Privacy Policy (iOS)

1. Scope and operator

Operator

Shenyang Tdx Network Technology Co., Ltd.

Unified Social Credit Code

91210124088957535L

Contact email

tdxkefu@foxmail.com

This policy applies to Tdx Teleprompter for iOS and its explicitly connected account and online services. Other platforms, including Android, have their own applicable disclosures. Independent third-party processing is governed by the provider privacy rules.

Personal information excludes anonymized information.

The app does not request all permissions at first launch. It requests access only when you start the related feature. Permissions and access are explained below:

• Microphone: local recognition, recording and local-network audio you enable.
• Camera: recording and scanning you choose.
• Local network: pairing and collaboration with prompting devices.
• Photo add: saving media or referral posters you choose.
• Clipboard: reads text or links only for your paste action, without background polling.

Granting access does not itself cause audio, images, or scripts to be uploaded. Refusing or disabling a permission affects only its related feature; other features remain available.

2. How we process information

Local scripts, editing and basic constant-speed prompting do not require registration. Online account features require privacy consent; Countly and Clarity also require the product-improvement setting. Local basic features remain available without consent, and the consent screen is excluded from Clarity reconstruction. Bounded local diagnostics may run before consent without a persistent identity; they stay on device unless you choose to deliver selected material through feedback or sharing. Umeng SDK (U-App analytics and basic U-APM performance monitoring) starts only after consent to the current privacy policy and does not additionally depend on the product-improvement setting. Umeng Tongxin (Beijing) Technology Co., Ltd. processes device/installation identifiers available from the system (such as IDFV, OpenUDID/GUID and SDK-generated identifiers), device models, system and app versions, network type and IP, launches, pages, approved business events, crash/stall stacks, thread and failure states, and launch timing for usage analysis, conversion analysis and stability diagnosis. Our business events do not submit script content, titles, file paths, audio/video, phone numbers, account IDs or order IDs. This version does not integrate advertising delivery or advertising attribution and adds no ATT or location permission. Umeng privacy policy: https://www.umeng.com/page/policy

Scripts and settings stay in app-private storage. Images, videos, and documents are read only after you choose them through iOS system pickers for import, preview, on-device recognition, or local video processing. Video Mirror saves a new result to the system gallery. Source files and processed results are not automatically uploaded as files, but after consent, visible text or images not covered by Clarity's Balanced masking may be included in interface-reconstruction data. Content saved as a script may subsequently upload under the script-sync rules.

Sign-in, the AI Follow trial, membership, purchase, invitations, feedback, and updates process only what is needed when you actively use them after consent, based on the service agreement, consent, or legal duties.

3. Local content and AI Follow

Scripts, groups, hotwords, annotations, settings and reading positions are stored privately. Account cloud sync runs automatically when privacy consent, account eligibility, the home-page foreground condition and other admission requirements are met and sync is not paused. You may pause the current device through the sync entry. Deleting content, removing the app or clearing data may make local content unrecoverable. System backups depend on iOS and your settings; temporary downloads and diagnostic caches are excluded where implemented. Keep necessary copies yourself.

Images selected through the iOS photo or file picker are read only for file checks, ordering, thumbnails and on-device Vision OCR. Original images are not automatically uploaded or kept as long-term script attachments. Confirmed text follows the local-script rules.

AI Follow requires an account and a connection for sign-in and starting a free trial. The built-in Sherpa-ONNX model processes microphone audio, recognition, text matching, and scrolling on-device. The current session needs no continuous connection and does not upload scripts or audio.

Up to three recent AI session evidence sets may be retained locally, up to 300 MB, and general logs for up to 14 days and 30 MB. They are automatically cleared at their limit and do not leave the device by default.

When script sync is available and your Professional membership is valid, scripts owned by your account sync automatically while Home is in the foreground, and active scripts without an account owner are enrolled. Sync includes text, titles, formatting, annotations, hotwords, and groups. Scripts and related text are uploaded to the account service and sent to Alibaba Cloud content moderation for risk checks. Approved documents are stored privately in mainland China for syncing between devices signed in to the same account; they are not published as public content. You can pause sync on this device without affecting local editing. Audio, video, reading progress, and display settings are excluded.

