OURZHAo Privacy Policy

Effective Date: April 17, 2026 Last Updated: April 17, 2026 Version: 1.0

OURZHAO LLC ("OURZHAO", "we", "us", or "our") develops and operates the OURZHAo mobile application (the "Service"). We take your privacy seriously. This Privacy Policy explains how we collect, use, store, share, protect, and delete your personal data when you use the Service, and describes the rights you have as a data subject.

This Policy is designed to comply with:

• The EU General Data Protection Regulation ("GDPR") and the UK GDPR, including Articles 17, 20, 30, 33–34;
• The California Consumer Privacy Act as amended by the CPRA ("CCPA/CPRA"), including §§1798.100, 1798.105, 1798.110, 1798.120;
• The Personal Data Protection Act of the Republic of China (Taiwan PDPA);
• The Children's Online Privacy Protection Act ("COPPA") age principles.

Where local law conflicts with this Policy, the mandatory provisions of the applicable jurisdiction prevail.

1. Who This Policy Applies To

The Service is available only to users aged 13 or older.

• If you are under 13, do not use the Service and do not provide any personal data to us.
• Where a jurisdiction imposes a higher digital-consent age (e.g., 16 in certain EU Member States), that higher age controls.
• If we learn or have reasonable grounds to believe that an account belongs to a user under the applicable minimum age, we will suspend and delete the account without undue delay.

2. Data Controller and Contact

Users in the EU/EEA, UK, and California may exercise their data subject rights via the email above. We reply within the statutory deadline applicable to your jurisdiction.

3. Personal Data We Collect

3.1 Data you provide

• Account data: email address, display name, photo URL (created via Firebase Authentication).
• Alarm & preference data: alarm time, recurrence, voice mode, TTS preferences, theme, locale.
• User content: documents you upload (PDF, text), calendar events (if you opt in).
• Social graph: friendship requests, alarm invites, friend-visibility preferences.

3.2 Data collected automatically

• Device & app data: device model, OS version, app version, locale, timezone, push notification token.
• Usage data: alarm ring events (alarm_ring_events), playback logs, TTS generation logs, YouTube watch history (only if you enable the related feature).
• Diagnostics: crash reports and error logs via Firebase Crashlytics and Sentry.
• Performance & analytics: anonymised usage metrics via Firebase Analytics and Firebase Performance Monitoring.

3.3 Data from third parties

• Firebase Authentication: when you sign in with Google, Apple, or email, Firebase returns your verified UID, email, and display name to the Service.
• App Store subscription verifiers (Apple App Store / Google Play): used to validate subscription status, prevent duplicate charges, and handle refunds.

3.4 Data we do NOT collect

• We do not ask for, collect, or store government-issued IDs, credit-card numbers, bank accounts, or any payment-instrument data. All payments are handled by the Apple App Store or Google Play; we only receive anonymised entitlement receipts.
• We do not record audio in the background, capture screen contents, or read your device contacts without explicit permission.

4. Purposes and Legal Bases (GDPR Art. 6)

If you withdraw consent, processing carried out before the withdrawal remains lawful.

5. How We Use Your Data

We use your data only to the extent necessary for the purposes described above, including:

1. Sending your text prompts to AI providers (OpenAI, Anthropic, Google Gemini) to generate alarm scripts.
2. Sending generated text to TTS providers (ElevenLabs, Google Cloud TTS) for voice synthesis.
3. Uploading synthesised audio to Firebase Storage and delivering it to your device.
4. Sending push notifications at the alarm times you configured.
5. Sharing friend invites and monthly ring-day counts within the limits you consented to.
6. Aggregating anonymised statistics to improve the Service.

We do not use your personal data for purposes beyond those described here, and we do not sell it.

6. Data Sharing and International Transfers

6.1 Recipients

We execute a Data Processing Agreement (DPA) with each processor, requiring them to act only on our instructions and apply security measures equivalent to or stricter than ours.

We do not "sell" or "share" your personal information as those terms are defined under CCPA/CPRA, including for cross-context behavioral advertising.

6.2 International transfers

Because the Service relies on Google Firebase and US-based AI/TTS providers, your data may be transferred to and processed in the United States, the European Union, or Asia. For users in the EEA, UK, and Switzerland, we rely on one of:

• An adequacy decision issued by the European Commission (where applicable);
• Standard Contractual Clauses (SCCs);
• Our vendors' Data Privacy Framework certification.

