Android 1.0.0 Privacy Policy
This page is for Android 1.0.0. The “Scope of Android 1.0.0” section governs Android data handling, together with the shared feedback, retention, deletion and contact terms. Apple-only feature terms do not apply to Android.

Jiaobei Privacy Policy

Effective and last updated: October 27, 2026

This policy applies to the Jiaobei iPhone app, its companion Apple Watch app, and the Android app. The developer and privacy contact is the Jiaobei developer (GitHub: hanyitim), reachable through hanyitim/feedback.

Jiaobei does not require an app account. Casting takes place on your device. The developer has no server that receives your questions, location or motion readings. The app contains no advertising or cross-app tracking. Starting with V1.1.0, Apple builds configured for analytics use TelemetryDeck to measure feature usage and Pro purchase flows. These events do not include your question text, specific casting results or location. Feedback you choose to submit in the app is handled separately as described below.

Scope of Android 1.0.0

Android 1.0.0 is free, requires no account, contains no advertising, and uses TelemetryDeck in builds configured for analytics to understand core usage and failures. The sections below about Apple Watch, location, direction, shake gestures, weather, prayer, drawing sticks, formal mode, purchases, and Apple services apply only to Apple versions that offer those features. They do not apply to the first Android release.

Android stores your questions, cast results, times, saved quote readings, unfinished sessions, preferences such as language and sound, and feedback drafts only on your device. Casting works offline. It does not access location, weather, motion, camera, microphone, contacts, or other personal information. Its only declared permissions are internet access and vibration. Internet access is used for public feedback you explicitly confirm and the usage analytics described below. Personal databases, question drafts, feedback drafts, and local preferences are excluded from Android cloud backup and device data extraction or transfer. Uninstalling removes local data; deleting a local record does not delete public feedback. The first Android release has no manual export or cloud sync.

Android analytics records only session starts, first local observation, completing or skipping onboarding, newly saved results actually shown, explicitly opening history, and finite storage or rendering failure stages and categories. Specific casting results are not uploaded. Event fields include platform, event_schema, development/testing/production environment, app version and build, app display language, Android major version, and SDK version for version and compatibility analysis. Default SDK model, display, timezone, calendar and accessibility parameters and automatic session events are disabled. Analytics excludes questions, quotations or other reading content and their identifiers, history text, location, raw exceptions or stack traces, advertising identifiers, Android ID, email and phone numbers. Local deduplication record IDs are not uploaded.

Analytics uses an identifier generated randomly and stored locally, hashed by the SDK with SHA-256 before sending, plus a random session identifier. It does not reuse an Apple identity. First observation does not mean first installation; unestablished prior use is marked unknown. TelemetryDeck receives event types, the fields above, identifiers and receipt times. The service also processes connection information such as IP addresses when establishing network connections. The local sending queue holds at most 1000 events and drops the oldest on overflow. Network failures may be retried; delivery of every event is not guaranteed. Analytics state or initialization failures stop analytics without interrupting casting, history saving or feedback. Casting still works offline. Saved history is not automatically uploaded.

Uninstalling deletes the local analytics identifier and unsent queue; reinstalling creates a new identifier. Deleting local records or uninstalling does not withdraw analytics already delivered. Analytics is used for product analysis and troubleshooting, not advertising or cross-app tracking. See the TelemetryDeck privacy policy for service processing and retention. Section 7 below describes only Apple analytics; this section governs Android.

Android feedback follows the public preview, explicit confirmation, and public repository rules in section 5. Including app and system information is off by default. If selected, only the previewed app version, Android version, and API version are attached, with no model, device identifiers, questions, or history. Your original text and submission ID remain unchanged. Disconnection, timeout, rate limiting, or an unclear receipt preserves the local draft and original ID across reopening. Retrying requires your explicit action and never happens automatically. Only a successful receipt with the same ID clears the corresponding draft.

1. Records and preferences on your device

The iPhone app stores your questions, cast results, times, quote identifiers and unfinished sessions locally. Prayer stores wishes, incense start and end times, and completion state; Draw stores questions, stick numbers, catalog identifiers, and reveal state locally. It also stores preferences such as scenes, colors, sound and haptics, along with feedback drafts. This data is used to show history, resume unfinished experiences and remember settings. It is not automatically sent to the developer.

Formal mode also stores thoughts, each ritual's question snapshot, incense times, permission and confirmation actions, saved readings and thanksgiving notes locally, separately from simple history. Formal records are not sent to Watch or the incense widget. Existing records remain readable and deletable after paid access expires.

