Privacy Policy

1. Controller and scope

App: Baiboki (百宝机). Developer and data controller: FANG GUOHAO, an individual developer. This Policy covers the Baiboki mobile app, baiboki.com, and related support. Platform-specific disclosures apply only to the corresponding version.

Privacy: privacy@baiboki.com. Support: support@baiboki.com.

We follow offline-first, purpose-limited and data-minimization principles. We do not sell personal information or build cross-app advertising profiles. Local tools require no account; sign-in is required to buy or restore AI credits and view account records.

2. Data kept on your device

Language, theme, tool and preset order, custom presets, translation history, communication profiles, universal information cards, correction glossary, favorites, travel notes and photos, temporary lists, Today Hide and learning conversations, game progress, reminder settings, and an offline entitlement cache normally remain on your device. Free users may also use the local profile features. You can delete or reset this data in the app, clear app data, or uninstall.

Reminders use local notifications and launcher badges. The current app obtains no remote push token and does not upload reminder text to Baiboki. AI provider names, endpoints, models and keys that you configure are stored only on your device. Android encrypts keys using an Android Keystore-supported mechanism rather than ordinary SharedPreferences. iOS uses device-only Keychain storage without Keychain cloud synchronization.

3. Four processing types

OFFLINE

Tool calculations and translation with downloaded models run on device. Translation text is not sent to Baiboki; downloading a selected model requires a network connection.

BYOK_PRESET

You supply a key and select a built-in provider template. After Provider-specific consent, your device connects directly to that Provider over HTTPS, not through api.baiboki.com.

BYOK_CUSTOM

You supply a name, Base URL, model and key. Data goes directly to the HTTPS Host you configure.

BAIBOKI_HOSTED

AI credits, Pro gift credits and subscription allowances can call Baiboki-provided models through api.baiboki.com. Only inputs needed for a task you initiate are sent; the app identifies the provider, purpose and estimated credits before sending.

4. Bring Your Own Key (BYOK)

A BYOK Provider is actively selected by you and connected directly from your device. Baiboki does not store your third-party API key, but remains responsible for the app-side transmission flow, prominent notice, safeguards, and authorization.

The Provider processes received data under its own terms, privacy policy, region, and retention rules. Do not send data you are not authorized to process.

Google Gemini API requires users to be at least 18 and to use supported regions. Unpaid services may use inputs and outputs for product and model improvement and human review; do not send personal, sensitive or confidential information to unpaid services. Paid services do not use prompts or responses to improve their products, but may retain content for safety and legal purposes. API clients in the EEA, Switzerland and UK must use paid services. See the provider's terms: https://ai.google.dev/gemini-api/terms

• Before the first request to each Provider, Baiboki shows its name, Host, purpose, data categories, privacy policy, and possible overseas processing. Nothing is sent until you agree.
• Depending on the action, you may send text, selected conversation context, an AI image crop or full image, a Today Hide image, travel query or summary instructions, API key, and network metadata required to complete the request. Selecting AI translation for an individual information-card field sends that field's original value, which can include a name, phone number, address, insurance or medical information, or an identity or passport number. Local substitution protection in ordinary translation does not apply to this individual-field action. Review and minimize sensitive inputs first.
• Although the data does not pass through Baiboki servers, it leaves the device. Google Play Data Safety collection, sharing, and purpose must therefore be assessed per data type rather than described as “BYOK means no collection.”
• Consent is separate per Provider. A Base URL change requires consent again. You may withdraw one Provider’s sending consent; sending is then blocked and the notice appears on the next request, while the local key remains unless you delete the Provider.
• Your key is not sent to Baiboki, analytics, crash reports or logs, is excluded from cloud backup, and is masked by default. Deleting a Provider deletes its key.
• Only HTTPS is accepted. Requests do not automatically follow redirects, so Authorization, API keys, cookies, and other credentials are not forwarded to another Host.

5. Permissions and device capabilities

Runtime permissions such as camera, microphone, and notifications are requested when a feature needs them. Refusing one normally affects only that feature.

