Liuying Privacy Policy

1. Who this policy covers and who is responsible

The Liuying mobile app ("Liuying") and this website, liuying.lenscript.cn, are built and operated by Lenscript (光子方程), an independent developer team ("we", "us") — the same operator named in the terms and privacy policies of the other Lenscript products (lenscript.cn, Zlens, paida). We are the controller of the personal information described here.

Contact: donaldkuke@gmail.com for privacy questions and rights requests (the mailbox is monitored); Chinese-speaking users can also reach us in QQ group 824558022; other channels and FAQs are on the support page.

The written contact used for app-store listings: donaldkuke@gmail.com (Lenscript (光子方程), an independent developer team).

This policy covers the Liuying app and this website. Liuying has no account system and no server-side user record: the app sends no data to our servers at all, so the only information we actually hold under this policy is this website’s access logs, the emails you choose to send us, and anything you choose to submit through the main-site support form.

2. What Liuying processes on your phone

To find duplicates, burst groups, sharpness candidates, screenshots and chat-app images and large videos on your device, and to let you decide what to keep, Liuying processes, after you grant access:

• Thumbnails (max 512 px on the long edge) of the photos and videos you granted access to, plus the metadata it needs: local asset identifier, type, capture time, dimensions, file size, duration, screenshot and live-photo markers, and source hints;
• Hashes, visual descriptors, sharpness and blur, exposure, eye state, classification, grouping results and the reason for a recommendation, all computed on the device;
• The keep / to-delete decisions you make, indexing progress, and safe failure and retry records;
• Your most recently granted photo-permission state;
• In the purchase flow, the on-device entitlement (whether the full version is unlocked) and the identifiers used to confirm and restore the purchase: on iOS, the identifiers of StoreKit transactions already processed; on Android, an identifier derived one-way from the Google Play purchase token (the token itself is not stored).

This information is used only for on-device indexing, grouping, display, undo, system deletion confirmation, failure recovery and the confirmation or restoration of the purchase. It is never used for advertising, profiling, cloud backup, social features, analytics or crash reporting.

Anything face-related happens on the device. On iOS, eye-state signals assist selection only where the system capability supports them and the behavior has been verified; Android currently makes no eye-open decision. These signals are used only to assist with sharpness or eye state: no identity recognition, no face database, no stored face features.

3. On-device storage, retention and deletion

The index, groups, decisions, failure records, permission state and the on-device purchase state live in Liuying’s app-sandbox database on your device. Thumbnails are not stored as database content, and the bytes of your original photos and videos never travel through the app’s cross-language channel.

When the system reports that a media item has been removed, Liuying clears the local index entry, pending decision and failure records tied to it. When you undo a pending deletion, that local decision is deleted.

The local index only ever exists on this device, and you can clear it whenever you like:

• Tap “Re-index” in settings: the existing media index, groups and failure records are cleared and the library is scanned again (the keep / to-delete decisions you have already made are kept);
• Clear Liuying’s app data in system settings, or uninstall the app: the index database and decisions go with the app sandbox.

You can change or revoke photo access in system settings at any time. Once access is denied or withdrawn, Liuying stops reading media it is not authorised for; index entries already written stay in the app sandbox on your device until you clear them in one of the ways above — and they never leave your device either way.

Liuying keeps no copy in the cloud. The Android app is configured to opt out of system backup and device-to-device transfer; that configuration still needs verification on the final release candidate. On iOS, if iCloud backup is on, whether app-sandbox data is included in that backup and restored after a reinstall is decided by the operating system and your backup settings, not by Liuying. Liuying itself neither uploads nor reads any cloud copy.

Liuying has no account and no server-side user record, so there is no sign-up, sign-in or account-deletion flow; account deletion does not apply to this version.

4. What "no upload" means, and where the system and third parties begin

Photo analysis, thumbnails, the index and pending deletions are processed locally on the device, and Liuying does not upload any of it to servers we control. You can verify this yourself:

• The Android release manifest does not declare the INTERNET permission (check the permission list of the installed package in system settings or with adb shell dumpsys package);
• The iOS build contains no network calls of our own and no App Transport Security exception;
• You can also set an HTTPS proxy on the phone and watch whether Liuying makes any request of its own while it runs.

