Carbon Portrait Privacy Policy
Controller and service operator: the operator identified for Carbon Portrait in the applicable app-store listing (“Carbon Portrait,” “we,” “us,” or “our”).
Application: Carbon Portrait for Android on Google Play, package com.zlym.tjhx.google.
Privacy contact: privacy@zlym.top
Carbon Portrait is intended only for users aged 18 or older. This policy explains what information the Google Play edition collects, why it is used, where it may be processed, and the choices available to you.
1. Information we process
Account and authentication
- Google sign-in: when you choose Google sign-in, we receive a Firebase user identifier, your email address, email-verification status, display name, profile image where available, and authentication-provider information. Google and Firebase may also process IP address, user-agent, device and security information to authenticate you and prevent abuse.
- Email and password: Firebase Authentication processes your email address, password and related security information. We receive your Firebase identifier, verified email address and authentication result. We do not receive or store your readable Firebase password.
- We process account ID, adult confirmation, session identifiers, login time, device/session name and account status to operate and protect your account.
Content you provide and AI-assisted results
We process text, people and relationship details, notes, conversations, prompts, feedback, uploaded images/files, voice recordings or transcripts, and the context you select. We also store results produced at your request, such as replies, summaries, profiles, suggested memories, tags and thinking-card results. This information is used to provide, synchronize, restore and improve the features you request.
Your entries may contain information about other people. Only provide information you have a lawful right to use. Avoid identity numbers, precise location, financial credentials, health data, private communications and information about minors unless strictly necessary and lawfully authorized.
Device permissions and technical data
- Camera and photo/media access are requested only when you take or select an attachment.
- Microphone access is requested only when you start voice input or recording.
- IP address, operating system, app version, device type, request time, API path, response status, crash/error and security logs may be processed for delivery, diagnostics, fraud prevention and security.
The app does not currently request contacts, precise location, SMS, call-log or advertising-ID access, and does not include third-party advertising or behavioral-advertising SDKs.
Google Play purchases
For subscriptions or other digital purchases, we process account ID, product, Google Play purchase token/order reference, currency, entitlement, purchase status, acknowledgement, renewal, cancellation and refund information. Google Play processes your payment method and billing account under its own terms. We do not receive your full card number or Google Account payment credentials.
2. How and why we use information
We use information to create and authenticate accounts; provide content, synchronization, AI and speech features; fulfill and restore purchases; maintain security; respond to support and rights requests; meet legal obligations; and improve reliability. Depending on your location, our basis may be performance of our contract, your consent, compliance with law, or our legitimate interests in security and service improvement. You may withdraw consent for optional processing without affecting earlier lawful processing.
AI-generated content is probabilistic and may be inaccurate. We do not use it as the sole basis for decisions that produce legal or similarly significant effects. We do not sell personal information and do not share it for cross-context behavioral advertising.
3. Service providers and disclosures
- Google Sign-In and Firebase Authentication (Google LLC): authentication, account security and token verification. Firebase Authentication may process email, passwords, phone numbers where applicable, IP addresses and user agents. Firebase privacy and security; Google Privacy Policy.
- Google Play Billing (Google LLC): purchase presentation, payment, subscription management, acknowledgement and restoration. Google Play Terms.
- Hosting, storage, speech and AI providers: our server infrastructure and the AI/model or transcription provider enabled for a requested feature may process the minimum prompt, selected context, audio, output, usage and diagnostic information needed to perform it. Providers may include Alibaba Cloud services, DashScope or DeepSeek where configured. Current provider information is shown in the app’s compliance/about area.
Providers act under their applicable contracts and privacy terms. We may also disclose information when required by law, to protect users and the service, or as part of a corporate transaction subject to appropriate notice and safeguards.
4. International processing
We are based in China and our application servers may process and store service content in China. Firebase Authentication is operated from infrastructure in the United States, and Google or other providers may process information in countries where they maintain facilities. Consequently, your information may be transferred outside your country. Where required, we use contractual or other lawful transfer safeguards and honor applicable local rights.
5. Retention
- Account information and user content are generally retained while your account is active or until you delete them.
- Authentication information held by Firebase is retained under Google’s Firebase retention practices and deletion procedures.
- Security and network logs are normally retained for at least six months where required for network security and may be kept longer for an active investigation.
- Purchase, tax, refund, consent and dispute records may be retained for the legally required period, even after account deletion, with access restricted.
- Local data remains on your device until you clear it or uninstall the app. Server-account deletion does not itself erase local device data.
When retention is no longer necessary, we delete or de-identify the information, subject to backup rotation and legal obligations.
6. Your choices and rights
You may access, correct or delete content in the app; revoke camera, photo or microphone access in Android settings; disconnect Google access through your Google Account; and request access, correction, deletion, restriction, objection, portability or withdrawal of consent where applicable.
Account deletion: use Profile → Account & Security → Delete account, or follow our external account-deletion instructions. Deleting the app is not the same as deleting your account. Cancelling a Google Play subscription is a separate action and can be completed in Google Play.
Send rights requests to privacy@zlym.top. We may verify your identity and normally respond within 15 business days, or within the period required where you live. You may also complain to your local data-protection authority.
7. Security
We use HTTPS in transit, access controls, password and token protections, audit logging, backups and supplier controls appropriate to the risk. No internet service is perfectly secure. Protect your device and credentials, and notify us if you suspect unauthorized access.
8. Adults only
The service is not directed to children and may be used only by people aged 18 or older. We do not knowingly collect children’s personal information. Contact us if you believe a child has provided information so we can investigate and delete it.
9. Changes and contact
We may update this policy for legal, technical or service changes. Material changes will be presented prominently and, where required, we will ask for renewed consent. Earlier versions will be retained where reasonably required.
Carbon Portrait service operator (as identified in the applicable app-store listing)
Privacy and support
privacy@zlym.top