Privacy Policy

Version Information

Version: V1.3. Updated and effective date: October 27, 2026.

1. Policy Scope and Responsible Entity

This Privacy Policy applies to the HiWish overseas application, overseas service websites and related features. It explains how we collect, use, retain, disclose and otherwise process your personal information. It does not apply to the mainland China version. Regional supplements applicable to you apply together with this policy.

The operator and entity responsible for personal information processing is Xujie Yinli Technology (Shenzhen) Co., Ltd., registered in China, with Unified Social Credit Code 91440300MAKN3JWB66. Registered address: Room 277, 2/F, Wenzhengxin Building, Building 3, Zone 30, No. 2 Kefa Road, Kejiyuan Community, Yuehai Subdistrict, Nanshan District, Shenzhen, Guangdong, China.

Personal information includes information that identifies you directly or can identify you when combined with other reasonably available information. Replacing a name with an account code or hash does not automatically make it anonymous. Records that remain linkable to you are still protected by this policy.

Please read this policy with the Terms of Service, Community Guidelines and Account Deletion Instructions. Accepting these documents does not give blanket authorisation for every data use. Third-party AI sharing permission, legally required sensitive-information choices and other optional processing are handled for their respective purposes. A content copyright licence does not replace a lawful basis for processing personal information.

2. Contact, Verification and Privacy Complaints

Send privacy questions, rights requests, consent withdrawals and privacy complaints to support@hiwish.fyi, or to the registered address in Section 1 marked “Privacy Matter”. These channels are also available if you cannot sign in, your account has been deleted or you do not have an account. Provide an account email or number, request type and necessary details. Do not send passwords, verification codes, full payment-card numbers or unrelated sensitive information.

To prevent disclosure to the wrong person or incorrect deletion, we may verify identity in proportion to the request's risk, for example by checking your control of the associated email. If further material is needed, we explain why and request only what verification requires. You do not need to buy membership, top up or register a new account to submit a statutory request.

Use “Privacy Complaint” in the email subject for privacy complaints. Where UK data protection rules apply, we acknowledge receipt within 30 days and handle and respond to the complaint without undue delay. This acknowledgement deadline is separate from statutory rights-request deadlines and does not restrict lawful complaints to regulators.

3. Adult-Only Service and Minors' Information

The HiWish overseas service is only for people aged 18 or older who meet local contracting eligibility requirements. It is not marketed to minors. Guardian consent does not replace the service's adult eligibility requirement. We collect birth month, year and necessary verification status to assess eligibility; a birth month alone may not establish that the 18th birthday has been reached.

Ordinary registration does not routinely require a full birth date or an identity-document copy. Where law or a reliable risk indication requires further verification, we will limit collection to what is necessary, with its purpose, recipients and retention explained.

After learning that someone under 18 has used the service or provided information, we take necessary access restriction, verification and information-handling measures under applicable law. Account restriction and completed data deletion are separate steps. Any minimal records needed for legal obligations, specific complaints or prevention of repeated abuse are subject to separate purpose and retention limits.

If you believe a minor has used the service or need to make a lawful request on a child's behalf, contact support@hiwish.fyi. Do not publish or redistribute a child's photographs, private content or identity documents when reporting.

4. Information Collected and Its Sources

Accounts and verification: Sign-in email, verification-code records and validity, and sign-in and security records. Enabled Apple or Google sign-in provides identifiers and authorised email. Existing accounts may retain a legacy linked phone number. An ordinary account does not require a residential mailing address; missing information needed for the selected sign-in method may prevent sign-in or verification.

Age, profiles and creations: Birth month/year and verification status, nicknames, biographies, avatars, personas, character/story settings, prompts, conversations, reference material, and uploaded or generated images, audio, video and task records. Voice features may transcribe speech and process it with necessary context. You choose whether to provide nonessential profile information or reference material and whether to publish. To maintain story continuity, the service also saves long-term memory summaries, important events, player preferences and characteristics, relationship notes and commitments, and uses selected memories in later replies. Memories may be model-generated and inaccurate, and do not necessarily describe your real characteristics.

