Yun Shang Xiang Ke Privacy Policy

Effective date: November 7, 2026

Subscriptions, voluntary support and shared membership

Apple sign-in users may confirm in a compatible vgogo native client, then return to Yun Shang Xiang Ke to check and confirm both accounts. Login tokens, Apple identity credentials and passwords are not shared between the apps. A short-lived one-time code is delivered over a fixed HTTPS server channel, checked with a server-held verifier, and readable only by the authenticated consumer owner. Delivery alone does not associate accounts or purchase. Expired codes cannot complete linking; maintenance removes expired request data. Minimal accounting retention follows the actual release configuration.

Apple handles payments. Our server associates verified signed transactions, product and original transaction identifiers, renewal or refund status, expiration dates and a pseudonymous app account token with your account to grant and restore access, prevent duplicate claims and process refunds. We do not receive card details. Voluntary one-time support funds the developer and app maintenance; it is not a charity or temple donation and grants no membership, merit points or digital benefits.

Basic membership offers three altar presets. Pro and shared memberships offer up to ten. Custom photos require Pro: Incense Pro and Shared Pro allow three successful generations per Beijing calendar month; Shared Family allows ten. Failed generations do not count as successes. Safety and service spending limits also apply. Expiration stops new cloud access while retaining local records and saved images. Account deletion or unlinking does not cancel an Apple subscription.

Only after you confirm both of your accounts do we exchange the minimum pseudonymous account pairing, membership level, expiration, environment and transaction identifiers with vgogo. Linking capabilities are encrypted at rest. Photos, wishes and journal text are not shared. Existing vgogo Pro/Family grants Incense Pro; Incense shared subscriptions grant the matching vgogo tier, while Incense-only subscriptions do not. Unlinking stops shared access. Manage the subscription in its original Apple purchase account. Minimal accounting, deduplication and refund records may remain as required; deleting an account removes business content and revokes the link.

Summary

Most features work without an account. The app has no advertising or analytics SDKs. An active subscription or verified shared membership is required for cloud features, including practice and wish sync, altar presets and online AI. Apple sign-in alone does not enable cloud access. The merit journal requires sign-in, with separate choices for AI processing and journal backups.

On-device data

The app stores your selected temple, altar candle and offering arrangement, scripture and playback mode, episode playback positions, ritual count, listening duration, woodfish count, usage streak, and audio you choose to download on your device. After signing in with an active membership, merit, practice statistics, listening positions and preferences sync over HTTPS to tianjigame.cn and our Alibaba Cloud RDS database. Downloaded audio is not uploaded.

To remove a downloaded episode, swipe left on it in the episode list and choose Delete Download. Delete Downloaded removes the downloaded audio for the current scripture. The bundled first episode of the Long Agama cannot be removed separately. Removing downloads does not erase playback positions, preferences, or statistics. Deleting the app removes local data and audio. Previously synced account records remain available when you sign in with the same Apple account on another phone.

The app does not access contacts, camera, or location, and does not create advertising identifiers, advertising profiles, or cross-app tracking records. Its optional photo feature uses Apple's system photo picker and receives only images you select, without reading the entire library. It asks for microphone and speech recognition access only when you tap the microphone button in the pre-ritual panel or the merit journal. Other features work without photos or voice input.

Wishes and voice input

Before lighting incense you may type or speak a wish (optional; you can turn the prompt off from Wishes on the home screen). The wish text (up to 200 characters), when it was used, the temple, and whether you chose to put it on the share card are kept with your practice records: on your device when signed out, and synced to our Alibaba Cloud RDS database when signed in so that it can be restored on a new phone. Only your own account can read it; we do not publish it, show it to other users, or use it for advertising or profiling. You can delete wishes at any time in Wishes; deleting your account also removes cloud wishes.

When you use voice input, Apple’s system speech recognition turns your speech into text. Where the device supports it, recognition runs on the device; otherwise the system may send audio to Apple under Apple’s privacy policy. The original recording is kept only inside the app on this phone and is never uploaded to our servers; deleting the wish, deleting your account, or deleting the app removes it.

Optional photos and AI image processing

Selecting a photo and adjusting its crop does not upload it. Only after you enable the separate processing consent and tap Generate does the app send that image, crop, selected scene and arrangement parameters over HTTPS to tianjigame.cn/incense_altar.php. Our server calls JLike's GPT Image 2.6 Sunburst image service to redraw the reference photo into a frame. AI can change appearance or composition; you must confirm the result before applying it, and can keep using arrangements without a photo.

Random installation and job identifiers and network addresses distinguish jobs and enforce usage limits. New photo jobs are bound to the signed-in account to verify Pro access, reserve its monthly allowance and recover the same job without a second generation. Legacy jobs retain their original installation-based access restrictions. They are used only for image processing, result delivery and abuse prevention, not advertising or cross-app tracking. Temporary photo and result files on our server are kept for no longer than 24 hours and removed upon cancellation or expiry. JLike's handling and retention follow its own policies; our 24-hour server limit does not guarantee the provider's retention period. Apple sign-in credentials and cloud wish records are not sent to the image service.

Confirmed photo arrangements are stored locally, separately for the two scene traditions, and do not sync to your account. Delete them in the arrangement panel, replace them by saving another package, or remove the app. A photo can appear in a share card only when you choose to share that card with a recipient or save destination.

Merit journal and AI conversations

The journal requires Apple sign-in. Text, conversations and local notes stay on this device by default, separated by account, protected by system file protection and excluded from system device cloud backups. Signing out hides the previous account's content. Journal text is not automatically synced or added to share cards; unbacked-up text cannot be restored after uninstalling or moving to another phone.

