玲珑键盘隐私政策

生效日期：2026 年 10 月 12 日

玲珑键盘由 XYZTech 提供。本政策说明玲珑键盘宿主 App、键盘扩展、离线字典、可选 AI 联想、剪贴板同步，以及主 App 中默认关闭的统计和广告接入准备如何处理数据。

1. 基础输入默认离线

基础拼音、九键、候选、符号、表情、离线字典和个人词库均在设备本地处理。使用这些功能不需要注册账户，也不需要把键盘的“允许完全访问”打开。

XYZTech 不在基础输入路径中运营收集键入内容的服务器，不出售个人数据。键盘扩展不接入广告或第三方统计，不把输入内容用于广告画像或跨 App、跨网站追踪。主 App 已包含统计和广告 SDK 的准备代码，但当前统计和广告总开关关闭，不启用第三方统计或正式投放广告；详见第 6 节。

2. 设备上的本地数据

玲珑键盘会在设备或 App Group 容器中保存以下内容，以便宿主 App 与键盘扩展共享必要状态：

  • 键盘布局、单手模式、高度、分类词库和 AI 开关等设置；
  • 用户主动添加的常用语、快捷缩写、分组和置顶信息，以及主动设置的候选置顶／屏蔽规则；
  • 用户主动选择候选形成的本地词频和关联学习记录；
  • 表情最近使用记录；
  • 用户主动开启并导入的剪贴板历史；
  • 当日 AI 请求次数、输入 Token、输出 Token、缓存复用和本地跳过次数；
  • 键盘是否完成过首次使用的状态。

恢复误删功能只在当前键盘会话内暂存本次删除的最多 256 字，不写入磁盘、不参与同步；关闭键盘、切换输入框或输入位置改变后清除。常用语和候选偏好不参与个人词库导入导出或剪贴板云同步。可在“设置 > 布局与快捷输入”删除常用语或恢复候选规则。

这些数据默认不会发送给 XYZTech。若用户另行开启 iCloud 多设备同步，符合条件的剪贴板记录会进入用户自己的 CloudKit 私有数据库；创建或加入跨平台共享空间后，只有明确分享到该空间的记录会进入该空间，具体见第 5 节。空间密钥保存在宿主 App 的本设备钥匙串中，键盘扩展只获取空间名称和标识，不获取密钥。个人词库只能由用户主动通过系统文件界面导入或导出，导出文件不包含 AI 配置或 API Key。

3. 可选 AI 联想

AI 联想是可选能力。只有同时满足以下条件时，玲珑键盘才会发起 AI 网络请求：

  1. AI 设置处于启用状态（初始开关开启，但不代表已授权联网）；
  2. 用户配置了有效的服务地址、模型和必要凭据；
  3. 用户确认了当前配置对应的数据发送授权；
  4. 用户在系统设置中为玲珑键盘打开“允许完全访问”。

AI 请求可能包含当前拼音或九键数字、输入类型和候选数量限制，以及光标前最多 24 个字符，用于生成中文候选。初始配置没有 API Key，也没有数据共享授权，不会自动发送键入内容。请求会直接发送到用户选择的 LM Studio、Ollama、Chat Completions 兼容服务或 DeepSeek 端点。XYZTech 不运营中转服务器。

玲珑键盘不限定单一 AI 服务商，内置本地、国内云、国际云和聚合服务预设，并允许填写自定义 Chat Completions 兼容端点。预设包括 LM Studio、Ollama、DeepSeek、通义千问、Kimi、智谱 GLM、腾讯混元、火山方舟/豆包、MiniMax、SiliconFlow、OpenRouter、xAI、Mistral、Together AI、Perplexity 和 Cohere。首次使用 AI 或保存新的 AI 配置前，主 App 会显示一份可滚动的数据共享声明，明确列出当前服务提供商、端点、模型和可能发送的数据。用户可以选择“允许并继续”或“暂不允许”；选择“暂不允许”会关闭 AI，且不会影响离线输入。

