Privacy Policy

1. Scope and operator

Operator

Shenyang Tdx Network Technology Co., Ltd.

Unified Social Credit Code

91210124088957535L

Contact email

tdxkefu@foxmail.com

This policy applies to the Tdx Teleprompter Android app, the official website at https://teleprompter.yiroot.com/, and account services expressly connected through them. A third party independently processing information under its own service applies its own privacy rules.

Personal information excludes anonymized information.

The app does not request all permissions at first launch. It requests access only when you start the related feature. Permissions and access are explained below:

• Microphone: used for AI Follow, speech-to-script, remote microphone use, and video sound recording. Permission is requested only when you start a related feature. Speech recognition runs on-device; enabling a remote microphone sends audio to your connected paired device.
• Camera: used for video recording and scanning Windows sign-in or remote-control pairing codes. Permission is requested only when you start a related feature. Scanning frames are processed on-device without being saved or uploaded; recorded videos are saved locally according to your actions.
• Display over other apps: shows your script and controls above camera, streaming, or other apps. Access is requested only when you choose Floating Prompt and does not read the underlying app’s pages or inputs. Full-screen prompting remains available if you disable it.
• Accessibility: hosts Floating AI Follow and supports continued on-device speech following while another app records. A separate explanation and your consent are required before enabling it. It does not read other apps’ text, passwords, or screenshots, or simulate taps.
• Clipboard: lets you paste text or links into script editing, script organization, content risk checks, or media-link inputs. Text menus may first check content types; content is read only when you choose Paste, without reading history or polling in the background. Subsequent submissions and interface analytics follow the relevant disclosures in this policy.

Granting access does not itself cause audio, images, or scripts to be uploaded. Refusing or disabling a permission affects only its related feature; other features remain available.

2. How we process information

We follow legality, fairness, necessity, good faith, specific purposes, transparency, and security. Basic prompting does not require registration or unnecessary information. Account, membership, update checks, and the Countly or Microsoft Clarity SDK and analytics requests start only after you tap Agree and Continue. If you decline, local scripts, editing, and basic Auto Scroll remain available; the privacy-consent screen is not captured by Clarity.

Scripts and settings stay in app-private storage. Images, videos, and documents are read only after you choose them through Android system pickers for import, preview, on-device recognition, or local video processing. Video Mirror saves a new result to the system gallery. Source files and processed results are not automatically uploaded as files, but after consent, visible text or images not covered by Clarity's Balanced masking may be included in interface-reconstruction data. Content saved as a script may subsequently upload under the script-sync rules.

Sign-in, the AI Follow trial, membership, purchase, invitations, feedback, and updates process only what is needed when you actively use them after consent, based on the service agreement, consent, or legal duties.

3. Local content and AI Follow

Scripts, groups, hotwords, markers, prompting settings, and reading position remain in private storage. Android cloud and transfer backup are disabled. Deleting content, clearing app data, or uninstalling may be irreversible. Script cloud sync operates separately from Android system backup under the script-sync disclosure in this section.

The app does not request access to the whole photo library. It receives limited access to up to 10 images you select for checks, ordering, thumbnails, and OCR supplied with the APK. Original images are not uploaded or retained as attachments; only recognized text you confirm is saved.

AI Follow requires an account and a connection for sign-in and starting a free trial. The built-in Sherpa-ONNX model processes microphone audio, recognition, text matching, and scrolling on-device. The current session needs no continuous connection and does not upload scripts or audio.

Up to three recent AI session evidence sets may be retained locally, up to 300 MB, and general logs for up to 14 days and 30 MB. They are automatically cleared at their limit and do not leave the device by default.

When script sync is available and your Professional membership is valid, scripts owned by your account sync automatically while Home is in the foreground, and active scripts without an account owner are enrolled. Sync includes text, titles, formatting, annotations, hotwords, and groups. Scripts and related text are uploaded to the account service and sent to Alibaba Cloud content moderation for risk checks. Approved documents are stored privately in mainland China for syncing between devices signed in to the same account; they are not published as public content. You can pause sync on this device without affecting local editing. Audio, video, reading progress, and display settings are excluded.

