Privacy Policy

1. Information we process

We process your account email, password hash and session data; verification and security metadata; camera frames, optional voice recordings, prompts, presets and reference images you submit; generated images and technical job records; photo-credit balances, orders, payment status and limited transaction identifiers; device, IP, request and error data needed for security and reliability. For direct website and Android purchases, Stripe—not Lieca—handles full card details on its hosted checkout. Lieca receives only the limited payment and order data needed to confirm credits, support purchases and handle refunds.

我们处理账号邮箱、密码哈希与会话信息；安全验证数据；你主动提交的取景帧、可选语音、提示词、预设和参考图片；生成结果与任务记录；照片额度、订单和有限的交易标识；以及保障安全稳定所需的设备、IP、请求和错误信息。官网和 Android 直接购买由 Stripe 托管收银台处理完整银行卡资料，Lieca 不会接收或保存；Lieca 只接收确认额度、支持订单和处理退款所需的有限支付与订单数据。

2. How we use it

We use data to create and secure accounts, send verification emails, process AI image requests, match named reference assets, maintain private history, fulfil credit purchases, prevent abuse, provide support, investigate failures and comply with law. We do not use private images to train our own general-purpose model.

上述数据用于创建和保护账号、发送验证码、处理 AI 图片请求、匹配被提及的素材、维护私人历史、完成额度购买、防止滥用、提供支持、排查故障及履行法律义务。我们不会使用你的私人图片训练自有通用模型。

Optional sharing and photo borders

In app versions that offer Plaza publication, a registered account can explicitly confirm publication of a completed image. The public feed exposes a separate copy displayed as AI-generated in Plaza, its post identifier and publication time, not your prompt, original camera frame, reference files, email or account identifier as separate public fields. Anything visibly present in the finished image can still be seen by others. Guests cannot publish. Withdrawing a post, deleting its source result or deleting its account disables that image's public access on our service; people who previously viewed or downloaded it may retain their own copies. Publishing the same result again may reactivate its previous public link. We keep limited publication and moderation records to operate sharing and handle reports.

For supported captures, the app submits selected aperture, shutter-speed, ISO, capture-time and UTC-offset values for photo borders when available. This structured metadata does not include GPS location or a full EXIF record. New border exports show the date and camera settings by default when available; you can turn them off. Account identifier, matched asset names and the slogan are optional and off by default. Prompts are never added by the border renderer. Saving or sharing an export outside the app shares the image and the visible border information you selected.

提供广场发布功能的 App 版本允许已注册账号明确确认发布一张已完成的成片。公开列表提供单独的图片副本、帖子标识与发布时间，广场界面标示 AI 生成；不会将提示词、原始取景帧、参考文件、邮箱或账号标识作为独立公开字段。成片画面本身可见的信息仍会被他人看到。游客不能发布。撤回帖子、删除其源结果或删除账号后，本服务会停用对应图片的公开访问；曾经查看或下载的人可能保留自己的副本。再次发布同一结果可能重新启用此前的公开链接。我们保存有限的发布与内容审核记录，以运行分享功能和处理举报。

对于支持的拍摄，App 会在有实际数据时提交所选光圈、快门速度、ISO、拍摄时间与 UTC 时差，用于照片边框。这组结构化数据不包含 GPS 位置或完整 EXIF 记录。新版边框导出默认显示可用的日期和拍摄参数，也可关闭；账号标识、匹配素材名称和标语均为可选项，默认关闭。边框渲染器不会添加提示词。将导出图片保存或分享到 App 之外时，你选中的可见边框信息也会随图片一起分享。

3. Service providers and transfers

APIMart and its model-processing providers process the scene photos, selected or matched reference images, prompts and optional voice recordings needed for your requested AI image generation and speech transcription. These inputs pass through Lieca's server. Live camera preview and ordinary PHOTO shots are not sent to AI. App versions with the AI permission control ask for your explicit permission before a new AI request sends these inputs; you may decline and use ordinary PHOTO, or withdraw permission for future requests in Settings on that device. Already submitted jobs may still finish. Withdrawal does not erase previously submitted information; contact support about deletion and retention.

Infrastructure and security vendors support hosting and abuse prevention; Resend delivers account and support emails; Stripe processes eligible direct purchases, while Apple App Store and Google Play process purchases within their respective store builds. For Apple purchases we receive limited transaction identifiers, product, environment, account-binding token, payment/refund status and credit-ledger data, not your full card details. Providers may process data outside your country under their own terms and safeguards. We disclose only what is necessary for each task and do not promise that all upstream providers have zero retention.

APIMart 及其模型处理服务商会处理完成你所请求的 AI 生图与语音转写所需的场景照片、选中或匹配的参考图、提示词及可选录音，数据经过 Lieca 服务器转发。实时取景与普通 PHOTO 照片不会发送给 AI。提供 AI 许可控制的 App 版本会在新 AI 请求发送这些数据前征得明确同意；你可以拒绝并使用普通 PHOTO，也可以在该设备设置中撤回对未来请求的许可。已提交任务可能仍会完成；撤回不等于删除既有上游数据，删除与留存问题可联系支持。

基础设施与安全服务商提供托管和防滥用能力；Resend 处理账号和支持邮件；Stripe 处理符合条件的直接购买，Apple App Store 与 Google Play 则处理各自商店版本中的购买。Apple 购买涉及有限交易标识、商品、环境、账号绑定令牌、支付或退款状态与额度账本，不包含完整银行卡资料。服务商可能在你所在国家或地区之外，依据其条款与保障措施处理数据；我们只提供任务所需信息，不承诺所有上游均为零留存。

4. Retention and deletion

Account content is kept while your account is active or until you delete it, subject to backups, fraud prevention and legal retention. Verification codes expire quickly and are consumed once. Payment and ledger records may be retained for accounting, dispute and legal obligations. Use the dedicated account deletion page for direct in-app deletion or a web request; we will explain any records that must be retained.

