1 Operator and scope
1.1 Your Neverland HK Limited is responsible for the InStory personal information processing described here and acts as the business or controller under applicable United States state privacy laws. State or country of incorporation: HONG KONG. Contact address: Suite 6503, 65/F, Central Plaza, 18 Harbour Road, Wan Chai, HONG KONG. This English-language Policy applies to the InStory website and mobile services offered to United States users. Common provisions apply across supported platforms. Provisions marked Android apply only to the Android app and do not describe the SDKs, identifiers or permissions used by the iOS app.
1.2 "Personal information" includes information that identifies you, relates to you or is reasonably linkable to you or your household, and personal data as defined by applicable law. We process necessary information only for functions you use and the purposes below. This Policy is not blanket consent to undisclosed uses. Independent third-party services have their own policies; our disclosures to them remain governed by this Policy.
1.3 This Policy distinguishes information you provide directly, information supplied automatically by devices, and information from sign-in, payment, other users and similar sources. A function not available to you does not result in collection merely because it is described here. New categories or incompatible purposes are specifically disclosed before processing, with required consent. You may request an accessible format through the privacy email.
2 Information categories and purposes
2.1 Account and profile: depending on your chosen and available registration method, we process your phone number or email, verification-code result, or third-party login identifier and authorized profile information for registration, login and security verification. Nickname and avatar identify the account; age and state of residence help us apply appropriate protections. Gender, interests and creation intent are optional information for display or preference functions you choose. Additional identity information is requested only where legally required or necessary for verification, with an explanation before collection. On Android, when you choose Google sign-in, Google credentials are used with Firebase Authentication to authenticate you. Our server receives a Firebase ID token and your display name when available to establish your InStory session. This sign-in flow does not request access to your Gmail messages or contacts.
2.2 AI chats and resonance conversations: we process the text you send, media you actively select, the current scene and relevant history needed to generate replies and organize stories you request. Context sent to a model is limited to what is needed for the current request. Where translation is available, content is processed for translation only when you request it or enable the relevant function.
2.3 Creation and materials: we process photos, audio, video, prompts, scripts, editing instructions, generation settings and results that you select and upload to generate, edit, save and publish works as instructed. Photo-library permission does not authorize us to read your entire library; we do not actively extract photo location metadata unrelated to the request. Without uploaded materials, the corresponding creation function cannot be completed, but other functions remain available.
2.4 Community and sharing: we process works, comments, likes, saves, following relationships, audience settings and sharing actions for display and interaction. Public content, nicknames and avatars can be viewed by the corresponding audience; private materials and private AI conversations are not automatically made public. When you share through an external platform, the content and necessary links you select are provided to that platform and may be saved or forwarded by recipients.
2.5 Points and transactions: we process order identifiers, products, amounts, currencies, point changes, transaction times, payment channels, payment status and refund records to deliver entitlements, reconcile accounts and resolve disputes. On Android, Google Play Billing processes purchases of points. We process product identifiers, order references, purchase tokens and purchase status to verify purchases, credit points and restore eligible transactions; an obfuscated account identifier is supplied to Google Play in the purchase flow. Payment details are handled through Google Play. We do not ask you to submit bank-card passwords or payment verification codes in chats. The Android flow described here is points purchasing, not a subscription service.
2.6 Device, installation and operational information: our Android app sends the Android-provided identifier ANDROID_ID, an app-generated installation identifier, device model, operating-system version, app version, language and time zone with business API requests. The installation identifier is a randomly generated value stored on the device and is retained across account changes; it is different from an advertising identifier and should not be understood as anonymous information. Authenticated requests also carry session credentials, so device information can be associated with the signed-in account. We also process IP addresses, request information and operational logs. The specific server-side purposes and retention rules for these identifiers must be confirmed before this draft is published.
2.7 Support and safety assistance: we process your requests, contact details and necessary evidence to handle complaints and rights requests. Safety systems may process relevant conversations and risk signals to limit harmful outputs, provide crisis resources or support necessary human review; this is not diagnosis and does not guarantee detection of every risk. We do not routinely notify family members because of ordinary emotional expression. We disclose only the minimum necessary information to necessary assistance providers when you request it, validly authorize it or an emergency disclosure is permitted or required by law.
