Last updated: May 13, 2026 | Effective date: May 13, 2026
Welcome to Niannian Diary (念念日记) ("the App", "we", "us", or "our"). This Privacy Policy explains how we collect, use, disclose, store, and protect your personal data. Our first target region is Singapore and the Asia-Pacific region, and we handle personal data in accordance with the Singapore Personal Data Protection Act 2012 (PDPA) and other applicable data protection requirements.
| Data Type | Details | Purpose |
|---|---|---|
| Account information | Apple Sign-In identifier, email address, display name, and avatar; or the email address you provide for email verification-code login | Account creation, login, account management, and security |
| Verification and login records | Email verification-code sending records, verification status, login time, and login method | Email login, account security, and abuse prevention |
| Diary and note content | Diary text, Q&A records, free-form notes, tags, mood, and weather | Core diary, note, storage, search, statistics, export, and AI features |
| Media uploads | Photos and images you attach to diary entries or notes | Media storage and display |
| Location information | When you actively use the diary location feature, your device latitude/longitude. Reverse geocoding (converting coordinates to city/district/street text) is performed on-device via the iOS system framework (Apple CoreLocation / CLGeocoder) and handled by Apple. The resulting place text, together with any location text you manually enter, is stored on our servers with the relevant diary entry | To add location context to diary entries |
| Profile information | Nickname and avatar you set manually | Personalisation |
| Feedback | Content and contact information you submit through in-app feedback | Support, troubleshooting, and product improvement |
| Data Type | Details | Purpose |
|---|---|---|
| Device and app information | Device model, OS version, app version, and language settings | Compatibility, troubleshooting, and service optimisation |
| Usage and log data | Feature usage records, operation logs, error logs, and crash reports | Service operation, security audit, troubleshooting, and product improvement |
| Network information | IP address, network type, and request time | Security, abuse prevention, service optimisation, and approximate region detection |
We do not use your data for personalised advertising.
Important: We do not proactively use your diary content to train our own AI models.
For third-party AI services, we prioritise providers that commit not to use API request content to train models or that provide reasonable data protection commitments. A provider's handling of request data remains subject to its applicable service terms, privacy policy, and data processing commitments.
When you use AI diary generation, AI question recommendation, AI profile summary, or similar AI features, relevant diary entries, notes, tags, mood labels, location text, and other necessary content may be sent to third-party AI service providers for processing. We minimise the content sent and avoid sending account identifiers, email addresses, or payment information unless necessary.
| Provider | Role | Purpose | Data Processing Region |
|---|---|---|---|
| Qwen (Alibaba Cloud) | Primary | Diary generation, question recommendation, AI profile summary, and related AI features | Currently Alibaba Cloud Mainland China; we plan to migrate to Alibaba Cloud International (Singapore) in the future |
| Doubao (Volcengine) | Backup | Used as automatic fallback when the primary provider is unavailable | Mainland China |
| Zhipu AI (GLM) | Backup | Used as automatic fallback when the primary provider is unavailable | Mainland China |
Backup providers are only invoked when the primary provider has availability issues (e.g., timeouts, quota exhaustion, or network failures), in order to maintain service continuity. When invoked, the relevant request content is sent to the corresponding provider for processing.
We prioritise Singapore and Asia-Pacific cloud infrastructure where reasonably practicable. Depending on the actual deployment of cloud hosting, object storage, content delivery, email, and AI service providers, some data may be processed or transferred outside Singapore. For cross-border transfers, we use reasonable measures such as encrypted transmission, access controls, and contractual safeguards to seek a standard of protection comparable to the PDPA.
The current version of this App does not provide end-to-end encryption (E2EE).
This means:
End-to-end encryption is on our product roadmap and may be offered in a future version. We will announce it in release notes when available.
While we take reasonable security measures, no method of internet transmission or electronic storage is 100% secure. We recommend that you regularly export and back up your important data.