Purchases and entitlements: Order numbers, transaction evidence, purchase channels, virtual-currency balances, membership entitlements, use, credit returns, refunds and disputes. Stores process their purchase payments; we do not receive full payment-card numbers. Where you separately permit refund consumption information to be sent to Apple, Section 6 explains its scope. When invitation features are used, we also save invite codes, associations between inviter and invitee accounts, reward-claim and activation status, and necessary repeat-claim prevention or risk-decision records.

Devices and security: Device and app versions, network addresses, sign-in and request records, and hashed device/network identifiers used against abuse. Supported iPhone sign-in paths may supply a DeviceCheck token; the server queries or updates necessary risk flags held by Apple only where the relevant capability and configuration are available. Codes and hashes remain personal information if linkable to a person.

First-party operational records: The app sends our service an installation-scoped device identifier, session identifier, platform/version, time, and allowlisted events for launch/foreground/background, screens, content views, story starts, message sends, story progression, timings and limited error or crash categories. In the overseas version, recording and transmission may begin on first launch once the business service endpoint is selected, before sign-in. This channel is independent of the optional Firebase analytics switch. Recording an event is not the same as uploading the related chat body.

Discovery, reading preferences and interactions: Your selected character-gender preferences, story genres, skipped-choice status and persona romance preferences and liked tags may be used for discovery ranking. We also process likes, follows, blocks, story starts, video plays, impressions, language, approximate country/region and recommendation-performance information. These choices and persona settings are not necessarily conclusions about your real sexual orientation. This processing does not mean accessing your address book or collecting precise GPS location.

Optional third-party analytics and crash reports: After the relevant choice allows it, Firebase Analytics may process app instances, device/network information, usage events and pseudonymised account identifiers. Crashlytics may process eligible crash reports, device/version information, limited screen information and automatic exception descriptions. Not deliberately adding chat bodies does not guarantee that crash reports contain no contextual information. Sections 6 and 7 explain upload and withdrawal limits.

Ad measurement: In the Android app, outside the European Economic Area, the United Kingdom and Switzerland, and only for sign-ins made after the sign-in notice says so, the same optional analytics choice also lets Firebase process the device advertising ID with these events, and lets our server report confirmed purchases (product, amount and currency) with ad measurement consent. This lets Google Ads measure which of our ads lead to installs, story engagement and purchases. It is not used for personalised advertising or remarketing. The iOS app does not use the advertising identifier.

Rewarded ads: Outside the European Economic Area, the United Kingdom and Switzerland, the wallet may offer an optional rewarded video ad that you choose to start in exchange for coins. The ad is provided by Google AdMob, which the app only starts when you choose to watch an ad, and only non-personalised ads are requested. To show the ad, measure its delivery and prevent fraud, Google may process device and app information, your IP address (and approximate location derived from it), ad interactions and, in the Android app, the device advertising ID. To credit the reward, Google sends our server a signed confirmation containing your account identifier, the reward task identifier and a transaction identifier. We keep each reward task, its outcome, the country it was requested from and hashed device/network identifiers to apply daily limits and prevent repeat claims. The iOS app does not ask for tracking permission and does not use the advertising identifier for these ads.

Support and detailed diagnostics: Reports, feedback, contact details and necessary evidence may be used to address specific issues. General HTTP tracing no longer stores request or response bodies. For server-registered diagnostic accounts, specific model troubleshooting may still record necessary prompts, context and provider requests. Saved conversations, task inputs, media and historical archives are separate data sources; retiring HTTP tracing does not mean all these cease to exist. When you submit an issue report with "Include diagnostics" turned on, we also receive the operational log recorded by the app on your device (including launch information, screen changes, the API paths, status codes, durations and request IDs of network requests, and error codes) and use it to troubleshoot the issue you reported. The operational log does not contain chat content, character replies, account credentials or contact details; it is kept only on your device for at most 3 days, is uploaded only together with your report, and is stored and deleted together with that report record.

Sensitive content: Information about a real person's health, sex life, sexual orientation, religion or other sensitive matters may appear in conversations or material. Entirely fictional content that cannot be linked to a real person is not automatically personal information. Ordinary photographs and voices are not automatically biometric information used for unique identification; identification templates require the protections applicable to their actual purpose. Provide only information needed for the feature and that you are entitled to provide; this reminder does not remove our responsibilities.

