Privacy Policy

1. Scope and personal information controller

This Privacy Policy applies to the mainland China edition of Star Memoirs AI. Ganyue (Shanghai) Technology Co., Ltd. ("we") operates the app and is its personal information controller. Our registered address is Room 118, Building 20, Nos. 1–42, Lane 83, Hongxiang North Road, Lin-gang Special Area, China (Shanghai) Pilot Free Trade Zone, Shanghai, China and our contact email is contact@happysense.cn.

We are responsible for personal information processing in the services we operate. Model accounts, cloud drives and sharing tools you connect independently are provided by their respective providers; those accounts and services are also subject to their privacy policies.

This policy also covers https://pickmemo.happysense.cn. Public app downloads, the production WeChat edition and paid membership are not yet available. The notice describes processing in the current development/test editions and when the corresponding features become available; reading it does not activate unavailable features. Mainland China online services must meet applicable domestic-processing or transfer requirements before opening.

3. Information we process and its purposes

Local records: text, book titles, entry times, interview messages, corrections and permissions, memoir plans, manuscripts and history are processed to save, search, check and organise your material. Photos and recordings you select are used for local display, playback and export. Text interviews currently do not read photo contents.

Text AI: with a valid backend connection and corresponding sending permission, required original records, recent conversations, option answers, consolidation permissions and existing plans are sent to the independent backend and its model. Existing personal model connections send this material to the configured OpenRouter model. The purpose is to generate interview replies and memoir plans.

Public checks: public keywords concerning schools, organisations, place names or history are processed by AI and search services only after you confirm the keywords and start the query. Results, source links and query times are displayed and retained as supporting evidence. Checks do not automatically alter your original records.

Voice: sending a short voice message saves the original audio on your device and automatically sends it through the Star Memoirs AI HTTPS gateway to Volcengine Doubao speech recognition for transcription; recognition fees may apply. No additional switch or per-message transcription action is required. Offline tasks are retained and, when online, queried using the same task identity. Submitted recognition with an unconfirmed result is not automatically repeated; explicitly retrying a terminal task may incur another charge. Temporary server audio is cleared after completion, failure or expiry. Results are kept for at most 24 hours and deletion is requested after the device saves them. Only hashed identity, file fingerprints and task receipts needed to prevent duplicate billing remain; provider retention follows its policy. On iOS, unfinished legacy chat audio attachments are also recognised in consecutive slices through Doubao, with no total transcription duration cap. Progress is saved per slice for resumption; existing original records are not retranscribed or overwritten. Device storage and service quotas still apply. iOS no longer uses system speech recognition; other platforms follow their feature descriptions. Live interviews continue to process audio, session identifiers, network information and captions through the gateway and Volcengine. Each connection automatically sends a limited selection of saved conversations, currently corrected originals, memoir contents and excerpts from the current book to continue the interview. Other books and unsaved drafts are excluded. The voice gateway does not store this text context, and live-call audio is currently not recorded.

When you submit a family recording for transcription, its audio, file information and task identifier are sent to the configured recording gateway and Volcengine recognition service to generate transcripts with speakers and timestamps. Memoir planning separately sends the relevant authorised text to model services.

After you connect cloud sync, books, conversations, drafts, history and chat attachments on the bookshelf are sent to the private app space in your selected iCloud or Google Drive. Google authorisation also processes account email, identifiers and tokens to identify the sync account. Only Drive app-data permissions are used; other documents in your drive are not read. The separate family-recording library is not automatically synced with the bookshelf.

Online recipients process necessary IP addresses, connection, task and usage information. Personal model keys, service credentials and cloud tokens authenticate requests. Model keys and service credentials are held in device secure storage and are not included in material backups.

iOS automatic writing access: after you allow AI interviews and memoir writing for the current book, the app sends an independent random installation identifier, recovery secret and permission version to the Star Memoirs AI writing backend to apply for or renew this device's account. The server stores identifier and secret hashes, expiry, refresh times and anonymous network rate counters. Recovery secrets and access credentials remain in local secure storage and are not backed up. Enrollment sends no original records and triggers no model. After book-specific confirmation, records, conversations, consolidation permissions and plans pass through the backend and OpenRouter to the selected model; photos and original audio are not sent by this operation. Writing permission is independent of voice permission and must be confirmed again after restoring a book.

Initial setup: editions offering this setup store your initial reply dialect and gender choice (including “prefer not to say”) and send them to our backend linked to the random installation account, separately from book content. Gender is not included in manuscripts or model prompts. The backend keeps the first submitted values rather than overwriting them when the voice dialect changes. Offline submissions wait on-device; after server acknowledgement, the local gender value and pending upload copy are cleared. Contact contact@happysense.cn to request withdrawal or deletion of backend information.

WeChat edition: the current development edition uses a random installation identity and local storage. It does not request your WeChat nickname, avatar, phone number, contacts or chat history for us, and does not obtain an OpenID through WeChat login. Only files or recordings you select and book-authorised text are used for their respective features; processing by the WeChat client and platform is also subject to its privacy rules. This edition is not registered or publicly released. Its production privacy guide will match the interfaces actually used; any future WeChat account login or sync will receive updated notice and required authorisation first.

4. Device permissions and refusal

The microphone is used only for recordings, push-to-talk and live voice you initiate. iOS transcription uses Doubao and no longer requests system speech-recognition permission. Denying microphone access affects recording, but not transcription of existing recordings, local text, reading or export. Other platforms follow their system permission settings.

You select images and files through system pickers. The app does not request full access to your photos, contacts, SMS or precise location. Network and audio-routing permissions support the corresponding connections and playback. You can change authorisations at any time in the phone's settings.