In My thoughts → Backup & restore, you can manually export thoughts and their ritual records, actions, absolute times and saved readings. Choose iCloud Drive or another available location in the system file picker. The app does not back up automatically or synchronize these records across devices. Simple cast, prayer and draw history, purchases and settings are excluded. The file contains your original text and has no additional app password protection; keep it in a private location. Apple processes files saved to iCloud Drive under your account and system settings; other file services follow their own policies. The app does not send backup contents, paths or account information to the developer or analytics. Saving a file does not confirm cloud upload; check its status in Files.

Before restoration, the app shows the backup date, thoughts and counts to add or skip. After you confirm, it adds only thoughts missing from this device and preserves existing thoughts with the same identifier. Previously deleted thoughts may return. Manage retention and deletion of exported backups in Files; deleting local thoughts or the app does not delete exported files. This feature is separate from Apple's whole-device backup, which may include other local data depending on your settings.

Apple Watch keeps the results, times and quote identifiers for your last 30 casts locally. New records replace older ones beyond that limit. We do not access contacts, photos, microphone recordings or health data.

The iPhone Culture guide includes offline information about moon blocks, original quotations, editorial notes and sources. Reading, block-turning demonstrations and search run locally. Reading history is not recorded and search terms are not sent to the developer. If you tap an external reference link, your browser visits that website using an internet connection. The app does not attach cast records or search terms to these links. Source websites may handle IP addresses and browser information under their own policies.

Versions configured with a public cultural content service fetch a version manifest, public articles and festival information over HTTPS when you open the Culture guide. Public images may be downloaded while reading. Complete text snapshots, bookmarked article identifiers and dismissed daily hints stay on your device; the system may clear image caches. Content requests read public static files without attaching questions, wishes, thanksgiving records, bookmarks, search terms or location. They do not affect offline casting or prayer. The hosting platform may process technical information such as IP addresses and request paths to provide network access and security. Sharing sends a public article URL without personal records.

2. Location, heading and motion

On iPhone, the app may request location access while using the app when first opened. The system prompt explains its purpose. If allowed, each app launch requests your approximate location once and calculates and caches each scene's target direction on your device. During foreground idle, holding (by touch or shaking) and result stages, it then monitors only phone heading and orientation to display directional scene effects. Switching scenes or returning from the background does not request another location. Location does not change random cast results.

Before a fortune book has been selected, the app sends the existing authorized location to Apple's location service to identify the country or region and recommend an available book. Taiwan is the fallback when no book matches. Only the selected book and selection method are saved locally; this feature does not save raw coordinates or send them to the developer or analytics services. Travel does not change the book after the initial selection, and manual choices take precedence. Denying access or a failed lookup does not prevent use or manual selection.

For directional effects, device coordinates, target directions, compass readings and raw orientation readings are processed only in memory. They are not written to history or uploaded to the developer. Heading and orientation collection stops when the relevant stage ends or the app enters the background; cached target directions remain available for the current launch and are discarded when the app exits. Current unfinished sessions do not store heading readings or coordinates. Older versions may have left an effect marker; when restoring a session, the app checks the direction again instead of using that marker to trigger an effect.

When a scene is selected, iPhone may round the shared startup location to an approximately kilometre-sized area and send it directly to Apple WeatherKit to adjust scene lighting and ambient sound. While a directional moon or deity Easter egg is visible, weather is queried for its reference point (or your saved hometown for a custom Pro moon) and the atmosphere uses that destination’s local time and weather. This does not request a new device location. Each region has a separate weather cache. Weather requests contain no questions, wishes or history and do not pass through a developer server. Weather, its update time and the approximate area are cached on-device for reuse within one hour; data older than two hours no longer drives weather effects. Without permission, connectivity or weather service, lighting still follows the current atmosphere location’s local time. Weather refresh pauses in the background. Ambient sound is off by default; Home and Settings share the same local preference. Playback does not use the microphone. See Apple’s Privacy Policy for information about weather request handling.

Pro owners can choose a hometown in Apple Maps in Settings, replacing Xi’an for the moon’s direction and atmosphere. Its name, coordinates and local time zone are saved on this device. Map search sends submitted place names to Apple; confirming a location and time zone sends selected coordinates to Apple’s location services. While the moon is visible, hometown coordinates are sent directly to Apple WeatherKit. They are not sent to the developer or analytics service, and selecting home does not request another device location. Cancel leaves the previous selection unchanged. Settings can restore the default and clear the custom home and its weather cache. If Pro access is revoked, the saved selection is retained but is not used.

