Privacy policy

Limited basic product analytics

To improve interactions, we aggregate daily counts of pages, selected links, pricing and payment interfaces, image selection and cropping, analysis submission, upload failure or cancellation, result views, partial and full-page explanation expansion, annotations and layers, corrections and history actions. Cross-platform counts are grouped by web/native app, operating system, runtime, version and interface language. Daily counts contain no individual clicks, precise event times, accounts or their hashes, order IDs, IP addresses, images, entered text or full URLs. We do not create personal behavior histories across sites, days or devices, or use these counts for advertising, profiling or AI model training.

For Taiwan traffic, basic analytics currently starts after this notice is shown, without a separate checkbox. Other or unknown regions require an affirmative opt-in. Region is used only to decide collection behavior at request time and is not written to product counts. DNT or GPC stops collection. You may stop future basic analytics below at any time; a previous explicit refusal is retained and never automatically changed to consent. The preference cookie stores only allow/stop status or whether the updated notice was seen, with no unique identifier. The native app does not automatically enable analytics under these web regional rules: it defaults off everywhere. You can opt in to “Help improve AIKTalk” in Settings, or turn it off and discard unsent events at any time. This choice is separate from consent to AI image processing.

Current collection scope

Only signed-in users with active accounts contribute events. Cloudflare stores daily counts; authentication does not write accounts into those counts. Separate retry and abuse-protection records contain a random batch ID, payload digest, account-derived abuse identifier and expiry time. They expire after two hours and are removed by scheduled cleanup, and are not used in product reports. Cross-platform daily counts have a 90-day retention window with scheduled cleanup; existing web basic counts retain their 395-day cleanup rule. Infrastructure may separately create request and security logs under its existing retention and access settings; these are outside daily product counts.

Necessary analysis and billing records

To provide requested services, reconcile credits and handle failures and support issues, we keep analysis job IDs, acceptance and completion times, job status, model, error codes, and necessary links to accounts and credit settlement. These backend records are separate from basic analytics. Opting out does not stop necessary service, billing or security records. Administrator queries are limited by permissions and environment isolation. Operational records are not used as advertising data or personal browsing history.

Analytics retention and legacy events

Current cross-platform daily statistics are retained for 90 days, while existing Web basic statistics are retained for 395 days, with scheduled deletion in batches after expiry. Daily counts are not linked to accounts, so they cannot identify or export an individual’s click history or subtract an individual’s events. Deduplication and anti-abuse batch records follow the two-hour period described above.

The new version stops adding legacy optional usage events containing account codes. Existing records are not transferred to basic analytics or used for new tracking. Legacy usage events retain the 90-day rule and billing diagnostics the 180-day rule, with batch cleanup that may be delayed by scheduling failures or a backlog. Account downloads still include linked legacy usage and billing diagnostics, up to the latest 10,000 per category with overflow indicated. Account deletion does not immediately erase these records; original purposes, retention and access restrictions apply. Contact support for personal-data requests.

Data collector

The service operator is the data collector. For its name and contact details, see the provider listed in Terms of service. Send personal-data requests using the support contact details below.

Data collected

• Account data: email address, sign-in identifiers, language and time zone. The authentication service may also retain the name and profile image you provide or your social sign-in provider returns.
• Service data: uploaded images, filenames, analysis results, analysis correction text you submit, operation status, credit ledgers and usage records.
• Transaction data: orders, products, amounts, currencies, subscriptions and refund status. We do not store full card numbers, CVVs or online banking passwords.
• Security and regional data: request times, source country or region, hashed anti-abuse identifiers and error trace codes. Billing-region records are linked to your account for regional pricing and abuse prevention. Native notifications also store account-linked installation identifiers and push tokens.

Purposes and third parties

Data is used only for authentication, AI analysis, payments and refunds, support, security, legal compliance and reliability. Necessary data may be processed by Clerk, Cloudflare, Google Cloud, OpenAI, Google Gemini and payment providers, including across borders at their service locations. Each receives only data needed for its function. Clerk assists authentication; Cloudflare and Google Cloud provide website, storage and analysis computing. AI providers receive needed images or processed images and prompts. Payments are handled by the provider shown at checkout.