5. Processing Purposes and Lawful Bases

We process information for specific purposes: maintaining accounts and adult eligibility, completing AI replies or media tasks you request, saving conversations and works, managing purchase entitlements, providing support, handling reports and appeals, protecting systems and meeting applicable legal obligations. Necessity and lawful basis are assessed separately for each purpose, as described in Appendix I.

Where EU or UK rules apply, ordinary personal information necessary to deliver a core feature you expressly request may be processed on contract-performance grounds where the conditions are met. This covers only objectively necessary input, context and delivery. Mentioning an activity in terms does not make training, optional analytics or every service improvement contractually necessary.

Permission for third-party AI sharing and a statutory legal basis are separate matters. The overseas sign-in page contains an AI sharing notice, with choices recorded through the relevant affirmative action; authorisation must correspond to the specific sharing scope explained. Accepting this privacy policy itself does not authorise every AI purpose. Sharing permission required by platform rules cannot be replaced merely by “contract necessity”.

Sensitive information may require conditions in addition to an ordinary lawful basis. For example, EU special-category data cannot be processed solely on contractual necessity; where explicit consent is required, it must address the specific purpose. You cannot consent for a third party you have no authority to represent. Real health and similar information is assessed separately from entirely fictional stories; clicks are not treated as established facts about health, sexual orientation or religion.

Discovery uses displayable works, your selected reading preferences, persona romance preferences and likes, language, approximate region, interactions and recent impressions to rank content, reduce repetition and evaluate results. It does not use private chat bodies or raw search terms for ranking. You can influence content through existing preference, language, follow and block controls, or submit applicable objections or restriction requests through Section 2.

Necessary diagnostics, security and service operations within first-party records are handled separately from optional product analysis. Sending data to our own server does not automatically make all analysis contractually necessary. Optional Firebase analytics and crash reports are enabled under the relevant permission. Declining that choice does not prevent ordinary sign-in or services that do not depend on that processing.

This policy gives no blanket authorisation to use private chats, portraits, voices or other personal information for independent model training, public promotion or advertising. A new purpose beyond delivering the requested result requires separate information about scope, recipients, retention and opt-out effects, and the relevant lawful basis and necessary consent. Section 6 addresses provider retention, evaluation and training conditions; this paragraph does not promise that every provider has zero retention or never trains.

Risk detection and content handling may use automated tools. When the relevant service and model are available, real-person likeness review of public creator characters processes character text, reference images and story context, retaining verdicts, confidence and reasons. Results suggesting certain real people may trigger automatic hiding and enter human review. Decisions may be wrong; you may seek review through support or appeal channels. Where a decision legally qualifies as having legal or similarly significant effects, applicable notice, explanation, opportunity to express views and human review safeguards remain available. Safety detection is not medical diagnosis or real-time crisis monitoring and does not mean that someone continuously reads every conversation.

6. Service Providers, Sharing and Access

We send purpose-relevant information to service providers needed to deliver actual features. Appendix III describes the principal services and data categories. A corporate relationship, model brand or author name alone does not establish a basis for receiving your data.

AI services use Alibaba Cloud Model Studio and Replicate; selected features or models may also use fal.ai. To complete reply, image, audio or video tasks, the relevant service receives necessary prompts, conversation context, character/story settings, reference media and task information. Other recipients are described where the actual route involves them. Running an open-source model hosted on Replicate does not automatically mean its developer receives the input. Relevant models may also process necessary content to organise long-term memories and review public-character likeness. Likeness review is a separate path from the Alibaba Cloud Content Moderation service described below.

Third-party retention, evaluation, training and safety review may vary by product, contract, model and calling settings. We do not make a uniform zero-retention or no-training guarantee based on provider brands. We will limit sharing to the disclosed purposes and obtain any legally required new permission or choice before the relevant transmission.

Media storage and distribution use Cloudflare R2 for platform material and generated media, including uploaded or generated images, video, audio and related metadata. Private storage does not mean that every download link is inaccessible to a person holding it; you must protect temporary access links.

Alibaba Cloud Content Moderation processes relevant text or review images for name/image checks only when the relevant moderation service is enabled. Listing it in this policy does not activate it while disabled. Model-level safety processing and handling of specific reports are separate processes.

Resend processes email addresses and delivery information needed for verification-code emails. Apple or Google processes identifiers and transaction information when the corresponding sign-in or store feature is enabled. Their independent processing for their own security, billing or legal obligations is subject to their relevant policies.