Optional enhanced punctuation downloads an approximately 163 MB model and processes text on your device without uploading transcripts, audio or video. Regular transcription works without it.

4. Feedback and diagnostic sharing

Ordinary feedback first creates and freezes a diagnostic package locally. You may choose online submission: with account authorization and your explicit submission, the selected description, images and diagnostics are uploaded to the account service and private OSS. Alternatively, system sharing sends the material to the destination you choose in the iOS share sheet. Generating a package alone does not upload it.

“Earn membership by completing tasks - Submit product experience feedback” is an optional online reward task. When you enter the task, describe a genuine experience, and submit, the description and up to three selected images re-encoded without original EXIF are uploaded. A diagnostic ZIP is created and uploaded only if you separately select diagnostic sessions, read the sensitive-content notice, and confirm. It may contain full scripts, hotwords, recognized text, algorithm events, device and app information, logs, and microphone audio. Routine AI Follow remains on-device and never uploads scripts or audio automatically.

Task materials use short-lived URLs fixed to specific objects and are stored in a private Alibaba Cloud OSS bucket in China with public access disabled. Authorized support and administrators may review descriptions and images. A short-lived read-only link to a diagnostic ZIP is created only when authorized developers need it for troubleshooting. The current reward decision is made by authorized staff, not by a model, and materials are not used for advertising, profiling, or unrelated distribution.

Incomplete server drafts close and are cleaned after 24 hours. If more information is requested, the supplement window is seven days. Thirty days after a final outcome, the server deletes descriptions, appeal text, images, thumbnails, and diagnostic ZIPs; failures enter retry and backlog monitoring. Irreversible digests, material type and size, reason codes, review records, reward ledger entries, and entitlement events remain as needed to prevent duplicate rewards and preserve required audit.

5. System permissions

Camera, microphone and local-network permission are requested only for the recording, recognition, scanning or local collaboration feature concerned. You may withdraw them in iOS Settings; refusal affects only dependent features.

Local collaboration connects only to the prompting device you choose to pair. Microphone audio is encrypted and sent only after you enable remote microphone use, and transmission stops when you disable it.

System pickers provide access only to selected photos and files. Saving output requests photo-add permission. Network access supports online features you choose after consent; local-network permission supports prompting collaboration. Permission alone does not upload source files or audio.

6. Optional account and transaction services

Phone, WeChat, QQ and Apple sign-in or binding are enabled only when you choose them. Verified provider credentials support authentication, recovery, security and binding; WeChat and QQ may provide a profile name and avatar, while phone sign-in processes the number and SMS verification records. We do not receive third-party passwords or retain SMS codes as long-term credentials. Apple sign-in does not require a phone number or disclosure of your real email address.

The service processes public Tdx account ID, sign-in result, session, membership, installation identifier, device brand and model, system version, and activity times for authentication, device limits, entitlement, security, disputes, and legally required audit. Logs exclude passwords, SMS codes, OAuth codes, and access tokens.

iOS purchases and restoration use Apple StoreKit/App Store without requiring a Tdx account. Apple-verified transactions and durable local delivery records authorize Pro features on this device; purchase, refund and revocation facts determine their term. When you permit our network services, the account service processes necessary products, transaction identifiers, purchase times, environments, signed evidence and refund state for fulfillment, restoration and reconciliation. When you sign in and the purchase source can be verified, unassociated guest transactions are automatically associated with that account. Self-service reassignment is not offered. Source proof may include an Apple AppTransaction, device verification identifier and App Attest request proof, used only for ownership and replay prevention, never as analytics identity. This release does not report consumption data to Apple. We do not receive payment-card or Apple Account passwords. Apple rules and applicable law govern payments and refunds.

Invitation services process codes, internal account identifiers, binding time, rule version, reward records, and anti-abuse digests.

Account deletion has a seven-day cooling-off period. Once effective, the account is deleted or irreversibly anonymized and remaining membership expires; local scripts remain. Legally required transaction, security, and dispute records are isolated for limited purposes and periods.