We do not sell, rent, or trade your personal data to any third party. We may share your data only in the following limited circumstances:
| Scenario | Details |
|---|---|
| AI service processing | Data transfer necessary for AI diary generation (see Section 3) |
| Email services | Sending login verification codes, account-related emails, or support replies |
| Cloud services and content delivery | Server hosting, databases, image storage, content delivery, logs, and security protection |
| Media storage and delivery | Images stored on Cloudflare R2 object storage and delivered via Cloudflare's global CDN |
| Location and geocoding | Device location and reverse geocoding handled by Apple CoreLocation / CLGeocoder on iOS |
| Payment processing | VIP subscriptions are processed through Apple In-App Purchase; we do not directly handle your payment card information |
| Security and compliance | Investigating fraud, abuse, security incidents, unlawful conduct, or Terms violations |
| Legal requirements | When required by law, regulation, court order, public authority, or regulator |
| User consent | With your explicit consent |
| Business transfer | In the event of a merger, acquisition, or asset transfer, your data may be transferred; we will notify you in advance |
Your core data is processed primarily through Singapore and Asia-Pacific infrastructure where practicable. Cross-border data transfers may occur in the following situations:
We take reasonable steps under the PDPA Transfer Limitation Obligation to ensure that overseas recipients provide a standard of protection comparable to the PDPA, unless an applicable legal exception applies.
| Data Type | Retention Period |
|---|---|
| Account and diary data | Retained for the duration of your account |
| Deleted diary entries | Deleted from your account-visible data and primary service database after you delete them; residual copies in backups, caches, or logs are cleared according to system cycles, except where retention is needed for legal, compliance, security, or dispute-resolution purposes |
| Account deletion data | After you request account deletion, your account enters an approximately 30-day recovery period. After the recovery period, personal data that is no longer required will be deleted or anonymised through our system process, except where retention is needed for legal, compliance, security, or dispute-resolution purposes |
| Server logs | Automatically purged after 90 days |
| Crash reports | Anonymous data retained for up to 180 days |
| Verification-code and abuse-prevention records | Retained for a limited period as needed for security, anti-abuse, and audit purposes |
We retain personal data only as long as needed for the purposes described in this Policy, to comply with legal obligations, resolve disputes, maintain security, or enforce agreements. When personal data is no longer required, we will delete, anonymise, or otherwise cease retaining it by reasonable means.
Under the Personal Data Protection Act 2012 (PDPA), you have the following rights:
We will review and handle requests as soon as reasonably practicable after verifying your identity and within any timeframe required by applicable law. If more time is needed, we will try to explain why and provide an estimated timeline.
This App is currently available in the following Asia-Pacific countries and regions: Singapore, Japan, South Korea, Hong Kong SAR, Macao SAR, Taiwan, Malaysia, Thailand, the Philippines, and Australia. If any of the following laws or similar local data protection laws apply to you, you may have rights of access, correction, deletion, withdrawal of consent, and the right to lodge a complaint with your local data protection authority:
We will respond to rights requests in accordance with the law applicable to you, and on a standard no lower than the Singapore PDPA.
If you are located in a jurisdiction with additional data protection rights (such as the EU/EEA under GDPR, or US states with privacy laws including California's CCPA/CPRA), you may also exercise those rights by contacting us. We will respond in accordance with applicable local laws.
This App is not intended for children under 13 years of age, for minors below a higher minimum age set by applicable local law (some APAC jurisdictions set 14 or 16 as the threshold), or for minors who require parental or guardian consent under applicable local law but have not obtained it.
This App does not use cookies or web tracking technologies (as it is a native mobile application).
We may use the following technologies for service optimisation:
We do not use any third-party advertising tracking SDKs and do not participate in cross-app tracking.
In the event of a data breach that is likely to result in significant harm to affected individuals, or that meets a notification threshold under applicable law, we will:
If you have any questions about this Privacy Policy, wish to exercise your data protection rights, or need to make a complaint, please contact us:
Data Protection Officer
Email: support@niannian.app
We will review and respond to your request as soon as reasonably practicable after verifying your identity. If a request is complex or requires more time, we will let you know our estimated processing time.
If you are not satisfied with our response, you may lodge a complaint with the Personal Data Protection Commission (PDPC) of Singapore at www.pdpc.gov.sg.