Privacy Policy

1. Overview & Scope

This Privacy Policy ("Policy") describes how Jianzhik ("we", "us", "our" or "the Studio"), an independent product studio based at Arizona State University Sky Song Innovation Campus, Tempe, Arizona, United States, collects, uses, discloses, and protects information in connection with:

• The website jianzhik.com and all subdomains (collectively, the "Website");
• All mobile, tablet, desktop and visionOS applications published by Jianzhik on the Apple App Store, Google Play, Huawei AppGallery, Xiaomi GetApps, Samsung Galaxy Store, Microsoft Store, Amazon Appstore, Mac App Store and any other distribution platform we may adopt from time to time (collectively, the "Apps");
• Any related services, APIs, marketing, support or communications (collectively with the Website and the Apps, the "Services").

By installing, accessing or otherwise using the Services, you confirm that you have read, understood and agreed to this Policy. If you do not agree, please discontinue use. We will not knowingly collect personal data in a manner inconsistent with this Policy.

2. Data Controller

The data controller for the Services is Jianzhik, located at Arizona State University Sky Song Innovation Campus, Tempe, AZ, United States. For GDPR purposes, our representative within the Union can be reached at contact@jianzhik.com. For UK GDPR purposes our representative is reachable at the same address. For PIPL purposes our local representative is reachable at contact@jianzhik.com.

3. Definitions

• "Personal Data" means any information relating to an identified or identifiable natural person.
• "Processing" means any operation performed on Personal Data.
• "End-User" means any individual who installs or uses our Apps.
• "Device Data" means information automatically collected from the device on which the App is installed (model, OS version, locale, IP address, advertising identifiers).
• "Advertising Identifier" means Apple's Identifier for Advertisers (IDFA) or Google's Advertising ID (GAID) depending on platform.
• "SDK" means a third-party software development kit integrated for a specific purpose such as advertising, attribution or analytics.
• "Sensitive Data" means special category data such as health, biometric, racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic or biometric data for uniquely identifying a person, sex life or sexual orientation.

4. Data We Collect

4.1 Data you provide voluntarily

• Email address, name and message contents when you contact us via the Website form or via email.
• Email address if you subscribe to our field-notes newsletter (handled by a third-party privacy-respecting email service).
• Account information you create inside an App, such as locally-stored credentials (we do not maintain a central account database by design).
• Support correspondence, including bug reports, screenshots and device metadata you voluntarily share.

4.2 Data collected automatically by the Apps

• Device model, OS version, locale, time zone, screen resolution, free storage, network connectivity type.
• App version, build number, language, region settings, in-app feature usage counts (with your opt-in).
• Advertising Identifier (IDFA on iOS, GAID on Android) — collected only after explicit opt-in via the platform's tracking prompt.
• Crash logs, performance counters (CPU, memory, frame rate), error stack traces — stored locally and only uploaded if you opt in to share diagnostics.
• Frequency-cap and consent signals managed by the Google User Messaging Platform (UMP) or equivalent SDK.

4.3 Data collected by the Website

• Server logs (IP address, user agent, referer, URL, response code) retained for 30 days for security purposes only.
• First-party cookies that remember your consent and theme preferences. We do not set advertising cookies on this Website.
• Aggregated analytics from a privacy-respecting self-hosted analytics tool (no cross-site profiling, no IP storage, no fingerprinting).

4.4 Data we never collect

• Government identification numbers, biometric identifiers, race, ethnicity, religion, political affiliation, sexual orientation.
• Contacts, photos, microphone, location, Bluetooth, NFC, HealthKit, HomeKit, Calendar, Reminders data — unless explicitly required for a documented in-app feature that you opt into.
• Personal Data of children under the age of 13 anywhere in the world, or under the higher age defined by local law where applicable.

5. Legal Basis for Processing

Under the GDPR, we rely on the following legal bases:

• Consent (Art. 6(1)(a)) — for advertising personalisation, analytics, newsletter subscriptions, diagnostic uploads.
• Contract (Art. 6(1)(b)) — to deliver the service you have installed or subscribed to.
• Legitimate interests (Art. 6(1)(f)) — for security, fraud prevention, aggregated product analytics.
• Legal obligation (Art. 6(1)(c)) — for compliance with tax, accounting and law enforcement requests.

Where consent is the basis, you may withdraw it at any time without affecting prior lawful processing.