7. Sharing and third parties

We do not sell personal information. Minimum information is sent only for sign-in, SMS, payment, update, or sharing that you choose. Independent providers apply their own rules; processors acting for us are limited by purpose, confidentiality, and security duties.

iOS uses WeChat OpenSDK for iOS, QQ Connect iOS SDK, Apple AuthenticationServices, StoreKit, Vision, AVFoundation, system pickers/networking and local components such as Sherpa-ONNX as needed. Apple authorization and purchases use system services. Vision OCR processes selected images on device without sending them to cloud OCR. Umeng SDK (U-App analytics and basic U-APM performance monitoring) starts only after consent to the current privacy policy and does not additionally depend on the product-improvement setting. Umeng Tongxin (Beijing) Technology Co., Ltd. processes device/installation identifiers available from the system (such as IDFV, OpenUDID/GUID and SDK-generated identifiers), device models, system and app versions, network type and IP, launches, pages, approved business events, crash/stall stacks, thread and failure states, and launch timing for usage analysis, conversion analysis and stability diagnosis. Our business events do not submit script content, titles, file paths, audio/video, phone numbers, account IDs or order IDs. This version does not integrate advertising delivery or advertising attribution and adds no ATT or location permission. Umeng privacy policy: https://www.umeng.com/page/policy

iOS uses a native adapter to our self-hosted Countly API. It does not integrate the Countly Android SDK or send Android Java/Kotlin crash or device-profile fields. Analytics identities are separate from business accounts. Collection and opt-out rules are in the personal-information list.

For the product-feedback reward task, Alibaba Cloud Object Storage Service (OSS) acts as our processor and privately stores in China only the descriptions, images, and optional diagnostic ZIPs you actively submit. Processing is limited to intake, staff review, troubleshooting, and reward disputes. Alibaba Cloud may not use these materials for advertising or independent profiling; private ACLs, server-side encryption, short-lived signed URLs, least privilege, and access audit restrict access.

After consent, Microsoft Clarity acts as an independent third-party analytics service and processes app layouts, visible content after Balanced masking, taps and gestures, app errors, and limited device information to reconstruct sessions and create heatmaps. Clarity is not used for ad targeting, and we do not set a Tdx account, phone number, order ID, or custom user ID in Clarity. Its processing is governed by the Microsoft Privacy Statement and Clarity terms.

8. Third-party SDK disclosures

WeChat, QQ and Apple identity authorization is performed only when you choose the corresponding feature. Native Countly analytics and the Clarity iOS SDK require both general consent and product-improvement consent. System frameworks and local components run as needed. Information categories are detailed in the lists in this policy. Umeng SDK (U-App analytics and basic U-APM performance monitoring) starts only after consent to the current privacy policy and does not additionally depend on the product-improvement setting. Umeng Tongxin (Beijing) Technology Co., Ltd. processes device/installation identifiers available from the system (such as IDFV, OpenUDID/GUID and SDK-generated identifiers), device models, system and app versions, network type and IP, launches, pages, approved business events, crash/stall stacks, thread and failure states, and launch timing for usage analysis, conversion analysis and stability diagnosis. Our business events do not submit script content, titles, file paths, audio/video, phone numbers, account IDs or order IDs. This version does not integrate advertising delivery or advertising attribution and adds no ATT or location permission. Umeng privacy policy: https://www.umeng.com/page/policy

9. Invitation rewards

When you use invitations, we process the code, internal account identifiers, binding time, rule version, and reward records. Scanning a poster only opens the official download page; a relationship starts only after sign-in, code entry, and server validation.

Eligible distributions may grant membership time.

Installation identifiers and irreversible HMAC digests support consistency checks against duplicate rewards, self-invitation, and bulk registration. Original provider identifiers and risk rules are not shown; abnormal relationships may be restricted and reviewed.

10. Retention, security, and location

Local scripts and settings remain until you delete them, clear app data, or uninstall. AI evidence, logs, ordinary-feedback image drafts, and share caches follow the limits in Sections 3 and 4. Online materials for the product-feedback reward task follow the separate periods below.