Optional enhanced punctuation downloads an approximately 163 MB model and processes text on your device without uploading transcripts, audio or video. Regular transcription works without it.

4. Feedback and diagnostic sharing

The app has two separate feedback routes. Ordinary Feedback creates a local diagnostic package. It leaves the device only after you choose a recipient in the Android share sheet and confirm sending; we do not upload it in the background.

“Earn membership by completing tasks - Submit product experience feedback” is an optional online reward task. When you enter the task, describe a genuine experience, and submit, the description and up to three selected images re-encoded without original EXIF are uploaded. A diagnostic ZIP is created and uploaded only if you separately select diagnostic sessions, read the sensitive-content notice, and confirm. It may contain full scripts, hotwords, recognized text, algorithm events, device and app information, logs, and microphone audio. Routine AI Follow remains on-device and never uploads scripts or audio automatically.

Task materials use short-lived URLs fixed to specific objects and are stored in a private Alibaba Cloud OSS bucket in China with public access disabled. Authorized support and administrators may review descriptions and images. A short-lived read-only link to a diagnostic ZIP is created only when authorized developers need it for troubleshooting. The current reward decision is made by authorized staff, not by a model, and materials are not used for advertising, profiling, or unrelated distribution.

Incomplete server drafts close and are cleaned after 24 hours. If more information is requested, the supplement window is seven days. Thirty days after a final outcome, the server deletes descriptions, appeal text, images, thumbnails, and diagnostic ZIPs; failures enter retry and backlog monitoring. Irreversible digests, material type and size, reason codes, review records, reward ledger entries, and entitlement events remain as needed to prevent duplicate rewards and preserve required audit.

5. System permissions

Camera access is used only when you start video recording or scan a Windows sign-in or remote-control pairing code, after camera permission is granted. Scanning frames are recognized on-device and are not saved or uploaded. Recording saves video locally according to your actions; sharing or export sends it only to the destination you choose. Declining affects only these camera features. Video recording uses camera and microphone foreground services. Audio extraction and video mirror export use media-processing foreground services to maintain recording or processing tasks you start. These foreground-service permissions do not show separate runtime prompts and do not replace camera or microphone permission. The app does not request notification permission and still provides foreground-service notifications as required by Android.

Accessibility is used only for Floating AI Follow over the system camera or a compatible app. It hosts the prompt and lets on-device recognition continue receiving microphone audio while another app records. It does not read or control another app's text, keystrokes, typed content, passwords, or screenshots. A separate prominent disclosure and express consent are shown before system settings.

Photo and file pickers grant limited access only to selected items. Network supports sign-in, the AI Follow trial, membership, updates, feedback, payment, and Countly after consent; local scripts, editing, and basic Auto Scroll remain available without it. Script sync also requires a network connection.

6. Optional account and transaction services

Phone-number, WeChat, and QQ sign-in or binding start only when you choose. The account service processes provider-verified identity and profile data or phone and SMS verification records for authentication, recovery, security, and binding. We do not receive third-party passwords, and SMS codes are not long-term credentials.

The service processes public Tdx account ID, sign-in result, session, membership, installation identifier, device brand and model, system version, and activity times for authentication, device limits, entitlement, security, disputes, and legally required audit. Logs exclude passwords, SMS codes, OAuth codes, and access tokens.

Membership, redemption, and orders process product, order number, amount, currency, state, payment-channel identifier, time, entitlement, and redemption. Alipay starts only after you select it and confirm; the server verifies the final result, and we do not receive card or payment passwords.

Invitation services process codes, internal account identifiers, binding time, rule version, reward records, and anti-abuse digests.

Account deletion has a seven-day cooling-off period. Once effective, the account is deleted or irreversibly anonymized and remaining membership expires; local scripts remain. Legally required transaction, security, and dispute records are isolated for limited purposes and periods.

7. Sharing and third parties

We do not sell personal information. Minimum information is sent only for sign-in, SMS, payment, update, or sharing that you choose. Independent providers apply their own rules; processors acting for us are limited by purpose, confidentiality, and security duties.

