Tingwen Reader Privacy Policy

This policy explains how Tingwen Reader handles information related to your use of the app.

1. Information We Process

• Book content: content from TXT, EPUB, MOBI, PDF, and other files that you choose to import.
• Reading and listening data: reading position, listening progress, playback settings, voice settings, subscription status, and related preferences.
• Audio and microphone data: processed only when you choose to record or import audio for a custom voice, and used to create that voice on your device.
• Feedback: when you choose to send feedback, the app sends your description, optional reply email, app version, system version, and device type to the Tingwen Reader support mailbox so that we can investigate and respond.
• Anonymous usage data: the app combines reading time, listening time, and completed-share count by UTC day and sends those totals at low frequency with a code valid only for that day, app version, major iOS version, and broad device class. This measures activity and version distribution without book titles, text, chapters, or reading positions and does not identify a device across days.
• Anonymous diagnostics: the app may send fixed-schema failure details, performance timings, and safe state information to troubleshoot on-device listening and model loading. This does not include book titles, book text, reading offsets, file paths, audio, or voice data.
• Model-generation error diagnostics: if model generation fails, the app automatically uploads only the failed passage's original text and de-identified model diagnostic parameters to Cloudflare for reproducing problems and model calibration. The passage is retained verbatim and is not anonymized text. Each passage is limited to 16 KiB, with at most five distinct failed passages per device per UTC day; errors beyond these limits are reported without book text. We do not upload entire books, adjacent successful passages, original recordings, custom-voice recordings or prompts, model keys, or local file paths. These records are available only through restricted administrative access for diagnostics, for at most 35 days; at expiry, access stops and deletion is performed. Cloud-platform internal backups follow the platform's retention and deletion mechanisms.
• Share landing-page data: when you open a share link, the page sends its installation-level anonymous referral code, a random UUID from the first-party tw_visitor_v1 visitor cookie, a random ID for that visit, and the language. The server briefly processes the visitor code, request IP address, and browser identifier and uses a server-side secret to create one-way hashes for deduplication and measurement. It also derives coarse device class, operating-system family, country/region code, and language for attribution. Raw visitor codes, IP addresses, and browser identifiers are not written to the database and are not used for advertising or cross-site tracking.
• Subscription and purchase statistics: if you have subscribed, the app uploads records such as your subscription plan, subscription events, dates, price, and currency, as described in section 5.
• Computer transfer connection data: when you choose to transfer books from a computer, we temporarily process a pairing code, WebRTC signaling, and connection state to establish the connection.

2. On-Device Processing

Core reading and listening features run on your device. Your books, custom voices, and progress data are stored locally by default. Tingwen Reader currently does not provide cloud sync and does not store book text or custom-voice recordings on our servers, except for the failed-passage text from model-generation errors described in section 1.

Computer transfers prefer an encrypted peer-to-peer WebRTC connection. If the networks cannot connect directly, Cloudflare TURN may relay encrypted transfer data, but we do not persist book files on our servers.

3. Permissions

• Microphone: used to record a custom voice. Access is requested only when you choose to record.
• Files: used to import books or audio files that you select.
• Network: used for subscription-related services, the initial Apple device authorization for the on-device large model, public pages, anonymous activity reporting, subscription and purchase statistics, and share landing-page visit reporting, computer transfer connections, and feedback that you choose to submit. Model authorization does not upload book text or custom-voice recordings.

4. Analytics, Advertising, and Tracking

Tingwen Reader does not include advertising, third-party behavioral analytics, or cross-app tracking. Anonymous activity data and share landing-page data are used only for first-party product analytics and share attribution. They do not contain advertising identifiers and are not combined with data from other companies. The tw_visitor_v1 cookie used by the share page is first-party and is not used for cross-site identification.

5. Subscription and Purchase Statistics

If you have subscribed in the app, the app reads the on-device transaction information provided by the App Store and uploads the following subscription records to Cloudflare:

• subscription plan (monthly, quarterly, or yearly);
• purchase, renewal, and revocation events;
• purchase, expiration, and grace-period end times;
• whether the subscription is a free trial, whether it renews automatically, and whether you have ever paid;
• the price in the currency's minor units, with its currency code.

Transaction and subscription IDs are never uploaded as-is: they are hashed on your device with SHA-256 together with the installation principal, and the server applies a keyed HMAC. These records are linked to the app's randomly generated installation identifier and are used to measure subscription conversion, renewal, and churn and to improve the service. They are not linked to your Apple ID, do not include App Store receipts, are not used for advertising or cross-app tracking, and are not shared with third parties other than Cloudflare as our data processor.

Payment records linked to an installation identifier are retained for at most 13 months and then deleted automatically; raw uploads are retained for at most 90 days; aggregated reports that contain no installation identifier may be kept longer. The app does not currently offer a separate switch to turn off these statistics. The installation identifier is random and stored only on your device; deleting the app resets it, after which earlier records are no longer associated with the new installation and are deleted on the schedule above.

6. Retention and Service Providers

Anonymous activity, usage, diagnostic, and share-visit records are retained for up to 35 days and then removed; retention for subscription and purchase statistics is described in section 5. The share-visit database keeps only the anonymous referral code, keyed hashes, and coarse device/region information. The tw_visitor_v1 cookie remains in your browser for up to one year, unless you delete it sooner. Short-lived pairing rooms are removed after expiry or transfer completion. We use Cloudflare to provide the website, APIs, signaling, database, and TURN relay when needed. Cloudflare processes related data only as needed to provide those services.

7. Feedback Email

Feedback is sent only after you tap Submit. An optional reply email is used only to contact you about your request, not for advertising or marketing.

8. Data Deletion

You can delete books, custom voices, and temporary content in the app. Deleting the app removes most locally stored app data. To request deletion of feedback already sent to us, contact us using the email below.

9. Children's Privacy

Tingwen Reader is not specifically directed to children. A parent or guardian who believes a child has submitted personal information may contact us to request assistance.

10. Contact

Questions about this Privacy Policy can be sent to [email protected].