2.8 We may receive account identifiers and authorized profile data from your chosen sign-in provider, payment, refund or fraud-review status from payment channels, and posts, mentions or complaints concerning you from other users. Receipt from a third party does not automatically authorize advertising, training or sensitive profiling. Nonusers may also make privacy or personal-rights requests concerning information about them on the platform.
2.9 Media processing may identify text, objects, scenes, speech or person locations needed for generation, captions and safety review. This is not equivalent to building an identity faceprint or voiceprint database. Biometric processing for identification occurs only when actually needed for the relevant function and after specific notice and authorization. We do not continuously read keystroke rhythms, contacts or unrelated files on your device.
2.10 The relevant saving or generation step explains whether drafts are stored on the device or in the cloud. Requesting cloud generation transmits the selected input even if it is never publicly posted. We do not treat other unsubmitted edits or the entire clipboard as default uploads. Feedback such as disliking content processes only the explained feedback data; if accompanying chat excerpts are sent for human review, their scope is explained.
2.11 Android analytics and crash diagnostics: Google Analytics for Firebase helps us understand app usage and functional outcomes, including login and registration events and SDK-generated usage information. Firebase Crashlytics processes crash reports, relevant app state, device metadata and installation-related identifiers to diagnose failures. Appendix A describes their data categories; section 6.4 describes current collection timing and the controls that still require resolution for this draft.
2.12 Local diagnostic logs (Android): the app uses Mars XLog to record operational events and errors in encrypted files in app-private storage. Records can include timestamps, request or operation references, account-related diagnostic context, transaction references and error details. These logs support troubleshooting and are separate from Firebase Crashlytics reports. The reviewed logging and export paths write files locally; they do not send logs to Tencent merely because XLog is used. The current version can record purchase tokens in payment diagnostics; removal or redaction of those values is a release-review item, not a completed safeguard.
2.13 Media delivery and caching (Android): images are fetched from the address associated with the content and may be cached in memory and app-private disk storage for display and reuse. The image server or content-delivery provider receives the network request, including the source IP address and requested resource address, which may contain signed access parameters. Coil is the image-loading library, not the image host. Loading an image does not by itself mean that a new photo from your device is uploaded; uploading selected content is a separate action described in sections 2.2 and 2.3.
3 Memory and personalization
3.1 When you enable long-term memory, we may create summaries from relevant conversations, facts you confirm and preferences for later interactions and story creation. Assessments of emotions, relationships and interests are potentially inaccurate inferences, not objective facts or evidence that you authorized disclosure. You may request access, correction or deletion of memories and disable future memory generation; disabling the function does not delete existing records. The scope of memory deletion and original-chat deletion will be explained separately, and you may request both.
3.2 If personalized recommendations are enabled, they may rank content or characters using selected interests and viewing, interaction, following and saving history. You may disable personalization, choose non-personalized content and manage tags; general recommendations may still appear. We do not exploit inferred emotional vulnerability to manipulate purchases or use story preferences or chat analysis for eligibility decisions in credit, employment, housing, insurance or other matters with legal or similarly significant effects. Statutory profiling and automated-decision rights are described in section 11.
3.3 We do not sell personal information, "share" it for cross-context behavioral advertising, or process it for cross-site or cross-app targeted advertising. "Sale" and "sharing" have the meanings given by applicable state law and are not limited to cash transactions. Private conversations, unpublished materials, long-term memories, consumer health data and biometric information are not provided to advertisers. Before changing these practices, we will update specific disclosures and choice mechanisms and obtain legally required consent, without retroactively expanding existing permissions.
3.4 Profiles, chats, memories and recommendation records may be linked through the same account to provide Services you choose, using only relevant and necessary data. Deleting an inaccurate memory does not automatically change a published work, and withdrawing a public work does not automatically delete its source chat. You may expressly request handling of these records together, and we explain scope and retention exceptions.
3.5 We do not build advertising audiences from private chats or sensitive inferences such as health, sexual orientation or religion. If creator analytics are offered, they generally show aggregate viewing and engagement metrics, without revealing viewers’ private chats or sensitive inferences. Statistics presenting identification risks remain protected as personal information and are not made public merely by being called “statistics.”