Optional Firebase Analytics and Crashlytics are controlled by the relevant permission and operating conditions. Crashlytics automatic upload is off by default; reports are submitted manually only with consent and eligibility for the current app/environment and prior session. We do not deliberately add business account numbers, chat bodies, sign-in credentials or raw requests to crash reports, but automatic exception descriptions may contain contextual information. Historical caches on first consent, environment changes or withdrawal are handled under eligibility rules.

Apple refund consumption information has a separate choice and is not shared by default. If allowed, when Apple requests information to assess a refund, we may provide delivery and usage status for the relevant purchase and a refund preference based on actual use, which may recommend declining a refund. The preference does not decide the outcome; Apple makes the refund decision. This does not include sending complete chats or media content.

Google AdMob receives the information described in Section 4 under “Rewarded ads” only when you choose to watch a rewarded ad, and processes it to serve and measure that ad and prevent ad fraud, subject to Google's own policies (https://policies.google.com/technologies/partner-sites). Only non-personalised ad requests are made, and rewarded ads are not offered in the European Economic Area, the United Kingdom or Switzerland.

DeviceCheck is used for device abuse prevention only on supported platforms and where the relevant configuration is available. Apple services process the relevant token and necessary risk flags. Its purpose differs from optional Firebase analytics, Apple refund information and AI sharing; agreeing to one does not automatically enable the others.

Private chats are not public to other users by default. Content you choose to publish and associated public information may be viewed, shared or copied. Authorised personnel may access relevant records where genuinely needed for specific support, reports, appeals, security, faults or legal matters; such access is not public display or continuous human monitoring. Legal disclosure and business transfers likewise remain limited to the relevant lawful purposes, rather than expanding every use. When invitation features are used, the relevant inviter and invitee may see related display names, associations and reward status in the feature.

7. Choices, Withdrawal and Free Rights Requests

Use the app's existing profile/content controls and request account deletion through “Me > Settings > Account and Security > Delete Account”, or contact support@hiwish.fyi if the route is unavailable. We verify and handle requests within applicable statutory deadlines and explain the outcome for the account and principal online data, and any portions retained for a lawful reason. Necessary verification cannot arbitrarily delay the statutory starting point or deadline.

Withdrawing AI sharing permission, changing optional Firebase choices (turning off optional analytics also stops ad measurement) and changing Apple refund-information permission in overseas iOS are separate actions, available through the relevant settings or privacy contact channels. Withdrawal affects later processing that relies on that consent and does not retroactively invalidate lawful processing before withdrawal. Features dependent on the relevant sharing may become unavailable.

Withdrawal is not deletion of all previous data and a switch cannot retrieve data already provided to a provider or Apple. Crashlytics stops submitting new reports and handles local caches that are no longer eligible; reports already handed to Google for transmission cannot be cancelled retrospectively, and fully stopping local automatic crash capture may require restarting the app. You may separately request lawful deletion of existing information.

Rewarded ads are never required: an ad is shown only when you start one, and not watching ads does not limit other features. In Android you can reset or delete the device advertising ID in the system settings.

The optional Firebase switch does not control first-party operational records, orders, account security or recommendation business records. Submit access, deletion, restriction or objection requests for these activities under Sections 2 and 11. Continued processing depends on the specific purpose, basis and applicable law; being first-party does not automatically exclude your rights.

Statutory privacy requests are generally free and do not depend on membership or paid chat export. Only where applicable law expressly allows may a reasonable fee be charged or a manifestly unfounded, excessive or repetitive request refused, with reasons explained. Legally authorised agents may submit requests; verification does not require unrelated information.

Uninstalling, clearing caches, deleting an account, cancelling store renewal and requesting a refund are different actions. Account deletion normally does not cancel store subscriptions, which should be managed separately. Statutory data rights do not require first surrendering a balance or refund right, or first cancelling a subscription.

We do not improperly discriminate against you for exercising privacy rights. If a request cannot be fulfilled in full, we explain the reasons, available portions and appeal or regulatory complaint channels as required by law. A new version does not retroactively withdraw more favourable commitments already applicable to existing requests; deadlines and retention exceptions are handled separately.

