Riji Privacy Policy
Version 1.8.0
# Riji Privacy Policy **Effective date**: October 26, 2026 **Version**: 1.8.0 Welcome to Riji. We value your privacy. This policy explains how we collect, use, store, and protect your personal information. Website language preference: only when you explicitly switch the website language, your browser saves a `website_language` cookie for one year. It contains only a language tag, with no account or unique identifier, and is not used for advertising or usage analytics. You can clear browser cookies; language-specific URLs remain available with cookies disabled. ## 1. Information We Collect | Type | Content | Purpose | |------|---------|---------| | Account | Apple user ID (`apple_sub`) | Sign-in and account identity | | Profile | Nickname, birthday, life stage, recent worries, tone preference | Personalized AI replies and cold-start persona | | Journal & chat | Journal text, chat text and images you choose to send | AI replies, image understanding and mood records; text is used for persona analysis | | Location | Optional coordinates and the name, address and coordinates of places you choose to send | Journal place tags, weather, nearby-place selection and location chat | | Device & logs | IP address, app version, API access logs | Security, review-period detection, troubleshooting | | Membership & payment | Apple transaction and product IDs, subscription status, expiry and a random UUID linking the Riji account | Verify purchases, restore, renew and handle refunds with Apple; no full receipts or payment card details are stored | | Usage analytics (can be disabled) | Page visits, feature actions and outcomes, subscription product IDs and purchase-action outcomes, an internal account ID or SDK installation ID, device and system information, app version, environment, session ID and event time | Analyze feature usage through PostHog to improve Riji | We do not sell your personal information. ### Sharing a Location in Chat Nearby-place search filters only the list already returned for this session; search terms are not uploaded. Tapping a location card passes that message's saved place name and coordinates to a device map app: Apple Maps is preferred on iOS, while Android uses the system default or app chooser. If a native map cannot open, the app falls back to Apple Maps or Google Maps on the web respectively (the Google web link receives coordinates only). Your current position is not fetched again. The map provider you open processes the data under its privacy policy. Tapping the location button requests while-in-use location permission and obtains your current position; there is no continuous background location tracking. Our backend sends coordinates to AMap Web services for coordinate conversion and nearby-place search. If that service is unconfigured or unavailable, you may still choose your current position. Places are provided by AMap; see [AMap's privacy policy](https://lbs.amap.com/pages/privacy/). Only after you confirm sending do we save the selected name, address, precise coordinates and coordinate system as a chat attachment associated with your account and journal on our own servers. Opening or cancelling the picker creates no location chat record. The name, address and accompanying text are sent to DeepSeek as user content to generate replies and may be reused in subsequent chat context; precise coordinates from the attachment are not sent to DeepSeek. Names, addresses and coordinates are not sent to usage analytics, and coordinates are not recorded in API access logs. The attachment is deleted with its journal or account. Avoid sharing unnecessarily sensitive places. ### Time Post Office and Writing Prompts The title, message, opening date and opening status of letters you send are associated with your Riji account and stored in our SQLite business database on our own servers in mainland China, for storage, device synchronization and reading when due. The server restricts access before the opening date, and list responses omit the message. This is access control, not end-to-end encryption. Letters remain until you delete them or your account, when associated letters are removed from the business database. Unsent drafts remain only in the current page's memory and are cleared when discarded, the page is closed or you sign out. Letters are not sent to AI, content-moderation providers or PostHog, and are not used for persona analysis. Drawing, changing or putting away a writing prompt happens locally without uploading it, calling AI or using your allowance. When you submit a diary with a selected prompt, its ID and the exact question displayed are saved with the diary on our servers and sent with the related diary and conversation to DeepSeek, as the AI's opening question and subsequent conversation context. This does not use an extra AI turn. No question is saved if none is selected. Saved questions retain their original language when you later change the app language. Questions are removed with the diary or account and are not sent to PostHog analytics. ### Notifications and Language Preferences For iOS notifications, we associate the Apple push device token, push environment and current app language with your signed-in account on our servers. These support journal reminders, return reminders and delivery reminders for unopened letters. Language is stored per device and synced when you change the app language, the followed system language changes, or you reopen the app. We do not read additional personal content beyond the system language preferences. Notifications are sent through Apple Push Notification service (APNs). They contain only generic reminder text and internal account/notification routing identifiers, never letter titles or bodies, journal text or chat content. We record sending status to reduce duplicate reminders and do not remind you about letters already opened. You can disable notifications in iOS Settings without losing access to the post office or due letters. Display depends on system permissions, connectivity and Apple's service. Device tokens are removed when the account is deleted or the token is determined to be invalid. Your device also supplies its system IANA time-zone identifier (such as `Asia/Shanghai`), without location permission. Device registration stores the zone; signed-in app requests also sync it, even if notifications are denied. The most recently active device's synced zone determines the account's diary day, streak, daily allowance and letter dates, with diary reminders at local 20:00 and letter reminders after local 09:00. We use the server's actual clock rather than collecting a manually changed device time. Travel or system settings can update the zone. It is stored on our own servers, is not added as a PostHog property, does not rewrite historical diary dates, and is removed with the associated account. ### Image Chat Image chat is optional. You can select an image using the system photo picker. The selected image is previewed in the composer and can be removed before sending; cancelling selection does not affect text chat. Only after you tap Send is the selected image uploaded to Riji: one image per message, up to 5 MiB after compression. We do not scan or upload your entire photo library. The server validates the actual format and re-encodes the image to remove EXIF, GPS and similar metadata. The image is first submitted to **Alibaba Cloud** for content safety checks. Approved images and relevant conversation are then sent to **DeepSeek (deepseek-flash)** for image