Privacy Policy

Last updated: 29 October 2026

The developer of "Hi Taigi" (the "App") respects user privacy and has designed the App to handle as little data as possible. This policy describes how the App handles personal information.

1. Personal information we collect

The App does not collect personally identifying information such as your name or email address. If you choose to sign in, only a pseudonymous identifier issued by Apple and a random account ID are stored (see Section 6).

• No user account is required. Account sign-in (Sign in with Apple) is optional, and the App works normally without it.
• Unless the user signs in and uses sync with Plus (see section 6), search history, favorites, view history, and learning progress are stored only on the user's device and are never transmitted externally.
• The App does not obtain the user's name, email, phone number, location, contacts, or any similar information.
• There are only four exceptions: the information sent when the user taps a report button themselves (see section 3), the anonymous events sent for the purchase flow and early use, which is on by default and can be turned off at any time (see section 4), records of in-app purchases (see section 5), and, if the user chooses to sign in, account information and Plus sync data (optional; see section 6). None of them contains a name, email address, or anything else that identifies an individual.

2. Network requests

The App makes HTTPS requests to a distribution origin operated by the developer (Cloudflare R2) in order to download audio for words and example sentences. These requests carry the following standard network information:

• IP address (required for any internet communication)
• User-Agent (a standard header containing OS version, etc.)
• The audio file name being requested

This information is temporarily logged by Cloudflare. The App's developer does not access or analyse these logs for the purpose of identifying individual users. Cloudflare's privacy policy is available at https://www.cloudflare.com/privacypolicy/.

When the user signs in, and when a signed-in Plus subscriber's data is synced, the App communicates over HTTPS with the developer's server (a Cloudflare Worker; see section 6).

Even if the user does not download audio (the dictionary text itself is bundled with the App), does not tap the report button described in section 3, has turned off the anonymous measurement described in section 4, and has not signed in as described in section 6, the App still communicates with RevenueCat (section 5) to check the status of in-app purchases. It performs no other network communication.

3. Reporting incorrect content

The App has one-tap report buttons in two places: "回報：這裡有誤 (this is incorrect)" on the "認證700" study cards in the Study tab, and "找不到？回報這個詞 (not found? report this word)", which appears when a search returns nothing. Only when the user taps one of those buttons does the App send the following information over HTTPS to the developer's server (a Cloudflare Worker), for the purpose of correcting errors in the dictionary content and learning which words are missing from it. Nothing is sent automatically or in the background.

The information sent is limited to:

• The dictionary entry ID
• The reported characters or word (e.g. "茉莉"; for a not-found report, the term being searched for at that moment)
• A source tag (e.g. "cert700", "missing")
• The app version (e.g. Taigi 2.1.0 (6))
• The OS version (e.g. iOS 18.5)

What is not sent:

• Name, email address, phone number, location, or contacts
• User content such as photos
• Identifiers such as user IDs or device IDs

IP addresses are processed transiently by Cloudflare for rate limiting (to prevent abuse and repeated submissions), but they are not stored in the database.

Submitted data is stored in Cloudflare D1 (a database), and the notification email to the developer is delivered via Resend (an email delivery service). The data is used only to correct incorrect content; it is not used to identify individuals and not used for tracking. Because a report contains no information that identifies an individual, it is retained without a set time limit as a record of dictionary corrections. Note that, as there is nothing indicating who submitted a given report, reports cannot be singled out and deleted for a particular user.

Under Apple's App Privacy categories this corresponds to Diagnostics (Other Diagnostic Data) and Usage Data (Product Interaction), in both cases "Not Linked to You", not used for tracking, and used for App Functionality.

Separately from the above, the "意見、回報問題 (feedback and bug reports)" link on the Info screen opens the mail app on the device. The draft it prepares contains only the app version, the OS version, and the language; whether to send it is the user's decision, and the App never sends it automatically. If the user does send it, the developer receives that email address and the message body, in order to reply and to improve the App.

Reporting tone judgements (Learning: "唸出來")

In the "唸出來" (say it aloud) questions in Learning, you look at the characters and say the word, and the App judges your tones by comparing how your pitch moves with the official recording. Recording and judging happen entirely on the device, and the recording is never saved or sent. If a judgement seems wrong, you can tap "判定怪怪的？" (Judgement seems off?) below it. Only when you then choose "我唸對了，卻判不對" (I said it right but it was marked wrong) or "我唸錯了，卻判對" (I said it wrong but it was marked right), the App sends the following to the same server as above, to improve the accuracy of the judgement:

• How your pitch moved (a series of numbers, one every 10 milliseconds, each expressed as the difference from your usual pitch), and that usual pitch (Hz)
• The judgement shown (one of three levels), the per-syllable feedback, and the claim you chose
• The word asked (dictionary entry ID, Hanji, Tâi-lô romanization, and the file name of the reference recording)
• App version and OS version

The recording itself is never sent. No identifiers such as a user ID or device ID are included. IP addresses and storage are handled the same way as the reports above (no notification email is sent). Because there is no way to tell who sent a report, we cannot pick out and delete a particular user's reports.