WeChat OpenSDK, QQ Connect SDK, Alibaba Cloud SMS, Alipay App SDK, Microsoft Clarity Compose SDK, Google ML Kit, Sherpa-ONNX, ZXing, OkHttp, AndroidX, WorkManager, and system pickers are used for their related functions. The bundled ML Kit OCR model processes selected images on-device and sends nothing to Google or our servers.

Our self-hosted Countly Community Edition is not used for advertising or cross-app profiling. It uses an independent random UUIDv4 installation ID for sessions, manual page views, fixed allowlisted events, and sanitized unhandled fatal Release Java/Kotlin exceptions, never merged with an account, phone, order, payment identifier, or hardware identifier.

For the product-feedback reward task, Alibaba Cloud Object Storage Service (OSS) acts as our processor and privately stores in China only the descriptions, images, and optional diagnostic ZIPs you actively submit. Processing is limited to intake, staff review, troubleshooting, and reward disputes. Alibaba Cloud may not use these materials for advertising or independent profiling; private ACLs, server-side encryption, short-lived signed URLs, least privilege, and access audit restrict access.

After consent, Microsoft Clarity acts as an independent third-party analytics service and processes app layouts, visible content after Balanced masking, taps and gestures, app errors, and limited device information to reconstruct sessions and create heatmaps. Clarity is not used for ad targeting, and we do not set a Tdx account, phone number, order ID, or custom user ID in Clarity. Its processing is governed by the Microsoft Privacy Statement and Clarity terms.

8. Third-party SDK disclosures

Sign-in and payment SDKs activate only when you use the related feature; Countly and Microsoft Clarity activate only after consent. Their collection is governed by this list and each SDK's official privacy rules.

9. Invitation rewards

When you use invitations, we process the code, internal account identifiers, binding time, rule version, and reward records. Scanning a poster only opens the official download page; a relationship starts only after sign-in, code entry, and server validation.

Eligible distributions may grant membership time.

Installation identifiers and irreversible HMAC digests support consistency checks against duplicate rewards, self-invitation, and bulk registration. Original provider identifiers and risk rules are not shown; abnormal relationships may be restricted and reviewed.

10. Retention, security, and location

Local scripts and settings remain until you delete them, clear app data, or uninstall. AI evidence, logs, ordinary-feedback image drafts, and share caches follow the limits in Sections 3 and 4. Online materials for the product-feedback reward task follow the separate periods below.

Countly may process app/build, channel, Android major version, normalized brand, specific model, phone/tablet type, screen pixel resolution, language, sign-in and membership state, and controlled enums for device-distribution analysis, compatibility diagnosis, and product-quality improvement. An unhandled fatal Release Java/Kotlin exception records its type, class, method, source file and line locations, plus limited device dimensions; raw exception messages, breadcrumbs, other thread stacks, arbitrary custom fields, handled exceptions, and native dumps are excluded. Countly also excludes IMEI, Android ID, MAC, advertising ID, screen density, carrier, location, scripts, and AI/voice content. IP is not a Countly field and ingress forwarding and access logs are removed. Administrators may inspect controlled behavior trails by random installation ID; the crash dashboard shows only groups, counts, affected-install counts, versions, time, sanitized stacks, and the latest controlled context, never an installation ID or personal trajectory. To diagnose faults including new exception types, reports also contain build number, channel, a fixed last-page code, whether an activity is resumed, bucketed process age, main/worker thread category, and the last controlled technical stage with its bucketed age. Recognized platform errors yield only fixed reason and component codes. This is a latest snapshot, without an operation history, thread names, or arbitrary business parameters; the dashboard shows the latest report context for each group. Script editing diagnostics also record the save type (new script, update or copy), trigger (automatic, manual, leaving the page or an action after saving), result, precheck/recovery-read/local-transaction stage, and fixed reason codes for limits, validation, conflicts, account state, storage or internal errors. File parsing and image text recognition failures use separate fixed reason codes. These Countly events contain no script ID, text, title, follow-term content, file path, account ID, exception message or random operation correlation ID. Safe save failure logs remain in local general diagnostic logs and a bounded memory summary, and leave the device only when you actively submit feedback or share a diagnostic package.

