paida Privacy Policy

1. Who this policy covers and who is responsible

Paida is operated by Lenscript (光子方程), an independent developer team ("we", "us"). We are the controller of the personal information described in this policy. Contact: donaldkuke@gmail.com.

This policy applies to the paida apps for iOS and Android and the website paida.lenscript.cn. By using these services you confirm that you have read and understood it; the rules for using the service are in the terms of service.

2. The short version

paida has no account and collects no name, phone number, email or location. Reference-image analysis and pose matching run entirely on your phone; reference images and photos are never uploaded. Face and body keypoints live only in memory for the comparison in progress — never written to disk, never stored in a database, never used to identify anyone. The app goes online in three cases only:

1. downloading the weekly cue update (it carries no identifier);
2. if you agreed, sending four kinds of de-identified usage counters (you can turn this off at any time);
3. verifying a Pro purchase or restore: the Google Play version sends the store-issued purchase token, the product ID and a random entitlement identifier to our server (see "Purchases and purchase verification" below).

We do not sell your personal information, show no ads and use no third-party analytics, advertising or crash-reporting service.

3. Processed on your phone and never sent

• Reference images: the single image you pick in the system photo picker, and the skeleton, position and facing extracted from it. Kept in the app's local storage; replace or delete them at any time.
• Viewfinder and pose matching: the camera preview, the subject's body keypoints and the eyes-open check, used in memory for real-time comparison only — never saved, never uploaded.
• Photos: captured by the phone camera and saved to your photo library if you choose.
• Settings and local state: the auto-shutter toggle, the usage-data toggle and your consent answer, the two random identifiers described below, and a local cache of your Pro entitlement.

Uninstalling the app or clearing its data deletes all of the above (photos already saved to your library excepted). System auto-backup is disabled for paida on Android, so local data does not go into cloud backups.

4. Permissions the app asks for

• Camera: viewfinder and taking photos.
• System photo picker: when you import a reference, the system shows its picker and the app receives only the one image you choose — it does not read your library, so the Android version requests no photo or media read permission.
• Add to Photos (iOS): saving the photos you take to your library. The iOS build also declares a photo-library usage description for the system picker (the app receives only the image you select).
• Audio settings (Android, no prompt): routing spoken cues to the loudspeaker.
• Network: the three uses listed above.

paida never asks for microphone, contacts or location permissions. Spoken cues use the system text-to-speech engine; they are played, nothing is recorded.

5. Optional usage data

On first launch the app asks whether it may send de-identified usage data. If you agree, it sends one counting event at four moments only: session start, reference-image use, auto-shutter trigger and purchase result. Each event contains exactly six fields: event name, random install identifier, app version, OS version, device model and time.

• The random install identifier is generated on the device. It is not a system device ID or advertising ID, is not linked to your identity or to any other service, and is used only to de-duplicate counts; you can reset it with one tap in Settings.
• Events are sent over HTTPS to paida.lenscript.cn. The server reads the IP address only for in-memory rate limiting; the IP is not written to the database, and this path is excluded from access logging.
• Raw events and install records on the server are kept for at most 180 days and then deleted automatically.
• Once you turn it off in Settings nothing more is sent, and no feature is lost.

6. Weekly content download

The app periodically downloads the weekly cue update from paida.lenscript.cn. Whether or not you agreed to usage data, this is a plain download carrying no identifier (only a cache tag). The server sees your IP address while handling it, but this path is excluded from access logging.

7. Purchases and purchase verification

Pro is sold only through in-app purchase: StoreKit on iOS (Apple) and Google Play Billing on Android. Your payment details are handled by the store under its own policy; we never see or store any card information.

• Google Play purchase verification: when you buy or restore, and when you start or return to the app, the Google Play version sends the store-issued purchase token, the product ID and an entitlement identifier to our server, which checks the purchase with Google's official API and returns the result (lifetime unlocked, subscription active) to the app. The request contains no name, email, phone number or Google account, and no reference image, photo or keypoint.
• The entitlement identifier is a second random identifier generated on the device, used only to tie a purchase to this device. It is separate from the counting identifier; resetting the counting identifier does not change it.
• The server keeps the purchase-token ↔ entitlement-identifier mapping and the check result. That mapping is your proof of purchase (restoring on a new phone relies on it); it is kept for as long as the entitlement exists and is not part of the 180-day usage-data clean-up.
• Promotional redeem codes (mainland China promotions only): redeeming sends the code and the entitlement identifier to our server; the activation record is kept as proof of entitlement.
• Purchase-verification and redeem requests appear in the server's access logs (IP address, time, the full request address and the User-Agent sent by the app's network library, among the fields listed in the website section below; for purchase-status checks the request address includes the entitlement identifier above) for fraud and brute-force prevention, and are deleted automatically after about 60 days under the same rule as the website logs below.
• On iOS, purchases are confirmed on the device by StoreKit; we run no receipt server of our own.

8. Third-party components

paida contains no advertising, third-party analytics or crash-reporting SDK. The only components relevant to data handling are:

• Apple StoreKit (iOS purchases) and Apple Vision (on-device pose detection on iOS): system capabilities.
• Google Play Billing Library (Android Play version only) and the Google Play services components (base, basement, tasks and location, plus places-placereport, which location pulls in) and Google DataTransport components that come with it: provided by Google for the billing library's own use and governed by Google's privacy policy. paida's own code does not call their location or other APIs, collects no data through them and requests no location permission because of them.
• MediaPipe Pose Landmarker (on-device pose detection on Android): the model ships inside the app and runs locally; we use a build with the task's anonymous usage statistics disabled.