After you withdraw AI sharing permission, signing back into the same account does not by itself restore that permission. Re-enabling the relevant sharing requires a new valid choice as applicable. To correct or delete long-term memories, recommendation preferences or inferences about you, use available content controls or contact support@hiwish.fyi identifying the account and relevant information. We will handle the request and explain the result within applicable law. Available app controls vary by feature; an individual request differs in scope from account deletion, and records that must lawfully be retained are handled under Section 8.

8. Security, Retention and Deletion Limits

We use reasonable security measures based on the nature and risk of the information. No system guarantees absolute security, but this does not exclude applicable security, incident-response or statutory notification duties. Incidents requiring legal notification are handled under the relevant requirements.

Retention is limited to the scope needed for specific purposes and applicable law. Accounts, saved conversations, long-term memories, works and media support ongoing provision and storage of selected features. After deletion, account closure or the end of a purpose, they are handled under deletion requests, statutory exceptions and the relevant storage arrangements. “Operational needs” do not justify indefinite retention. Appendix II explains the principal categories and criteria.

Necessary portions of purchase, tax/financial, refund-dispute, fraud-prevention, repeat-benefit-prevention and active-restriction records may lawfully remain after account closure. Starting points, bases, periods and reviews are assessed separately by record type. Identity-linkable hashes remain protected; a long-term restriction does not justify permanent retention of all chats or media.

First-party operational records, recommendation records, specific model diagnostics, task inputs and historical archives do not share one uniform period. Retiring general HTTP body tracing does not mean frozen task inputs, conversations or backups have been deleted. We will distinguish the purposes and access limits of routine cleanup, legally required retention and minimal evidence for specific legal claims.

Caches, object storage, backups and service-provider copies may be cleared separately from the main account record. We will not use portions that cannot immediately be cleared for technical or legal reasons for unrelated purposes. Confirmed deletion requests must still be respected when a backup is restored. Public content copied by independent third parties may be outside our direct control, without removing deletion or assistance duties within our scope.

Local caches depend on app/device actions, account status and cache eviction. Clearing a local copy does not delete server copies. Verification codes expire under their validity periods and are not permanent passwords. Use Section 2's channels to ask about relevant categories, bases and status for particular retention or deletion requests.

9. External Services and Third-Party Links

External websites, app stores, social platforms or independent third-party services you choose to visit may independently process information under their own policies. Please read those policies and manage the relevant choices when using those services.

The AI, storage, email, analytics and other providers we select and call within our service are described in Section 6 and Appendix III. Their third-party status does not remove our legal responsibility for notice, choices, supplier management and security in processing activities we determine.

10. International Processing and Transfer Safeguards

The operator is located in China, and the current core production ECS host is located in Singapore. AI processing, media storage, email delivery, backups and authorised support access may involve other countries or regions. A core host in Singapore does not mean that all data is located in Singapore. Cloudflare R2's Asia-Pacific location hint is also not a storage guarantee for a specific country. The Chinese operator's domicile, actual server locations and staff access locations are separate matters.

AI information is processed by the providers described in Section 6 and Appendix III according to the feature used. Media is stored in Cloudflare R2. Providers and their actual downstream recipients may process or access information in locations different from our core business deployment. A user's direct provision of information to an overseas operator and our onward disclosure to another recipient require separate assessment under applicable international transfer rules.

Where applicable law requires transfer safeguards, lawful mechanisms may include an applicable adequacy decision, EU Standard Contractual Clauses, the UK International Data Transfer Agreement or UK Addendum, together with necessary risk assessments and supplementary measures. The applicable conditions depend on the exporter, recipient, destination and processing activity. Listing these mechanisms does not mean that every path uses the same mechanism. Accepting this policy or allowing an AI feature on one occasion does not replace safeguards legally required for ongoing transfers.

You may contact support@hiwish.fyi about the processing locations, recipients and applicable transfer safeguards relevant to you and request explanations or safeguard copies as provided by law. Appropriate redactions may be made where necessary to protect others' privacy, commercial secrets or security, while providing understandable information.

11. Regional Additional Rights and Appeals

Your specific rights depend on the laws actually applicable to you, our business and the relevant processing activities. This policy does not choose one country's law to exclude your mandatory protections, and the following explanations do not mean that every law worldwide automatically applies. You may contact support@hiwish.fyi to make a request or ask about your applicable rights.

