AI processing (cloud read-aloud synthesis, backend for translation and word lookup) — called temporarily only when you actively use those features; requests are used once and discarded, never retained or used for training
• Zhipu AI (GLM), SiliconFlow, DeepSeek: the free text-AI fallback chain for translation and word lookup — called only when you actively use translation or word lookup and local results miss; requests are used once and discarded, never retained or used for training, and you can turn cloud processing off in Settings at any time
• Apple: in-app purchases (StoreKit 2) and iCloud (CloudKit) end-to-end encrypted sync; only receipts and product IDs are returned

Your rights

• Access and export: your in-app records and data can be exported at any time (including the list of local flywheel samples)
• Deletion: you can clear local flywheel samples at any time (Settings “My assistant → Join the data flywheel → Clear local samples”); deleting your account wipes all data in the cloud and on-device, and cannot be undone
• Withdrawing consent: you can turn off notifications, microphone, network and other permissions in system settings; you can also turn off account sync, cloud processing or end-to-end encrypted sync in Settings at any time

Data flywheel & smart learning (local-first)

To make translations fit better and definitions understand you better, Ziming distils part of your usage (translations, word lookups, Roundtable conversations, records added and corrected) into “flywheel samples”. Under the default local-first design these samples stay on your device only — they are not uploaded automatically, and personalisation happens entirely on-device.

• Transparency and control: you can turn this on or off at any time under “My assistant → Join the data flywheel”; once off, no new samples are collected, and you can wipe local samples in one tap
• What a local sample contains: only the input and the model output structure (including your correction signal). Sensitive information (ID numbers, phone numbers, emails, addresses, medical records, etc.) is blocked wholesale and never collected
• Anonymous contribution (on by default, switch off anytime): only the anonymous quality signal derived from those samples through differential privacy (noise added, irreversible, aggregated) is uploaded, to improve general translation and word-lookup quality — it never contains your original text or anything identifiable
• Retention and deletion: local samples unused for over 90 days are cleaned up automatically; you can wipe all local samples in one tap; when you delete a record, the unused samples derived from it are marked for cleanup too
• Privacy by design: any learning result only makes the features understand you better — it is never used to target ads at you

Usage statistics: we also collect anonymous feature-usage statistics (for example, which page a share happened on and how far it got). These contain only entry point, stage and timing — never your account or content — and are used to improve the product.

Behaviour events (linked to your account): to tune translation, word lookup and review more closely to you, Ziming uploads the following behaviour events to the cloud, linked to your account — changes to your translation difficulty level; the words you look up (word, language, difficulty, source, meaning, root, whether saved to your cards); and review results (how well you recalled, time spent, whether your own sentence was used). They never contain your record text or conversation content, and are used only to improve the product and personalise tuning. Turn on Settings → Privacy mode to stop these uploads.

Language features & cloud processing (thin-cloud, transparent)

Language features such as translation, word lookup and the Roundtable first try to complete on your device (on-device dictionary, cache, and the local profile already built up). Only when local results are insufficient is that single request temporarily handed to the cloud models below:

• Alibaba Cloud DashScope: backend for translation and word lookup, plus cloud read-aloud synthesis
• Zhipu AI (GLM), SiliconFlow, DeepSeek: free fallback chain for translation and word lookup
• Apple CloudKit / iCloud: carries encrypted data only when you turn on end-to-end encrypted sync

All cloud processing follows one commitment: used once and discarded, never retained, never used for training, never archived, handling only the current request. You can turn cloud processing off at any time in Settings; once off, deep capabilities that rely on cloud models fall back to on-device basics. We never use these cloud requests for any other purpose.

Access for my assistant & personal profile

When you actively turn on “Access for my assistant”, an external assistant can read your memory (records and basic profile) with the one-time passcode you generate. That snapshot is decrypted and assembled on your device, and is readable only while you have authorised it and hold the one-time passcode:

• With identity: if you have built a personal profile, we pass along a one-line summary of its human viewpoints to the assistant you connect, so it understands you from the start; the profile contains no original record text and no internal sensitive inferences
• One-time passcode: the passcode is single-use, expirable and rotatable at any time; every read is counted and the most recent read time is shown in the app — fully transparent
• Turn off anytime: switching off “Access for my assistant” invalidates the passcode immediately
• Inference disclaimer: the profile is an inferred summary of preferences and tendencies drawn from statistics. It may not represent all of you or be accurate, is provided for your own understanding and as a feature reference, and is not an official description of your identity

Bring Your Own API Key (BYOK)

Ziming is planning a “bring your own API key” capability: once you connect your own provider API, the corresponding translation, word lookup and read-aloud requests will run on your own key and services (no rate limits, cost borne by you), keeping your content inside your own compute. Until that ships, your content is handled under this policy. If the key feature launches, keys will be stored encrypted, usable only by you, never written to logs, and rotatable or revocable at any time. We will never use your key for any other user or purpose.

In-app purchases

Membership purchases go through Apple StoreKit. After purchase you can reactivate in the app via “Settings → Restore Purchases”. We record only purchase status and expiry date; we never obtain your payment details.

Minors

Ziming is not intended for children under 13. If you believe a child has created an account without a guardian's consent, contact us and we will help delete it.

Policy changes

Material changes will be announced in advance through in-app notices and the date at the top of this page; continued use means you accept them.

Contact

For any question, complaint or data request, leave a message in the in-app Help Centre or email [email protected].