远端服务可能按其自身条款处理、记录或保留请求内容，并可能产生费用。用户应在启用前阅读所选服务提供商的隐私政策和服务条款。修改提供商、端点、模型、上下文范围或数据共享声明版本后，玲珑键盘会使旧授权失效并要求重新确认。

4. API Key 与安全

AI API Key 保存在 Apple 钥匙串中，并设置为仅本设备可用。API Key 不写入普通偏好、个人词库导出文件、分析事件或应用日志。

除本地网络服务外，玲珑键盘只允许 HTTPS AI 端点。HTTP 仅允许 localhost、IPv4 回环地址、IPv6 回环地址 ::1、有效的 .local 名称，以及完整的 10.0.0.0/8、172.16.0.0/12、192.168.0.0/16 私有 IPv4 地址；远程服务必须使用 HTTPS。

5. 完全访问与剪贴板

基础输入不需要完全访问。联网 AI、在键盘内主动读取系统剪贴板及分享记录需要完全访问；iCloud 和共享空间的网络同步由宿主 App 执行，键盘扩展不直接访问 CloudKit 或中继。

5.1 本机历史

剪贴板历史默认关闭。打开键盘历史面板本身不会读取系统剪贴板，只有点按“导入当前”才读取。主 App 的“导入当前剪贴板”也属于主动读取，并会开启本机历史。纯文本先保存在本机 App Group，每条最多 2000 字；本机记录和每个共享空间分别最多保留 50 条。正文有效期为 24 小时，到期后不再展示或同步，并在 App 下次读取记录或执行同步时清理，不承诺 App 未运行时按时擦除磁盘或远端副本。

5.2 可选 iCloud 同步

iCloud 多设备同步独立默认关闭，并需要在主 App 另行确认。开启后，符合条件的主动导入文本、随机记录标识、创建/过期时间和删除状态会进入 iCloud.com.xyztech.XYZKeyboard 的 CloudKit 私有数据库，用于同一 iCloud 用户的设备同步。不会同步按键记录、输入上下文、个人词库、AI 配置或 API Key。它使用 Apple CloudKit 的访问与传输保护，本 App 不为这一通道增加应用层端到端加密。同步在主 App 启动、回到前台或手动刷新时执行，未启用实时后台 iCloud 同步。

5.3 Android / iOS 共享空间

共享空间与 iCloud 是独立通道。初始没有已加入的空间；你需要主动创建空间或扫描邀请加入，再对某条记录点“分享”选择空间。仅明确分享到该空间的记录及删除标记参与交换，本机其他历史不会因加入空间或开启自动同步而自动上传。加入已有空间会立即接收该空间仍有效的共享记录。

共享正文使用 AES-256-GCM 在设备上加密，通过 HTTPS 发往你配置的中继，或局域网内选出的兼容中继。持有同一邀请中的空间密钥的成员设备可以解密正文；邀请二维码等同于钥匙，请只交给可信成员。本 App 提供的中继存储密文，但可见空间和记录标识、时间、删除状态、密文大小以及连接所需的网络信息；兼任空间成员的中继设备也持有空间密钥。自定义中继由其运营者控制。XYZTech 不运营接收这些记录的公共中继。

“自动同步”和“自动选择中继”初始开启；它们仅对已主动创建或加入的空间生效。自动同步会在主 App 前台交换已分享记录，并申请由 iOS 决定执行时间的后台刷新；可随时关闭。自动选择中继会在局域网发现兼容中继，并在当前中继不可用时由设备接替；iPhone/iPad 作为中继需保持 App 前台，进入后台或锁屏会停止。该机制可能更新空间使用的中继地址，但不改变空间密钥和接收成员。

“同步内容直接放入系统剪贴板”初始关闭，来源空间初始未选择。主动开启并选择来源空间后，主 App 仅在前台把该空间新收到的合格文字写入系统剪贴板；检测到你刚复制新内容时会避免覆盖。此写入使用本机限定、24 小时过期的系统剪贴板选项，不通过 Apple 通用剪贴板继续传播；你仍可自行粘贴或复制到其他 App。