EU and EEA: Where the General Data Protection Regulation applies, you may, subject to statutory conditions, request access, rectification, erasure, restriction of processing and data portability. You may object to legitimate-interest processing on grounds relating to your particular situation, object to direct marketing at any time and withdraw consent relied on for processing. We normally respond within 1 month of receipt. For complex or numerous requests where legally permitted, this may be extended by up to 2 further months, with the extension and reasons notified within the first month. You may complain to a competent supervisory authority in your habitual residence, workplace or the place of the alleged infringement. Authority directory: https://www.edpb.europa.eu/about-edpb/about-edpb/members_en.

United Kingdom: Where UK data protection rules apply, you have the corresponding rights of access, rectification, erasure, restriction, objection and applicable data portability. Requests are handled within UK statutory deadlines, with any legally permitted pause or extension explained to you. The 30-day acknowledgement period for internal privacy complaints in Section 2 is separate from data rights request deadlines. You may also complain to the Information Commissioner's Office: https://ico.org.uk/make-a-complaint/. Internal complaints are not a general condition preventing you from seeking lawful regulatory remedies.

Applicable US states: Where the law and applicability thresholds are met, you may have rights to know, access, correct, delete, obtain a usable copy and opt out of sale, legally defined sharing, targeted advertising and certain profiling for significant decisions. Some sensitive-information uses are subject to additional restrictions. Whether an ordinary service-provider disclosure constitutes a legal sale or sharing depends on actual contracts and purposes, not only on whether money changes hands. You or a legally authorised agent may make a request and receive statutory protection against improper discrimination. Where the law requires acceptance of universal opt-out signals or Global Privacy Control, the relevant signal applies to processing covered by that law. The ad measurement described in Section 4 may be treated as sharing or targeted advertising under some state laws; you can opt out at any time by turning off optional analytics in Settings or by contacting support@hiwish.fyi. Rewarded ads described in Section 4 use only non-personalised ad requests and are shown only when you start one.

Where California rules apply, access, deletion and correction requests generally receive a substantive response within 45 days. Where an extension is legally needed, we notify you of the reason within the initial period and may extend to a total of 90 days. Other states' deadlines, frequency rules and appeal rights are handled separately under their laws. If a request is refused, you may email support@hiwish.fyi with “Privacy Appeal” to seek review. We provide refusal reasons, appeal outcomes and the relevant attorney general complaint route as required by law.

Consumer health information: Physical or mental health information relating to an identifiable person may receive special legal protection even when it appears in entertainment or character conversations. Where Washington State or other applicable health-data laws cover the processing, collection, sharing, consent, withdrawal, deletion and any required separate health privacy notice are governed by those laws. You may use the Section 2 channel to make a related request. This general policy does not replace a legally required separate health-data notice or specific consent.

Other regions: Access, correction, deletion, withdrawal, consent, international transfer and complaint requirements may differ in Canada, Australia, Brazil, Japan, South Korea and other markets. You may use the Section 2 channel to make requests protected by your local law. Additional notices, languages, channels and deadlines legally required in a particular region also apply and are not excluded merely because they are not listed individually in this section.

12. Policy Updates

We may update this policy because of changes to features, providers, laws or security arrangements, and identify the version and update date in the updated policy. Please use the policy access point provided in the service to view the version applicable at the time.

We provide appropriate notice as required by law of material changes to information uses, recipients, choices or rights. Where law or platform rules require renewed permission, those requirements apply. Continued use or acceptance of new wording does not automatically mean consent to every new processing activity.

An update does not retroactively expand authorisation to use information already collected or affect rights, responsibilities or more favourable commitments that lawfully arose before the update. Contact support@hiwish.fyi with questions about the policy or changes.

Appendix I. Processing Purposes, Information and Legal Bases

Scope | The following distinctions separate processing purposes. Where EU or UK rules apply, performance of a contract covers only objectively necessary processing. Legitimate interests require necessity and a balancing assessment, a legal obligation requires an actually applicable legal requirement, and consent must be freely given, specific, informed and unambiguous. Using the same information for a new purpose also requires a separate assessment of the basis for that purpose.