4 Sensitive information and device permissions
4.1 Chats and materials may contain sensitive information such as health, sex life or sexual orientation, religious beliefs, race or ethnicity. Facial geometry for identification, voiceprints, government identification numbers, account credentials or precise geolocation may also receive special protection. Before processing, we explain the specific purposes, categories, recipients and retention and obtain affirmative, separate or written consent required by applicable law. Optional sensitive processing can be refused or consent withdrawn without limiting unrelated functions; Any additional consumer-health notice required for the actual processing must be provided before that processing; no separate notice is supplied by this draft.
4.2 If facial, voiceprint or real-person verification is enabled, specific written disclosures and legally required written releases must precede collection or derivation of biometric identifiers; uploading a photo or accepting this Policy does not replace that release. We do not sell, lease, trade or profit from biometric data itself, or use verification data for advertising, emotional profiling or model training. Data subject to Illinois BIPA is permanently destroyed when its initial purpose is satisfied or within 3 years of your last interaction with us, whichever occurs first; absent a valid court warrant or subpoena, we follow that deadline, with any shorter period under other law or Appendix B applying. Disclosures occur only under valid authorization or another statutory exception.
4.3 Photo-library or file access enables your material selection; the camera supports capture or verification you initiate; the microphone supports recording or voice functions you initiate; notification permission supports messages or task alerts you choose. Permissions are requested only for the corresponding function and may be withdrawn in system settings. Accepting this Policy does not grant access to contacts, precise location or continuous background recording; new functions requiring such information need separate notice and legally required consent.
4.4 Before supplying materials depicting another person, inform them and obtain required permission. Performance authorization records verify the permitted story, purpose and scope and do not automatically authorize collection of biometric identifiers. The person concerned may contact privacy or safety channels to request verification, correction or cessation of unauthorized processing. We do not reject applicable rights requests solely because another user uploaded the material.
4.5 Android-specific media and notification access: the app uses the system media picker to access individual photos or videos you choose, rather than requesting access to the entire photo library. Microphone permission is requested when you enter voice mode or initiate recording and can be denied or revoked in Android settings. Notification permission is checked on Android 13 and later; earlier Android versions do not use that runtime permission. Selected media and audio submitted through a feature are handled as user content under sections 2.2 and 2.3. Notification display controls are distinct from push-token processing and device registration described in Appendix A.
5 Model processing and training
5.1 AI replies or works require relevant model providers to process necessary inputs and context. The model providers, recipient entities, locations and retention arrangements for United States services are listed in Appendix A; before use, we explain what request information is processed by which provider categories. Providers may not use entrusted data for unauthorized independent purposes. Sensitive information, biometric information and consumer health data must also meet applicable consent requirements and restrictions; sending an ordinary chat does not authorize other purposes.
5.2 By default, we do not use private conversations, uploaded materials, generated content or long-term memories to train or fine-tune general-purpose models, and we do not allow contracted providers to use them to train their own general-purpose models. Any optional training programme for non-sensitive content requires separate disclosure of the data, purposes, models, recipients, retention and withdrawal method and an independent affirmative choice; declining does not affect basic services. Consumer health data and biometric verification data are excluded from such training programmes. Processing context for inference is not training.
5.3 Necessary human access may support requested troubleshooting, safety review and lawful investigations, with role-based authorization and access records. Human review is not routine reading of all chats and does not automatically authorize adding content to training datasets. Identifiable quality-evaluation samples require disclosed purposes, necessary scope and any choices or consent required by applicable law.
5.4 If you join future optional training, you may withdraw from further participation. We will stop new training use and address retained source data. Applicable deletion or other rights concerning information in existing models must still be handled. We will neither promise item-by-item removal from model parameters without confirmed capability nor use that limitation to avoid legal duties. The specific arrangements must be explained before participation.
6 Storage technologies and privacy choices
6.1 Local storage and necessary session technologies retain account or onboarding state, profile information, language, preferences and device content. On Android, local storage also holds the app-generated installation identifier described in section 2.6. Clearing local data may reset preferences or remove device content but does not delete your account or server data. Browser settings do not control the Android app's Firebase collection or erase information already sent to a service.
6.2 We process information according to the functions you request, your choices and applicable United States law, without treating acceptance of terms as unrestricted permission to use data. As required by law, we recognize and honor universal opt-out signals such as Global Privacy Control (GPC) as requests to opt out of sale, sharing or targeted advertising; although we do not currently conduct these activities, we do not circumvent such signals. Traditional Do Not Track signals do not trigger an additional mechanism, without affecting compliance with GPC or other recognized signals. Marketing emails may be stopped through unsubscribe links; necessary service and security notices are not marketing emails.