5.4 敏感过滤与后续使用

本机规则会在 iCloud 上传和共享空间分享前拦截疑似密码、验证码、API Key、访问令牌、银行卡号、助记词和长密钥；自动识别不能覆盖所有秘密，请自行确认分享内容。拦截的本机记录仍可由你在本机使用或删除。该过滤不代表对 AI 上下文作同样保证：将记录插入文本框后，如果继续使用已授权 AI，文本末尾最多 24 个字符可能成为发往所选服务的上下文。

6. 本地用量与主 App 统计、广告准备

主 App 显示的 AI Token 与请求统计保存在本机，仅用于帮助用户了解当日使用情况。它们不是服务提供商账单，也不会上传给 XYZTech。

6.1 当前默认关闭

主 App 独立包含 Firebase Analytics Core、友盟 U-App / UMDevice、Google AdMob、Google User Messaging Platform（UMP）及穿山甲 GroMore SDK。当前统计和广告总开关均为关闭状态；配置了服务标识并不代表已经启用服务。应用不主动启用统计采集、调用广告启动接口或请求、展示广告；正式采集和广告展示尚未启用。已链接的 SDK 仍可能在应用装载时执行构造器和基础检查；关闭这些业务开关不是所有 SDK 装载处理或网络活动为零的保证。键盘扩展不链接、初始化或调用这些 SDK。

统计与广告使用分别取得同意，不能用同意 AI、完全访问、同意统计或仅已回答弹窗代替广告授权。主 App 设置提供独立控制和撤回入口。未配置、未明确同意或 App Store 商店地区无法确定时，应用不主动启用对应统计采集、调用广告启动接口或发起广告请求；这些选择不影响基础离线输入。若将来完成配置并启用，主 App 会在主动启动对应服务前说明接收方、用途和数据范围。

6.2 启用后的主 App 统计范围

服务按 App Store 商店地区选择：中国大陆使用友盟 U-App，其他已确定地区使用 Firebase Analytics；该选择不使用精确定位。统计限于主 App 安装后的首次打开（first_open）、会话及固定枚举的功能事件，不收集键盘输入、拼音、光标上下文、剪贴板正文、API Key、AI 请求正文或个人词库，也不记录任意用户输入的事件名称或参数。首次打开表示已同意统计且运行主 App 的安装实例，不等于 App Store 下载量，也不覆盖未打开主 App 或未同意的用户。

统计 SDK 在启用后还可能处理安装实例标识、App / SDK 版本、系统和设备信息、事件时间及连接所需的网络信息，以生成汇总使用报告。此类数据不能保证绝对匿名。Firebase 采用不含广告标识支持及设备端广告转化模块的 Core 组件，默认不采集 IDFV，并将广告存储、广告用户数据和广告个性化同意设为拒绝。统计同意不用于开启广告画像或跨服务身份关联。

6.3 启用后的主 App 广告范围

广告仅允许出现在主 App，不能出现在键盘、候选栏或输入流程。当前中国大陆与其他已确定商店地区均选择 Google AdMob 提供广告。GroMore 保留为后续国内广告接入准备，尚未启用；未来切换前将更新相关披露，并在需要时重新征求同意。除独立广告同意与有效配置外，还须通过会员状态核验和非会员门禁；每次请求和展示前重新检查资格。当前没有正式广告投放，也不会因拒绝统计或广告而限制基础输入。

AdMob 启用前通过 UMP 更新适用地区的隐私选择，并在需要时提供隐私选项入口。UMP 允许请求广告不替代本 App 的独立广告同意，也不替代 Apple 的追踪许可。当前准备态不取得 IDFA；任何未来跨 App / 跨网站追踪或 IDFA 使用都须先满足 Apple App Tracking Transparency 授权和相关同意要求，拒绝追踪时不得改用指纹识别。

