HiPupu Privacy Policy

Updated: 2026-09-15. Effective date: 2026-09-15.

1. This policy and the operator

HiPupu is a private journal for guardians to record a child’s growth and family memories. This policy explains data handling when you use the iPhone App, cloud synchronization, the legal and support website, and email support.

Operator and personal information controller: 沈张正义. Privacy and support email: 97053331@qq.com. Legal policies are available in Simplified Chinese and English; human support is available in Chinese only.

2. Information we process and why

• Child and family details: names, nicknames, birth dates and optional birth time, time zone and birthplace, to organize family memories and display age.
• Moments: titles, text, dates, types, tags and associated place names, regions and coordinates, for timelines, maps and memory browsing.
• Photos and videos: media you select or capture, including video sound, for displaying memories and private cloud synchronization. Original files may contain capture time, device or location metadata; this version does not promise to remove all EXIF information.
• Account details: email address, account and family identifiers, and sign-in sessions, for verification codes, identity checks, access control and synchronization.
• Support information: your email address, messages, attachments and problem descriptions, to answer questions, investigate issues and handle privacy requests.

These features support family memories, not medical decisions. Add only information you are entitled to store. Do not send verification codes, passwords, sign-in credentials or unnecessary child or family information in support messages.

3. Local use and cloud synchronization

You can create and view records locally without signing in. Successful sign-in automatically enables private cloud synchronization, including existing local records. Family and child details, moments, locations, tags and media descriptions synchronize to the Supabase database; copies of photos and videos upload to private file storage.

Records and downloaded media remain on the device for offline use. Content that has not uploaded cannot be restored from the cloud, and media that has not downloaded requires a connection. Signing out does not clear local information or delete the cloud account.

4. Device permissions

• Camera: used when you choose to take a photo or record a video.
• Microphone: records sound within videos; it does not record continuously.
• Photos: imports photos and videos you select; it does not automatically upload your entire system photo library.
• Location while using the App: helps select places for moments. You can choose a place manually if location access is denied. There is no continuous background location tracking.

You can manage permissions in iPhone system settings. Disabling a permission affects the related feature but does not automatically delete information already saved.

5. Service providers and processing across regions

Supabase provides sign-in authentication, the database and private media storage. The production cloud project’s primary region is Tokyo, Japan (ap-northeast-1). Verification emails are delivered through Brevo (sign-in and identity-verification emails); your receiving mailbox provider also processes these emails.

Maps and geocoding on iPhone use Apple system services. Apple and its applicable service providers handle related map, location or search requests under their corresponding privacy rules. This App does not independently integrate Google Maps for iOS.

The primary cloud region does not mean all information is processed exclusively there. Email delivery, provider logs, backups, technical support and website content delivery may involve other countries or regions; they are not guaranteed to occur in Tokyo simply because the primary database is there.

Providers process relevant information for their respective service functions. We do not sell your personal information or use advertising SDKs, advertising identifiers, behavioral analytics SDKs or cross-app tracking. We have not integrated a separate crash-reporting SDK.

6. Privacy and security

Information is private by default. Account and family permissions restrict access to cloud data and media. Cloud communications use HTTPS; local information is held in the App’s dedicated storage, and deletion-recovery credentials are held in secure device storage. These safeguards do not amount to end-to-end encryption or guarantee absolute security.

7. Retention

7.1 Active account information

Active account data is retained for the lifetime of the account.

7.2 Business data after permanent deletion

After the user completes account deletion, the business database records within the account scope and the sign-in account are deleted. A failed or interrupted deletion remains incomplete and must be continued; no fixed completion time is promised.

7.3 Private cloud media

After account deletion is completed, the family’s photos and videos managed by HiPupu in Private Storage are deleted. System photo-library originals, exported files and offline copies on other devices are outside this cloud-deletion scope.

7.4 Deletion receipts

Once a deletion task is completed and acknowledged by the current device, the deletion task and receipt are cleared and the device removes its recovery credential. Before acknowledgement, only the job identifier, former user and family identifiers, and stage required for recovery are retained, without journal content or media. Tasks that have not been acknowledged are not represented as cleared; this version has no fixed-day automatic expiry.

7.5 Cloud backups

Rolling cloud-service backups are handled according to the relevant provider’s policies. Deleted accounts will not be restored from backups. Database backups are distinct from Private Storage media objects. We do not promise immediate erasure from every provider backup or a permanent-deletion deadline unsupported by the provider’s official policies.

7.6 Security and operational logs

Cloud-service security logs are handled according to the relevant provider’s policies. Cloud, email and website-hosting services may process technical logs needed for operation, delivery, security and troubleshooting; retention depends on the service, plan and settings used. They are not used by HiPupu for advertising, cross-app tracking or behavioral profiling. Account deletion does not promise immediate erasure of all provider logs.

7.7 Support emails

Support emails are retained for 12 months after the issue is closed and may be deleted as needed thereafter. Mailbox-provider backups are handled according to the provider’s policies.

7.8 Legal exceptions

Data explicitly required by law may be retained as an exception, limited to the necessary scope and purpose, and is deleted when the legal obligation ends.

8. Access, correction and deletion

You can view records and edit supported fields in the App. Ordinary moment deletion retains a marker to synchronize the deleted state; it does not immediately and permanently erase all related content or media.

To permanently delete an account, open Settings → Data & Privacy → Delete account. Review the risks, enter the Chinese confirmation text “删除账号”, verify the code for your current email inside the App, and confirm “永久删除账户” (Permanently delete account). This version supports deletion only by the sole owner of a family with no other members. Requests that do not meet these conditions are refused to protect other members’ data. Family invitations and ownership transfer are not currently available.

After cloud deletion is confirmed successful, the current device clears App records, managed media, caches and sign-in state. System photo originals, exported files and downloaded offline copies on other devices are not remotely erased. If deletion is interrupted, reopen the App to continue. See this website’s Account deletion page for the steps.

When signed out, Clear local data removes information only from the current App; it does not delete a cloud account. You can also contact 97053331@qq.com for access, correction, deletion or other applicable personal information rights. We may request information necessary to verify your identity and prevent impersonation, but we will not ask you to email verification codes or passwords.

9. Information about children and other people

The App is intended for guardians, not for children to independently register or manage accounts. Confirm that you have appropriate guardianship authority before adding a child’s information, and obtain necessary permission before adding information about others. Child information and precise location may require particular care; record only what is relevant to your family memories. Contact support if you believe information was stored without appropriate authorization.

10. The legal and support website

This website displays policies, help and email contact details. It does not require sign-in or accept uploads of family records or media. Its pages do not set behavioral analytics, advertising, tracking cookies or online forms. Hosting and network services may still process IP addresses, request times and error information needed to serve pages and maintain security. Selecting an email link opens your chosen email tool; we receive your message only after you send it.

11. Changes and contact

Policy changes update the version and date on this page. Material changes to data handling will be communicated through suitable means, such as in-app notices, with necessary consent obtained where applicable. The Chinese and English versions describe the same arrangements; contact us if any wording needs clarification.

Operator: 沈张正义. Email: 97053331@qq.com. Human support language: Chinese only.