This promise is about Liuying itself not going online. It does not mean that every system or third-party process on your device is offline:

• The iOS in-app purchase is carried out by Apple’s StoreKit system capability; Apple’s handling of transaction data is governed by its own terms and privacy policy. We run no receipt server of our own.
• The Android in-app purchase is carried out by Google Play’s billing system: the purchase happens in the Google Play Store app on your device, and Google’s handling of transaction data is governed by its own terms and privacy policy. We run no receipt server of our own and never see your payment method.
• When you choose to preview a video on Android, Liuying hands the local content:// URI and a temporary read-only grant to the system or to a player you have installed. That player is independent of Liuying and its network and privacy behaviour is its provider’s responsibility; Liuying neither uploads the video nor downloads a player for this.
• When you tap a privacy or support link, your system browser opens that page; the browser vendor’s and the site operator’s own policies apply.

The only third-party components Liuying currently uses are Flutter, sqflite and path_provider, plus two Google libraries on Android: AndroidX WorkManager (a Jetpack library) for background indexing — Liuying uses none of its network constraints, and the network-state permission is removed from the manifest — and the Google Play Billing Library for the in-app purchase. The Billing Library brings a Google logging component that needs the internet permission to send anything; the Android release build does not declare INTERNET, so that component cannot send any data from Liuying. Related face signals use system capabilities: Android’s android.media.FaceDetector currently supplies face-location signals and makes no eye-open decision; Apple’s Vision framework on iOS assists eye-state decisions where supported and verified (platform features, not third-party SDKs, and offline). There is no advertising, analytics, crash-reporting or cloud-storage SDK in the app.

5. Permissions and deletion

We request photo-library access only where the cleanup features need it. You may grant full access, limited or partial access, or deny it; with limited access Liuying can only organise the items the system has granted, and says so in the interface.

So that indexing can continue when you switch away, the Android build also includes the background-task system permissions brought in by the WorkManager library. To buy the full version through Google Play, the Android build also includes the Google Play billing permission (com.android.vending.BILLING), which only lets Liuying talk to the Google Play Store app on your device; it is not an internet permission. The authoritative permission list for a release is the one shown on the store listing and in system settings.

Liuying never deletes a photo or video on its own. You build a to-delete list in the app, then the operating system shows its own confirmation dialog: iOS uses Recently Deleted, Android uses the system trash. How long items stay recoverable is decided by the OS and version; we promise no fixed number of days.

6. The one-time purchase and the free allowance (iOS and Android)

Liuying offers the same type of one-time, non-consumable purchase (the full version) separately on iOS and Android; there is no subscription, no auto-renewal and no consumable product. The price is the one shown on the App Store or Google Play purchase screen. To confirm and restore the purchase locally, Liuying stores the on-device entitlement and the identifiers of transactions it has already processed.

Free allowance: when Liuying can access up to 2,000 photos (with limited access, only the photos you allow count; videos don’t count), reviewing and deleting are completely free. With more than 2,000 photos you can still scan and see every result, and, if the one-time trial is eligible and unused, try one cleanup task of up to 100 items; reviewing and deleting beyond that need the full version. The allowance depends on library size, so it is never used up and never withdrawn.

An on-device purchase that has been saved successfully is not revoked by Liuying because of a later refund or revocation on StoreKit or Google Play. On a new device or after a reinstall, it can be restored only on the original platform with the corresponding Apple Account or Google Account; purchases are neither synchronized nor transferable across platforms. Restore relies on the purchase currently active for that store account. Payment is handled entirely by Apple or Google Play: we never see or store your payment method, card number or billing address.

Android is in internal testing and iOS is not yet publicly available. These are the rules for the planned release; actual purchase availability is shown by the corresponding store.

The iOS app is licensed under Apple’s standard Licensed Application End User License Agreement; purchases on Android are governed by the Google Play Terms of Service. Liuying has no separate terms of service.