GroMore 的准备配置限制个性化广告，禁止 IDFA、位置、Wi-Fi BSSID、传感器访问和额外设备信息上传。这些限制不等于广告网络完全不处理数据。广告服务实际启用后仍可能处理 IP 地址及推断的大致地区、App / SDK / 设备信息、设备标识（如 GroMore 的 IDFV）、系统语言与时区、网络状态、诊断、广告展示、点击和互动数据；接收方为所选广告服务及实际配置的广告合作方。不会把键盘输入、剪贴板、AI Key 或个人词库作为广告定向数据。

6.4 接收方、保留和撤回

Firebase / AdMob / UMP 由 Google 提供，友盟 U-App / UMDevice 由友盟同欣（北京）科技有限公司提供，GroMore 由北京巨量引擎网络技术有限公司提供。启用后的数据处理还受其各自隐私政策、服务配置和适用法律约束，可能在其运营地区处理。可参阅 Firebase 隐私与安全、Google 隐私政策、友盟隐私政策和 GroMore SDK 隐私政策。

关闭统计或撤回广告同意会阻止后续符合该授权条件的采集、广告请求和展示，但不会自动删除服务已经收到的数据。若未来启用这些服务，远端数据保留和删除取决于当时的服务政策及后台配置；可通过官方支持渠道提出隐私请求，或使用接收方提供的控制。当前未启用的准备状态不代表已有第三方安装统计或广告收入。

7. 数据保留与删除

本地设置和学习数据保留到你修改、清空或移除应用容器，具体受 iOS 备份和钥匙串行为影响。剪贴板正文有效期为 24 小时；到期清理在下次读取或同步时进行。关闭历史、关闭 iCloud 或关闭共享空间自动同步不会自动擦除现有远端副本。

删除 iCloud 或共享空间中的记录会在相应通道后续成功同步时传播删除标记；标记不含正文，有效期最多 7 天，清理也依赖后续运行/同步。离线设备和中继不能保证立即擦除。“删除 iCloud 剪贴板数据”操作成功后擦除 CloudKit 正文及对应本机记录，并保留短期删除标记；它不删除独立共享空间的数据。共享空间记录可在同步内容列表中删除或清空，删除会同步到该空间。移除空间只移除本机空间密钥并停止对该空间的同步，不会自动删除其他成员、中继或已接收的本机历史。已经由成员复制或导出的副本无法由本 App 撤回。

用户可以随时关闭 AI、撤回授权和清空 API Key。关闭 AI 后不会再发起新的 AI 请求，但不能撤回服务已经收到的数据。

如需在删除 App 前清除钥匙串凭据，请先在 AI 设置中清空 API Key。远端 AI 服务已经收到的数据应按相应服务提供商提供的控制方式管理或删除。

8. 离线字典与开放数据

离线字典和内置词库使用 Unicode Unihan、CC-CEDICT、中文维基词典等开放数据源。这些语言资料随 App 发布，不包含用户个人信息。来源、许可和署名见 App 字典页面及 第三方词库文档（见主 App“字典”页底部 / See the bottom of the App’s Dictionary page）。

9. 儿童隐私

玲珑键盘不以收集儿童个人信息为目的。基础输入默认离线。若监护人为儿童配置第三方 AI 服务，应同时审阅该服务提供商的年龄要求和隐私条款。

10. 联系与政策更新

隐私或数据处理问题可通过 玲珑键盘支持页 联系 XYZTech。

如果产品功能或数据处理方式发生实质变化，XYZTech 会更新本政策，并修改顶部的生效日期。

XYZKeyboard Privacy Policy

Last updated: October 12, 2026

App Provider: XYZTech
Contact: XYZKeyboard Support

This Privacy Policy describes how XYZKeyboard (玲珑键盘), its host application, and its keyboard extension handle information. Core input is local and offline; AI networking, iCloud sync, and cross-platform clipboard spaces are optional. The host App also includes analytics and advertising integration preparations that are disabled by default, as described below.

1. Summary

XYZKeyboard does not require an account. Basic full-pinyin input, nine-key input, local candidate processing, symbols, emoji, personal lexicons, and offline dictionary lookup are designed to run on your device.