The iPhone Ask and Draw screens support Shake: while it is in the foreground, unobstructed by a sheet or the first-use guide, and waiting for input, it reads acceleration and rotation to recognize back-and-forth motion followed by stillness to cast blocks or draw a stick. Detection stops when leaving that screen, in Pray, when a sheet opens, during casting, drawing animations and results, or in the background. Neither feature requires Pro. Raw motion readings are not stored or uploaded. Touch-and-hold remains available when motion sensors are unavailable.

Casting on Apple Watch requires Pro. When unlocked, Shake mode reads motion data such as acceleration and rotation while the casting screen is in the foreground, to detect shaking and stillness. Shake detection does not start while locked. Raw motion readings are not stored or uploaded. The app does not use these readings to identify you or track advertising.

You can decline location access or revoke it in iPhone Settings → Privacy & Security → Location Services → Jiaobei. Casting, history, and Pro scenes and colors still work. Turning off Precise Location may affect direction detection. On the watch, switch back to Hold mode to stop shake detection, or adjust motion authorization in system permission settings where available.

3. Sync between your phone and watch

The app uses Apple’s device communication service to send settings such as scenes and colors between your paired devices, and to sync watch cast results, times, record identifiers and quote identifiers to iPhone. Transfers may be queued until a connection is available. They do not pass through a developer-operated server and do not include raw location or motion readings. Questions entered on iPhone are not synced to the watch.

Phone and watch records are separate copies. Deleting phone history does not delete watch records or queued transfers. Device backups, restoration and system diagnostics may depend on your Apple Account and system settings. See Apple’s Privacy Policy.

4. Pro purchases and restoration

Premium access is available through Apple’s App Store as an auto-renewing monthly subscription or a one-time lifetime purchase. It unlocks casting on Apple Watch, scenes and colors on both devices, and custom hometown selection on iPhone. You can purchase or restore on iPhone or Apple Watch; both independently read verified active subscription or lifetime entitlements, so you do not need to pay twice. Apple handles payments, refunds and account information. The app reads Apple-verified transactions and entitlement status to unlock features, restore purchases and respond to refunds. Existing cast records remain if access is revoked. The developer does not receive your payment card details, payment password or Apple Account password, and does not upload transaction receipts or transaction identifiers to the developer or analytics service. Only purchase entry points, categorized outcomes, entitlement changes and available amount and currency are measured. A random purchase-attempt token associates a locally initiated transaction with Apple and is not uploaded as an analytics identity.

Deleting the app does not cancel automatic renewal or a completed lifetime purchase, or delete transaction records held by Apple. Manage or cancel a monthly subscription in your Apple Account. Buying lifetime access does not automatically cancel an existing subscription. Apple handles purchase records and refund requests under its own rules.

5. Feedback

Feedback forms and drafts are initially stored on your device. Tapping Submit feedback first shows a public post preview. Only after you tap Publish publicly does the app send the previewed title and body, including feedback type and any app and system details you chose to attach, together with a randomly generated submission identifier, over HTTPS to the developer’s feedback service hosted on Cloudflare Workers. Canceling the preview sends nothing. Submission does not require GitHub registration or sign-in, and the app does not read your GitHub username or account.

The service forwards feedback to the public hanyitim/feedback repository on GitHub. It returns a success receipt only after GitHub confirms that an issue was created. Anyone can read the feedback, attached information and submission identifier. Posts are published by a service account configured by the developer. Feedback is used to handle problems and feature suggestions, not advertising. Do not include real names, contact details, health information or anything else you do not want made public.

Include app & system details is off by default for new users and can be enabled by you. Existing users retain their previous preference. If enabled, only the app version, system version and device category displayed in the form are attached. Location, casting questions and history are not attached automatically. The app does not automatically copy feedback to the clipboard.

The Cloudflare service reads and forwards the request body during processing, but does not persist the body in a Durable Object. It stores the submission identifier, a digest of the body, receipt time, and GitHub issue number or forwarding status to prevent duplicate submissions. It also processes the IP address needed for the connection and stores a keyed digest of it with hourly submission counts to limit abuse. Neither the original IP address nor its digest is attached to the public issue. IP digest counts are stored separately from deduplication records.