System permissions and consent to personal information processing are managed separately. Withdrawing a permission limits future access only and does not automatically delete text or recordings already saved.

On first entry to the main screen, the app requests microphone access in advance; iOS no longer requests system speech-recognition permission. Permission itself starts neither recording nor recognition. iOS also sends one request to the public health endpoint at pickmemo.happysense.cn, containing no originals, audio, identity identifiers or credentials, to trigger any system WLAN/cellular prompt early. The recipient receives necessary IP and connection information. Android and HarmonyOS declare network permissions at installation and do not provide the same prompt. Permissions already handled are not requested again when recording or calling; after refusal you can change them in system settings.

5. Recipients and third-party components

OpenRouter is used for text interviews, memoir planning and public research. It receives necessary prompts, context, queries, model and request information and forwards them to the selected model provider. Public queries currently use OpenRouter's Exa search component, which receives confirmed keywords. Providers differ in retention, training use and processing region; the app cannot make a universal promise of zero retention or no training.

Volcengine speech services and their official SDKs are used for live interviews and audio transcription you initiate, processing relevant audio, captions, sessions and necessary device/network information. Microphone permission may be requested on first entry to the main screen; actual audio collection begins only when you initiate that feature.

Apple iCloud / CloudKit and Google Drive / Google sign-in components are used for your chosen cloud sync and account authorisation, processing synced materials, account identifiers and authentication information. Android uses Google sign-in components; iOS uses system web authorisation and Drive APIs.

We operate the Star Memoirs AI backend, voice gateway and recording gateway, receiving material, authentication and task information required for each feature. We are responsible for these services. Providers entrusted with processing must follow agreed purposes and security requirements. A third-party backend you configure separately follows its provider's processing rules.

The app currently includes no advertising or advertising-tracking SDK. We do not sell your original records or memoirs. Sharing, export and third-party use deliver material to destinations you choose. Disclosures to authorities required by law or transfers during mergers/reorganisation follow the procedures required by applicable law.

7. Retention, security and deletion boundaries

Local originals, conversations, memoirs, attachments, drafts and recovery versions remain on your device until you delete the relevant material with available controls or uninstall the app. Editing the current memoir does not also delete history, recovery copies or separate audio records. Export material you want to keep before uninstalling. iOS may retain secure-storage credentials after uninstall under system rules.

Our recording and voice-transcription gateways clear temporary audio after completion, failure, deletion or expiry. Transcription results are kept for at most 24 hours and can be cleared earlier after the device confirms saving. The live voice gateway relays audio and captions in memory and does not save call recordings. Material synced to the memoir backend remains for ongoing interviewing and writing while that book's service is provided. Minimal task receipts, membership and accounting records may be retained separately for duplicate prevention and legal duties. Independently chosen providers apply their published retention periods.

Service logs support security, troubleshooting and operations. App logs do not record full originals, audio or access credentials. Logs and recovery backups are retained only for as long as needed for their purposes or required by law. After deletion from active storage, existing recovery backups follow their backup lifecycle; legally required retained copies are used only for that duty.

Turning off AI, disconnecting cloud sync or withdrawing permissions stops the related future processing, but does not automatically retract requests already sent, delete existing cloud files or destroy exported copies. Manage material on your device, in cloud services and with the relevant recipients separately.

We use app-private storage, system credential protection, protected transmission, access restrictions and task isolation. We cannot promise absolute security or describe the app as an end-to-end encrypted service; cloud and model services access material according to their processing methods. Where notice of a security incident is legally required, we will notify as required and take remedial measures.

8. Your rights and contact channels

You can read, search and export originals and memoir text, check transcription and make confirmed corrections, adjust device permissions, turn off AI or disconnect sync. HTML exports and full backups may contain complete original records and historical material; review their scope before sharing.

For access, copying, correction, supplementation or deletion of personal information held by the operator, withdrawal of consent, explanation of processing rules or legally available transfers of information, contact contact@happysense.cn. The local edition currently requires no app account registration. Manage third-party accounts with their providers; if you use an operator backend account, ask the operator to close it and handle the material.

After reasonable and necessary identity checks, we reply within fifteen working days of receiving a request. Other legal periods or permitted extensions follow applicable law and will be explained. We request only necessary verification information and do not require a complete memoir as proof. If a request is refused or deferred, we explain the lawful reason and available remedies. You may also complain to the competent personal information protection authority.

9. Minors and other people's information

The app primarily serves adults with appropriate civil legal capacity. Minors should use it with a guardian's involvement. Processing personal information of children under fourteen requires separate guardian consent and special rules. The current edition does not offer independent registration or use to children under fourteen.

For recordings and memoirs involving relatives, interviewees or other people, obtain the required permissions and avoid uploading unnecessary sensitive information. If you discover children's material provided without appropriate authority, request handling through the privacy email.

10. Membership and purchase information

The server processes device membership identity, trial periods, Apple signed transaction identifiers, product terms, refunds and gift-code redemption records. Gift codes are stored as irreversible hashes. Apple processes payment-card information; the app does not obtain full card numbers. Membership information is stored separately from book contents and used only to verify or restore entitlements, prevent duplicate redemption and keep necessary accounting records.

Before a China-region user requests printing and mailing, we separately disclose the required print manuscript, recipient, phone number and address, as well as printer, carrier, purposes and retention periods, for your confirmation. Joining or claiming a trial does not itself submit a manuscript or shipping details.

11. Policy updates

Version 1.1.0, updated 2026-10-08, effective 2026-10-08. Updates are published on the app's legal pages. Material changes in processing purposes, methods, categories, recipients or rights receive prominent notice and renewed applicable consent where required by law. Continued reading or local use does not automatically constitute consent to new optional processing.