Under Apple's App Privacy categories, the pitch series is User Content (Other User Content), and the rest falls under the same categories as the reports above, Usage Data (Product Interaction) and Diagnostics (Other Diagnostic Data). All are "Not Linked to You", not used for tracking, and used for App Functionality.

4. Anonymous measurement (purchase flow and early use)

To understand where people stop, the App can send a very small number of anonymous events. There are two things worth knowing: where people stop in the purchase flow — how many open the purchase screen, how many start the trial — and which of a few early actions go together with continuing to use the App.

• On by default, and can be turned off at any time. Turning off "Help improve the app" under Info → Help improve in the App stops the sending at that moment; nothing is sent after that, and nothing that happens after you turn it off is sent retroactively.
• What is sent: the name of the step (app launched — used as the denominator for these ratios, purchase screen opened, plans screen reached, trial started, purchase completed, closed without buying), which entry point it came from, the app version, and the OS version.
• What is sent (early use): once when your first session ends, and once on the first launch seven days after installing, a record of five yes-or-no items — whether you played audio, added a favorite, opened the Learning tab, finished one learning session, and searched five or more times. Counts, times, and the words you looked up are not sent, only whether you did each thing. What is sent on day seven is the same record taken when your first session ended, not a seven-day total.
• What is not sent: any identifier (there is no install identifier and no session identifier), search terms, dictionary content, browsing history, or purchase amounts.
• Because no identifier is included, the server cannot link two records from the same device; only population-level counts are visible. For the same reason, records already sent cannot be selected and deleted for an individual user.
• Events go to Cloudflare Workers and D1, the same destination as the reports described in section 3. IP addresses are processed only for rate limiting and are not stored in the database.
• No third-party analytics service is used, and the data is never used for advertising or cross-app tracking.

Under Apple's App Privacy categories this falls under the same categories as section 3 — Diagnostics (Other Diagnostic Data) and Usage Data (Product Interaction) — in both cases "Not Linked to You", not used for tracking, and used for App Functionality and Analytics.

5. In-app purchases and subscriptions

To determine the status of in-app purchases (one-time purchases and the "Plus" subscription), and so that the same purchase can later be used in versions of the App other than iOS, the App sends purchase records to RevenueCat (a purchase management service). Payment itself is handled by Apple; neither the developer nor RevenueCat has access to payment information.

When someone buys Taigi Plus on the web as a gift (for example through an "Ask Family for Plus" link), the payment is processed by Stripe. The email address and other details entered at checkout are handled under Stripe's Privacy Policy, and the developer never sees card numbers or other payment details. The purchase is recorded in RevenueCat under a random ID created for that request and is not linked to the payer's identity. See the Terms of Sale.

• What is sent: records of in-app purchases issued by Apple (product ID, purchase date, expiration date, store country or region, Apple transaction ID, and the like), and a random anonymous ID that the RevenueCat SDK creates for each device (replaced by the account ID after you sign in; see section 6).
• What is not sent: name, email address, payment information, the advertising identifier (IDFA), or the identifier for vendor (IDFV).
• When: when you make a purchase, when you restore purchases, and when the App checks purchase status, such as at launch.
• Purpose: deciding which purchased features to unlock, and counting sales, subscribers, and cancellations. It is not used for advertising or cross-app tracking.
• Purchase records are kept by RevenueCat for as long as they are needed to determine purchase status and for these counts. To request deletion, contact us at the address in section 12.

Under Apple's App Privacy categories, this is "Purchases (Purchase History)" and "Identifiers (User ID)", both "linked to the user", "not used for tracking", with the purposes "App Functionality" and "Analytics". The anonymous ID contains no name or similar information, but because it stays the same on a device and is sent together with Apple transaction IDs, we declare it as linked.

6. Account sign-in and sync

So that a Plus subscription bought on one device (or in the Android or web version) can be used on your other devices, and so that your data can be synced between them, the App offers an optional account sign-in (Sign in with Apple) under Info → Account. The App works normally without signing in.

Sign-in

• What is sent: the ID token issued by Apple. The developer's server (a Cloudflare Worker and D1) verifies it and stores only the pseudonymous identifier ("sub") that Apple issues for this developer team.
• What is not obtained: the App does not request your name or email address, and does not read them even if the token contains them.
• The server creates its own random account ID (a UUID). After you sign in, this account ID replaces the random anonymous ID described in section 5 as your RevenueCat App User ID.
• IP addresses are processed only temporarily for rate limiting and are not stored.
• Deleting your account under Info → Delete Account deletes the account and all data linked to it on the server.

Sync (signed-in Plus subscribers only)

For Plus subscribers who are signed in, the following data is stored on the developer's server (Cloudflare D1), linked to the account:

• Favorites, word lists (including their names and the words in them), and the decks you are studying
• Learning records (review progress for each word and facet, and the review log: which word, the grade, and when)
• The history of dictionary entries you have looked up (entry ID, the headword copied as is, when you viewed it, and how many times you opened it)

Only entry IDs, headwords, list names, timestamps, and learning results are sent. Search text that you type but do not open is not sent. The data is used only to show the same data on your own devices; it is not used for analytics, advertising, or tracking.