understanding and replies. Recent images may be included again as context for follow-up messages. Do not send ID documents, bank cards, passwords or other unnecessary sensitive information. Images are not sent to PostHog analytics. ### Usage Analytics Scope and Controls In iOS / Android versions that include usage analytics, we use the PostHog SDK to record app opens, page visits, starting a journal draft and its save outcome, whether AI message sending and replies succeed, viewing the pet dialog, subscription purchase actions and outcomes, and restore-purchase actions. Events describe actions and results, not the content you enter or receive. - **Account association**: before sign-in, the SDK uses a generated installation ID; after sign-in, events are associated with an internal Riji account ID (formatted as `riji:<userID>`). These records can be linked to an account or installation and are not fully anonymous. We do not send nicknames, email addresses, phone numbers or WeChat account identifiers to PostHog. - **Excluded content**: usage analytics does not collect journal text, chat content, AI reply text, mood labels, images, coordinates, pet card IDs or scenes, login credentials, Apple receipts or transaction IDs. This exclusion applies to PostHog analytics, not the processing needed when you choose to use journals, AI, weather or purchases. - **Device and network information**: the SDK adds device, operating system, app, session and event-time information. Network requests expose the source IP address to the provider. We disable PostHog's IP-based geolocation and do not send location as an analytics property. - **No advertising tracking**: this feature does not access IDFA, record the screen or replay sessions, or track you across apps or companies for advertising. - **Default and choice**: usage analytics is enabled by default. You can turn it off at any time in **Settings → Usage analytics**; the adjacent information icon explains the details. Turning it off stops collection of new usage analytics without affecting sign-in, journals, AI, pets or membership. A saved off preference is preserved across normal restarts and updates. Turning it off does not automatically delete data already sent. ## 2. How We Use Information 1. **Core features**: journaling, warm AI replies, multi-turn chat, calendar review. 2. **Persona**: we batch-analyze yesterday’s journal and chat at night to update a structured persona for later conversations; requests only read the existing persona. 3. **Safety**: user input and AI output are moderated; violating content is not stored. 4. **Quota & membership**: daily interaction counts for Free / Pro / Max entitlements. 5. **Product improvement**: analyze page visits, feature actions and subscription flows to identify experience issues. The usage analytics switch does not control business data processing required to deliver core services. ## 3. Storage, Retention & Protection - Riji backend business data, including accounts, journals, chats and membership records, is stored on servers in the People’s Republic of China (SQLite). Third-party services process relevant information as needed to provide their features. - **Chat images**: metadata is stored in the database and files on private server disks. Access requires sign-in and an account ownership check; no public image links are provided. Images remain with the conversation and are removed when the account is deleted. Failed or rejected submissions are not stored as persistent chat records. - **Temporary moderation files**: Alibaba Cloud's content safety temporary upload area is used instead of public image links. Its [official API documentation](https://help.aliyun.com/zh/document_detail/467829.html) states that temporary files for local-image moderation are retained for 30 minutes. DeepSeek processes content needed for replies under its service terms and privacy policy. Local storage does not mean third-party providers do not process or retain data. - **PostHog US region**: usage analytics is sent directly from the app to PostHog US Cloud and stored and processed in the United States. For users in mainland China or elsewhere outside the US, this involves an international data transfer. The transfer is limited to the analytics data described here and excludes journal and chat text. - **Analytics retention**: we currently use the PostHog Free plan, whose published event retention window is **1 year**. This window is not a guarantee of complete deletion at expiry; older events may no longer be queryable, and deletion is a separate operation. See [PostHog event retention](https://posthog.com/docs/data/events-retention). We will update this policy if we change the plan or retention arrangements. - Apple user IDs and sessions are stored hashed; login credentials are not kept in plaintext. - We use access control, encryption, and audit logs to protect data. - After account deletion, the Riji backend retains only minimal transaction identifiers, pseudonymous account bindings and subscription status for reconciliation and preventing duplicate claims, not your journals, chats or persona. - **Analytics deletion**: turning off analytics or deleting a Riji account does not currently trigger automatic deletion of historical data already sent to PostHog. You may request access or deletion by emailing us at the address below. We will process the request after verifying the necessary account or installation association and inform you of the outcome. Do not send passwords, verification codes or journal text. ## 4. Sharing & Disclosure We share or disclose information only when: - **Required by law**: legal process, litigation, or lawful government requests. - **Service providers**: content safety (Alibaba Cloud / Tencent Cloud), AI (DeepSeek), weather (QWeather), transmitting only what is needed. - **Usage analytics provider**: PostHog Inc., through the `posthog_flutter` SDK and PostHog US Cloud, receives the analytics events and identifiers described in this policy for product analysis. See the [PostHog Privacy Policy](https://posthog.com/privacy). - **With your consent**: other cases with your explicit authorization. ## 5. Your Rights You may: 1. **Access & correct**: view and edit your profile in the app. 2. **Delete account & data**: delete your account in Settings to permanently remove your account, journals, chats and persona from the Riji backend. Section 3 explains retained payment records and the separate process for deleting PostHog history. 3. **Turn off usage analytics**: disable **Settings → Usage analytics** without deleting your account or losing other features. You can also manage location and other permissions in system settings; disabling a permission only affects features that depend on it. 4. **Access, deletion & complaints**: email the developer below with questions about analytics or other personal data processing, or to exercise your rights. ## 6. Children Riji is intended for adults. If you are under 18, use the service only with a guardian’s consent. ## 7. Policy Updates We may revise this policy and publish updates in the app or on our website. Material changes to purposes, data categories, recipients or retention arrangements will be subject to applicable notice and authorization requirements. This policy describes our data practices; a default-on setting, publication of this policy or continued use does not replace consent where it is legally required. ## 8. Contact - Product: Riji - Developer: bin.liu - Email: [liu_bin4835@outlook.com](mailto:liu_bin4835@outlook.com)