6. How We Use Personal Data

• To provide, operate, maintain, secure and improve the Services.
• To deliver core in-app functionality that runs entirely on your device.
• To display advertising and measure its performance (only after explicit consent on iOS 14.5+ / iPadOS 14.5+ / tvOS 14.5+ and equivalent Android versions).
• To respond to your enquiries and provide support.
• To send the field-notes newsletter (only with your explicit subscription).
• To detect and prevent fraud, abuse, security incidents and violations of our Terms of Service.
• To comply with our legal obligations, enforce our terms, and protect our rights and the rights of others.

7. Advertising & Monetisation Overview

All ad-serving activity is gated by the platform's App Tracking Transparency (ATT) prompt on Apple platforms and the equivalent Play Console prompts on Android. Until you grant consent, we serve contextual ads only and pass no IDFA/GAID to ad networks. You may withdraw consent at any time via the in-app "Privacy Choices" panel which is surfaced in every App's settings.

8. Google AdMob Specific Disclosures

We use Google AdMob (and where applicable, AdMob Mediation). AdMob may collect and process:

• IP address, device identifiers including IDFA (iOS) / GAID (Android), cookie identifiers, Advertising IDs.
• App metadata, ad impressions, clicks, conversions.
• Coarse location derived from IP (no precise GPS).
• Information about the device, OS version, language, carrier, time zone.

AdMob uses this data to select, serve and measure ads. You can opt out of personalised ads via:

• Apple: Settings > Tracking > "Allow Apps to Request to Track" > toggle off for Jianzhik Apps, or via our in-app "Privacy Choices" panel.
• Android: Settings > Google > Ads > "Opt out of Ads Personalisation".
• Web: adssettings.google.com.

AdMob and Google are signatories to the EU-US Data Privacy Framework, the UK Extension, and the Swiss-US Data Privacy Framework where applicable, providing adequate safeguards for transfers from the EEA, Switzerland and UK to the United States. Google's EU and UK GDPR-compliant Data Processing Terms apply. For more information, please consult the Google Privacy Policy and the Google Advertising Policies.

9. Other Advertising & Monetisation Platforms

Through AdMob Mediation (and in some legacy build flavours, directly), our Apps may request ads from the following networks. Each network processes data under its own privacy policy. Each may use cookies, device identifiers, IP addresses and similar signals to deliver and measure ads.

9.1 Major Demand Sources

• Google AdMob & Google Ad Manager (incl. Google AdSense) - policies.google.com/privacy
• Meta Audience Network (Facebook) - facebook.com/policy
• Unity Ads (Unity Technologies) - unity.com/legal
• AppLovin MAX (AppLovin) - applovin.com/privacy
• Pangle (TikTok / ByteDance Ads) - pangleglobal.com/privacy
• Mintegral (Mobvista) - mintegral.com/en/privacy
• InMobi - inmobi.com/privacy-policy
• ironSource / Digital Turbine - ironsrc.com/privacy-policy
• Vungle (Liftoff) - vungle.com/privacy
• Liftoff Monetize - liftoff.io/privacy
• Chartboost (now part of Digital Turbine) - chartboost.com/privacy
• Tapjoy - tapjoy.com/legal/privacy
• StartApp - startapp.com/policy/privacy-policy
• AdColony (now Digital Turbine) - adcolony.com/privacy-policy
• MoPub (Twitter / X Ads) - mopub.com/legal/privacy
• Smaato - smaato.com/privacy
• Criteo - criteo.com/privacy
• Taboola - taboola.com/privacy-policy
• Outbrain - outbrain.com/legal/privacy
• Moloco - moloco.com/privacy-policy
• BidMachine - bidmachine.io/privacy-policy
• Amazon Publisher Services (APS) - aps.amazon.com/aps/privacy
• Yahoo Advertising (Verizon Media) - legal.yahoo.com
• Adyen Ads - adyen.com/privacy

9.2 China-Tier Demand Sources

• Huawei Ads (Petal Ads) - consumer.huawei.com/privacy
• Xiaomi Ads - privacy.mi.com
• Samsung Ads - samsung.com/us/account/privacy-policy
• OPPO Ads - oppo.com/privacy-policy
• vivo Ads - vivo.com/en/privacy
• Baidu Ads / Union - privacy.baidu.com
• Tencent Ads (优量汇) - e.qq.com/ads/privacy

9.3 Russian and other regional

• Yandex Advertising - yandex.com/legal/confidential
• VK Ads (myTarget) - vk.com/privacy
• Mail.ru Ads - help.mail.ru

9.4 Open Web Monetisation

• Google AdSense - policies.google.com/technologies/ads
• BuySellAds - buysellads.com/about/privacy
• Carbon Ads - carbonads.net/privacy