7. What the website (liuying.lenscript.cn) collects

No account is needed to browse this site. It is a static website and collects only:

• Server access logs: IP address, time, request path, browser User-Agent and referrer, used to troubleshoot and to defend against attacks. Logs rotate by size and are kept for at most 30 days before being overwritten.
• Content delivery: the site is served through Cloudflare for CDN and security. Cloudflare processes your IP address and request headers in transit; see its privacy policy.
• Scripts Cloudflare may inject: we place no third-party analytics, advertising or social plugins on these pages and set no tracking cookies. The site is, however, delivered through the Cloudflare CDN, and Cloudflare may inject scripts of its own at the edge — its email-address obfuscation script (/cdn-cgi/scripts/…/email-decode.min.js) is one you can see today, and when automatic injection is switched on for its Web Analytics it also adds a performance-measurement script (static.cloudflareinsights.com/beacon.min.js). That script is not configured by us, sets no cookie and is not used for advertising or cross-site tracking; it reports page performance and page views to Cloudflare, and Cloudflare’s own privacy policy governs it. A content-blocking browser extension will stop it.
• Emails you send us: the contact links simply open your own mail app; what we receive is the message you send, used only to reply and for the purpose you asked for.
• Main-site support form: if you use the support request form on the Lenscript main site instead, what you submit is received and handled by the main site under the support-request section of the lenscript.cn privacy policy.

8. Sharing, processors, transfers and where data lives

Other than the processing described above by a system or platform capability (StoreKit on iOS, Google Play billing on Android), your system browser, or an external video player you choose yourself, Liuying does not upload or disclose your photos, videos, thumbnails, index, decisions, failure records or on-device entitlement to servers we control. This version uses no advertising, analytics, crash-reporting or cloud-storage SDK.

This website’s servers are located in mainland China and the site is served through Cloudflare for CDN and security, so your IP address and request headers are handled by Cloudflare’s global network in transit; the scripts Cloudflare injects at the edge (see the previous section) are likewise processed by Cloudflare outside China. Emails you send us are stored with our mail provider. There is no other cross-border processing.

If we ever add a feature that changes data processing, third-party SDKs, network transmission, accounts or cross-border processing, we will update this policy, the in-app explanations and the corresponding store disclosures first, and obtain consent where required. Until then, such a feature is not part of this version.

9. Children

Liuying is intended for users aged 14 and over (or the minimum age required where you live) and is not designed for children. Other Lenscript products state their own age limits in their own privacy policies — the LCT app, for example, is 18 and over. We do not knowingly collect personal information from children under 14 — Liuying has no account, collects no contact details, and the app sends us no data at all. The age rating shown on each app store is the one stated on that store listing.

Whatever the age tier, what Liuying does on the device is unchanged: no account, no contact details collected, no profiling and no targeted messaging. If you are a parent or guardian with questions about a child using Liuying, contact us via the support page or write to donaldkuke@gmail.com.

10. Your rights

Under China’s Personal Information Protection Law and any law that applies where you live (such as the GDPR or CCPA) you may access, copy, correct and delete the personal information we hold about you, withdraw consent, obtain a copy, and complain to your local supervisory authority.

For Liuying specifically, those rights land as follows:

• Data the app creates on your device: entirely under your control. You can change or revoke photo access, clear the index with “Re-index” in settings, clear Liuying’s app data, or uninstall the app. We cannot view, export or delete any of it, because it never leaves your device.
• This website’s access logs: rotated by size and overwritten after at most 30 days; we do not use them to identify individuals.
• Emails you send us: used only to reply to you and for the purpose you asked for; you can ask us to delete them at any time.

To exercise a right, email donaldkuke@gmail.com. We reply within 15 business days. Requests are free unless clearly repetitive or unfounded.

11. Changes to this policy

We update this policy on this page and revise the date at the top. For material changes to what we collect, why, or with whom we share it, we give at least 15 days' notice on this page, in the app or by email. Previous versions are available on request. The current version lives at https://liuying.lenscript.cn/en/privacy/.

12. Contact

Privacy questions, rights requests, data export or deletion: donaldkuke@gmail.com (this mailbox is monitored). Chinese-speaking users can also reach us in QQ group 824558022. We reply within 15 business days.