Accounts and core AI services | Email addresses, sign-in identifiers, necessary account information and the prompts, context, long-term memories, media, task status and generated results you ask us to process are used to sign in, complete requests, save content you choose to retain and deliver entitlements. Ordinary information objectively necessary for these core requests may be processed on the contract-performance basis where its conditions are met. Third-party AI sharing remains subject to the relevant platform permission and notice requirements. Additional information, special category data and independent training purposes are not automatically covered by that basis.

Transactions, support and rights requests | Order, delivery, use and dispute information is used to complete purchases and handle refunds or specific support matters. Actually applicable financial, tax, consumer protection or data protection laws may require retention or processing of specific records. Such obligations do not extend to all private conversations. Apple refund consumption information is a separate choice and is not shared by default; refusal does not remove statutory refund request rights.

Adult eligibility, security and abuse prevention | Necessary age information, device/network information, tokens, risk associations and action records are used to enforce adult restrictions and prevent repeat benefit claims, fraud and specific security risks. The basis must be assessed separately for the actual purpose: necessity for the core service, a specific legal obligation or legitimate interests supported by necessity and balancing. Calling everything “security” does not justify unlimited scope. Criminal-offence or special category data also requires additional legal conditions.

First-party operational records, discovery and recommendations | Installation identifiers, sessions and technical events may be used for actually necessary operation, security or fault handling. Reading/persona preferences and usage, impression and recommendation-performance analysis are separate purposes. First-party collection or product terms alone do not make every event necessary for a contract. Discovery ranking uses the signals listed in Section 5. Analytics or device-information access legally requiring consent must meet consent conditions; processing relying on legitimate interests must meet necessity, balancing and applicable objection requirements.

Optional Firebase analytics and crash reports | Necessary events, pseudonymised identifiers and eligible crash information are submitted only when the relevant permission and runtime eligibility allow it, for the disclosed usage analysis and fault diagnosis; consent is the basis where legally required. This choice does not automatically permit advertising personalisation or control separate first-party operational records. Section 7 explains prospective withdrawal and handling of reports already submitted. Where the Android sign-in notice outside the EEA, the UK and Switzerland says so, the same choice also covers ad measurement with the device advertising ID; consent through that notice is the basis, and it never covers personalised advertising.

Optional rewarded ads | When you choose to watch a rewarded ad for coins (outside the EEA, the UK and Switzerland), the information described in Section 4 is processed to show the ad, credit the reward you asked for and apply daily limits and abuse prevention. Crediting the reward is part of the feature you request; limits and fraud prevention rely on legitimate interests. Only non-personalised ads are requested, and the ad provider's own processing is described in Section 6.

Sensitive information and new purposes | Identifiable health, sex-life, sexual-orientation, religious and similar information may receive special protection under applicable law. In addition to an ordinary legal basis, the applicable additional conditions must be met, such as explicit consent for a specific purpose. Contract necessity or accepting this policy alone is insufficient. This policy also gives no blanket authorisation for independent training, evaluation, promotion or marketing; specific notice and applicable bases, choices and restrictions are required first.

Appendix II. Retention and Deletion Arrangements

Accounts, conversations, long-term memories, works and media | Retained to maintain the account and provide content you choose to save. Deletion is handled under applicable law when you delete content, request account deletion or the relevant purpose ends. Only minimal portions with a separate lawful reason may continue to be retained. Account status, principal online business information, task copies and media storage are different cleanup scopes; we will explain the specific completion status and categories lawfully retained when handling a request.

Operational, security and diagnostic records | Scope and periods are determined by the fault diagnosis, security or service operation purpose of the specific event, followed by deletion or irreversible anonymisation when the purpose ends. Ordinary technical metadata, first-party usage events, limited diagnostic information and saved conversations are managed separately. Calling information “logs” does not justify routine retention of all chats or media. Where evidence must lawfully be retained for a specific event, retention is limited to relevant minimal records and the necessary period.

Discovery and recommendation records | Necessary associations and event records are retained for ranking, reducing repetition and disclosed performance analysis. Raw personal records are treated separately from irreversibly anonymised aggregates. Reversible associations or pseudonymisation are not anonymity. Linked records are handled according to the relevant purpose, legal basis and statutory conditions when a deletion, objection or withdrawal request applies.

Order, tax, refund and dispute records | Minimal records are retained for the period needed to complete transactions, meet actually applicable financial/tax duties or establish, exercise or defend specific legal claims. Account deletion does not necessarily remove accounting records that must lawfully be retained, but that reason does not justify retaining unrelated private chats or media. The need for continued retention must be reassessed after a dispute ends.