10. Other US State Privacy Laws

In addition to California (see Section 18), the following US state privacy laws may apply depending on your residency and our relationship with you:

• Virginia CDPA (Va. Code Ann. § 59.1-575 et seq.)
• Colorado CPA (Colo. Rev. Stat. § 6-1-1301 et seq.)
• Connecticut CTDPA (Conn. Gen. Stat. § 42-515 et seq.)
• Utah UCPA (Utah Code § 13-61-101 et seq.)
• Texas TDPSA (Tex. Bus. & Com. Code § 541.001 et seq.)
• Oregon OCPA (Or. Rev. Stat. § 646A.570 et seq.)
• Montana MCPA (Mont. Code § 30-14-2801 et seq.)
• Iowa SF 262
• Tennessee TIPA
• Indiana INCDPA
• Washington My Health My Data Act (health-data specific)
• Nevada NRS 603A (do-not-sell mechanism)
• New York SHIELD Act

Where these laws apply, we extend the rights described in Section 18 (CCPA / CPRA) to you, including the rights of access, correction, deletion, portability, opt-out of sale / targeted advertising and opt-out of profiling. You may exercise these rights via the in-app "Privacy Choices" panel or by emailing contact@jianzhik.com.

11. Ad Formats We Serve

Our Apps integrate the following standard mobile ad formats. Each format is described in plain English and the data signals shared are limited to what the format requires.

AdMob's User Messaging Platform (UMP) and equivalent consent dialogs from each mediation partner will be presented to you on first launch and periodically thereafter. We honour Global Privacy Platform (GPP), IAB Europe TCF v2.2, Apple ATT and Google Play data safety signals.

12. Tracking, IDFA & Privacy Choices

• On iOS / iPadOS / tvOS 14.5+ we use Apple's App Tracking Transparency framework. The prompt reads (verbatim): "Allow [App Name] to track you across other companies' apps and websites?".
• Until you tap "Allow", we will not pass IDFA to any third party. Ads will be contextual only.
• On Android 12+ we honour the Advertising ID and the "Opt out of Ads personalization" toggle.
• You can revisit your choice at any time via the in-app "Privacy Choices" panel or via the platform settings listed in section 8.
• We honour the Global Privacy Platform (GPP) and Apple's Limit Ad Tracking setting.
• Where regional law (e.g. EU ePrivacy) requires it, we present a CMP (Consent Management Platform) dialog aligned with the IAB TCF v2.2 specification.

13. App Store & Distribution Compliance

Our Apps are published on the following distribution platforms. Each platform has its own privacy and data-handling rules that we honour in addition to this Policy:

• Apple App Store, Mac App Store, Apple TV App Store and visionOS App Store — we comply with the Apple Developer Program License Agreement, App Store Review Guidelines (including Guidelines 5.1.1, 5.1.2 and the Privacy section), the App Store Privacy Policy requirements, the Required Reason API (AppPrivacyDetails / Nutrition Labels), Apple's HealthKit, HomeKit and other framework rules where applicable, ATT framework, "Sign in with Apple" requirements and Apple's EU Digital Markets Act rules.
• Google Play — we comply with the Play Developer Distribution Agreement, Play Console Data Safety form, Google Play Families Policy (where relevant), Google Play's Deceptive Behaviour Policy, EU DMA rules and Google's User Data Policy.
• Huawei AppGallery — we comply with the Huawei Developer Service Agreement, AppGallery Privacy & Security requirements, and applicable Chinese regulations (see PIPL below).
• Xiaomi GetApps — we comply with Xiaomi Developer Terms and Privacy Policy.
• Samsung Galaxy Store — we comply with the Samsung Galaxy Store Developer Agreement and Privacy Policy.
• Microsoft Store (Windows) — we comply with the Microsoft Store App Developer Agreement and Microsoft Privacy Statement.
• Amazon Appstore — we comply with the Amazon Developer Services Agreement and Amazon Privacy Notice.
• Mac App Store (macOS) — we comply with the Apple Mac App Store sandboxing requirements and Hardened Runtime where applicable.
• Open-source or direct distribution — where we distribute software directly via our Website or via public repositories (e.g. GitHub), the same privacy practices apply.

For each App we maintain an up-to-date privacy nutrition-label / data safety declaration listing every category of data collected and every purpose for which it is used, including advertising, analytics and functionality.

14. Age Restrictions

Our Apps have the following age ratings across the major storefronts:

• Apple App Store: 4+ (when the App contains no objectionable content), 9+, 12+ or 17+ as assigned by the App Review Board. The age rating is shown in the App listing and enforced by Apple.
• Google Play: IARC age rating, typically Everyone / PEGI 3, but can be 7 / 12 / 16 / 18 depending on content.
• Other stores: We apply equivalent ratings.

