Privacy Policy
The short version. Qsum keeps your ledger on your device. We never store your transactions, your audio, or the text you ask us to parse. To turn speech or text into entries, the content is processed in real time and then discarded. We do keep the minimum needed to run accounts, credits, and subscriptions.
1. Who we are
Qsum is developed and operated by Zihao Liu, an independent developer (“Qsum”, “we”, “us”). For the purposes of the EU/UK GDPR, we are the data controller for the processing described here. You can reach us at zihao.liu.qs@icloud.com.
2. What stays on your device
Your ledger, categories, settings, search history, statistics, theme photo, and pending import drafts are stored in the app’s sandbox on your iPhone or iPad. They are not uploaded to us and there is no Qsum cloud sync. If you enable device backups (iCloud Backup or a computer backup), the app’s data may be included in that backup according to your iOS settings; that backup is controlled by you and Apple, not by us.
Face ID / Touch ID / Optic ID verification and on-device OCR run locally. Screenshots are converted to text on your device; the image itself is not uploaded.
3. What we process on our servers
Account and device
- If you sign in with Apple, we receive Apple’s stable subject identifier for Qsum and, only if you choose to share it, your name and email address. Apple may use a private relay address.
- We create an internal account ID and a random device installation ID. Session tokens are stored only as hashes.
AI requests (speech, screenshots, shared text)
- Cloud speech recognition. If you choose “Cloud enhanced”, your recording is sent over HTTPS to our server and then to Alibaba Cloud DashScope (Beijing region) for transcription. We do not store or log the audio, and it is discarded after the request.
- Text parsing. The transcript, or the text extracted from a screenshot or shared/pasted text, is sent to DeepSeek (Hangzhou, China) to identify entries. We do not store or log this text. Server logs contain request metadata (such as device ID, path, status, latency, and cost) but never the transcript or the text.
- On-device speech recognition. If you choose on-device recognition, audio never leaves your device. The resulting text is still sent to our server and DeepSeek if you ask Qsum to parse it.
- Manual entry with the keypad does not contact our servers.
Credits and usage
To bill AI usage fairly, we record the number of requests, audio seconds, token counts, the resulting credit charge, your balance, timestamps, and a random request ID. These records are linked to your account or anonymous device. They do not contain your transactions or the content you submitted.
Subscriptions
Purchases are processed by Apple. We receive and store the App Store transaction identifiers, product ID, purchase environment (Production or Sandbox), expiry date, and revocation status so we can unlock membership and respond to App Store server notifications. We never receive your payment card or bank details.
Technical logs
Our server logs the IP address, device or account identifier, request path, HTTP status, latency, and time of requests for security, rate limiting, and troubleshooting. Logs are kept for up to 90 days and then rotated out.
4. What we do not do
- We do not store your transactions, audio recordings, transcripts, or OCR text on our servers.
- We do not use advertising SDKs, cross-app tracking, or analytics SDKs.
- We do not sell or rent personal data.
- We do not use your content to train AI models.
5. Why we process data (legal bases)
- Contract. To provide the app, accounts, AI processing, credits, and subscriptions you request.
- Legitimate interests. To keep the service secure, prevent abuse and fraud, enforce rate limits, and diagnose failures. We balance these interests against your rights.
- Consent. For optional features such as cloud speech recognition and Sign in with Apple. You can withdraw consent at any time by changing the setting, signing out, or contacting us; this does not affect processing that already happened.
- Legal obligation. Where we must retain or disclose information to comply with applicable law.
6. Service providers and international transfers
We use a small number of processors:
- DigitalOcean — hosting of our API server in the United States.
- Alibaba Cloud (DashScope) — cloud speech recognition, Beijing region, only when you choose cloud recognition.
- DeepSeek — text parsing, China, only when you use AI entry.
- Apple — Sign in with Apple, App Store purchases, and subscription status.
- Resend — delivery of operational alert emails to the developer. It does not receive your ledger data.