Only when you choose Share this good deed does the app prepare a card on this device. It includes the current confirmed deed summary, encouragement and the score for that deed, excluding account balances, practice activity totals and private conversations. You can edit the public wording in the preview and should check names, contact details and other private information. Editing does not change the journal or score, contact AI services or enable cloud backup. The image retains an AI-content label and is passed to your chosen app or save destination only through your subsequent system share action.

AI processing and journal backups require separate affirmative choices and a declaration that you are at least 14. We do not collect identity documents or an exact birth date. When AI is available and you agree, confirmed text, relevant conversation and supplied date or region are sent over HTTPS to the journal server and forwarded through JLike's text gateway to DeepSeek. Apple sign-in credentials are not sent to the model or gateway. Bing public web searches receive abstract, deidentified legal questions rather than whole journal entries; official sources are then read separately. Separate consent is required at first use and when processing parties change. Each of JLike, DeepSeek and the search provider processes and retains received data under its own policies; our retention limit does not promise zero provider retention. You may stop AI processing in the journal settings. Offline withdrawal immediately stops new local AI requests and is submitted to the server once online.

For interrupted delivery, complete responses are temporarily encrypted outside the public server directory. They are deleted after the app acknowledges saving them; access expires after 23 hours and total retention is capped at 24 hours. Minimal account-linked assessment versions, grades or reference terms, legal source receipts, deduplication fingerprints and confirmed transactions are retained to prevent duplicate posting. Scores are for reflection, not a conviction or a prediction of a court sentence. Posting requires your confirmation and remains separate from practice activity totals.

Journal backup is off by default and cannot upload content while the capability is unavailable. Before enabling it, the app shows the verified historical database backup retention period. Backup includes existing and future undeleted text, conversation and responses, excluding recordings and local notes. Application encryption uses server-managed keys stored separately from the database; it is not end-to-end encryption with user-only keys. Disabling backup stops uploads from every device and removes online text within 24 hours. Historical database copies expire on the disclosed schedule. Local copies and confirmed transactions remain.

Deleting an entry removes its local and online text, conversation and delivery cache while retaining necessary transactions. Account deletion removes business data. To prevent restoration of deleted content, an independent deletion record retains a pseudonymous account HMAC, necessary record identifiers and timestamps, without original text, until 24 hours after the longest recoverable backup expires. Until that retention period is verified, deletion records are retained and original-text backup stays disabled. These records and score metadata remain protected as personal information, rather than being fully anonymous. Deletions are replayed before restored data becomes accessible. Original text, recordings, conversations and sign-in tokens are excluded from ordinary access, error and analytics logs.

Optional assessment feedback sends only the assessment identifier, a selected reason label and a timestamp. It excludes the entry and conversation, is not used to train models, and does not change scores automatically. Feedback is kept for at most 30 days and is removed with your account.

Journal speech uses Apple's system recognition, on-device when supported and otherwise potentially online under Apple's policies. Separate temporary recordings are deleted after recognition or cancellation, never uploaded to the journal server, JLike or DeepSeek, and excluded from backup. Leftovers after an unexpected app exit are cleared at launch or after protected files become available on unlock. Review names, numbers and negations before submitting the transcript.

Apple sign-in and cloud records

We use Apple’s system sign-in and receive a verified Apple user identifier and authorization credentials. We do not request a name, email address or phone number. The shared account is intended for Yun Shang Xiang Ke and Tianji; this version syncs only Yun Shang Xiang Ke records, not Tianji charts, journals or payment records. The overseas forwarding entry is www.tianjiwendao.com. Credentials are stored in Keychain; Apple refresh credentials are encrypted on the server. Account endpoints do not log authorization credentials or practice content.

The app generates a random identifier for its installation and uploads it with signed-in records to distinguish changes from multiple devices. This is neither an advertising identifier nor a hardware serial number. User identifiers, installation identifiers and synchronized practice activity, playback positions and preferences are linked to the signed-in account and used only for app functionality.

Sign out or delete your account in Practice and Account (修行与账号). Signing out retains cloud records and keeps unsynced records assigned to their original account. Deletion requires fresh Apple verification and removes the shared account and its practice records while revoking Apple authorization. Production backups expire according to the configured Alibaba Cloud retention policy and are not used to restore deleted accounts.

Audio downloads

When you choose to download recitation audio that is not bundled with the app your device requests that audio file over HTTPS from xiuxian-mud-assets.oss-cn-hangzhou.aliyuncs.com. The request does not include your name, account, playback position, or advertising identifier, but the requested file path may reveal the audio you chose to download. Alibaba Cloud OSS infrastructure processes standard connection information, including network address, request time, and file path, to deliver files and protect the service. This information may be retained in security and operations access logs according to infrastructure and legal requirements. It is used only to provide files, maintain the service, and protect security—not for advertising, cross-app tracking, or profiling. Because access logs contain a network address, they may be associated with the relevant network connection or device.

Third-party services and sharing

The app uses Apple’s system sign-in and has no advertising, analytics or social SDKs. Network or security services you enable on your device may process connection information under their own policies.

The completion screen offers the system share sheet. A share card includes the current temple scene, altar arrangement, date, session duration and listening time, total completed rituals, total listening time, and total merit. Buddhist cards also include session woodfish strikes; Taoist cards do not. Your own wish appears on the card only if you turned on “write into share card” for that wish (off by default); otherwise a fixed dedication is shown. Figures use currently saved records, including activity awaiting synchronization. The app does not share automatically. A card is passed to the app, recipient, or save location only when you make that choice in the share sheet. Recipients handle shared content under their own privacy policies.

Children's privacy

The app is a culture and digital art experience for a general audience. It does not request personal details or an account and is not designed to collect children's personal information.

Policy updates

If the app's data practices change, we will update this policy and its effective date.

Contact

For privacy questions or requests, email wenrongruan@gmail.com.