Afterline 隐私政策

English version

Version: 0.2
Draft updated: October 1, 2026
Effective date: [TO COMPLETE: effective date]

1. Scope and contact

This Policy explains how [TO COMPLETE: operator’s legal name] (“we,” “us”) processes your personal information when providing the Afterline application and related services.

Privacy email: [TO COMPLETE: email]. Contact address: [TO COMPLETE: valid contact address]. You may use this email for access, correction, deletion, withdrawal of consent, or complaints.

This Policy does not replace the policies of WeRead, Apple, or other independent services. We remain responsible for our own processing and the provider oversight required by applicable law.

2. Key points

• Local reading, keyword search, and local relevance calculations mainly take place on your device. Reading-data synchronization, cover downloads, and online AI are separate network activities.
• Online AI sends the relevant book titles, highlights, thoughts, and note identifiers through the Afterline backend to the appropriate model provider. Online note matching may be triggered when you open note details, not only when you tap a generate button.
• Your WeRead API Key is stored on your device and sent directly to WeRead when its interfaces are called. Current AI requests do not contain that Key.
• There is currently no separate Afterline registration account, in-app iCloud note synchronization, advertising SDK, or cross-app advertising tracking. System backups are different from the application’s own cloud synchronization.
• Removing a Key, clearing search history, deleting the application, and deleting server records are different actions. Deleting local data does not delete original content from WeRead.

3. Information processed and purposes

The current version does not proactively request access to contacts, precise location, microphone, camera, or health data, or require identity-document or bank-card information. Your thoughts or support submissions may nevertheless contain such information. Avoid submitting unnecessary sensitive information or personal information about others.

Processing necessary for core features is based on the service you request and the grounds permitted by applicable law. Optional AI processing requires valid authorization after appropriate notice. Processing required to meet legal duties relies on the relevant legal basis. We do not treat one blanket consent as the basis for every activity.

4. AI processing and third-party services

4.1 Scope and triggers

AI requests contain notes involved in the particular operation, rather than uploading the entire library by default. Online matching sends the current note and locally selected candidates; background explanations send the current note; insights send the group being analyzed. Personal thoughts can be included with a note even if they are not expanded in the current interface.

[TO IMPLEMENT BEFORE FINALIZATION: explicit permission before the first transmission and a withdrawal control under Settings → AI data permissions.] The initial notice should explain the feature, information types, recipients, and processing locations. You may refuse or withdraw optional AI authorization while continuing to use local features that do not depend on it. Withdrawal does not invalidate lawful prior processing; existing records are handled under Sections 6 and 7.

Purchasing Pro or accepting the Terms of Use does not replace this authorization. If providers or processing scope materially change, we will update the notice and obtain renewed consent where required.

4.2 Service providers

This table reflects the service paths in the current code. Actual recipients, deployment locations, contractual roles, and retention must be checked before production publication. Brand names do not replace required legal-entity information.

We provide relevant information only for the stated functions and necessary service operation, and apply the requirements for processors or independent recipients according to the actual relationship. Separate consent will be requested where required. We do not sell your personal information, use notes for advertising, or track you across applications through advertising SDKs.

We may disclose relevant information to the extent necessary to comply with applicable law or a lawful request from a competent authority. If a merger, acquisition, or business transfer requires personal information to be transferred, we will notify you of the recipient and arrangements and require continued compliance with applicable protections. Changes to processing purposes or methods will require renewed authorization where provided by law.

4.3 Model training

Afterline currently has no function for training its own models or building a training dataset from users’ notes. This does not establish that every upstream service has zero retention or never trains on data. TypeSafe AI’s published policy states that it does not train or fine-tune models on input. The actual training use, opt-out options, and retention for the DeepSeek API must still be verified against the account and contract used.

[TO CONFIRM: for each production API, state training uses, retention, human access, and applicable opt-out or deletion methods. Do not publish an end-to-end no-training or immediate-deletion promise before verification.] If we later propose training uses beyond the original purpose, we will provide prior notice and obtain legally required authorization.

5. Private books and sensitive information

Afterline uses privacy flags returned by WeRead to filter identified private books from display, search, and subsequent processing. This depends on successfully refreshed status and may involve caching or synchronization delays. Changing privacy settings at the source does not recall requests already sent or delete every historical copy.

Highlights and thoughts may contain health, religious, financial, or other sensitive information. The service does not require such information; review it carefully before online processing. If a service specifically requires sensitive personal information, we will explain the necessity and impact, obtain separate consent where required, and apply appropriate safeguards. Ordinary AI authorization is not unlimited permission to process any sensitive information.

6. Storage locations and retention

6.1 Your device

Synchronized notes, local indexes, relationship results, generated content, and research records are mainly held in local application storage. Your API Key, preferences, and search history are also stored locally. The application does not currently provide its own iCloud note synchronization. Device or iCloud backup settings may include some local application data in system backups, which are managed through your and Apple’s system settings.

