Privacy Policy

1. Scope and controller

This policy covers Offline Music / Offline Player for Android, native HarmonyOS and iOS, and related support. The developer and personal information controller is 焦健 (Jiao Jian) (“we”). Privacy contact: liangshujun996@163.com. Features differ by platform, channel and version; a practice applies to the feature actually available. The Android edition is intended for Google Play; the Huawei channel uses the native HarmonyOS edition.

No developer account is required. Google Drive authorization or a store purchase does not create an app account. Reading this policy, continuing use, purchasing or granting one permission is not blanket consent. Where consent, separate consent or guardian consent is legally required, the corresponding notice and consent must precede processing.

2. Shared-feature data inventory

Basic media features do not read contacts, SMS, call logs, health data or precise location, or record your camera/microphone. Selected files may contain sensitive or others’ information; process only content you are entitled to use. We do not sell personal information. The iOS analytics, diagnostics and web practices below preclude a blanket “no data collected” claim.

3. Android-specific processing

• Google Drive: Selecting Drive invokes Google authorization/picker with drive.file. The app handles the authorized account identifier, token, selected IDs, names, types, sizes, download eligibility and content for import, without enumerating the entire Drive. Requests go directly to Google, without our authorization relay.
• Credentials: “Remember connection details” stores settings/passwords locally with encryption protected by Android Keystore. Google tokens and verified receipts are also encrypted locally. Unsaved server details serve the current connection.
• Purchases: Launch/foreground return, purchase pages and purchase/restore actions query Google Play products/entitlements, handling product IDs, order/purchase tokens, times, status, original receipts and signatures for verification, acknowledgement and restoration. Verification is local, without sending receipts to our validation server. Google handles the payment account; we do not receive complete card details.
• Codes: Submitting a trial/review code sends it, a random request value and package name over HTTPS to our Cloudflare Workers service. Its database stores only the code hash, aggregate count and enabled status, not a personal/device redemption profile. The code body and random value serve the current verification. Network infrastructure still handles IP/connection data. Temporary access is stored locally; the current grant lasts seven days.
• Diagnostics: Payment stages/error codes can be logged on-device. Diagnostic builds may also log store country and app/SDK versions. There is no developer-integrated automatic remote analytics/crash SDK in this edition.

4. Native HarmonyOS

On first launch, HarmonyOS displays a privacy notice and offers the full policy and terms offline. If you decline, local import, playback, playlists and settings remain available, while purchase initialization, app remote connections and LAN transfer remain disabled. Use Settings → Privacy and Terms to reconsider or withdraw. Withdrawal exits the app and a new choice is offered on next launch; it does not automatically delete local media or third-party records. The versioned consent record stays on the device until withdrawal, app-data clearing or uninstall; material changes requiring renewed consent prompt again. System file providers and actively chosen system sharing/email follow their own rules.

Media, playlists, records and preferences are in the app directory; saved credentials use the system secure asset store. System networking/background-audio capabilities support connections and playback.

Google authorization relay and Huawei receipt validation are currently unconfigured and do not process authorization or purchases. Basic local import/playback remain available. Activation requires updated policy and applicable notice first.

The inactive Google implementation uses drive.readonly for directory browsing, a developer relay for sessions/access tokens and server storage of refresh tokens. Receipt validation would send app identifiers, purchase records and a request identifier. This describes inactive implementation, not a live service or consent to future processing.

5. iOS-specific processing

• Drive and credentials: System-browser OAuth and Picker use drive.file to exchange tokens and read/download selected files from Google. The access token is currently in local preferences (UserDefaults). WebDAV/SMB settings/passwords use the device Keychain; these protections differ.
• Purchases: At launch/purchase/restore, StoreKit/SwiftyStoreKit process products, transactions and receipts and validate with Apple. Pro status is cached locally. Apple processes payment details; we do not receive complete card information.
• Web and search: Visits send URL requests, IP, browser information and site cookies. Non-empty search input sends text to Google for suggestions; submitting sends it to the chosen Google/YouTube service. Suggestions currently use HTTP. History/favorites are local, WebKit manages cookies/cache, and websites apply their own policies. Do not enter passwords or sensitive information in the suggestion field.
• Firebase Analytics: Initialized at launch, recording page views, feature clicks, playback actions, import counts, purchase/restore results and product IDs for usage analysis/improvement. These business events do not attach complete personal media files. The SDK also handles instance/device-related identifiers, app/device data, sessions and interactions, and can derive approximate region from IP. Advertising identifier availability depends on system authorization/configuration.
• Crashlytics/Performance: Default startup supports crash diagnosis/performance analysis, processing installation IDs, crash stacks, action breadcrumbs, device/OS information and startup/network metrics. Network metrics can include request addresses, response codes, durations and byte counts. Sessions, Installations and transport components support reporting and identification.
• Messaging/Remote Config: Integrated and involved in default initialization. Messaging registration depends on conditions such as an APNs token; Performance can use Remote Config for reporting configuration, involving installation/registration identifiers and app/device configuration. There is no user-facing remote-notification subscription or personalized-configuration feature, but that does not mean these components never communicate.

There is currently no separate iOS analytics-off control. Email us to request cessation, deletion or explanation. Stopping use prevents new app-use events but does not erase existing remote records. These iOS SDK practices do not apply to Android/HarmonyOS editions without those components.

6. Permissions and system capabilities

Declining optional authorization affects its feature. Revoking a system permission does not revoke third-party account grants or erase records.