If the network fails or a receipt is unclear, the app retains the local draft and submission identifier for retry. An unclear receipt can mean that GitHub has already created the issue. The service avoids blindly posting duplicates, and a maintainer may need to investigate. The draft is cleared only after a success receipt. Success does not mean the developer has read the feedback.

Cloudflare and GitHub handle hosting and forwarding respectively. The developer requires these services to handle entrusted data under their data protection terms, and does not sell feedback or use it for cross-app tracking. Network infrastructure may process technical records for security, connectivity and operations under its service terms. Please read Cloudflare’s Privacy Policy and GitHub’s General Privacy Statement.

6. Retention, deletion and withdrawal

You can delete individual iPhone history records or clear all history. Remove feedback draft input by editing its title and body; it is also cleared automatically after successful submission. Closing the form does not clear a draft. Deleting the app can remove its local data from that device. Offloading the app while keeping documents and data may retain that data. Watch records can currently be removed by deleting the watch app. Apple backups, synced copies and queued system transfers must be managed separately. Restoring a backup may restore old data.

Local data is kept until you delete it, it is replaced under the watch’s last-30-records rule, or the system removes it. The developer cannot remotely view or delete cast records on your devices.

The Cloudflare service uses a 30-day threshold for deduplication record cleanup, checking hourly for expired records. IP digest rate-limit counters are generally removed about two to three hours after the corresponding hour ends. Site-wide daily counters are removed the next day. Scheduled-service failures can delay cleanup; processing continues when service resumes. This cleanup does not automatically delete GitHub issues. The developer has not enabled persistent runtime logs for this Worker. The hosting platform handles its own security and infrastructure records under its service policies.

Feedback on GitHub remains available for developer follow-up until a maintainer deletes it. Closing an issue or deleting a local draft does not delete published content. Anonymous feedback is posted by a service account. To request deletion, provide the feedback reference or issue number and a necessary explanation. A maintainer must check copies on both GitHub and the receiving service. Do not repost sensitive content in public channels. Copies made by the public, GitHub retention and Apple backups are subject to their respective mechanisms.

7. Product usage analytics on Apple versions

Configured builds send key action events to TelemetryDeck over HTTPS. These include foreground sessions, onboarding, completed cast counts, page visits, setting changes, synchronization and feedback submission outcomes, and Pro purchase entry points, purchase results and restoration status. They help us improve usability and diagnose flow failures.

Custom events use a fixed allowlist of parameters such as platform, app version and build, language, Pro status, entry point and categorized result. We do not send question text or summaries, specific casting results, quote identifiers or text, search terms, feedback text, location or motion readings, transaction identifiers or receipts, or Apple account details. Local history cannot be read through the analytics service.

The TelemetryDeck SDK adds device and runtime metadata, including device model, system and SDK versions, screen characteristics, locale and language preferences, time zone, interface orientation and some accessibility settings. Locale comes from system settings rather than GPS. The SDK hashes a device-side identifier and creates random session identifiers; the original device identifier is not sent to the developer. TelemetryDeck further processes the analytics identifier according to its published documentation. We do not use advertising identifiers, merge iPhone and Watch identities or connect individual users to external acquisition data.

The app stores the first analytics observation time, whether the first subsequently observed cast was completed, and local purchase-attempt and deduplication information. The SDK buffers at most 1,000 pending events and may discard events beyond that limit, retrying when connectivity permits. The buffer contains analytics fields rather than user text. Deleting the app removes device-side analytics state and cached events, subject to backups and restores; it does not automatically remove events already delivered to TelemetryDeck. See TelemetryDeck's privacy information for its retention and anonymization rules, or contact the developer through the channel below about this app's data handling.

Missing analytics configuration, automated UI tests and previews do not send analytics. Development and TestFlight data are separated from production reports. Analytics failures never prevent casting, reading, saving or purchasing.

8. Contact and policy updates

For privacy questions, feedback handling or deletion requests, contact GitHub user hanyitim through the feedback repository. This channel is public; provide only information necessary to process your request.

If features or data handling change, we will update this policy and its revision date, and request system permissions or necessary consent again where applicable. The app includes the full policy supplied with its current version, available to read offline.

Formal mode stores matters, ritual question snapshots, incense intervals, permission and confirmation attempts, reading snapshots and gratitude notes locally, separately from simple history. These records are not synced to Watch or the incense widget. Existing matters remain readable and deletable after access expires. Formal mode reuses motion recognition only while its unobscured screen is active and access is valid; raw motion data is neither saved nor uploaded.