Local notes and generated records normally remain until you delete the relevant application data. Search history holds up to 50 recent entries and may be deleted manually. Cover caches are refreshed or evicted according to space and usage and are not permanent storage. Application updates, source-content changes, and system cleanup may also affect caches.

6.2 Backend and providers

During online processing, the Afterline backend and model providers access the relevant request and response. Cloudflare D1 currently stores verified purchase mappings, subscription periods and entitlements, session-token hashes, request fingerprints, request reservations and settlements, model usage, credit purchases and refunds, and webhook event identifiers. Its current tables do not store complete signed evidence, note text, or generated results. Worker still processes that content in transit; hosting and model-provider retention require separate verification. Session expiry does not delete historical billing records, which also prevent duplicate grants and preserve non-expiring credits.

Production backend and provider processing locations: [TO CONFIRM: list countries or regions individually].
D1 purchase, session, and usage record retention: [TO CONFIRM: category-specific periods and cleanup].
Operational log retention: [TO CONFIRM: period and automated deletion process].
Model input/output retention: [TO CONFIRM: by provider].
Support and rights-request retention: [TO CONFIRM: period or specific determining criteria].
Backup and expiry-deletion cycles: [TO CONFIRM: verify even if there are no backups].

We retain personal information only as long as necessary for the stated purposes, then delete or anonymize it. Where law requires continued retention or deletion is temporarily technically unavailable, we restrict processing and complete deletion when possible.

6.3 International processing

Online features may involve processing outside mainland China; we cannot promise that all data remains in mainland China. Before enabling such transfers, we will disclose overseas recipients, contacts, purposes, processing methods, information types, retention, and rights channels, and complete the legally required transfer arrangements and permissions. Specific arrangements: [TO CONFIRM: overseas recipients, locations, and applicable mechanisms]. Accepting this Policy does not replace separate cross-border consent where required.

7. Your choices and rights

• Stop synchronization: Remove the WeRead API Key in Settings and, where available, revoke authorization through the source platform. Existing local data may remain after new requests stop. Requests already sent cannot necessarily be recalled immediately.
• Delete search history: Use search-history management to remove individual entries or clear all history. This does not delete your note library.
• Delete local data: The current version has no one-tap control to erase all data. Use iOS “Delete App” to remove the application and its local container data. “Offload App” retains documents and data and is not equivalent to deletion. Manage system backups separately; restoring a backup can restore data. Deleting the app does not automatically cancel Apple subscriptions, delete purchase records held by Apple, RevenueCat, or D1, or guarantee removal of Keychain items; these require separate handling.
• Withdraw AI permission: [TO IMPLEMENT: in-app withdrawal control and prevention of further requests]. Withdrawal does not automatically erase previously generated local results or lawfully retained server records; deletion may be requested separately.
• Access, correct, copy, or delete other records: Contact the email in this Policy with your request and necessary verification details. Manage original reading records in WeRead as well. There is currently no separate Afterline account to close.

We will respond within the time required by applicable law and request only information proportionate to verifying your request. Our specific service response commitment is [TO CONFIRM: a period we can actually meet]. If we cannot fulfill a request, we will explain why and the available remedies. We cannot remotely read or delete information held only on your device and will explain available local actions. We will assist with information held by our processors as required by law.

You may complain or seek assistance from a regulator with jurisdiction. Refusing unnecessary processing or exercising these rights does not prevent use of features that do not rely on that processing.

8. Security

Current default online interfaces use HTTPS. Local application data relies on iOS sandboxing and device protections. These measures are not end-to-end encryption or a guarantee of absolute security; servers and providers processing AI requests can still access their content.

The WeRead API Key is currently held in local preferences, not Keychain. Short-lived service sessions issued after purchase verification are held in the device Keychain without iCloud Keychain synchronization. D1 holds session-token hashes rather than raw tokens. Protect your device and credentials and avoid including complete Keys in support requests.

If a personal information security incident occurs, we will take remedial action and notify affected users and authorities as required by applicable law.

9. Minors

The service is not directed to children under fourteen, and we do not actively target them for information collection. A higher local child-age threshold applies where required. If you believe a child has provided personal information without necessary guardian consent, contact us. We will investigate and delete it or take other appropriate action under applicable law. Offering services directed to children would require appropriate guardian-consent procedures and dedicated protections first.

10. Policy updates

This page will show the version and effective date. Material changes to information types, purposes, recipients, international arrangements, or your rights will be notified in the application or through another reasonable channel, and renewed consent will be obtained where required. Continued application use alone will not be treated as consent to new optional processing or processing requiring separate authorization.

Chinese is the primary text, and English is provided for convenience. In case of inconsistency, Chinese prevails to the extent permitted by applicable law, without reducing your lawful rights.