XYZTech does not operate an input-content server for basic keyboard use and does not sell your personal information. The keyboard extension contains no advertising or third-party analytics integration and does not use input content for advertising profiles or cross-app or cross-site tracking. Host-App analytics and advertising master switches are currently off; there is no active third-party analytics or live advertising service.

If you enable optional AI, the App may send limited input data directly to the provider and endpoint you choose. That provider's privacy policy and terms govern its handling of the request after transmission.

2. Information Processed Locally

Depending on the features you use, XYZKeyboard may process or store the following on your device or in the shared App Group container used by the host app and keyboard extension:

  • keyboard layout, one-handed mode, height, appearance, input-mode, category-lexicon, and AI settings;
  • quick phrases, their shortcuts, groups and pin settings that you create, and candidate pin/block preferences that you explicitly set;
  • current composition state and local candidate-processing data;
  • personal lexicon entries, local word frequency, and association-learning records created by your selections;
  • recently used emoji records;
  • clipboard-history text that you explicitly import after enabling the history feature;
  • offline dictionary and lexicon data distributed with the App;
  • AI request counts, cache hits, local skips, prompt-token counts, completion-token counts, and locally estimated usage; and
  • the state needed to remember onboarding, consent, and configuration decisions.

API keys for configured AI providers are stored in the Apple Keychain using the shared access group needed by the host app and keyboard extension. The ordinary AI configuration does not contain the API key, and personal-lexicon exports do not include it.

Quick phrases and candidate preferences remain local and are not part of personal-lexicon exports or clipboard cloud sync. You can delete phrases and restore candidate preferences in Settings > Layout & Quick Input. The deletion-recovery tool keeps up to 256 characters from your recent keyboard deletions only in session memory, never on disk. Closing the keyboard, changing fields or changing the input context clears that recovery state.

The App may temporarily retain AI candidate responses in process memory to avoid duplicate requests. This cache is short-lived and is not intended as permanent storage.

3. Optional AI Data Sharing

AI is optional. Its initial configuration switch is on, but there is no saved credential or data-sharing consent, so it does not automatically transmit input. Candidate requests require an enabled, valid configuration, explicit consent for that configuration, and the system access needed by iOS. The local candidate strategy may also skip a request when local results are sufficient.

The AI Service Disclosure identifies the possible request contents and explains the provider, endpoint, model, consent, and deletion controls. In summary, a request may contain the current pinyin letters or nine-key digits, the input mode, pinyin-correction information, and up to 24 characters immediately before the cursor. The request is normalized and limited before transmission.

Requests go directly from the App to your configured endpoint. XYZTech does not operate a proxy, relay, or server that receives and stores those requests. A provider may process, retain, log, use, or disclose the request and response under its own policies, and may charge fees. Review the provider's current terms and privacy policy before enabling it.

4. Clipboard, Full Access, and Optional Sync

Basic input does not require Full Access. Network AI, explicit clipboard import in the keyboard, and sharing a keyboard history item require Full Access. The host App performs iCloud and shared-space network synchronization; the extension does not directly access CloudKit or relay endpoints.

Local history

Clipboard history is disabled by default. Opening the keyboard history panel does not read the system clipboard; tapping “Import Current” does. The host App's “Import Current Clipboard” is also an explicit read and enables local history. Plain text is stored in the App Group container, with at most 2,000 characters per item and 50 items in local history and separately in each shared space. Text is valid for 24 hours, then is excluded from display and sync and removed when the App next reads or synchronizes records. This is not a promise of timed disk or remote erasure while the App is not running.

Optional iCloud sync

iCloud multi-device sync is separately disabled by default and requires confirmation in the host App. It sends eligible explicitly imported text, random record identifiers, creation/expiration times, and deletion state to the user's private database in iCloud.com.xyztech.XYZKeyboard. It does not synchronize keystroke logs, input context, personal lexicons, AI configuration, or API keys. This channel uses Apple CloudKit's access and transport protections; the App does not add application-level end-to-end encryption to CloudKit. It runs when the host App launches, becomes active, or is manually refreshed, and is not real-time background iCloud sync.