7. Retention

When your account is deleted, we remove all identifying primary data within 30 days. Backups, audit logs, and records required by law are retained for the applicable period then purged.

8. Your Rights

8.1 Taiwan PDPA rights

You may request to:

• Inspect or access your personal data
• Obtain a copy
• Rectify or complete inaccurate data
• Stop collection, processing, or use
• Delete

8.2 GDPR / UK GDPR rights

• Right to data portability (Art. 20): export your data as a single ZIP via Settings → Data & Privacy → Export my data. The ZIP includes JSON metadata plus audio binaries. The download link is delivered by email to your registered address and is valid for 72 hours.
• Right to erasure / to be forgotten (Art. 17): exercise instantly via Settings → Data & Privacy → Delete account. We delete database records, revoke Firebase authentication, and schedule Firebase Storage purge (usually within 24 hours, at most 72 hours).
• Right to restriction (Art. 18), right to object (Art. 21), right to withdraw consent, and right to lodge a complaint with a supervisory authority (e.g., the UK ICO or your national DPA).

8.3 CCPA / CPRA rights

California residents may request:

• Disclosure of categories and specific pieces of personal information we have collected, used, or shared (Cal. Civ. Code §1798.110 / §1798.115);
• Deletion of personal information (§1798.105);
• Correction of inaccurate personal information (§1798.106);
• Limit use and disclosure of sensitive personal information (§1798.121) — we do not use sensitive personal information for purposes beyond those for which the right-to-limit does not apply under the statute;
• To opt out of "sale" or "sharing" — we do not sell or share your personal information as those terms are defined under CCPA/CPRA;
• Protection against discriminatory treatment for exercising rights (§1798.125).

8.4 How to exercise rights

Under CCPA §1798.130 we provide two designated methods for California residents to submit rights requests:

• In-app self-service: Settings → Data & Privacy → "Export my data" or "Delete account" (covers access, portability, and deletion);
• Email: support@ourzhao.com with subject "Data Subject Request" and the email address on your account so we can verify identity (covers correction, limit-sensitive-data, opt-out, and any other right).

We acknowledge receipt within 5 business days and respond within 30 days (extendable up to 3 months under GDPR; 45 days under CCPA). You may also designate an authorised agent to make a request on your behalf; we may require reasonable proof of the agent's authority.

9. Security

Technical and organisational measures we apply:

• Transport encryption: all client ↔ server traffic is TLS 1.2 or higher.
• Storage encryption: Firebase Storage and PostgreSQL use the cloud provider's default at-rest encryption.
• Access control: backend APIs authenticate Firebase ID tokens and enforce authorisation through a centralised authz module to prevent IDOR.
• Revocation: account deletion calls revoke_refresh_tokens; token verification uses check_revoked=True, so stale tokens cannot resurrect deleted accounts.
• Audit logs: every deletion and export event is recorded; identifiers are stored as SHA-256 hashes, not plaintext.
• Error redaction: outbound error messages never leak stack traces or database internals.

No internet transmission or storage system is 100% secure. In case of a personal data breach, we will notify the relevant supervisory authority and affected users in accordance with Taiwan PDPA, GDPR Art. 33–34, and CCPA.

10. Cookies and Similar Technologies

The Service is a native mobile application and does not use browser cookies. We use local storage for:

• Device-local databases (SQLite / SharedPreferences / Hive): caching, preferences, offline playlists.
• Firebase SDK internal storage: installation IDs, push tokens, performance metrics.

You can clear local data via your OS's "Clear app data" function; signing in again will resync from the cloud.

11. Children's Privacy

The Service is not directed to children under 13 and we do not knowingly collect personal data from anyone under that age. Parents or guardians who believe their child has provided personal data to us should email support@ourzhao.com, and we will delete the data promptly.

12. Third-Party Links

The Service may contain links to third-party websites, app stores, or external resources such as YouTube. We are not responsible for their privacy practices; please review those parties' privacy notices separately.

13. Changes to this Policy

We may update this Policy to reflect legal, functional, or operational changes. For material changes we will notify you via at least one of:

• An in-app prominent notice;
• An email to your registered address;
• A re-consent prompt on launch.

For non-material changes (typographical, formatting), we will update the "Last Updated" date only.

14. Contact

For questions, complaints, or rights requests, contact:

OURZHAO LLC Email: support@ourzhao.com Subject: "Privacy" or "Data Subject Request"

We will acknowledge receipt within 5 business days and provide a substantive response within 30 days (subject to any statutory extension).