• Camera and photos: used when you start photo translation, menu recognition, image chat or a related tool. Ordinary iOS OCR uses Apple Vision on device; Android OCR uses Google ML Kit. A selected region or full image is sent to the current AI provider only when you choose AI vision.
• Microphone: used for conversation or scene speech input and the Noise Light. Noise levels are computed on device; recordings are not uploaded. iOS speech recognition requires supported on-device recognition and reports unavailability rather than falling back to cloud recognition. Android network behavior depends on the selected system speech service.
• Motion, orientation and touch: support local tools such as shake actions and Level. The developer does not collect these readings. iOS has no lock-screen Guard feature; the Android feature depends on the system and device.
• Network: used for model downloads, AI, travel queries, accounts, purchase verification and website reading that you initiate. Android INTERNET is a normal permission; iOS does not request a runtime permission by that name.
• Notifications: travel and temporary-list reminders use local notifications and badges, without obtaining a remote push token. Display depends on system permissions and device settings.

6. Recipients and SDKs

The current build has no advertising, cross-app tracking, third-party analytics, remote push, or third-party crash-reporting SDK. AI credits pay for enabled, clearly identified tasks such as text, image understanding or image generation. Relevant content and charges are disclosed before sending.

• Cloudflare: hosts, delivers and protects the website and routes email. Website access may involve IP address, request time, browser details and security logs.
• iOS Apple frameworks: Translation downloads selected models and translates on device on supported systems and languages; Vision recognizes text on device; Speech requires on-device recognition; Keychain protects local credentials; StoreKit handles Apple store payments and subscriptions without giving Baiboki full payment-card details.
• Android Google ML Kit and Google Play Billing: provide on-device translation and OCR, model downloads, and store products, purchases and restoration. Google Play processes payment-card details. These components do not provide the corresponding iOS functionality.
• Alibaba Cloud Bailian (DashScope, Beijing region): provides models for user-initiated hosted AI tasks. Baiboki forwards only task inputs, authorized images, limited context and necessary technical metadata. The provider actually used is disclosed before sending.
• Expo Notifications: registers local due reminders and badges on the device. The current app obtains no remote push token.
• System services: system speech recognition, text-to-speech, camera and sharing are handled by services selected on your device.
• BYOK Providers: are actively selected or configured by the user and directly connected; Baiboki remains responsible for the in-app sending flow, disclosure, safeguards, and authorization, while each Provider processes received data under its policy.

7. Free, lifetime Pro, AI credits, and subscription

The app is free to download. Free includes core tools; lifetime Pro is a one-time purchase of the local advanced features and higher limits listed on the purchase page, without unlimited hosted AI. AI credits pay per request and do not unlock Pro local features. An active AI subscription includes Pro local benefits and cycle credits without a separate Pro purchase. After expiry, separately purchased lifetime Pro and purchased credits remain. Basic BYOK needs no subscription; advanced-workflow BYOK requires an active AI subscription, or you can use valid credits for hosted AI.

iOS offers lifetime Pro, 1,000 / 3,000 / 10,000 credit packs, and monthly and annual subscriptions. Base USD prices are US$24.99, US$1.69, US$4.69, US$14.99, US$1.99/month and US$21.99/year respectively; the App Store confirmation sheet determines the actual currency, taxes and price. Monthly subscriptions provide 500 credits per eligible monthly cycle. Annual subscriptions provide 600 credits in each monthly cycle anchored to the purchase date, rather than the first of each calendar month. Cycle credits do not roll over and annual credits are not granted all at once. Purchase availability depends on the regional store; the first iOS release is not distributed in mainland China's App Store.

iOS digital purchases use Apple StoreKit; Android purchases use Google Play Billing. Baiboki receives product IDs, transaction and original transaction identifiers, transaction dates, environment, state and necessary account or installation credentials for verification. Apple purchases include signed transaction and subscription information; Google Play purchases include a purchaseToken. Only valid, server-verified transactions grant access; pending purchases do not unlock early. Restoration, duplicate-grant prevention, refund and revocation records can be linked to your account. A signed entitlement cache is stored locally and revalidated. Baiboki does not receive full payment-card details.

Subscriptions automatically renew at the price and interval shown by the store. Manage or cancel through the app's subscription-management entry or Apple / Google Play account settings; cancellation normally stops later renewal after the current paid period. Store refunds and revocations can remove the corresponding access or unused balance. Restore lifetime Pro and subscriptions with the original store account; purchased-credit balances are recovered with your Baiboki account, without a new grant on each restore.