We do not knowingly collect or process Personal Data from children under the age of 13 (United States COPPA), under 16 (EU/UK GDPR unless lower with Member-State Consent), under 14 (China PIPL & Personal Information Protection Specification for Children), under 13 (Brazil LGPD for children), or under any higher age defined by the local law of your country.

Parents, teachers and guardians may request review or deletion of any data we may have inadvertently collected from a child by writing to contact@jianzhik.com. We will respond within 30 days.

15. Country & Region-Specific Notices

The Services are intended for global use. Where you reside in one of the regions below, the additional provisions of sections 17-22 apply. We provide region-specific rights regardless of whether you are physically present in the region, where reasonably practicable.

17. GDPR (EEA / UK / Switzerland)

If you are in the European Economic Area, the United Kingdom or Switzerland, the General Data Protection Regulation (and its UK and Swiss equivalents) apply. You have the following rights:

• Right of access — to obtain a copy of your Personal Data (Art. 15).
• Right to rectification — to correct inaccurate data (Art. 16).
• Right to erasure ("right to be forgotten") — to have your data deleted (Art. 17).
• Right to restriction of processing — to limit how we use your data (Art. 18).
• Right to data portability — to receive your data in a structured, machine-readable format (Art. 20).
• Right to object — to object to processing based on legitimate interests or for direct marketing (Art. 21).
• Rights related to automated decision-making — not to be subject to a decision based solely on automated processing (Art. 22).
• Right to withdraw consent at any time (Art. 7(3)).
• Right to lodge a complaint with your supervisory authority. A directory is available from the European Data Protection Board.

Where we rely on consent for advertising personalisation (e.g. via the IAB TCF v2.2 CMP), you can revisit your decisions at any time. You also have the right to lodge a complaint with your local Data Protection Authority:

• EU: list at edpb.europa.eu/about-edpb/about-edpb/members_en
• UK: ico.org.uk
• Switzerland: edoeb.admin.ch

The legal bases we rely on are described in section 5. International transfers are described in section 24.

18. CCPA / CPRA (California, USA)

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), applies. You have the right to:

• Know what categories of Personal Information we collect, the sources, the business purposes, and the categories of recipients.
• Access the specific pieces of Personal Information collected about you in the preceding 12 months.
• Delete Personal Information collected from you, subject to exceptions.
• Correct inaccurate Personal Information.
• Opt out of sale or sharing of your Personal Information. We do not "sell" Personal Information for money. Some advertising personalisation may constitute "sharing" under CPRA. You may opt out via the in-app "Privacy Choices" panel, via the platform-level toggles described in section 8, or by emailing contact@jianzhik.com.
• Limit use of sensitive personal information — we do not collect sensitive personal information beyond what is strictly necessary for the Services.
• Non-discrimination — we will not deny service, charge different prices or provide a different level of quality for exercising your rights.

Categories of Personal Information collected in the last 12 months:

19. PIPL (People's Republic of China)

If you are located in the People's Republic of China, the Personal Information Protection Law (PIPL), the Cybersecurity Law (CSL) and the Data Security Law (DSL) apply. Where our Apps are distributed via Huawei AppGallery, Xiaomi GetApps, OPPO Software Store, vivo App Store or any PRC channel, additional PIPL-specific rules apply:

• We will only process your Personal Information with your separate, informed consent.
• Cross-border transfers are subject to one of the lawful mechanisms (CAC security assessment, Standard Contract, Certification).
• Sensitive Personal Information is processed only with a specific purpose, sufficient necessity and strict protection measures.
• We honour the right to access, correct, delete, portability, withdraw consent and request explanation.

The PRC-specific local representative can be reached at contact@jianzhik.com. For Baidu, Tencent and other PRC-based ad networks, their respective privacy policies govern the data they process.

20. LGPD (Brazil)

If you are in Brazil, the Lei Geral de Protecao de Dados (LGPD) applies. You have rights of confirmation, access, correction, anonymisation, portability, deletion, information on sharing and information on the possibility of not providing consent. The Brazilian National Data Protection Authority (ANPD) is the supervisory authority.

21. COPPA (United States - Children under 13)

We do not knowingly collect Personal Information from children under the age of 13 in a manner that requires verifiable parental consent under the Children's Online Privacy Protection Act (COPPA). Our Apps marked as suitable for children under 13 are reviewed for compliance and:

• Disable behavioural advertising.
• Use only contextual advertising (where supported).
• Do not collect IDFA / GAID from child-directed builds.
• Do not include third-party SDKs that target children.