Countly uses an independent random UUIDv4 analytics installation ID, managed separately from accounts, phone numbers, orders, Apple identifiers and hardware identifiers. It is not used for advertising or cross-app profiling.

iOS Countly receives only the version, distribution, language and controlled events in the information list. It does not upload system crash stacks, specific device models or location. MetricKit reports and general diagnostic logs stay in bounded local storage and are supplied only in feedback or sharing you choose. Selected diagnostics may include app/system version, basic device information and controlled code locations, but never Apple authorization codes or tokens.

Countly installation-linked records are retained for at most 180 days and count-only aggregates for at most 24 months. On iOS, opting out clears local analytics identity/queues and stops sending; it does not automatically delete existing server history. History retention and rights requests follow this policy. Account, audit, referral, transaction and refund records are retained as needed for service, security, disputes and legal requirements. Umeng retention and rights requests follow its privacy policy. This app does not submit business-account identities to Umeng.

We use private app storage, iOS Keychain credential protection, HTTPS, field encryption, access control, redacted logging and security audits. Account, order and membership records are stored in China. Independent providers such as Apple, Tencent and Microsoft process necessary data in their operating regions under their own privacy and rights rules.

Microsoft Clarity ordinarily retains session-playback data for 30 days; favorite or sampled sessions and click or heatmap data may be retained for up to nine months. Withdrawal immediately tells Clarity to deny analytics storage and pauses future collection on this device, but Microsoft currently provides no self-service API to delete existing Clarity data for an individual app user. Contact us through this policy to make a deletion or other rights request.

Cloud scripts remain in the recycle bin for 30 days. After membership expires, cloud scripts are retained for 90 days and then become eligible for cleanup. Sync stops and cloud scripts are retained during the account-deletion cooling-off period; once deletion takes effect, cloud scripts are deleted asynchronously. Cloud cleanup does not remotely erase local scripts that must be retained.

iOS uses a bounded local analytics queue; the server accepts events from the previous seven days only. Records exceeding time or capacity limits are discarded, so complete delivery is not guaranteed. Opting out stops future uploads and clears the local queue.

11. Your rights

Under applicable law, you may know, decide, restrict, or refuse processing and request access, copy, correction, supplementation, deletion, withdrawal, explanation, or account deletion. We generally respond within 15 working days after verification.

You may edit or delete local scripts, manage system permissions, disable product improvement or withdraw permission for our network services, and manage accounts, devices, sign-out or deletion. Withdrawal pauses client account access, cloud sync, transaction reporting, automatic association and result queries. Verified Apple access continues for its term, with necessary original purchase targets and unknown-operation records retained; permitting network services again resumes those same operations. An Apple purchase or restore you initiate does not re-enable our accounts, sync, diagnostics or analytics. The server continues processing accepted transactions and financial records under fulfillment and legal retention rules. Withdrawal does not delete scripts, delete your account or refund an Apple purchase. The personal-information list explains Umeng withdrawal for the current process and the next cold launch; already initialized performance components may not all stop immediately.

You can cancel diagnostic sharing or clear caches. If you cannot use the app, use the public deletion page or email tdxkefu@foxmail.com; identity verification may be required for protection.

Before task submission completes, you can cancel the upload or remove the optional diagnostic ZIP. The result page provides supplement or appeal actions when applicable. You may request access, correction, deletion, or an explanation of processing through the contact route in this policy; after identity verification we respond under applicable law. An active reward dispute or legal duty may limit the deletion timing.

You can pause or resume sync for this device from Home and restore or permanently delete scripts through the recycle bin under the applicable rules. Signing out or changing accounts does not force unsynced changes to upload.

12. Minors

The service is not specifically directed to children under 14. A minor should use it under parent or guardian guidance and avoid unnecessary personal information in scripts, images, or diagnostic packages.

Basic offline features do not require registration. An account or transaction feature that uploads personal information requires guardian guidance and any consent required by law; otherwise the online feature should not be used.

13. Policy updates

We may update this policy for changes in features, purposes, information types, third parties, or law and will show a new publication date. The updated policy takes effect on that date.