6.3 Technology names, platform applicability, purposes and data categories are described in Appendix A. Analytics and crash diagnostics are separate from permissions for photos, microphone access and notifications. Denying notification or microphone permission does not by itself disable analytics or crash diagnostics.
6.4 Android analytics and diagnostics controls: the Android version reviewed for this draft enables Analytics after successful sign-in and after a signed-in session is successfully restored at startup. Crashlytics collection is enabled after successful sign-in, and its enabled state persists beyond sign-out. The current privacy settings screen does not provide a separate analytics or crash-diagnostics switch. This draft does not represent acceptance of the Policy or sign-in as a separate optional analytics choice. The available consent, withdrawal and request-handling mechanism must be finalized before publication; applicable rights are not waived by the absence of a settings control.
6.5 Android local components: MMKV and Room support local storage of preferences, account-related state or app data. Coil supports image loading and caching; cache keys distinguish the current environment and account. Mars XLog supports local diagnostic files. These software components are not identified as remote data recipients solely because they run inside the app. The data sent by app features using stored information remains subject to the relevant collection and disclosure provisions.
6.6 Diagnostic support: if you choose to send us diagnostic logs to help resolve a problem, we process the information they contain for troubleshooting. This may include device and app information, error details and account-related operational records described in section 2.12.
6.7 Cache and account deletion have different effects. Removing a cached image or clearing local preferences does not remove the hosted image, server-side account records, previously submitted diagnostic material or provider-held data. Similarly, signing out does not mean that all installation-level identifiers or diagnostic records have been deleted. Category-specific handling is described in Appendix B.
7 Processors and external disclosures
7.1 To provide the services, we disclose necessary information to providers performing hosting, content delivery, model inference, safety review, identity verification, payments, login, notifications or support, with categories and the specific register in Appendix A. Processors are contractually restricted as to purpose, confidentiality, security and retention and must assist with rights requests as required by law. Independent login or payment providers process necessary information for their disclosed purposes. We do not provide complete chats or materials to every provider; each receives only what its actual function requires.
7.2 Apart from public or external sharing you choose, we disclose necessary information only for purposes permitted by applicable law, including verifying valid legal process, protecting lawful rights, addressing safety or fraud incidents, and providing assistance in lawful and necessary emergencies. If a merger, acquisition or asset transfer involves data, recipients remain subject to applicable law and existing commitments; material changes in purpose require further notice and consent where required. Stricter rules for health and biometric information continue to apply.
7.3 Public disclosure follows your chosen audience; service-provider processing is not publication. If collaboration or external sharing enables others to access works, materials or specific profile information, we explain the scope at the action. Independently saved copies may be controlled by recipients; you may still request handling of information within our control and report unlawful recipient uses.
7.4 Disclosures within a corporate group must also have a specified purpose and necessary scope; affiliation does not automatically grant access to all information. Actual recipients and roles are listed in Appendix A; any consumer-health-specific recipient disclosures must be completed in a supplemental notice where required. Deidentified information is handled under applicable law with reasonable safeguards against reidentification, a commitment not to attempt reidentification, and corresponding recipient restrictions.
7.5 Network and storage components: OkHttp and Retrofit perform network requests to the service endpoints used by the app; they are not themselves the companies receiving the requests. Media upload may transfer selected files directly to an object-storage endpoint authorized by our server. Storage protocol compatibility, including S3 compatibility, does not establish which company hosts the file or its processing country. The actual hosting and content-delivery recipients must be identified in the completed service register.
8 Storage locations and retention
8.1 Offering services in the United States does not mean that all information is processed only in the United States. Processing may involve our hosting, storage, authentication, notification, diagnostics and model providers. The actual countries or regions for primary storage, backups, remote support and provider processing remain subject to confirmation for this draft. We do not rely on this Policy or user consent to bypass applicable data-transfer restrictions.