Linkable installation records, unique-count markers, individual crash reports, and crash groups containing sanitized stacks last up to 180 days. Page, event, and crash count-only aggregates without installation IDs or stacks last up to 24 months. Withdrawal stops Countly, clears local identity and queue, and requests anonymous deletion retried for up to 30 days. Unlinkable anonymous aggregates are not retroactively deducted. Account, audit, invitation, order, and refund records remain only as needed for service, disputes, anti-duplication, and legal duties.

We use private storage, disabled backup, HTTPS, Android Keystore, encrypted phone fields, access controls, redacted logs, permission minimization, and audit. Account, order, and membership records are stored in China; independently processed third-party data follows that provider's rules.

Incomplete task drafts on the server close and are cleaned after 24 hours. Thirty days after a final outcome, descriptions, appeal text, images, thumbnails, and diagnostic ZIPs are deleted. Task materials in Alibaba Cloud OSS are stored in China; deletion failures are retried and monitored. Irreversible anti-duplication digests, review decisions, reward ledger entries, entitlement events, and necessary security audit may remain only as long as needed to deliver the reward, prevent duplicate claims, resolve disputes, or meet legal duties.

Microsoft Clarity ordinarily retains session-playback data for 30 days; favorite or sampled sessions and click or heatmap data may be retained for up to nine months. Withdrawal immediately tells Clarity to deny analytics storage and pauses future collection on this device, but Microsoft currently provides no self-service API to delete existing Clarity data for an individual app user. Contact us through this policy to make a deletion or other rights request.

Cloud scripts remain in the recycle bin for 30 days. After membership expires, cloud scripts are retained for 90 days and then become eligible for cleanup. Sync stops and cloud scripts are retained during the account-deletion cooling-off period; once deletion takes effect, cloud scripts are deleted asynchronously. Cloud cleanup does not remotely erase local scripts that must be retained.

Ordinary analytics use a local pending queue with count and size limits. The server accepts offline records from the preceding 7 days; crash reports remain limited to the preceding 72 hours. Records beyond the time or capacity limits may be discarded, and delivery of every record is not guaranteed. After an Android anonymous-deletion request, an irreversible installation-identifier digest is retained for 14 days solely to prevent late requests from recreating deleted analytics records. These delivery rules do not add collected fields or identity links, or extend the maximum server retention period for linkable data.

11. Your rights

Under applicable law, you may know, decide, restrict, or refuse processing and request access, copy, correction, supplementation, deletion, withdrawal, explanation, or account deletion. We generally respond within 15 working days after verification.

You can manage local content, system permissions, privacy consent, account bindings, devices, sign-out, and deletion in the app. Withdrawal does not delete local scripts and is not account deletion.

You can cancel diagnostic sharing or clear caches. If you cannot use the app, use the public deletion page or email tdxkefu@foxmail.com; identity verification may be required for protection.

Before task submission completes, you can cancel the upload or remove the optional diagnostic ZIP. The result page provides supplement or appeal actions when applicable. You may request access, correction, deletion, or an explanation of processing through the contact route in this policy; after identity verification we respond under applicable law. An active reward dispute or legal duty may limit the deletion timing.

You can pause or resume sync for this device from Home and restore or permanently delete scripts through the recycle bin under the applicable rules. Signing out or changing accounts does not force unsynced changes to upload.

12. Minors

The service is not specifically directed to children under 14. A minor should use it under parent or guardian guidance and avoid unnecessary personal information in scripts, images, or diagnostic packages.

Basic offline features do not require registration. An account or transaction feature that uploads personal information requires guardian guidance and any consent required by law; otherwise the online feature should not be used.

13. Policy updates

We may update this policy for changes in features, purposes, information types, third parties, or law and will show a new publication date. The updated policy takes effect on that date.

A material effect on personal-information rights is announced prominently, and renewed consent is obtained where required. An update cannot reduce statutory rights without express consent.

14. Contact us

Operator

Shenyang Tdx Network Technology Co., Ltd.

Unified Social Credit Code

91210124088957535L

Contact email

tdxkefu@foxmail.com

Website

https://teleprompter.yiroot.com/

Contact us with policy, processing, complaint, or rights questions.

