Echo 用来记下你说出口的瞬间。能留在你这台手机上的，我们就留在这。必须离开设备的，下面写清楚：去哪里、为什么、谁看得到。
Echo is for keeping spoken moments. What can stay on your iPhone, stays. When something has to leave the device, this page says where it goes, why, and who can see it.
录音文件、照片、精确 GPS 坐标都不会发给写信服务。语音转文字在设备上完成（Whisper）。位置只用来生成一句地点名称（比如「乔治市 · 爱内」），坐标随即丢弃。
Audio files, photos, and precise GPS coordinates are not sent to the letter service. Transcription runs on-device (Whisper). Location is only used to make a place-name label (for example “George Town · Armenian Street”); the coordinates are then discarded.
如果你在这台 iPhone 上登录了 iCloud，瞬间、行程、转录文字、信件，以及录音和照片，会同步到你自己的 iCloud 私人数据库。开发者看不到这些内容。你可以在系统设置里退出 iCloud；退出后，新内容只留在本机。
If you’re signed into iCloud on this iPhone, moments, trips, transcripts, letters, audio, and photos sync to your private iCloud database. The developer cannot see that data. Sign out of iCloud in Settings to keep new items on-device only.
点「生成」时，Echo 会把这些片段发给托管服务（Cloudflare Worker，再转到我们选用的语言模型，目前为 OpenRouter 上的 DeepSeek）：
When you tap Generate, Echo sends these fragments to our hosted service (a Cloudflare Worker, then the language model we use — currently DeepSeek via OpenRouter):
这些内容用于生成信件，不用于广告或建档追踪你。模型提供商会按他们自己的政策处理请求；我们不把录音或照片送出去。
This is only to write the letter — not for ads, and not to profile you. The model provider handles the request under their own policy. We do not send audio or photos on this path.
用 Apple 登录时，我们只保存 Apple 返回的用户标识（sub），用来计算每日免费写信次数，并把 Echo Pro 订阅绑到你。没有这个标识，就无法在换设备后认出同一份额度。
With Sign in with Apple we store the Apple user identifier (sub) so we can count the free daily letters and bind an Echo Pro subscription to you. Without it we couldn’t recognize the same allowance on a new device.
如果你在设置里改用自己的 API 密钥，文字片段会直接发往你选择的服务商（OpenAI 或 OpenRouter），不走 Echo 的免费额度。密钥只存在本机 Keychain。
If you paste your own API key in Settings, those fragments go straight to the provider you chose (OpenAI or OpenRouter) and don’t use Echo’s free quota. The key stays in the on-device Keychain.
Echo Pro 通过 Apple 的 App 内购买订阅。付款信息只经过 Apple。我们会把 Apple 签发的交易凭证发到托管服务，用来确认订阅是否有效，从而取消每日封数限制。
Echo Pro is an auto-renewable In-App Purchase through Apple. Payment details stay with Apple. We send Apple’s signed transaction to our hosted service only to confirm the subscription and lift the daily letter cap.
在 App 里删除瞬间或行程，会从这台设备上拿掉对应内容；若开了 iCloud，也会从你的私人数据库里同步删除。卸载 App 不会自动删除 iCloud 里已同步的数据。退出 Apple 登录会清掉本机的登录会话，不会删除已经生成的信件。
Deleting a moment or trip in the app removes it on this device, and from your private iCloud database if sync is on. Uninstalling the app does not by itself erase already-synced iCloud data. Signing out of Apple clears the on-device session; it does not delete letters you already generated.
Echo 不是面向儿童的产品。我们不会故意收集 13 岁以下儿童的个人数据。
Echo is not directed at children. We don’t knowingly collect personal data from children under 13.
政策若有实质改动，我们会更新本页日期。继续使用 Echo 即表示你了解当前这一版。
If this policy changes in a material way, we’ll update the date on this page. Keeping using Echo means you’ve seen the current version.
隐私相关：zjyjune@gmail.com
Privacy questions: zjyjune@gmail.com