8.2 Information is retained for the shortest period necessary for its purpose, with category-specific periods in Appendix B. After account deletion, a deletion request or completion of a purpose, we delete or anonymize the corresponding information; legally required retention is limited to necessary records, with other processing restricted. Data that cannot immediately be deleted individually from backups is isolated and removed within the backup rotation period, without reuse in ordinary services; deletions are reapplied after backup restoration. De-identified data may still be personal information and is not equivalent to anonymized data.
8.3 Retention depends on functional needs, whether you retain content, dispute handling, legal retention requirements and security risks, rather than keeping data indefinitely because it “might be useful.” Legally preserved evidence is separated from ordinary-use data, used only for preservation purposes and subject to applicable deletion once the basis ends. Account deletion does not require erasing legally mandated transaction records, but does not permit continued recommendation or marketing use of them.
9 Security and your rights
9.1 We apply transmission protection, access controls, permission reviews and incident response measures appropriate to the risk; human access to content is limited to necessary support, safety or legal-duty scenarios and is logged. If a personal information security incident occurs, we take remedial measures and notify users and authorities as required by law, explaining the impact, response and available protective steps.
9.2 All United States users may request access, copies, correction or deletion of personal information, disable memory, personalization or marketing, withdraw relevant consent, or delete an account through [Privacy contact — pending confirmation]. Requests do not require a new account; existing account holders may use their account for appropriate verification. We verify only information proportionate to the request’s risk and do not request account passwords. Additional state-law rights and appeals are in section 11; any separately required consumer-health notice remains a publication prerequisite.
9.3 We respond to general rights requests within 45 calendar days, or a shorter period required by applicable law. If an extension is necessary and legally permitted, we explain the reason and new deadline within the original period. Opt-out requests follow any applicable shorter deadline. Ordinary reasonable requests are free; any legally permitted fee or refusal is explained. Deletion may not apply to limited records that must or may lawfully be retained; we explain exceptions and restrict later uses, with specific health-data rules taking precedence. Withdrawal does not affect prior lawful processing but may stop optional functions dependent on the information.
9.4 Request verification normally uses an existing account or contact information already held. High-risk access to specific information may require stronger verification to avoid disclosure to an impostor. Verification materials are used only for verification, security and legal obligations and deleted after the necessary period. If verification fails, we explain why and what appropriate additional information may help, without requiring unrelated sensitive details.
9.5 Portability requests provide data you are entitled to receive in a commonly used, machine-readable form where applicable, while protecting other people’s information and legally protected security information. Disabling a function, clearing device cache, deleting one item and deleting an account have different effects. We act on your actual request and do not require account deletion as a condition of correction, opting out or deleting an individual item.
9.6 Account deletion and requests outside the app: the Android app includes an account-deletion request flow. Signing out, uninstalling or clearing cache does not replace that request. Before publication, this Policy must provide a verified external request channel usable without reinstalling the app, explain proportionate identity verification, and identify the data deleted and any retained exceptions. A webpage that only directs you back to the app is not presented by this draft as a completed external deletion service.
10 Age restrictions and policy updates
10.1 The services are for users at least 18 years old who meet their state’s legal age for independent contracting, are not intended for minors, and do not knowingly collect personal information from children under 13. If we discover children’s information was improperly collected, we promptly delete it and take necessary measures under law. Parents or guardians may contact [Privacy contact — pending confirmation]. Age statements do not replace applicable children’s privacy or teen-protection obligations; if an ineligible user is identified, we restrict relevant use, provide an appropriate appeal route and handle data under law.
10.2 We review and update this Policy at least every 12 months and notify you of material changes, explaining the changes and effective date. Processing requiring new consent begins only after obtaining it. This draft is in English; a translated policy is not being provided or represented as available here.
11 United States state privacy rights
11.1 Depending on your state of residence and whether the relevant law applies to us, you may have rights to confirm processing, access, copies and portability, correction, deletion, information about data recipients, and opt-outs from sale, sharing, targeted advertising and certain significant-effect profiling or automated decisions. Some states also require prior consent for sensitive processing or allow limits on its use and disclosure. We honor each applicable requirement in effect without reducing these rights through this Policy.
11.2 Where CCPA / CPRA applies, California residents may request the categories and specific pieces of information collected, used, disclosed, sold or shared, source categories, business or commercial purposes and recipient categories; request deletion and correction; opt out of sale or sharing; and, where applicable, limit use and disclosure of sensitive information. We do not unlawfully deny service, charge different prices or reduce quality because you exercise rights. Our commitments against sale, sharing and cross-site targeted advertising are in clause 3.3; we do not knowingly sell or share information of anyone under 16.