Android / iOS shared spaces

Shared spaces are independent of iCloud. No space is joined initially. You explicitly create a space or scan an invitation to join, then choose a destination space using an item's Share action. Only records explicitly shared to that space and their deletion markers are exchanged; joining or enabling automatic sync does not upload other local history. Joining an existing space immediately receives its still-valid shared records.

Text is encrypted on-device using AES-256-GCM and sent over HTTPS to a relay you configure or a compatible relay selected on the local network. Devices holding the space key from the same invitation can decrypt the text. The invitation QR code is a key: give it only to trusted members. The supplied relay stores encrypted records, while space/record identifiers, timestamps, deletion state, ciphertext sizes, and connection information remain visible to it. A relay device that is also a space member holds that space's key. Custom relays are controlled by their operators; XYZTech does not operate a public relay receiving these records. Space keys are stored in the host App's device-only Keychain; the extension receives only public destination names and identifiers.

Automatic Sync and Automatic Relay Selection start enabled and apply only to spaces you have explicitly created or joined. Automatic sync exchanges shared records in the foreground and requests background refresh scheduled by iOS; you can disable it. Automatic relay selection discovers compatible LAN relays and can let a device take over when the current relay is unavailable. An iPhone/iPad relay must keep the App in the foreground and stops in the background or when locked. A relay address can change without changing the space key or members.

“Put synced content directly on the system clipboard” starts disabled, with no source space selected. If you enable it and select a source space, the foreground App writes newly received eligible text from that space to the system clipboard. It checks for a recent local copy to avoid overwriting it. These writes use local-only and 24-hour expiration options, rather than propagating through Apple's Universal Clipboard. You can still paste or copy text into other apps yourself.

Sensitive content and subsequent AI use

On-device rules exclude suspected passwords, verification codes, API keys, access tokens, payment-card numbers, seed phrases, and long secrets from iCloud upload and shared-space sharing. Detection cannot identify every sensitive value: review text before sharing. Rejected local records remain available for local use or deletion. The same exclusion is not promised for AI context: if you insert a record and continue with authorized AI, up to 24 trailing characters may become part of the context sent to your selected provider.

5. Information XYZTech Does Not Collect Through the App

Based on the current implementation, XYZTech does not collect through its own servers:

  • an account name, email address, phone number, contact list, or account credentials;
  • advertising identifiers or cross-app tracking data from the keyboard extension;
  • precise location, payment information, or biometric information;
  • the content of basic offline input;
  • personal-lexicon exports, unless you choose to send them to us in a support request; or
  • AI request content through a XYZTech proxy or analytics service.

Apple may provide crash or diagnostic information if you separately choose to share diagnostics with app developers through Apple settings. Any such information is handled under Apple's applicable processes and is used to diagnose and improve the App.

6. How Information Is Used

Local information is used to:

  • provide input, candidate ranking, correction, symbols, emoji, dictionary, and learning features;
  • synchronize necessary settings between the host app and keyboard extension;
  • display local AI usage statistics;
  • remember your data-sharing decision for the exact AI configuration you approved; and
  • support troubleshooting when you voluntarily provide information through the support channel.

XYZTech does not use local input, personal lexicons, or local AI statistics for advertising or profiling.

7. Sharing and Third-Party Services

XYZTech does not sell your personal information. Information may leave your device when you choose to:

  • enable an AI provider and authorize a request;
  • copy, share, or export text or a personal lexicon through iOS;
  • submit a support request or attach diagnostics;
  • enable clipboard synchronization to the private CloudKit database associated with your iCloud account;
  • join a shared clipboard space, share a record to its members through a configured or selected relay, or enable received-text clipboard writes;
  • separately consent to host-App analytics or advertising if those services are configured and activated in a future release;
  • use iOS backups, device migration, or other Apple services according to your settings; or
  • open content in another app or service.