Appendix 1: Personal Information Collected

1.1 Device and app information

Online features such as account and updates may process app version, distribution channel, network status, and diagnostics as needed. The app does not read IMEI, IMSI, MAC address, advertising ID, or contacts. Android ID is read only on-device to derive a salted, irreversible hash as the installation identifier; the raw value is neither stored nor transmitted. After privacy consent, local diagnostics initialization reads Android ID and derives this identifier. The identity object reuses its cached value; a process restart may read it again. The derived identifier supports diagnostic correlation, account authentication, device management, and duplicate-reward prevention. The raw Android ID is not transmitted.

Countly uses an independent random UUIDv4 installation analytics ID. It is not an account ID, phone number, order number, or hardware device ID. IP is not an analytics field, and forwarding and access logs are removed at ingress. App version/build, channel, Android major version, normalized phone brand, specific device model, phone or tablet type, screen pixel resolution, app language, sign-in state, and membership state may be transmitted. For unhandled fatal Release Java/Kotlin exceptions, Countly may also receive the exception type, a sanitized stack containing class, method, source-file and line locations, and those limited device dimensions. Raw raw exception messages, breadcrumbs, other thread stacks, arbitrary custom fields, native dumps, screen density, and hardware or advertising identifiers are not transmitted. To diagnose faults including new exception types, reports also contain build number, channel, a fixed last-page code, whether an activity is resumed, bucketed process age, main/worker thread category, and the last controlled technical stage with its bucketed age. Recognized platform errors yield only fixed reason and component codes. This is a latest snapshot, without an operation history, thread names, or arbitrary business parameters; the dashboard shows the latest report context for each group.

1.2 Account, free trial, transactions, and local content

Phone number, third-party sign-in identity, sign-in token, AI Follow trial eligibility, orders, membership, referrals, and feedback are processed only as needed when you use the related feature. Trial rules are shown in the app.

Source script, image, and document files, microphone audio, recognition results, text matching, and scrolling state are processed on-device by default and are not automatically uploaded as source files. After you consent to Clarity analytics, visible text or images on the current screen that are not covered by Balanced masking may be sent to Microsoft as interface-reconstruction data. Microphone audio and local files themselves are not sent to Clarity. The Content Risk Checks tool uses offline rules shipped with the app and does not upload scripts or detection content to Tdx or third-party detection servers. Uploads for script-sync risk checks follow the separate disclosure below. Clipboard: when you use text selection or a paste menu, text components may read clipboard descriptions, such as content types, to determine whether Paste is available. This check does not read the content itself. Only when you choose Paste does the app read the current clipboard text or link into script editing, script organization, content risk checks, or a media-link input. It does not poll the clipboard on startup or in the background for this purpose, or read clipboard history. Pasting itself does not upload content. Subsequent link parsing, sharing, or other online actions you submit follow the disclosures for those features. Content displayed after pasting remains subject to the Clarity interface-reconstruction and masking rules described in this policy.

When script sync is available and your Professional membership is valid, scripts owned by your account sync automatically while Home is in the foreground, and active scripts without an account owner are enrolled. Sync includes text, titles, formatting, annotations, hotwords, and groups. Scripts and related text are uploaded to the account service and sent to Alibaba Cloud content moderation for risk checks. Approved documents are stored privately in mainland China for syncing between devices signed in to the same account; they are not published as public content. You can pause sync on this device without affecting local editing. Audio, video, reading progress, and display settings are excluded.

1.3 Countly analytics data

After consent, the app sends sessions, manual page views, enrollment/active events, fixed duration buckets, exit reasons, six groups of fixed stage events, and sanitized unhandled fatal Release Java/Kotlin exceptions. Sign-in, membership, purchase, and referral events contain only controlled enums. Crash reports retain exception types, code locations, and controlled technical context, never raw exception messages, accounts, orders, payment transactions, or original content. To diagnose faults including new exception types, reports also contain build number, channel, a fixed last-page code, whether an activity is resumed, bucketed process age, main/worker thread category, and the last controlled technical stage with its bucketed age. Recognized platform errors yield only fixed reason and component codes. This is a latest snapshot, without an operation history, thread names, or arbitrary business parameters; the dashboard shows the latest report context for each group. Script editing diagnostics also record the save type (new script, update or copy), trigger (automatic, manual, leaving the page or an action after saving), result, precheck/recovery-read/local-transaction stage, and fixed reason codes for limits, validation, conflicts, account state, storage or internal errors. File parsing and image text recognition failures use separate fixed reason codes. These Countly events contain no script ID, text, title, follow-term content, file path, account ID, exception message or random operation correlation ID. Safe save failure logs remain in local general diagnostic logs and a bounded memory summary, and leave the device only when you actively submit feedback or share a diagnostic package.