This means data may be transferred to and processed in the United States and China. Where required, we rely on your consent or on contractual and technical safeguards for these transfers. You can avoid the China transfer for audio by choosing on-device speech recognition; text parsing still uses DeepSeek unless you enter transactions manually.
7. Retention
- Account, device, credit, and subscription records: kept while your account or device record is active, and deleted when you delete your account (or when we process a deletion request for an anonymous device).
- Operational logs: up to 90 days.
- Audio, transcripts, and OCR text: not retained beyond the real-time request.
Deleting the app does not automatically delete an anonymous device record on our server. Email us if you want that record removed.
8. Your rights
Depending on where you live, you may have the right to access, correct, delete, restrict, or object to processing, to data portability, and to withdraw consent. You can delete your account in the app (Settings → Account → Delete Account), which removes your account, identities, sessions, credits, and subscription records from our server. You can also email us. We will respond within the period required by applicable law. EU/UK users may lodge a complaint with their local supervisory authority; mainland China users may contact the relevant cyberspace or consumer protection authority.
Deleting your Qsum account does not cancel an App Store subscription. Cancel it in your Apple ID subscription settings.
9. Children
Qsum is not directed to children under 13 (or under 14 in mainland China, or under 16 in the EEA where applicable). We do not knowingly collect personal data from children. If you believe a child has provided data, contact us and we will delete it.
10. Security
We use HTTPS for all network traffic, store session tokens as hashes, restrict server access, and keep the service patched. No system is perfectly secure; please use a device passcode and keep iOS up to date.
11. Changes
We may update this policy as the app changes. We will post the new version here with a new effective date, and for material changes we will provide notice in the app or by email where appropriate.
12. Contact
Questions or requests: zihao.liu.qs@icloud.com.
隐私政策
一句话版本。账本保存在你的设备上。我们不保存你的流水、录音，也不保存你交给 AI 解析的文字。语音和文字只在请求过程中实时处理，处理完即丢弃。服务器只保留账号、积分和订阅运行所必需的最少信息。
