Privacy Policy

1. Scope and controller

This Privacy Policy applies to the international mobile edition of Star Memoirs AI, provided and operated by Ganyue (Shanghai) Technology Co., Ltd. (“we”, “us” or “our”). Our registered address is Room 118, Building 20, Nos. 1–42, Lane 83, Hongxiang North Road, Lin-gang Special Area, China (Shanghai) Pilot Free Trade Zone, Shanghai, China. Contact contact@happysense.cn for privacy requests. We are the controller responsible for personal information processed through our services.

We are responsible for the personal information processing carried out through the services we operate. Where you independently connect a model account, cloud account or sharing service, that provider’s policy also applies to its account and services.

This policy also covers https://pickmemo.happysense.cn. Public app downloads, the production WeChat edition and paid membership are not yet available. The notice describes processing in the current development/test editions and when the corresponding features become available; reading it does not activate unavailable features. Mainland China online services must meet applicable domestic-processing or transfer requirements before opening.

3. Information and purposes

Local features process the text and book titles you enter, recording timestamps, chat messages, corrections, permissions, memoir plans, drafts and history to save, search, review and organise your materials. Photos and recordings you select are kept for display, playback and export. The current text interview does not analyse photo contents.

With a valid connection and book-specific sending permission, text AI processes relevant source records, recent conversation, option responses, editing permissions and existing plans through the independent backend and its model to generate interview replies and writing plans. Existing personal connections continue to use their configured OpenRouter model.

Public research sends a proposed public keyword query only after you review and request it. Queries about schools, organisations, places or public history are processed by AI and search providers. Results, source links and retrieval dates are saved as supporting material, without automatically correcting your records.

Sending a short voice message saves the original audio on your device and automatically sends it through the Star Memoirs AI HTTPS gateway to Volcengine Doubao speech recognition for transcription; recognition fees may apply. No separate switch or per-message transcription action is required. Offline tasks remain on-device and reconnect using the same task identity; already dispatched recognition with an unconfirmed result is not automatically repeated. Explicitly retrying a terminal task may incur another recognition fee. Temporary server audio is cleared after processing, failure or expiry. Results are kept for up to 24 hours and cleared on device acknowledgement; only hashed identity, file fingerprints and minimal receipts remain to prevent duplicate billing. Provider retention follows its policy. On iOS, unfinished legacy chat audio attachments also use the Doubao gateway in consecutive slices, without a total transcription duration cap. Slice results are saved locally for resumption; existing original words are not retranscribed or overwritten. Device storage and service quotas still apply. iOS no longer calls system speech recognition; other platforms follow their respective feature descriptions. Live interviews continue to send audio, session identifiers, connection information and captions through the gateway and Volcengine. Each call automatically includes a bounded selection of saved conversation, current revised originals, and memoir outlines and excerpts from the current book to continue the interview. Other books and unsaved drafts are excluded, and the voice gateway does not store this text context; live calls currently have no local audio recording.

When you request cloud transcription of a family recording, the selected audio, file information and task identifiers are sent to the configured recording gateway and Volcengine speech service to produce time-coded speaker transcripts. Memoir planning separately sends the relevant authorised text to the model service.

Cloud sync sends books, chats, drafts, history and chat attachments to the private app space in the iCloud or Google Drive account you connect. Google authorisation processes your account email, account identifier and tokens to identify the sync account. Drive access is limited to app data; other Drive documents are not read. The separate family-recording library is not automatically included.

Online recipients process necessary IP addresses, connection, job and usage information. Model keys, service credentials and cloud tokens authenticate requests. Personal model keys and service credentials are stored using device secure storage and are excluded from content backups.

iOS automatic writing access: after you allow AI interviews and memoir planning for the current book, the app sends a separate random installation identifier, recovery secret and consent version to the Star Memoirs AI writing backend to obtain or renew a device account. The server stores identifier/secret hashes, expiry and refresh times, and anonymous network rate counters. Recovery secrets and access tokens stay in device-only secure storage and are excluded from content backups. Enrollment does not send your records or run a model. After book-specific permission, records, conversations, editing permissions and plans pass through the backend and OpenRouter to the selected model; photos and original audio files are not sent by this operation. Writing permission is separate from voice permission and must be renewed after restoring a book.

Initial setup: editions offering this setup store your initial reply dialect and gender choice (including “prefer not to say”) and send them to our backend linked to the random installation account, separately from book content. Gender is not included in manuscripts or model prompts. The backend keeps the first submitted values rather than overwriting them when the voice dialect changes. Offline submissions wait on-device; after server acknowledgement, the local gender value and pending upload copy are cleared. Contact contact@happysense.cn to request withdrawal or deletion of backend information.

WeChat edition: the current development edition uses a random installation identity and local storage. It does not request your WeChat nickname, avatar, phone number, contacts or chat history for us, and does not obtain an OpenID through WeChat login. Only files or recordings you select and book-authorised text are used for their respective features; processing by the WeChat client and platform is also subject to its privacy rules. This edition is not registered or publicly released. Its production privacy guide will match the interfaces actually used; any future WeChat account login or sync will receive updated notice and required authorisation first.

4. Legal bases where required

Where the GDPR, UK GDPR or equivalent rules apply, processing necessary to perform the functions you request relies on contractual necessity where appropriate. Optional permissions and processing that requires consent rely on your affirmative choice. Required legal disclosures rely on legal obligations.

Necessary security and service-integrity processing may rely on legitimate interests after considering your rights. Special-category data requires an applicable additional condition, such as explicit consent; an ordinary agreement to the service is not sufficient. You may withdraw consent for future processing without affecting processing that was lawful before withdrawal.