A material effect on personal-information rights is announced prominently, and renewed consent is obtained where required. An update cannot reduce statutory rights without express consent.

14. Contact us

Operator

Shenyang Tdx Network Technology Co., Ltd.

Unified Social Credit Code

91210124088957535L

Contact email

tdxkefu@foxmail.com

Website

https://teleprompter.yiroot.com/

Contact us with policy, processing, complaint, or rights questions.

Appendix 1: Personal Information Collected

1.1 Device and app information

Accounts, updates and diagnostics process necessary app versions, channels, network and failure information. The iOS app uses a locally generated installation identifier for authentication, device management and duplicate-reward prevention. It does not read Android IMEI, IMSI, device MAC addresses or contacts. Diagnostics, Countly and Umeng identifiers are managed separately. This version does not request ATT tracking or location authorization.

The native iOS Countly adapter uses an independent random UUIDv4 analytics installation ID, app version, build, distribution, language, controlled sessions, pages, duration buckets and business enums. It does not receive account, phone or Apple identifiers, authorization codes, order identifiers, script text or titles, hardware identifiers, device models, location or crash stacks. IP is not an analytics field and related forwarding/access logs are removed at ingress. MetricKit diagnostics are retained separately on device and shared only through feedback or sharing you initiate.

1.2 Account, free trial, transactions, and local content

Phone number, third-party sign-in identity, sign-in token, AI Follow trial eligibility, orders, membership, referrals, and feedback are processed only as needed when you use the related feature. Trial rules are shown in the app. Sign in with Apple (iOS only): When you choose Sign in with Apple, we use Apple's system authorization service to obtain and verify an app-scoped Apple user identifier, a one-time authorization code and identity credentials. We use them to create or sign in to your teleprompter account, bind an account you explicitly select, and prevent authorization replay. Initial authorization may include a name you choose to provide, which may be used for your profile. Apple may return an email address in the credentials. We do not use email addresses to match or automatically merge accounts, and we do not require disclosure of your real email address or a phone-number binding to use Sign in with Apple. We do not receive your Apple Account password. The server uses a domain-separated fingerprint of the Apple identifier to locate the account. Necessary identity evidence is encrypted under the existing account-evidence rules. Refresh tokens needed to revoke authorization are encrypted on the server, are never returned to the client, and are excluded from ordinary logs and behavioral analytics. When authorization is updated, local copies of superseded tokens are destroyed. Unbinding Apple or completing account deletion schedules revocation with Apple. Revocation secrets are retained for at most fourteen days during unsuccessful retries, then destroyed while the system awaits trusted revocation confirmation. Related audit metadata without secrets is retained for at most one hundred and ninety days, subject to existing rules for legal requirements and evidence preservation.

Source script, image, and document files, microphone audio, recognition results, text matching, and scrolling state are processed on-device by default and are not automatically uploaded as source files. After you consent to Clarity analytics, visible text or images on the current screen that are not covered by Balanced masking may be sent to Microsoft as interface-reconstruction data. Microphone audio and local files themselves are not sent to Clarity. The Content Risk Checks tool uses offline rules shipped with the app and does not upload scripts or detection content to Tdx or third-party detection servers. Uploads for script-sync risk checks follow the separate disclosure below. Clipboard: when you use text selection or a paste menu, text components may read clipboard descriptions, such as content types, to determine whether Paste is available. This check does not read the content itself. Only when you choose Paste does the app read the current clipboard text or link into script editing, script organization, content risk checks, or a media-link input. It does not poll the clipboard on startup or in the background for this purpose, or read clipboard history. Pasting itself does not upload content. Subsequent link parsing, sharing, or other online actions you submit follow the disclosures for those features. Content displayed after pasting remains subject to the Clarity interface-reconstruction and masking rules described in this policy.

When script sync is available and your Professional membership is valid, scripts owned by your account sync automatically while Home is in the foreground, and active scripts without an account owner are enrolled. Sync includes text, titles, formatting, annotations, hotwords, and groups. Scripts and related text are uploaded to the account service and sent to Alibaba Cloud content moderation for risk checks. Approved documents are stored privately in mainland China for syncing between devices signed in to the same account; they are not published as public content. You can pause sync on this device without affecting local editing. Audio, video, reading progress, and display settings are excluded.