When you share content with a provider, app, website, service, or person, that recipient's privacy policy and terms apply. Offline language data and local input libraries support on-device functionality. The host App separately includes the inactive third-party SDK preparations described below.

Host-App analytics and advertising: current preparation state

Only the host App includes Firebase Analytics Core, Umeng U-App / UMDevice, Google AdMob, Google User Messaging Platform (UMP), and CSJ GroMore. Analytics and advertising master switches are currently off; configuring service identifiers alone does not activate these services. The App does not explicitly enable analytics collection, call advertising start APIs, or request or display ads. Live analytics collection and ad delivery have not been activated. Linked SDKs may still execute load-time constructors and basic checks when the App loads; these disabled business controls are not a guarantee of zero SDK load-time processing or network activity. The keyboard extension does not link, initialize, or call these SDKs.

Analytics and advertising have separate consent choices and withdrawal controls in host-App settings. AI consent, Full Access, analytics consent, or merely answering a prompt does not authorize advertising. With missing configuration, missing affirmative consent, or an unresolved App Store storefront, the App does not explicitly enable the corresponding analytics collection, call advertising start APIs, or make ad requests. These choices do not affect basic offline input. Before any future activation, the host App will explain recipients, purposes, and data scope before explicitly starting the corresponding service.

Analytics scope if activated

The App Store storefront selects Umeng U-App for mainland China and Firebase Analytics for other resolved storefronts; this does not use precise location. Analytics covers host-App first open after installation (first_open), sessions, and a fixed enumeration of feature events. It excludes keyboard input, pinyin, cursor context, clipboard text, API keys, AI request contents, and personal lexicons. Event names and parameters do not contain arbitrary user-entered content. First open measures an installation instance that runs the host App with analytics consent; it is not an App Store download count and does not include people who never open the host App or decline analytics.

When enabled, the SDK may also process an app-installation identifier, App/SDK versions, OS and device information, event times, and network information needed for the connection to produce aggregate usage reports. This is not a guarantee of absolute anonymity. Firebase uses the Core component without advertising-identifier support or on-device advertising conversion modules, defaults IDFV collection to off, and defaults ad storage, ad user data, and ad personalization consent to denied. Analytics consent does not enable advertising profiles or identity matching across services.

Advertising scope if activated

Ads may appear only in the host App, never in the keyboard, candidate bar, or input flow. Currently, mainland-China and other resolved storefronts select Google AdMob for advertising. GroMore remains prepared for future mainland-China advertising and has not been activated; relevant disclosures will be updated and consent requested again where necessary before a future switch. In addition to separate advertising consent and valid configuration, ad requests and presentation require verified membership status and non-member eligibility. Eligibility is checked again before every request and presentation. There is currently no live ad delivery, and refusing analytics or advertising does not restrict basic input.

Before AdMob activation, UMP refreshes applicable privacy choices and provides a privacy-options entry point when required. Permission to request ads from UMP does not replace the App's separate advertising consent or Apple's tracking permission. The current preparation state does not obtain IDFA. Any future cross-app/cross-site tracking or IDFA use requires applicable consent and prior authorization through Apple's App Tracking Transparency framework. A tracking refusal must not be bypassed through fingerprinting.

The GroMore preparation limits personalized advertising, forbids IDFA, and disables access to location, Wi-Fi BSSID, sensors, and uploads of additional device information. These restrictions do not mean an ad network processes no data. When actually activated, advertising services may still process IP addresses and inferred approximate region, App/SDK/device information, device identifiers (such as IDFV for GroMore), system language and time zone, network state, diagnostics, impressions, clicks, and other ad interactions. Recipients are the selected advertising service and the ad partners actually configured. Keyboard input, clipboard text, AI keys, and personal lexicons are not supplied for advertising targeting.

Recipients, retention, and withdrawal

Google provides Firebase, AdMob, and UMP; Umeng Tongxin (Beijing) Technology Co., Ltd. provides U-App and UMDevice; Beijing Ocean Engine Network Technology Co., Ltd. provides GroMore. Processing after activation is also governed by each provider's policies, service configuration, and applicable law, and may occur where it operates. See Firebase Privacy and Security, the Google Privacy Policy, Umeng's Privacy Policy, and the GroMore SDK Privacy Policy.