5. Device permissions

Microphone access is used for recordings and live voice you initiate. iOS transcription uses Doubao and no longer requests system speech-recognition permission. Denying microphone access affects recording, but not transcription of existing files, local text, reading or export. Other platforms follow their system permissions.

Photos and files are selected through system pickers. The app does not require full photo-library, contacts, SMS or precise-location access. You may change permissions in device settings. Revoking permission does not delete existing recordings or text.

On first entry to the main screen, the app requests microphone access in advance; iOS no longer requests system speech-recognition permission. Granting access does not start recording or recognition. iOS also makes one request to the public health endpoint on pickmemo.happysense.cn, without source records, audio, identity identifiers or credentials, to bring forward any system WLAN/cellular prompt. The recipient receives necessary IP and connection information. Android and HarmonyOS declare network access at installation and do not provide the same system prompt. Processed permissions are not requested again when recording or calling; you can change a refused permission in device settings.

6. Recipients and integrations

OpenRouter receives necessary prompts, context, confirmed research queries, model and request information and routes requests to your selected model provider. Public research currently uses OpenRouter’s Exa search integration. Model providers differ in retention, training use and processing location; the app does not promise that all of them offer zero retention or exclude training.

Volcengine speech services and their official SDKs process the audio, captions, session details and necessary device/network information needed for live voice and audio transcription that you initiate. Microphone permission may be requested when you first enter the app; recording starts only when you initiate the corresponding feature.

Apple iCloud / CloudKit and Google Drive process the synced materials and necessary account/authentication information. Android uses Google sign-in components; iOS uses system web authorisation and Drive APIs. Your configured backend and gateways receive the materials needed for the corresponding feature.

We do not sell your memoirs or records and the current app has no advertising or advertising-tracking SDK. We disclose information when you direct a share or export, where lawfully required, or during a business transfer with applicable safeguards. The roles and responsibilities of independently chosen providers depend on the service you use.

8. Retention and security

Local records, conversations, attachments, drafts and recovery versions remain until you remove the relevant material using available controls or uninstall the app. Editing a memoir does not remove all earlier versions. Device secure-storage credentials may survive uninstall under the operating system’s rules.

For our recording and voice-transcription gateways, temporary audio is cleared after processing completes, fails, is deleted or expires. Transcription results are retained for up to 24 hours and are cleared earlier when the device confirms successful saving. Live-voice audio and captions are relayed in memory and are not stored as recordings by our voice gateway. Records synced to the memoir backend are retained to support the book’s ongoing interviewing and writing. Minimal job receipts and entitlement or accounting records may be retained separately for duplicate prevention and legal obligations. Independently selected providers apply their own retention policies.

Service logs are used for security, troubleshooting and operations; our application logs do not include the full original records, audio or access credentials. We keep logs and recovery backups only for as long as needed for those purposes or required by law. When material is removed from active storage, existing recovery backups are handled through their backup lifecycle; copies subject to a legal retention duty are restricted to that duty.

Turning off AI, disconnecting sync or revoking permission stops the related future access; it does not retract accepted requests or automatically delete existing cloud or exported copies. Manage each storage location separately.

Safeguards include app-private storage, device credential protection, protected transport, access controls and job isolation. No system is completely secure. This is not a promise of end-to-end encryption: cloud and AI providers may need to access material to perform the requested service. Legally required breach notices and remedial measures will be provided.

9. Your rights and requests

In the app you can read, search and export records, correct transcription after confirmation, adjust permissions, turn off AI and disconnect sync. A full backup or HTML export may include complete source records and history; check the scope before sharing.

Depending on your location, you may request access, correction, deletion, portability, restriction or objection, and withdraw consent. EEA and UK residents can complain to a competent supervisory authority. Submit requests to contact@happysense.cn. We verify only what is reasonably necessary and respond within the applicable legal period, normally one month under the GDPR or UK GDPR, explaining any permitted extension.

Local use does not require an app account. Third-party accounts are managed with their providers. If you use an operator-provided backend account, request closure and related data handling through the operator. Information kept exclusively on your device may need to be managed there.

10. California supplement, where applicable

If the CCPA/CPRA applies, the categories collected are identifiers (account, IP and task identifiers), content you provide, audio or selected images, internet/network information and service usage described above. Sources are you, your device and the services you connect. The purposes and recipient categories are set out in sections 3 and 6; retention is in section 8.

We do not sell personal information or share it for cross-context behavioural advertising. We do not use sensitive personal information to infer characteristics for advertising. You may request to know/access, correct or delete information, use an authorised agent and receive service without unlawful discrimination. Send requests to contact@happysense.cn; applicable response periods, generally 45 days for verifiable requests, apply. There is no advertising sale/share to opt out of, and we do not disregard applicable browser or device privacy signals.

11. Children and third-party information

The service is designed for adults and is not directed to children under 13, or a higher applicable age for independent use. Minors above that threshold need any legally required guardian involvement. We do not knowingly offer independent service to children below the applicable threshold.

Do not upload another person’s recording or sensitive information without appropriate authority. If you believe a child’s information was provided without a lawful basis, contact contact@happysense.cn to request review and handling.

12. Membership and purchase information

The server processes your installation membership identity, trial dates, Apple signed transaction identifiers, product expiry, refund status and gift redemption records. Gift codes are stored as irreversible hashes. Apple handles payment card details; the app does not receive full card numbers. Membership records are separate from book content and are used for entitlement verification, restoration, duplicate prevention and necessary accounting records.

Membership in the international edition does not include printing or home delivery. We do not collect a print-ready manuscript or shipping details as part of this membership.

13. Updates

Version: 1.1.1. Last updated: 2026-10-08. Effective date: 2026-10-08. Changes are published in the app. Material changes receive appropriate notice and new consent where required. Continued local reading does not constitute consent to newly introduced optional processing.