1. 我们是谁
Qsum 由独立开发者刘子豪开发和运营（下称“Qsum”或“我们”）。就本政策所述的处理活动，我们是个人信息处理者。联系方式：zihao.liu.qs@icloud.com。
2. 只留在你设备上的数据
你的账本、分类、设置、搜索记录、统计、主题照片和待导入草稿都存放在 App 的沙盒里，不会上传给我们，Qsum 也没有云端同步。如果你开启了 iCloud 备份或电脑备份，App 数据可能随系统备份一起保存；这部分由你和 Apple 控制，不经过我们。
面容 ID / 触控 ID / 视控 ID 验证和截图文字识别都在本机完成。截图会先在设备上转成文字，图片本身不会上传。
3. 服务器会处理哪些数据
账号与设备
- 使用“通过 Apple 登录”时，我们会收到 Apple 为 Qsum 生成的稳定用户标识；只有你选择共享时，才会收到姓名和邮箱。Apple 可能使用隐藏邮箱地址。
- 我们会生成内部账号 ID 和随机的设备安装 ID。登录会话令牌只以哈希形式保存。
AI 请求（语音、截图、分享文字）
- 云端语音识别。选择“云端增强”时，录音会通过 HTTPS 发到我们的服务器，再转发给阿里云百炼 DashScope（北京地域）转写。我们不保存、不记录录音，请求结束后即丢弃。
- 文字解析。转写文本，或从截图、分享 / 粘贴文字中提取的文字，会发给 DeepSeek（中国杭州）用于识别流水。我们不保存、不记录这些文字。服务器日志只包含设备 ID、接口路径、状态码、耗时和成本等元数据，绝不含转写或原文。
- 本机语音识别。选择本机识别时，录音不离开设备；但只要你让 Qsum 解析，识别出的文字仍会发到我们的服务器和 DeepSeek。
- 小键盘手动记账不访问我们的服务器。
积分与用量
为了按真实用量公平扣积分，我们会记录请求次数、音频秒数、token 数量、实际扣减的积分、余额、时间戳和随机请求 ID。这些记录关联到你的账号或匿名设备，但不包含你的流水或提交的内容。
订阅
购买由 Apple 处理。我们会接收并保存 App Store 交易标识、产品 ID、购买环境（正式 / 沙盒）、到期时间和撤销状态，用于开通会员和响应 App Store 服务器通知。我们不会收到你的银行卡或支付账户信息。
技术日志
为安全、限流和排查故障，服务器会记录 IP 地址、设备或账号标识、请求路径、HTTP 状态码、耗时和请求时间。日志最多保留 90 天，之后轮转删除。
4. 我们不会做的事
- 不在服务器保存你的流水、录音、转写文本或截图文字。
- 不接入广告 SDK、跨 App 追踪或分析 SDK。
- 不出售、不出租个人信息。
- 不把你的内容用于训练 AI 模型。
5. 处理目的与合法性基础
- 履行合同。提供你请求的 App 功能、账号、AI 处理、积分和订阅服务。
- 正当利益。保障服务安全、防止滥用和欺诈、执行限流、诊断故障；我们会权衡这些利益与你的权利。
- 同意。云端语音识别、通过 Apple 登录等可选功能。你可以随时在设置中更改、退出登录或联系我们撤回同意，撤回不影响此前已发生的处理。
- 法定义务。在适用法律要求时保留或披露信息。
6. 服务商与跨境传输
我们只使用少量受托处理方：
- DigitalOcean：在美国托管我们的 API 服务器。
- 阿里云（DashScope）：云端语音识别，北京地域，仅在你选择云端识别时使用。
- DeepSeek：文字解析，中国境内，仅在你使用 AI 记账时使用。
- Apple：通过 Apple 登录、App Store 购买和订阅状态。
- Resend：向开发者发送运维告警邮件，不会收到你的账本数据。
因此，数据可能被传输到美国和中国境内处理。在适用法律要求时，我们会依据你的同意或相应的合同与技术保障措施进行跨境传输。选择本机语音识别可以避免录音出境；但只要你使用 AI 自动记账，文字解析仍会使用 DeepSeek，除非你改用手动记账。
7. 保存期限
- 账号、设备、积分和订阅记录：在账号或设备记录存续期间保存；删除账号时一并删除（匿名设备记录可按你的请求删除）。
- 运维日志：最多 90 天。
- 录音、转写文本和截图文字：请求结束后不保留。
删除 App 不会自动删除服务器上的匿名设备记录；如需删除，请发邮件联系我们。
8. 你的权利
根据你所在地的法律，你可能有权查阅、更正、删除、限制或反对处理、要求数据可携带，以及撤回同意。你可以在 App 内删除账号（设置 → 账号 → 删除账号），这会从服务器删除你的账号、登录身份、会话、积分和订阅记录；也可以发邮件联系我们。我们会在法律规定的期限内答复。欧盟 / 英国用户可以向我方或当地监管机构投诉；中国大陆用户可以联系网信或消费者权益保护部门。
删除 Qsum 账号不会取消 App Store 订阅，请到 Apple ID 的订阅设置中取消。
9. 未成年人
Qsum 不面向 13 周岁以下儿童（中国大陆为 14 周岁以下，欧盟适用地区为 16 周岁以下）。我们不会有意收集儿童的个人信息。如果你认为儿童向我们提供了信息，请联系我们删除。
10. 安全
所有网络请求使用 HTTPS；会话令牌以哈希保存；服务器访问受限并及时更新补丁。任何系统都无法做到绝对安全，请设置设备密码并保持 iOS 更新。
11. 政策更新
随着 App 功能变化，我们可能更新本政策。新版本会发布在本页并标注新的生效日期；如有重大变化，我们会通过 App 内提示或邮件等方式另行通知。
12. 联系我们
问题或请求：zihao.liu.qs@icloud.com。