11.3 Request channels are [Privacy contact — pending confirmation] .Authorized agents may use the same channels with reasonable proof of authority; we verify directly with you when necessary. Opting out of sale, sharing or targeted advertising does not require the identity verification used for ordinary access requests. Recognized opt-out signals such as GPC are handled under clause 6.2 and apply to the relevant browser, device or linkable account as required by law.
11.4 If a request is denied, appeal by emailing [Privacy contact — pending confirmation] with the subject "Privacy Appeal". We provide a written outcome and reasons within 45 calendar days, or a shorter legally required period. If the appeal is unsuccessful, we explain how to complain to your state attorney general or other competent privacy regulator. This appeal channel is also available to United States users without a statutory appeal right and does not limit other legal remedies.
11.5 Privacy requests will not result in unlawful retaliation or differential treatment. If we offer a financial-incentive program in exchange for voluntarily supplied personal information, we provide a separate notice before enrollment describing categories, enrollment and withdrawal methods, material terms and any legally required data-value estimation method. Withdrawal may end the corresponding benefit without affecting other statutory rights.
11.6 California residents may also contact the privacy email about applicable direct-marketing disclosures. We do not provide personal information to third parties for their independent direct marketing. Applicable state rights may vary by residence, processing activity and legal exemptions. If we deny a request, we explain the actual basis rather than merely stating that “the law does not apply.”
12 Notice at collection and California category disclosures
12.1 This section must be available before or at collection. Depending on the functions used, we collect the following categories, with specific purposes in sections 2 through 7 and retention criteria in section 8 and Appendix B: identifiers and account contact information; voluntary profile information such as age and gender; commercial information such as orders; internet activity and device information; text, photos, audio and video you submit; and preference and memory inferences. Sensitive categories are processed only for enabled functions and where legal conditions are met, including sensitive chat content such as health information, account credentials and identity-verification information.
12.2 Sources include you, your device and service activity, login and payment providers you select, collaborators you authorize or other users who post content involving you, and system inferences from those sources. We do not purchase personal dossiers from data brokers or collect employment or education records for the services. If you voluntarily include such information in content, it is handled as user content subject to relevant sensitive-information restrictions.
12.3 Business disclosures follow the minimum necessary scope: account information to login, security, hosting or support providers; order information to payment, accounting and support providers; internet activity to operations, security and enabled analytics providers; content and inferences to model, storage, delivery and review providers needed for the request; and verification information only to necessary verification and security providers. Other users see only what you choose to post or share with them. Legal-disclosure recipients and transaction successors are addressed in clause 7.2. None of these categories is sold or shared for cross-context behavioral advertising.
Appendix A — Android services and recipient register
A.1 Google sign-in and Firebase Authentication (Android). Provider: Google / Firebase. These services authenticate the Google account you choose and establish an InStory session. The flow processes authentication identifiers and tokens and available authorized profile information. Firebase Authentication also processes technical request information such as IP addresses and SDK information for authentication and abuse prevention. Our business server receives the Firebase ID token and available display name.
A.2 Google Analytics for Firebase (Android). Provider: Google. Used to understand app usage and functional outcomes. The app records successful login and registration events with the sign-in method (email or Google); these method labels are not the user's email address. SDK collection may also include app-instance identifiers, session and lifecycle events, purchase events and approximate location derived from IP addresses, depending on configuration. The Android app disables advertising-ID collection, advertising-personalization signals and automatic screen reporting. Those settings do not disable all Analytics collection. Collection timing and the current control limitation are described in section 6.4.
A.3 Firebase Crashlytics (Android). Provider: Google / Firebase. Used to diagnose crashes and assess their impact. Data includes crash stack traces, relevant application state, device metadata and a Crashlytics installation identifier. Supporting Firebase Installations and Sessions components process installation or session information used by the service. Collection is enabled after successful sign-in as described in section 6.4. This draft does not claim that signing out deletes previously collected crash reports.