For data-processing details, see Clerk Privacy Policy、Cloudflare Privacy Policy、Google Cloud Privacy Notice, and the AI data terms below. Also read the privacy policy of the payment provider shown at checkout.

Sale, marketing and public use of data

We do not sell or rent personal data or use your uploads or analyses for advertising, public display or unrelated marketing. Public case use requires separate consent.

AI referral statistics for public pages

To understand whether public teaching and product pages are discoverable, Cloudflare operational logs record known AI-platform source categories, destination public-page paths, and whether the source was identified by a referrer header or URL tag. These events omit full referrer URLs, queries, IP addresses, accounts and conversation content, set no extra cookies, and are not linked to personal login, payment or analysis records. DNT or GPC prevents these events. You can also remove utm_source tags and use browser settings that restrict referrer information. Logs follow Cloudflare retention settings; separate aggregation keeps only category counts.

AI processing and model training

We do not independently use your uploads or analyses to train general-purpose AI models. Necessary content is still sent to third-party AI services to perform analysis; their training use and retention follow applicable terms, service plans and account settings.OpenAI API data policy states that API data is not used for training by default, except when users opt in to sharing; Google Gemini API terms distinguishes free and paid services. Paid-service inputs and responses are not used to improve its products. No training does not mean zero retention: providers may keep necessary security, anti-abuse or legally required records.

AI data sharing and consent

To perform the chart analysis you request, AIKTalk sends your confirmed cropped image, selected analysis language and analysis instructions through our servers to OpenAI or Google Gemini. The service may switch providers based on availability. A correction also sends the chart image, previous analysis and the correction explanation you select or enter so the AI can review and revise the result. We do not send sign-in passwords, payment details, email addresses or account balance fields as AI analysis content. If you include such information in an image or text, however, it is sent with that content; hide or remove it first.

Before this account first submits an analysis on this device, the native app shows a separate AI data notice and asks for your explicit agreement. The first correction separately explains the additional content and requests consent. Signing in, selecting photos and choosing basic analytics do not grant AI data-sharing consent. You can return to your local image or correction choices without starting a submission or spending credits. Consent records stay on this device and contain the notice version and acceptance time. The app asks again when the shared data, purpose or recipients materially change.

You can withdraw this account’s consent on this device at any time under Settings → AI data sharing. The app will ask again before another analysis or correction. Withdrawal blocks future submissions; it does not automatically cancel work already sent to our servers or retroactively delete data. Use the rights contact process below to request deletion or cessation of processing. We require third-party service providers receiving personal data to provide protection at least equivalent to this policy, including processing only for necessary purposes, confidentiality, appropriate security and assistance with data-rights and deletion requests as required by law. AI-provider security retention and applicable conditions are described above.

Your choice to provide data

You may decline to provide data, but without necessary authentication, analysis or payment data we cannot provide the corresponding functions. Hide unrelated names, account details, asset balances and identifying information before uploading, and avoid unauthorized data about others.

Retention periods

Original uploads stored by this site are retained for up to 24 hours. The three latest successful analyses are retained for up to 30 days; completing a fourth deletes the oldest. Payment, refund, ledger and tax records are access-restricted and retained for up to 10 years for legal and audit needs. Other data is deleted or anonymized when its purpose or statutory period ends. These limits apply to this site's data; necessary third-party AI security retention follows the terms above and does not mean every provider copy is deleted within 24 hours.

Your rights

You may lawfully request inquiry, access, copies, supplementation, correction, cessation of collection/processing/use, or deletion of personal data. Contact support for copies or other requests. Where law requires transaction retention, we may restrict processing for the necessary period rather than delete immediately.

Security and cookies

We use access controls, encrypted transport, environment isolation, rate limits and audit records. Sign-in cookies maintain secure sessions. We currently use no advertising-tracking or cross-site marketing cookies.

Policy updates

For material changes affecting personal-data handling or your rights, we notify you by site announcement or email before effectiveness, describing changes and dates. We seek separate consent where legally required. Urgent security incidents or legal requirements may prevent advance notice; we explain as soon as practicable.