免费版本可能使用 Google AdMob 展示广告。Google Mobile Ads SDK
可能自动处理 IP 地址（可推测大致位置）、应用交互（例如启动、点击和视频观看）、
诊断信息（例如崩溃、性能和能耗）以及设备或账号标识符（例如 Android 广告 ID、
App Set ID，或在获得授权时使用的 iOS IDFA）。这些信息可能用于广告投放、
广告衡量、分析和防止欺诈，并通过加密传输。
This Privacy Policy is provided by DEVELOPER_LEGAL_NAME
(“we,” “us,” or “our”) and applies to the ChronoSeal mobile application
and its related pages.
1. Core privacy promise
ChronoSeal is designed around local-first processing. Capsule titles,
messages, tags, moods, reflections, opening dates, and your app PIN are
not uploaded to our servers. The app does not require a ChronoSeal
account, and we do not operate a cloud database that stores this content.
Important: “Local-first” does not mean the app never
connects to the internet. Advertising in a free tier, subscription
purchases and restoration, and advertising consent management require
communication with Google, Apple, or advertising partners. Those services
do not receive your capsule text, tags, app PIN, backup password, or
encrypted backup files.
2. Data processed locally
Data category
Purpose
Location and handling
Capsule titles, messages, tags, reflections, moods, and dates
Create, seal, search, open, and manage time capsules
Stored in the on-device database; sensitive message content is encrypted using an on-device key
App PIN and biometric result
Lock and unlock the app
A derived PIN value is stored in secure system storage; biometric templates remain under operating-system control and are never read or stored by us
Notification, theme, and language preferences
Provide arrival reminders and personalize the interface
Stored locally on the device
Encrypted backup files
Let you export, store, and restore capsules
Encrypted with the password you provide and saved to the location you select in the system file picker
Subscription status and purchase evidence
Verify subscriptions, restore purchases, and unlock subscriber benefits
Processed by Google Play or the Apple App Store; the app uses only necessary product, transaction, and entitlement status information
Advertising and device data
Serve and measure ads, prevent fraud, and honor consent choices
Processed by advertising services only in ad-supported versions, as described in Section 4
Encrypted backups
A .tcap file that you export is protected with the backup
password you choose. We do not retain that password and cannot recover
it or read the backup for you. If you save a backup to iCloud Drive,
Google Drive, OneDrive, or another provider, that provider processes the
file under its own privacy policy.
3. Permissions and system features
Notifications: used for local reminders when a capsule is ready. Notifications do not reveal capsule text and can be disabled in system settings.
Biometrics: used to unlock the app. Authentication is performed by the operating system; we receive only a success or failure result.
System file picker: used only when you choose to export or restore an encrypted backup.
Network: used to load ads, obtain advertising consent status, and complete or restore store subscriptions. Core capsule content is not uploaded.
Advertising identifiers: used only when permitted by applicable law, platform rules, and your choices. You can reset, delete, or restrict these identifiers in device privacy settings.
Declining notification, biometric, or tracking permission does not prevent use of the core local capsule features.
4. Advertising and ad privacy
The free tier may use Google AdMob to display ads. The Google Mobile
Ads SDK may automatically process an IP address (which may indicate
general location), app interactions such as launches, taps, and video
views, diagnostic information such as crashes, performance, and energy
usage, and device or account identifiers such as the Android advertising
ID, App Set ID, or—when authorized—the iOS IDFA. This information may be
used for advertising, ad measurement, analytics, and fraud prevention,
and is encrypted in transit.
We do not send capsule titles, messages, tags, reflections, app PINs,
backup passwords, or .tcap files to advertising services.
Advertising partners are not permitted to use this local content.
Personalized ads and consent
In the EEA, the United Kingdom, Switzerland, and other applicable regions, we use an appropriate consent management platform when consent or disclosure is required by law or Google policy.
On iOS, if advertising involves tracking across apps or websites, we request authorization through App Tracking Transparency before using the IDFA for tracking.
In applicable U.S. states and other regions, we provide relevant opt-out or restriction choices for personalized advertising.