Parents may request review or deletion of any data inadvertently collected by writing to contact@jianzhik.com. We will respond within 30 days.

22. PDPA (Singapore, Thailand, Malaysia)

For users in Singapore, Thailand and Malaysia, the Personal Data Protection Acts (PDPA) apply. We comply with the consent, notification, purpose, accuracy, protection, retention limitation, access & correction, and transfer limitation obligations.

23. Sharing & Disclosure

We share Personal Information only as described below:

• Advertising & mediation partners as described in Section 9, after you grant consent where required.
• Email & newsletter providers — for the field-notes newsletter, opt-in only.
• Cloud infrastructure — encrypted hosting providers in the EEA, US, Asia for backup and analytics aggregation.
• Customer support — first-party tools only. No third-party "session replay" tracking is used without your consent.
• App store operators — anonymised install and crash data where required by the store policies.
• Legal — when required by law, court order, or to protect our rights or the safety of others.
• Corporate transactions — in the event of a merger, acquisition or sale of assets, with continued protection commitments.

We do not sell Personal Information for monetary consideration.

24. International Data Transfers

Personal Information may be transferred to, stored and processed in countries other than your country of residence. Where required by law, we rely on:

• EU-US Data Privacy Framework (DPF), the UK Extension and the Swiss-US DPF (where applicable).
• Standard Contractual Clauses (SCCs) approved by the European Commission (Module 1, 2 and 3 as appropriate).
• UK International Data Transfer Agreement (IDTA) and the UK Addendum.
• EU-China Standard Contract for transfers from the EEA to the PRC.
• APEC Cross-Border Privacy Rules (CBPR) where applicable.

You may request a copy of the transfer mechanism applicable to your data by writing to contact@jianzhik.com.

25. Data Retention

We retain Personal Information only for as long as necessary for the purposes described in this Policy, unless a longer retention period is required or permitted by law.

26. Security

We employ administrative, technical and physical safeguards designed to protect Personal Information, including:

• TLS 1.3 for all in-transit data.
• AES-256 encryption for at-rest data.
• Hardware-backed key storage (Apple Secure Enclave / Android StrongBox / TPM).
• Annual third-party security review and penetration test.
• Strict least-privilege access controls, multi-factor authentication, just-in-time access.
• Encrypted backups, off-site replicated.
• Incident response plan with 72-hour notification.

No system is 100% secure. If you believe your interaction with us is no longer secure, please notify us immediately at contact@jianzhik.com.

27. Your Rights & How to Exercise Them

Regardless of where you live, you have the following baseline rights. We will respond within 30 days (45 days under CCPA where extension is permitted).

• Access — request a copy of Personal Data we hold about you.
• Correction — correct inaccurate or incomplete data.
• Deletion — request deletion of Personal Data.
• Portability — receive data in a portable format.
• Opt-out of sale / sharing — opt out of advertising personalisation.
• Restriction — limit how we use your data.
• Withdraw consent — at any time, without affecting prior processing.
• Lodge a complaint — with your local supervisory authority.

To exercise any of these rights, email contact@jianzhik.com with the subject "Privacy Request". For verification we may need to confirm your identity via a piece of information only you would know.

28. Children

The Services are not directed at children under 13 (or higher where local law applies). We do not knowingly collect Personal Information from children. Where we publish Apps that may be used by children, we apply heightened protections and disable behavioural advertising.

29. Changes to this Policy

We may update this Policy to reflect changes in our practices, the Services, applicable law, or the advertising ecosystem. The "Last updated" date at the top reflects when the most recent changes were made. Where changes are material we will notify you via:

• An in-app banner on next launch.
• A field-notes newsletter issue (if you are subscribed).
• A notice on the Website homepage.

Your continued use of the Services after a change indicates acceptance of the updated Policy.

30. Contact, DPA & Complaints

For any question, request or complaint relating to this Policy, please contact:

Jianzhik - Privacy Office
Arizona State University Sky Song Innovation Campus
Tempe, AZ, United States
Email: contact@jianzhik.com
Business / support: support@jianzhik.com

If you wish to engage our Data Protection Authority representative, request a Data Processing Agreement (DPA), or submit a formal complaint, please email contact@jianzhik.com with the subject "DPA" or "Complaint" as applicable. We will acknowledge within 5 working days and respond substantively within 30 days.

// END OF POLICY // v6.4.0 // 2026-09-23 // Jianzhik