Privacy Policy

Scope and operator

This policy covers the Aitun 愛囤 iPhone and Android apps and the official website. The service is operated by JICHUANG DIGITAL LLC (“we”), registered address: 30 N Gould St, Ste N, Sheridan, WY 82801-6317, United States.

Privacy and support contact: govoko01@gmail.com. You can also chat with support inside the app under Settings → Report a problem.

The service is for people aged 16 and older. Effective from the day the service is released on the App Store and Google Play.

What we collect and why

Account and sign-in: you sign in with Apple or Google. From the sign-in service we receive an account identifier, your email and your name (if you use Apple’s “Hide My Email”, this is the relay address Apple provides). When you create your account you enter a display name and your birthday. We also record your language, country (taken from your phone’s region setting, not from location) and time zone. Purpose: signing you in, confirming your age, setting the app language and notifications, and calculating daily limits in your time zone.

Your content: the photos and videos you choose to upload (including video sound), file names, dimensions and durations, plus basket names, titles, tags, comments, sharing settings and review status. Purpose: storing your content and showing it to you or to the people you choose.

Activity records: your pushes, unlocks, reports, blocks, star ledger and level, and share-link open records (we store only a hashed request identifier, not the raw IP address). When someone takes a screenshot of another person’s protected content, we record the media, the account and the time, and notify the creator, without telling the creator who took it. Purpose: providing the features, statistics, preventing abuse and protecting creators.

Device and security: once you allow notifications we store your push address (Apple Push Notification service, or Firebase Cloud Messaging on Android). When the app connects, it uses Firebase App Check to prove to Apple (App Attest) or Google (Play Integrity) that it is the genuine app. Purpose: sending notifications and preventing bots and abuse.

Problem reports: the messages you write in a problem report, any screenshots you attach, and the app version, phone model, system version and language. This does not include your location or your photo library. Purpose: answering your question.

Platform logs: the cloud platforms we use produce service logs that may show the IP address of a connection. They are kept under the platform’s default settings, generally within 30 days.

What we do not collect: precise or approximate location, contacts, calendars, health data, advertising identifiers, crash or performance reports. We use no third-party analytics tools. The app shows no ads, does not track you and does not sell your personal data. The official website does not use cookies.

Photos, videos, AI and location

Your private media is visible only to you by default. AI features such as face detection, face masking and privacy checks run only on your phone and never send private media to cloud AI; if a phone does not support them, the feature is unavailable and does not fall back to the cloud.

Automatic AI review is currently turned off: review before sharing is done by people, and we do not send your content to Google Gemini or any other third-party AI service. If this is turned on in the future, we will first update this policy and tell you in the app before enabling it.

Before upload, we remove metadata that can carry location from photos and videos, such as EXIF GPS and location tags. This does not remove an address or landmark that is visible in the picture itself, and it does not change the original on your phone. When you edit and save, you get a new copy; the original is not changed.

Sharing, review and public content

Before media can be seen by a second person it must pass human review; if it does not pass, it is not shared. To complete the review, reviewers can see the media you submit, along with its title, tags and description.

If you publish to the market or secret market, or share by link, the audience can see your display name, creator ID, avatar and that content. The web preview of a shared link shows only a low-resolution, blurred, watermarked picture; full content is viewed in the app.

When you report someone, or are reported, the reported content and your report note may be viewed by reviewers.

Minimum age and sensitive content

The service is for people aged 16 and older. You enter your birthday when you create an account, and accounts for people under 16 cannot be created. We do not knowingly collect personal data from children under 16; if someone gave a false birthday, we may suspend or delete the account.

Sensitive content is available only to users aged 18 or older who have turned on “Show sensitive content” in settings, and each item still needs a tap on “Show”. Accounts aged 16 to 17 cannot turn it on. Your birthday is used only to determine age and is not shown to other users.

Service providers and where data is stored

These providers process data on our behalf under their own service and data-processing terms: Google (Firebase sign-in verification, database, cloud functions, App Check, notifications; the database and cloud functions run in Google’s Taiwan region), Cloudflare (private R2 media storage and media delivery), Apple (Sign in with Apple, push notifications, App Attest) and Google Play (Play Integrity). We do not sell your personal data to anyone.

Our operator is in the United States and our providers operate in many countries, so your data may be transferred to and processed in countries outside where you live. We take reasonable steps to keep it protected there.

How long we keep data

While your account is active: we keep the account and media data needed to provide the service until you delete the content or delete your account.

Recycle basket: media you delete goes to the recycle basket and is kept for 30 days so you can restore it; after that the system permanently removes it (the cleanup runs every hour). Media in the recycle basket is no longer shared with anyone.

Deleting your account: once you submit the request, your account is disabled and your share links stop working immediately. The system then removes, in the background, your account data, media and derived files, baskets, share links, comments, notifications, push addresses and support conversations, and finally deletes your sign-in account (your email goes with it). The cleanup runs every hour and usually finishes within 24 hours of the request; if an upload or processing job is still in progress, it waits for that to end first.

Backups: our database has point-in-time recovery (kept for 7 days) and daily backups (kept for 14 days), so after deletion your data disappears from these backups within 14 days at most. Media files are stored in Cloudflare R2 and are currently not backed up separately; once deleted they are removed from storage.

What may be kept after deletion: (1) content involving child safety or other serious violations and the related review records, which we keep as evidence until the investigation ends or the period required by law expires, and which is not removed by deleting your account; (2) report, review, star ledger and operational audit records, which are recorded under an internal account identifier and do not contain your email, although report and review records may keep the title, tags or note text from that time. These records currently have no fixed automatic expiry; we keep them only as far as needed to prevent abuse, protect other users, comply with the law and handle disputes.

Other: signed URLs for web previews are valid for at most 120 seconds; a share link stops working as soon as it expires or is withdrawn; temporary rate-limit records expire automatically within a short time (at most a few days). If someone has already downloaded or screenshotted content you shared, we cannot remove it remotely.

For inactive accounts, see the Terms of Use.

Your choices and rights

In the app you can manage your profile visibility, whether you can be found in search, notifications, and whether sensitive content is shown. Photo and camera permissions are managed by your phone’s system settings and can be turned off at any time.

You can download your own photos and videos in the app, and delete your account at any time under Me → Settings and privacy → Delete account.

To access, correct, export, delete or restrict the processing of your personal data, email govoko01@gmail.com. Please write from the email registered to your account and include your creator ID or display name; to protect your account we may ask you to reply to confirm, but we will never ask for your password or a verification code. We will reply within the period required by applicable law.

Depending on the law where you live (for example the EU, the UK or California), you may also have rights of access, correction, deletion, objection and complaint, and you may complain to your local data protection authority. We do not sell personal data and do not share it for cross-context behavioral advertising.

Data security

All connections use HTTPS encryption. Media is stored in non-public storage and can be read only through short-lived signed URLs; the server decides who can see what based on permissions, not on what the phone claims. Staff need the matching permission to view content, and their access is recorded in an audit log. No system can guarantee absolute security; if a data breach affects you, we will notify you as required by law.

Updates and contact

When we change this policy we update the date at the top; material changes will be announced in the app or on the official website. For privacy questions, email govoko01@gmail.com.