Repeat-benefit prevention, fraud and active restriction records | Necessary identifiers, hashed associations and grounds for action may be retained to prevent repeat benefit claims by the same identity or device, address specific fraud and enforce active restrictions. Retention depends on the specific risk, validity of restrictions and appeal needs. Hashing does not justify indefinite storage; we will delete or irreversibly anonymise associations no longer needed.

Support, reports, appeals and rights requests | Information necessary to handle specific matters, record outcomes, protect third parties and address related legal claims is retained. Retention periods depend on case closure, statutory record duties and dispute status, with access and reuse limited.

Caches, backups and provider copies | Device caches, identifiable online copies, isolated backups and provider retention follow different processes. Deleting online information does not mean that backups or information already transmitted are simultaneously erased completely. Backups that must lawfully be retained in isolation are limited to recovery, security or statutory purposes, and applicable deletion must still be implemented after restoration. Deletion or restriction is requested for provider copies according to contracts, actual control and applicable law. Clearing local caches, uninstalling or stopping use is not deletion of the cloud account.

Appendix III. Main Service Providers and Processing Scope

AI | Alibaba Cloud Model Studio and Replicate are used for actual AI tasks; selected features or models may also use fal.ai. The relevant providers receive necessary prompts, context, settings, reference media, task parameters and result information for the task. Hosting an open-source model on Replicate does not automatically give the model author access to inputs. Disclosure to another recipient occurs only where the actual runtime or onward-transfer path involves that recipient. Retention, training, evaluation and safety processing depend on the specific product, contracts and call settings and cannot be inferred from a model name. Relevant models may also process necessary information to organise long-term memories and review public-character likeness; these activities are not the same as independent model training.

Media storage and delivery | Cloudflare R2 stores platform assets and generated media. Information includes images, videos, audio, object identifiers and necessary metadata. Access links, caches, backups and source objects are different copies. An Asia-Pacific location hint is not a storage guarantee for a specific country.

Email | Resend processes recipient email addresses, email content and delivery metadata needed for verification-code emails. Verification delivery and privacy rights requests are different processes; the rights request channel is support@hiwish.fyi.

Sign-in and app stores | Apple or Google processes identity identifiers, authentication and purchase-verification information when the respective platform's sign-in and store features are enabled. We retain the copies needed for account and entitlement management. Apple refund consumption information is not shared by default. When the relevant choice allows it, delivery/use status and a handling preference that may recommend declining a refund are supplied; Apple makes the final refund decision.

Optional analytics and crash diagnosis | Firebase Analytics and Crashlytics process events, pseudonymised identifiers and eligible crash information within the relevant permission scope. Automatic Crashlytics uploads are disabled by default. After consent, reports must still meet conditions including application/environment and prior-session eligibility. Automatic exception context may contain information from the incident. Turning these features off does not turn off separate first-party telemetry. Withdrawal does not retrieve reports already submitted to Google, and stopping local crash capture may require an app restart. For Android users who allowed ad measurement, Google Ads receives measurement of installs, engagement events and confirmed purchases, without personalised advertising.

Rewarded ads | Google AdMob processes device and app information, IP address, ad interactions and, on Android, the advertising ID when you choose to watch a rewarded ad, to serve and measure non-personalised ads and prevent ad fraud, and sends our server a signed reward confirmation with your account identifier, task identifier and transaction identifier. Rewarded ads are not offered in the EEA, the UK or Switzerland.

Conditional device checks and content review | DeviceCheck sends necessary device tokens and risk flags to Apple for abuse-prevention checks only on supported platforms where the relevant configuration is available. Alibaba Cloud Content Moderation processes necessary name text or review images only when the relevant review service is enabled; listing it does not make a disabled service run. These are separate from model-level safety processing, Firebase analytics and Apple refund choices.

Providers and locations | The actual contracting entities, processor or independent-controller roles, processing and support-access regions and actual downstream providers may differ by service. Sections 6 and 10 apply. You may contact support@hiwish.fyi about relevant recipients, locations, retention and transfer safeguards. Specific retention and reuse conditions depend on the applicable product, effective contract and processing settings. This Policy does not make a zero-retention or no-training guarantee covering every provider.