账号内容在账号存续期间保存，也可由你删除；备份、防欺诈与法定留存可能造成有限延迟。验证码会短期过期并一次性消费。支付和账本记录可能因会计、争议和法律义务而继续留存。请使用专门的账号删除页面在 App 内直接删除或提交网页申请；我们会说明必须保留的记录。

Guest trial and onboarding

The no-login trial uses a private guest identity and a randomly generated installation identifier. We use keyed hashes of installation identifiers and eligible email addresses, plus bounded IP-based limits, to prevent repeated promotional grants. Trial images, presets and assets remain private to that guest session. Unclaimed guest access expires after 7 days, and expired guest content is queued for periodic deletion. Content you claim through registration or account sign-in follows the account retention rules above. You can also delete the guest session in the app.

We record limited onboarding events, such as viewing or dismissing the introduction or registration offer, and trial/registration credit outcomes. Onboarding events and promotional eligibility hashes have a 30-day retention window and are removed by periodic cleanup. Deleting an account does not immediately erase the limited anti-abuse eligibility hash; it does not retain the deleted email address in that record. Backups, pending processing and the separate payment-retention rules above can delay complete erasure.

免登录试用使用独立的私密游客身份与随机生成的安装标识。我们使用安装标识和符合赠送条件的邮箱的带密钥哈希，以及有限的 IP 频率限制，防止重复领取赠送额度。试用图片、预设和素材仅属于该游客会话。未承接的游客访问在 7 天后失效，过期内容进入定期清理；通过注册或登录账号承接的内容适用上述账号留存规则。你也可以在 App 内删除游客会话。

我们记录有限的新手流程事件，例如查看或关闭导引、注册优惠提示，以及试用和注册额度结果。新手事件与赠送资格哈希的留存窗口为 30 天，由定期任务清理。删除账号不会立即删除有限的防重复领取资格哈希，但该记录不保留被删除的邮箱原文。备份、尚未结束的处理及上述独立支付留存规则可能延迟彻底清除。

5. Security, children and your rights

We use access controls, user-scoped storage, encrypted transport, short-lived access tokens and protected refresh sessions. No system is risk-free. The service is not directed to children under 16. Depending on your location, you may request access, correction, deletion, export, restriction or objection by contacting us. We may verify your identity before acting.

我们使用访问控制、用户隔离存储、加密传输、短期访问令牌与受保护的刷新会话，但任何系统都不能保证绝对安全。本服务不面向 16 岁以下儿童。根据所在地法律，你可联系我们申请访问、更正、删除、导出、限制处理或提出异议；处理前可能需要验证身份。

6. Contact and updates

Controller/operator: An Kang, independent developer, Hong Kong. Contact us through the private support form. Material changes will be dated here and, when appropriate, notified in the app or by email.

控制者/运营者：香港独立开发者安康。请通过私密支持表单联系我们。重大变更会在此更新日期，并在适当情况下通过 App 或邮件通知。

Plaza safety controls

In versions offering these controls, you can report a public image or its creator and block a creator from your signed-in Plaza feed. We store the reporting or blocking account and creator identifiers, the related public post identifier, the selected reason where applicable, and timestamps. Reports are reviewed by authorised administrators; their decisions and necessary actions are audited. Blocking does not notify the creator, remove their content for everyone, or make publicly available images private. You can view and remove your own blocks in the app. New publication confirmations also record the account, post, accepted consent version and time; earlier publication records are not reinterpreted as acceptance of the new confirmation.

Unblocking removes that block relationship. Deleting an account clears its new Plaza block, creator-report and publication-consent relationships in the active database, including relationships concerning that deleted account. Separate security or administrator audit records and backups may remain subject to the retention and legal obligations described above. Do not include private credentials or unrelated personal information in reports.

在提供这些控件的版本中，你可以举报公开作品或其作者，也可以在自己登录后的广场中屏蔽作者。我们保存举报或屏蔽账号与作者的内部标识、相关公开帖子标识、适用的所选理由以及时间。经授权的管理员会核查举报，并对处理决定和必要操作留存审计。屏蔽不会通知作者，不会为所有人删除其内容，也不会把公开图片变为私密；你可在 App 中查看和取消自己的屏蔽。新版发布确认还记录账号、帖子、所接受的同意版本和时间，旧发布记录不会被重新解释为接受了新版确认。

取消屏蔽会删除该屏蔽关系。删除账号时，当前数据库会清理该账号新建的广场屏蔽、作者举报和发布同意关系，包括以该已删除账号为对象的关系；独立安全或管理员审计记录及备份仍可能依据上述留存规则和法律义务保存。不要在举报中提供密码或无关的个人信息。