9. What the website (paida.lenscript.cn) collects

No account is needed to browse this site. It is a static website and collects only:

• Server access logs: time, IP address (plus the address of the Cloudflare node that forwarded the request), host name, request method, full request address (including any query string), protocol version, status code, response size and response time, the User-Agent sent by your browser or by the app, and referrer. Requests for this site's pages and files, and the app's redeem and purchase-verification requests, are logged; the app's usage-data reports and weekly content downloads are not. The logs are used to troubleshoot and to defend against attacks; they are rotated daily and deleted automatically after about 60 days. When a request — including those two unlogged kinds — is rejected for exceeding a rate limit or fails because of a server error, the server's error log may also record its IP address and request address; those entries are likewise deleted after about 60 days.
• Content delivery: the site is served through Cloudflare for CDN and security. Cloudflare processes your IP address and request headers in transit; see its privacy policy.
• Scripts Cloudflare may inject: we place no third-party analytics, advertising or social plugins on these pages and set no tracking cookies. The site is, however, delivered through the Cloudflare CDN, and Cloudflare may inject scripts of its own at the edge — its email-address obfuscation script (/cdn-cgi/scripts/…/email-decode.min.js) is one you can see today, and when automatic injection is switched on for its Web Analytics it also adds a performance-measurement script (static.cloudflareinsights.com/beacon.min.js). That script is not configured by us, sets no cookie and is not used for advertising or cross-site tracking; it reports page performance and page views to Cloudflare, and Cloudflare’s own privacy policy governs it. A content-blocking browser extension will stop it.
• Page-view counting: pages report "which path was opened", the page title and the referrer to our self-hosted counter (markstats.lenscript.cn, GoatCounter). It is first-party, sets no cookie, creates no device identifier and never reads page content. To opt out permanently run localStorage.setItem('lens_telemetry','0') in your browser console.
• Emails you send us: the "register your email" and "buy by email" buttons simply open your own mail app; what we receive is the message you send, used only to reply and for the purpose you asked for.

10. Retention

Data	Where	Kept for
Reference images, settings, the two random identifiers	Your phone	Until you delete them, clear the app's data or uninstall
Viewfinder frames and body keypoints	Phone memory	Discarded after use; never written to disk
Photos	Your library	Managed by you
Usage data (raw events and install records)	Our server	At most 180 days
Purchase token ↔ entitlement identifier, redeem activations	Our server	While the entitlement exists
Access logs for purchase checks, redeem requests and the website; server error logs	Our server	About 60 days

Our server database is backed up automatically once a day; data cleared on the schedule above or deleted at your request may remain in these backups for up to about 8 days, and is then deleted together with them.

11. Your rights

Under China's Personal Information Protection Law and any law that applies where you live (such as the GDPR or CCPA) you may access, copy, correct and delete the information we hold about you, withdraw consent, obtain a copy, and complain to your local supervisory authority. For paida specifically:

• you can turn usage data off, reset the random install identifier, and delete reference images in the app or photos in your library at any time;
• paida has no account, so there is no account-deletion flow and account deletion does not apply; we cannot link the de-identified counters on the server to you, and they are deleted automatically on the schedule above;
• to have the purchase-verification record for a device deleted, write to us describing the purchase; afterwards that device will need to "Restore purchase" again.

To exercise a right, email donaldkuke@gmail.com. We reply within 15 business days. Requests are free unless clearly repetitive or unfounded, and we never treat you differently for exercising a right.

12. Security and security incidents

All traffic to our servers is encrypted with HTTPS; only the necessary ports are exposed to the public internet, administrative endpoints are authenticated and rate-limited, and secrets live only in the server environment, never in code or logs. The event and redeem endpoints limit request size and are rate-limited; the app's local data is protected by the operating system sandbox.

If a security incident is likely to put your personal information at risk, we notify you within 72 hours of confirming it, by the email you gave us or on this page, and report it to the authorities as the law requires.

13. Children

paida is intended for users aged 14 and over (or the minimum age required where you live) and is not designed for children. We do not knowingly collect personal information from children under 14; if you are a parent or guardian and believe a child has given us information, contact donaldkuke@gmail.com and we will delete it promptly.

14. Where data is stored and international transfers

Our server is located in Seoul, Republic of Korea (Tencent Cloud's Seoul region). Requests from the paida app to our server, and visits to this website, pass through Cloudflare's global network before they reach that server. So wherever you are — mainland China, the United States or any other country or region — the information this policy describes our server receiving or keeping (such as usage data, purchase-verification and redeem records, and server logs) is transferred to the Republic of Korea and stored and processed there, and in transit it may also be processed at Cloudflare locations outside your country or region. In addition, the app stores (Apple and Google) may process payment data where they are established, and any other provider named in the relevant section of this policy may process data where it is established. We send each provider only the minimum needed for its task and require protection equivalent to this policy.

15. Changes to this policy

We update this policy on this page and revise the date at the top. For material changes to what we collect, why, or with whom we share it, we give at least 15 days' notice on this page, in the app or by email. Previous versions are available on request. The current version lives at https://paida.lenscript.cn/en/privacy/.

16. Contact

Privacy questions, rights requests, data export or deletion: donaldkuke@gmail.com (this mailbox is monitored). Chinese-speaking users can also reach us in QQ group 824558022. We reply within 15 business days.