1.3 Countly analytics data

With both general privacy consent and product improvement enabled, iOS sends controlled sessions, pages, duration buckets, exit reasons and allowlisted login, save, import, prompting, tool, purchase and referral events to self-hosted Countly. Only fixed results, stages and reason codes are used. Events exclude script IDs, text, titles, hotwords, paths, account IDs, authorization material and raw errors. Client purchase events are not server payment confirmation. Local diagnostics are shared only in feedback or diagnostic sharing you initiate. Umeng SDK (U-App analytics and basic U-APM performance monitoring) starts only after consent to the current privacy policy and does not additionally depend on the product-improvement setting. Umeng Tongxin (Beijing) Technology Co., Ltd. processes device/installation identifiers available from the system (such as IDFV, OpenUDID/GUID and SDK-generated identifiers), device models, system and app versions, network type and IP, launches, pages, approved business events, crash/stall stacks, thread and failure states, and launch timing for usage analysis, conversion analysis and stability diagnosis. Our business events do not submit script content, titles, file paths, audio/video, phone numbers, account IDs or order IDs. This version does not integrate advertising delivery or advertising attribution and adds no ATT or location permission. Umeng privacy policy: https://www.umeng.com/page/policy

Turning off product improvement stops further Countly and Clarity analysis and clears local identities and pending data according to their respective rules. Umeng depends on overall privacy consent only. Withdrawing that consent stops new business events submitted by this app and disables Umeng analytics. The app does not force an exit: already initialized performance components may continue during the current process. A new cold launch does not initialize Umeng without renewed consent. Local cleanup does not automatically delete server history; retention and rights requests follow this policy and the provider rules.

1.4 Product-feedback reward task

When you actively submit the product-feedback reward task, we process internal Tdx account and device identifiers, feedback type, description, images re-encoded without original EXIF, material size and SHA-256, submission and review state, reason codes, reward records, and a device anti-abuse HMAC digest used to prevent duplicate claims.

A diagnostic ZIP is processed only after you actively select sessions and confirm again. It may contain full scripts, hotwords, recognized text, algorithm events, device and app information, logs, and microphone audio. Materials support staff review, troubleshooting, the three-day membership reward, and disputes; they are not used for advertising, profiling, or model review in the current version.

When you download the punctuation model, we and the file hosts receive your IP address, file requests and necessary connection information to deliver the files.

Appendix 2: Third-Party Sharing

Appendix 3: SDKs and Open-Source Components

3.1 Feature SDKs

3.2 Foundation components

Appendix 4: System Permissions

4.1 Network access (no separate system prompt)

Our network services support accounts, entitlement association, sync, feedback and model downloads after you permit them. Countly and Clarity additionally require product-improvement consent. Local-only mode or withdrawal retains verified Apple Pro features for their term. You may initiate an Apple purchase or restore without enabling our account network services. iOS local-network permission supports pairing, control and microphone audio you explicitly enable on the same Wi-Fi or hotspot.

4.2 Camera

Camera permission is requested only for recording or scanning login/pairing codes you choose. Scan frames are recognized locally and are not saved or uploaded. Recordings are saved locally according to your actions; sharing and export require your choice.

4.3 Microphone

Microphone access is requested only when you start AI Follow, speech-to-script, a remote microphone, or video recording with sound, for on-device recognition, sending audio to a paired device, or recording video sound. Normal AI Follow does not automatically upload audio or use it for analytics. For troubleshooting, evidence from up to the three most recent sessions may store audio in the app's private directory; related diagnostic materials are shared or uploaded only if you later select sessions, read the notice, and confirm. If you decline, Auto Scroll remains available.

4.6 System photo and file pickers

System photo and file pickers grant access only to items you select. Image OCR uses iOS Vision locally; source images are not automatically uploaded. Saving recordings, processed media or referral posters requests add-only photo permission, not permission to read the whole library.