Disabling analytics or withdrawing advertising consent blocks subsequent collection, requests, and presentation that require that consent. It does not automatically erase data already received. If these services are activated later, remote retention and deletion depend on their then-applicable policies and account settings; you can use their controls or the official support channel for a privacy request. The present inactive preparation does not imply that third-party installation reports or advertising revenue already exist.

8. Retention and Deletion

Local settings and learning data remain until changed, cleared, or removed with the app container, subject to iOS backup and Keychain behavior. Clipboard text is valid for 24 hours; expiration cleanup occurs on subsequent record access or synchronization. Disabling history, iCloud sync, or automatic shared-space sync does not itself erase existing remote copies.

Record deletion is propagated through its applicable iCloud or shared-space channel on subsequent successful sync. Deletion markers contain no text and remain valid for up to seven days, with cleanup on later runs/syncs. Offline devices and relays cannot be promised immediate erasure. A successful “Delete iCloud Clipboard Data” operation erases CloudKit text and corresponding local records while retaining short-lived deletion markers; it does not erase independent shared-space data. You can delete or clear shared-space records from the synced-content list to propagate deletion to that space. Removing a space removes its local key and stops syncing it, without automatically erasing other members' copies, relay copies, or previously received local history. Copies already exported or copied by members cannot be recalled by the App.

To remove an AI credential, clear the API key in AI settings before deleting the App. To stop new AI sharing, disable AI or revoke the data-sharing decision. These actions cannot delete data already received by a third-party provider. Use that provider's deletion and retention controls for provider-side data.

If you contact XYZTech using the official contact published on the support page, your message, contact details, and diagnostics you choose to provide are used to respond and investigate the request. The selected communication or hosting service may process and retain them under its own terms. Do not include sensitive input text, passwords, or API keys.

9. Security

XYZKeyboard uses iOS app sandboxing, App Group storage, the Apple Keychain, CloudKit's private database, and HTTPS requirements for non-local remote AI endpoints. CloudKit sync has no additional app-level end-to-end encryption. Shared-space text uses the separate encryption and membership model described in Section 4; it is not private to a single iCloud account. No storage or transmission method is perfectly secure. Protect your device with a passcode and review the security and privacy settings of any AI provider or local-network service you configure.

10. Children

XYZKeyboard is not designed to collect children's personal information. We do not knowingly collect personal information from children through our own servers. Parents and guardians should review the age requirements and privacy terms of any third-party AI provider configured in the App.

11. International Processing

Core input is processed locally. If you enable a third-party provider, contact XYZTech through the published support channel, share diagnostics through Apple, or use another external service, information may be processed in countries where that recipient or its service providers operate.

12. Your Choices and Rights

You can control the main data flows by:

  • leaving AI disabled;
  • refusing or withdrawing consent for an AI configuration;
  • separately refusing or withdrawing host-App analytics and advertising consent in settings;
  • revoking Full Access in iOS Settings;
  • clearing the API key and local settings in the App;
  • deleting personal lexicon entries or exported files;
  • disabling clipboard sync or deleting iCloud clipboard data from clipboard settings; and
  • deleting XYZKeyboard from your device.

Depending on where you live, you may have additional privacy rights. To ask a privacy question or submit a request, use the XYZKeyboard Support page. We may need enough information to understand and respond to the request, but please do not send unnecessary personal data.

13. Changes to This Policy

We may update this Privacy Policy when the App, its data flows, third-party integrations, or legal requirements change. The updated version will be identified by the "Last updated" date above. If a change materially affects how information is handled, we will update the in-app disclosure or request a new consent where appropriate.

14. Contact

For questions about this Privacy Policy or XYZKeyboard data practices:

XYZTech
XYZKeyboard Support

Please do not include passwords, API keys, or private input text in a support request.