A.4 Firebase Cloud Messaging (Android). Provider: Google / Firebase. Used for push messaging. The app obtains a push token and registers it with our server together with the installation identifier, platform, app identifier, device model, OS version and app version for an active account. Supporting Firebase Installations provides installation-related identifiers. On Android 13 and later, the app checks notification permission before this token acquisition and registration path; earlier Android versions do not use that runtime permission. Disabling notification display is different from deleting a token or removing the account's device registration.
A.5 Google Play Billing (Android). Provider: Google Play. Used to process points purchases. Google Play and our server process the purchase information described in section 2.5 for payment, purchase verification, entitlement delivery and transaction recovery. We supply an obfuscated account identifier in the purchase flow. The payment channel handles the payment information supplied through its own interface.
A.6 Scope of this draft register. These Android disclosures do not imply that the iOS app includes the same services. The iOS register and the shared hosting, content-delivery, AI-model, moderation and support providers remain to be verified. Contracting entities, processing locations, retention settings and recipient roles must be confirmed before this register is complete. Local libraries are not treated as third-party data recipients solely because they are included in the app.
A.7 Hosting and media delivery — recipient details pending. The reviewed Android code supports direct object-storage uploads and image requests, including Aliyun OSS image-resize URL handling. This establishes a storage or delivery integration, but does not prove the production provider, contracting entity, processing location or all active domains. Those details must be verified for the release; no exclusive United States hosting claim is made by this draft.
A.8 Local components are described separately in Appendix C. They are not merged with remote service providers. An open-source attribution or a software dependency name is not evidence that its author receives personal information.
Appendix B — Retention and deletion schedule (draft)
B.1 This schedule is pending operational confirmation and does not establish new retention periods. Before publication, each category below must identify its purpose, retention period or concrete retention criterion, deletion trigger, exceptions and backup or provider deletion process.
B.2 Account and authentication records: confirm deletion of InStory profile data, external identity records and active sessions, including the distinction between account deletion and sign-out.
B.3 Chats, selected and uploaded media, generated works and memories: confirm cloud and local copies, unpublished content, temporary uploads, provider copies and whether deleting source content also removes related generated content.
B.4 Device and installation identifiers, push tokens, analytics and diagnostic records: confirm account associations, provider-side retention settings, withdrawal handling and removal or deactivation of device registrations.
B.5 Purchase and transaction records: confirm the records retained for fulfillment, reconciliation, refunds, disputes or legal obligations, with the corresponding duration or retention criterion.
B.6 Backups and legal holds: confirm backup rotation periods, restrictions on retained copies and how deletions are reapplied after restoration. No fixed deletion deadline is introduced by this preview.
B.7 Android local diagnostic files: the reviewed source configures XLog's maximum log age to 7 days. This is a cleanup configuration, not a verified guarantee that every copy is deleted within 7 days; actual cleanup behavior, cache files, exported ZIP archives and support-held copies must be assessed separately. App-private diagnostic files persist across account and environment changes in the reviewed design.
B.8 Android image cache: the reviewed app stores cached images in an app-private cache directory with a configured size limit and account/environment-specific keys. A size limit or cache eviction is not a fixed retention period and does not remove the hosted original. Production cleanup behavior must be confirmed before assigning a retention deadline.
Appendix C — Android local and networking components
C.1 Mars XLog — local diagnostics. An open-source logging component from the Tencent Mars project, included through an InStory-maintained package. It writes encrypted diagnostic files to app-private storage and supports the local export described in section 6.6. The reviewed integration does not establish Tencent as a recipient of these files. This component must not be confused with the Firebase Crashlytics service.
C.2 Coil and Telephoto — image display. These components load, cache and display images or support zooming. The request is sent to the image resource's host, not to the library author because the library is used. Actual image hosts and their processing are covered by section 2.13 and the service register.
C.3 MMKV and Room — on-device storage. These components store app-managed information locally for the functions described in section 6.5. Using MMKV does not by itself send those records to Tencent, and using Room does not by itself send them to Google. Server synchronization and backup must be assessed separately from local storage.
C.4 OkHttp and Retrofit — networking. These components carry requests to configured business or media endpoints. Disclosures depend on the request content and receiving service, not on the library's name. For the reviewed Android image-loading client, the business request interceptor that adds device identifiers and account authorization is not attached.
C.5 This component inventory describes the reviewed Android source version. It is not a certification that every packaged dependency is network-silent, and it does not replace verification of the final release artifact, enabled SDK features or actual server destinations.