• The data is kept when Plus ends, so it comes back if you subscribe again.
• Deleting your account deletes this data.
• Signing out keeps the data on the device.

Under Apple's App Privacy categories, favorites, word lists, and learning records are "User Content (Other User Content)", the history of looked-up entries is "Search History", and the account ID is "Identifiers (User ID)" (already declared in section 5). All are "linked to the user", "not used for tracking", with the purpose "App Functionality". Sign-in also falls under the purpose "App Functionality".

7. Third parties

The App does not share or sell user data to third parties for advertising, analytics, or similar purposes. No advertising or tracking SDKs are included in the App. The only third-party SDK included is RevenueCat, used to manage in-app purchases as described in section 5. The transmissions described in sections 3 and 4 are implemented by the App itself: section 3 happens only when you tap the button, and section 4 is on by default and can be turned off in the App at any time. Sign-in and sync in section 6 are also implemented by the App itself and happen only if you choose to sign in.

The following service providers (subprocessors) are used to operate the reporting feature, the anonymous measurement, in-app purchase management, account sign-in and sync, and the audio delivery described above:

• Cloudflare (hosting and storage for Workers, D1, and R2, including account and sync data) — privacy policy
• Apple (authentication for Sign in with Apple) — privacy policy
• Resend (delivery of report notification emails) — privacy policy
• RevenueCat (recording in-app purchases and determining purchase status) — privacy policy

8. Crash reports

If the user has enabled "Share with App Developers" in iOS → Settings → Privacy & Security → Analytics & Improvements, Apple may forward anonymized crash logs to the developer. This sharing is controlled entirely by the iOS system settings and is not a collection mechanism specific to this App.

9. Children's personal information

The App has no age restriction, but as stated above it collects no personally identifying information. Accordingly, it does not collect personal information from users under 13 either. Account sign-in is optional, and the App can be used without it; signing in does not give the App your name or email address. The reporting feature does not ask for any personal information.

10. Android version

This policy also applies to the Android version distributed on Google Play. Sections 1–9 apply to the Android version as written, except for the following.

• Sign-in (section 6) uses your Google Account (there is no Sign in with Apple). It is optional and lives under Info → Account. The App sends the ID token that Google issues; the developer's server verifies it and stores only the Google Account identifier (sub). The App does not ask for your name or email address, and does not read them even if the token contains them. Once signed in, as in section 6, your account ID becomes your RevenueCat user ID, so Plus bought on another device works here too.
• There is no sync (section 6). Even when signed in, favorites, word lists, browsing history and learning progress on Android are all stored only on your device.
• To delete your account, go to Info → Account → Delete Account. If you have already removed the App, you can also ask on the account deletion request page.
• Payments for in-app purchases (section 5) are processed by Google Play. What the App sends to RevenueCat is the purchase record issued by Google Play (product ID, purchase date, expiry date, store country or region, purchase token, and so on) and a random anonymous ID that the RevenueCat SDK creates on each device. Purchases belong to your Google account and can be brought back with "Restore purchases". The App does not read or send the advertising ID (Google Advertising ID).
• Reporting (section 3) is only the "找不到？回報這個詞" (report this word) button shown when a search finds nothing. The app and OS versions are sent in a form such as "Taigi Android 1.0.1(2)" and "Android 15"; the device model is not sent. There is no tone-check report.
• "唸出來" (say it aloud) asks for permission to use the microphone. Recording and tone checking happen entirely on the device; recordings are neither stored nor sent. If you do not allow it, everything other than 唸出來 works as usual.
• "相機掃描" (camera scan) takes one photo with your device's camera app and reads it on the device with Google's ML Kit (text recognition; the model is bundled with the App). Neither the photo nor the recognized text is sent. However, to diagnose problems and understand usage, ML Kit may send Google the device model, OS version, app version, processing time, error codes and a per-installation identifier (see ML Kit data disclosure). For this reason, the Android version includes ML Kit in addition to RevenueCat (section 7).
• Anonymous measurement (section 4) is the same as on iOS and can be turned off under "資訊 → 協助改善 App" (Info → Help improve the app).
• Crash reports (section 8): if you allow usage and diagnostics sharing in your device settings, anonymized crash information may be shared with the developer through Google Play. This is not collected by the App itself.
• In Google Play's Data safety section, the App declares purchase history and user IDs (section 5, including the account ID and Google identifier if you sign in), app interactions and diagnostics (sections 3 and 4), and the device IDs and diagnostics that ML Kit sends (above). All of it is encrypted in transit and is not shared with or sold to third parties.

For Google (distribution and payment processing through Google Play, and authentication when you sign in with a Google Account), see the Google Privacy Policy.

11. Changes to this policy

This policy may be revised in response to changes in applicable law or in the App's specification. Significant changes will be announced on this page.

12. Contact

For questions about this policy:

• Email: noform.dev@gmail.com