An eligible lifetime-Pro purchase includes a 500-credit AI gift activated manually, once per valid purchase. It expires after 30 consecutive days or depletion. The gift remains with the activating installation through normal updates, but is not transferred or restored after a device change, app-data clearing or reinstall. It never auto-renews; expiry does not affect lifetime Pro.

AI allowance records

Trial, subscription-cycle and purchased balances are separate: the trial lasts 30 days after activation; cycle allowance resets without rollover; purchased credits survive subscription expiry and are recoverable with the account. The earliest-expiring valid allowance is used first, then purchased credits. BYOK never spends Baiboki credits.

8. Accounts, retention and deletion

Select Delete Account on the app's account page, confirm and verify your password, or use the website account page or privacy@baiboki.com. Deletion disables the account, removes the email, login identities and password, and revokes sessions. Minimum transaction, credit, anti-fraud and legal records may be retained for restoration, refunds, disputes and legal obligations, without enabling ordinary account login.

Deleting a Baiboki account does not automatically cancel an Apple or Google Play subscription; manage or cancel it in the purchasing store as well. Account deletion is separate from local tool-content deletion, which you can perform within each feature, by clearing data or by uninstalling.

• Baiboki account: an email verification code is used for first registration, code sign-in, or password reset; you can then sign in with email and password. We retain the normalized email, internal account ID, verification time, salted one-way password hash, and protected session digest. We never store plaintext passwords or codes. Codes expire quickly and signing out revokes the session. Short-lived protected email or network-address digests limit code and password attempts. Purchase and usage records may be linked to internal account or installation identifiers.
• On-device data: remains until you delete it, clear app data, or uninstall. Signing in does not automatically upload local tool content.
• BYOK data: goes directly to your selected Provider. Baiboki receives neither the key nor a request copy.
• Hosted AI content: api.baiboki.com and the selected provider process the current task's prompt, authorized images, selected context, travel queries and search terms, and information-card fields you choose to send. Content may contain names, phone numbers, addresses, health or insurance information, identity numbers or other personal information. Usage records include account or installation identifiers, request ID, capability, model, usage, cost, status and error codes. Providers may retain inputs and outputs under their terms for safety, abuse prevention and legal requirements; zero retention is not promised. The app identifies the provider and charges before sending.
• Purchase and credit records: protected purchase-token records, order state, entitlements, balances and ledger entries are retained as necessary for restoration, fraud prevention, refunds, disputes and law.
• Support email: may include your address, message and optional attachments and is retained as reasonably necessary.

9. Regional privacy rights

You can delete local content, withdraw connected-feature consent, withdraw sending consent for one Provider, and revoke system permissions. Contact privacy@baiboki.com to exercise rights that apply where you live.

We may verify identity where reasonably necessary and will respond within applicable legal periods.

• EEA / UK: you may have rights of access, rectification, erasure, restriction, portability and objection, and may complain to a supervisory authority. Processing you initiate is generally needed to perform the requested service; optional processing relies on consent where required.
• United States: depending on your state, you may have rights to know, access, correct or delete covered data and appeal a request decision. Baiboki does not sell or share personal information for cross-context behavioral advertising.
• Japan: requests concerning retained personal data may be sent to the privacy address above under applicable law.
• South Korea: you may request access, correction, deletion or suspension where applicable. We do not claim a local office or representative that does not exist.

10. International processing

The website, app store, system speech service, or a BYOK Provider may process information in another country. Before first send, the Provider notice identifies its Host, purpose, data types, privacy policy, and possible overseas processing. Baiboki does not store your third-party key but remains responsible for the app-side sending flow and required safeguards.

11. Security and age requirements

The app uses HTTPS, keeps request credentials out of logs and blocks automatic redirects. Android protects keys with Android Keystore-supported encryption and excludes them from backups; iOS protects keys with device-only Keychain. No system can guarantee absolute security.

The current iOS release is intended for people aged 18 and over, not children. A store age rating is not identity or age verification. Third-party AI also has provider-specific age, regional, account and use restrictions. People under 18 must not use this release or its AI services.

12. Changes and contact

We will update this Policy when features, permissions, SDKs, providers, payment arrangements or laws change. Material changes will receive an appropriate website or in-app notice.

Controller: FANG GUOHAO
Privacy: privacy@baiboki.com
Support: support@baiboki.com

中文版隐私政策