7. Third parties, SDKs and recipients

Read this table with the inventory above for purpose, trigger and scope. Local libraries do not imply transfers to their authors. Independent account, payment and website services apply their own policies; we remain responsible for processing we determine or commission.

Google user data is not used for advertising targeting, resale or general-purpose AI training. Our use/transfers comply with the Google API Services User Data Policy, including applicable Limited Use requirements. We do not provide information to unrelated parties without a lawful basis. Legally required disclosure/protection of legal rights is limited to necessity. A business transfer requires lawful notice of recipients/safeguards, not unrestricted new purposes.

8. Retention, location and transfers

• Local media/records: Retained until deletion, app-data clearing or uninstall. Temporary files/cache support transfer/playback; Android removes unfinished transfer leftovers older than 24 hours at a later launch, and maintenance removes some other leftovers. Recovery manifests, preserved damaged databases or system backups can retain metadata. Use system data clearing/app deletion and separately manage backups for complete removal.
• Credentials/transactions: Manage saved connections/authorizations under section 9. iOS Keychain can survive uninstall. Token expiry is not revocation. Receipts/entitlement caches support verification/restoration until invalidation/cleanup or local deletion; stores retain transaction history under their policies/law.
• Codes: Hashes/aggregate counts remain during the code lifecycle and as necessary to enforce usage limits, without personal redemption logs. Host security logs follow its policy.
• iOS analytics/diagnostics: Analytics retention depends on actual project settings and necessity, not local controls. Firebase states that Crashlytics records enter deletion after 90 days; Performance IP-associated events after 30 days and installation-associated/de-identified performance data after 60 days. Installation identifiers follow service purposes/deletion procedures, including provider clearing cycles. See Firebase retention. These periods do not promise instant erasure of all data.
• Support email: Kept for the shortest time needed for response, necessary follow-up and related dispute resolution; deleted once purposes end and no lawful retention remains. Legal retention is limited in scope/duration. You can request reasons and deletion.

Local media normally stays on-device. Google, Apple, Firebase, Cloudflare, GitHub and overseas servers you choose may process network data outside mainland China, including the US and infrastructure locations. We do not promise all data stays in China. Section 7 identifies recipients, purposes, types and contact channels; our email also accepts rights requests.

Mainland-China transfers require applicable transfer conditions, impact assessment, notice and separate consent where necessary. This policy or a third-party authorization page alone does not satisfy those obligations. Processing must not be enabled before conditions are met. Transfers elsewhere likewise require applicable safeguards.

9. Rights and controls

• View/delete library media and edit/delete playlists. Deleting app copies normally leaves originals/cloud files intact; playlist deletion does not delete media. Remove exported/shared copies with their recipients.
• Android: “Sign out and revoke access” on Drive clears local authorization; if remote revocation fails, complete it in Google account connections. Use “Delete saved connection” in WebDAV/SMB forms; disconnecting alone keeps saved details.
• HarmonyOS: turn off “Securely save connection details” in the server form and connect again; after creating the source, the app removes that saved entry. Disconnecting alone keeps it, and there is no separate delete button. Google authorization is inactive; future activation must provide revocation instructions.
• iOS: “Clear history” on search removes app search records, not site cookies/server records or Firebase data. Revoke Google access in Google account connections. There is no dedicated Google-token clearing, Keychain-connection deletion or analytics-off button. Uninstalling does not guarantee removal of every credential/remote record.
• We cannot remotely read, restore or delete device-only data. Use system app-data clearing on Android/app deletion, and separately manage backups, Keychain and recipients’ copies.
• Email liangshujun996@163.com for access, copies, correction, deletion, restriction/objection, withdrawal or explanations, and portability/transfer where applicable. Give platform, version, request and necessary record-locating information, not passwords, full card details, live tokens or your entire library. Identity checks are limited to preventing impersonation.
• We respond within applicable legal deadlines. If records cannot be located, must be retained or requests cannot be fulfilled, we explain why and available alternatives. Withdrawal does not invalidate earlier lawful processing. You may complain to competent data/consumer-protection authorities.

There is no developer app account or corresponding account-deletion flow. This does not prevent data-deletion requests and does not close Google, Apple, Huawei or other provider accounts.

10. Security

Safeguards include sandboxing, scoped sharing, system credential protection, access controls and HTTPS where implemented. Android/HarmonyOS receivers use session tokens; iOS uses a different mechanism. Local HTTP, HTTP WebDAV, iOS search suggestions and unencrypted SMB are not fully encrypted transfers. Use trusted networks, valid HTTPS and available SMB encryption, and protect addresses/credentials.

We remediate security incidents and notify users/authorities where required. No measure guarantees absolute security; this does not reduce legal duties.

11. Minors

The app is not directed at children and does not offer a child-directed service. Minors need guardian guidance and necessary purchase permission. Processing information of children under 14 or the applicable local age requires guardian consent and special rules where legally required. There is no separate child account/service.

Contact liangshujun996@163.com if you believe child data was processed without required consent; we will investigate and delete it or take necessary protective action. General acceptance cannot replace special child protections.

12. Updates and contact

Material changes to features, purposes, recipients or platform practices require an updated policy/revision date and appropriate notice. Obtain renewed consent before new processing where required; old acceptance is not blanket authorization.

Developer/controller: 焦健 (Jiao Jian). Privacy, deletion and complaints: liangshujun996@163.com. See Terms of Service and support. Both languages intend the same meaning; contact us about ambiguity. Neither reduces statutory protection.