Internal administrators may inspect controlled event trails by random installation ID. On withdrawal, the client removes that identity and uses an anonymous deletion endpoint to clear linkable records; the deletion path does not accept an account ID.

1.4 Product-feedback reward task

When you actively submit the product-feedback reward task, we process internal Tdx account and device identifiers, feedback type, description, images re-encoded without original EXIF, material size and SHA-256, submission and review state, reason codes, reward records, and a device anti-abuse HMAC digest used to prevent duplicate claims.

A diagnostic ZIP is processed only after you actively select sessions and confirm again. It may contain full scripts, hotwords, recognized text, algorithm events, device and app information, logs, and microphone audio. Materials support staff review, troubleshooting, the three-day membership reward, and disputes; they are not used for advertising, profiling, or model review in the current version.

When you download the punctuation model, we and the file hosts receive your IP address, file requests and necessary connection information to deliver the files.

Appendix 2: Third-Party Sharing

Appendix 3: SDKs and Open-Source Components

3.1 Feature SDKs

3.2 Foundation components

Appendix 4: System Permissions

4.1 Network access (no separate system prompt)

Network access supports sign-in, AI Follow trials, membership and payment, updates, feedback, Countly analytics, and Microsoft Clarity session reconstruction after consent. Before consent, the app does not initialize the Countly or Clarity SDK or their analytics requests. Turning off network access affects only online features; local scripts, editing, and basic Auto Scroll remain available. Script sync also requires a network connection.Optional model downloads also use network access and a data-sync foreground service with a download notification.

4.2 Camera

Camera access is used only when you start video recording or scan a Windows sign-in or remote-control pairing code, after camera permission is granted. Scanning frames are recognized on-device and are not saved or uploaded. Recording saves video locally according to your actions; sharing or export sends it only to the destination you choose. Declining affects only these camera features. Video recording uses camera and microphone foreground services. Audio extraction and video mirror export use media-processing foreground services to maintain recording or processing tasks you start. These foreground-service permissions do not show separate runtime prompts and do not replace camera or microphone permission. The app does not request notification permission and still provides foreground-service notifications as required by Android.

4.3 Microphone

Microphone access is requested only when you start AI Follow, speech-to-script, a remote microphone, or video recording with sound, for on-device recognition, sending audio to a paired device, or recording video sound. Normal AI Follow does not automatically upload audio or use it for analytics. For troubleshooting, evidence from up to the three most recent sessions may store audio in the app's private directory; related diagnostic materials are shared or uploaded only if you later select sessions, read the notice, and confirm. If you decline, Auto Scroll remains available.

4.4 Display over other apps

The app guides you to enable display-over-other-apps access only when you choose Floating Prompt. It shows your prompt above camera or streaming apps and does not read their content. Declining affects only Floating Prompt; full-screen prompting and other features remain available.

4.5 Accessibility service

Accessibility is used only when you choose Floating AI Follow. Before system settings, the app shows a separate prominent disclosure and obtains express consent. The service hosts the floating prompt and lets on-device recognition continue receiving microphone audio while another app records. It does not read or control another app's text, keystrokes, typed content, passwords, or screenshots, and does not perform taps or gestures. Granting access does not itself upload scripts or audio. You can turn the service off in system Accessibility settings at any time. If you decline, Auto Scroll remains available.

4.6 System photo and file pickers

The app does not request access to your entire photo or media library. System pickers grant limited access only to items you select, and canceling does not affect other features. Image Script accepts up to 10 images at a time for on-device file checks, ordering, thumbnails, and OCR. Video Mirror reads only the single video you select, previews and processes it on-device, and saves a new video to the system gallery. Original images, source videos, and processed results are not uploaded automatically.