You can revisit consent through “Settings → Privacy choices / Ad privacy” when available in an ad-supported version, and through Android ad privacy controls or the iOS Tracking setting.
If you decline personalized advertising, the free tier may still show
non-personalized or limited ads. When an active subscription includes an
ad-free benefit, we do not request or display regular ads during that
entitlement period.
ChronoSeal may offer auto-renewing subscriptions that provide ongoing
ad-free access or other premium benefits. The app and store purchase
sheet will clearly present the price, billing period, trial terms,
renewal terms, and included benefits before you confirm a purchase.
Android digital subscriptions are processed through Google Play Billing; iOS digital subscriptions are processed through the Apple App Store.
We do not receive or store your full card number, complete billing address, or app-store password.
The app may receive a product ID, transaction or purchase evidence, subscription status, and expiration date to verify entitlements and restore purchases.
Subscriptions generally renew automatically unless canceled within the time specified by the store. After cancellation, benefits generally continue until the end of the current billing period, subject to store rules and applicable law.
Refunds, billing disputes, payment information, and store accounts are handled by the applicable app store.
We do not sell capsule content or other locally stored private content. Third parties are involved only in these limited circumstances:
Advertising services: process the advertising and device data described in Section 4 in an ad-supported tier. Some laws may define certain personalized advertising transfers as “sharing”; you can manage choices as described in Section 4.
App stores: process downloads, purchases, subscriptions, refunds, and store accounts.
Your chosen storage provider: only when you choose to save an encrypted backup there or select a file from that provider.
Legal and safety: only for information we actually hold, where required by law or reasonably necessary to protect users, the public, or legal rights.
Third-party services process information under their own policies.
We take reasonable steps when selecting and configuring service providers,
but we do not control storage providers you independently choose or your
app-store account.
7. Data retention and deletion
Capsules and preferences remain on your device until you delete them in the app, clear app data, or uninstall the app.
Capsules in the recycle bin remain on the device until permanently deleted.
Uninstalling the app or clearing its data normally removes the local database and local key and may make content unrecoverable.
Exported backups are not automatically deleted with app data; you must delete them from their saved location or cloud drive.
Advertising and app-store data is retained by those providers according to their policies, configuration, and legal obligations.
ChronoSeal does not create a developer-operated user account, so there
is no ChronoSeal cloud account to ask us to delete. Use the applicable
platform’s privacy tools to delete a store account or data held by an
advertising provider.
8. Security
We use local encryption, secure system storage, password derivation,
password-encrypted backups, and transport encryption provided by
third-party services to reduce risk. No device, software, or storage
method can guarantee absolute security. Use a strong device lock, keep
your backup password safe, and regularly back up important capsules.
9. Your choices and rights
Depending on where you live, you may have rights to access, correct,
delete, restrict, object, withdraw consent, and complain. In ChronoSeal:
You can view, correct, and delete local data directly in the app.
You can disable notification, biometric, or tracking permission in system settings.
You can revisit advertising consent through the ad privacy entry point or limit advertising identifiers in device settings.
You can manage, cancel, or restore subscriptions in Google Play or the App Store.
Because we cannot access your local capsules, we generally cannot export, recover, or delete that content on your behalf.
To exercise rights concerning information we actually hold, contact us using Section 12.
10. Children’s privacy
ChronoSeal is not directed to children under 13, or a higher minimum age
where required by local law. We do not knowingly collect personal
information from children. If the app is distributed to children or a
mixed audience, we will configure advertising, consent, and data handling
to follow applicable law and store family policies. Contact us if you
believe a child has provided information to us.
11. International processing
Advertising partners, Google, and Apple may process relevant information
outside your country or region using the legal mechanisms and safeguards
described in their policies. Your local capsule content is not uploaded
as a result of using these services.
12. Policy changes and contact
We may update this Policy when features, third-party services, laws, or
platform rules change. We will provide reasonable notice of material
changes through the app, store listing, or this page and update the
effective date. Continued use of an updated app means you have reviewed
the updated Policy; where fresh consent is legally required, we will ask
for it again.