Privacy Policy

Version: 2.0 | Effective date: 29 September 2026

Welcome to “Zivo Draw” (the “App”). This Policy explains how Nanjing Heyback Technology Co., Ltd. (the “Company”, “we”, “us”) collects, uses, shares and protects information when you use the App.

The App does not offer account registration. On first launch, the App creates an anonymous user ID for you through Google Firebase and generates a device ID stored on your device. Neither contains your name, phone number or email address, but they are used to link usage records, subscriptions and feedback from the same device (see Section 2).

1. Data Controller

2. Data We Collect

2.1 Identifiers

• Anonymous user ID (created by Firebase anonymous sign-in): the main identifier in the App, also used for subscriptions (RevenueCat), crash reports, push notifications and records on our own servers.
• Device ID: randomly generated by the App and stored locally; a new one is generated if you reinstall the App.
• Push token (FCM / APNs): obtained only after you allow notifications.
• Advertising identifiers (IDFA on iOS, only if you allow tracking; the Advertising ID on Android) and the IDFV on iOS.

2.2 Usage and Device Information

• In-app events, such as screens opened, templates or lessons tapped, drawing duration and outcome, paywall and ad impressions and results, opening of notifications and links, and API error messages.
• Device and environment: platform, OS version, app version, interface language and the country/region set on your device; camera diagnostics additionally include device brand and model.
• This information is sent to Google Firebase Analytics and to our own servers for analytics, product improvement and troubleshooting. Our own servers do not record device model or store IP addresses with these events.

2.3 Onboarding Questionnaire

When you complete onboarding, the optional answers you give — gender, age range, drawing skill level, interests and how you heard about the App — are uploaded to our own servers and set as Firebase Analytics user properties, to understand our audience, measure marketing channels and improve content recommendations. You may skip these questions.

2.4 Subscription and Purchase Information (RevenueCat)

Store country/region, product ID, purchase receipt, renewal and trial status, price and promotional information. To support restoring purchases and push notifications, RevenueCat also receives the anonymous user ID, push token, Firebase instance ID, interface language and subscription status, as well as advertising identifiers (IDFA / Advertising ID, IDFV), IP address and OS version collected by its SDK. We never access your full payment details.

2.5 Advertising (Google AdMob)

The App shows app-open ads, resume ads and rewarded video ads through Google AdMob and currently requests non-personalised ads only. The AdMob SDK processes advertising identifiers, IP address, device information and ad impression/click data under Google’s own policies. Subscribers do not see ads.

2.6 Crashes and Stability (Firebase Crashlytics)

Crash stack traces, non-fatal errors and device state at the time of a crash, associated with the anonymous user ID, used only to locate and fix problems.

2.7 Push Notifications

If you allow notifications, your push token is registered with Google Firebase Cloud Messaging and with our self-hosted push service (located in mainland China, see Section 6), together with device brand, OS version, app version, language and the anonymous user ID, to deliver notifications and measure open rates.

2.8 In-App Feedback

When you submit feedback in the App, we receive: feedback type and description, the contact details you choose to provide (email or phone), screenshots you attach (up to 3), the App’s recent runtime logs (attached automatically to help us investigate), device brand and model, OS version, app version, country/region, the anonymous user ID and device ID, and the IP address at the time of submission.

2.9 Sampled Collection of Drawing Materials

To improve our templates, lessons and tracing experience, the App may collect samples from some devices and some drawing sessions (sampling is controlled by us on the server side, at most 10 times per device per day):

• Reference images: images you pick from your photo library or take with the camera to trace;
• Result photos: photos of your artwork taken or saved on the drawing screen;
• Session information: the template or lesson used, drawing mode, duration, whether the drawing was completed, app version, platform, country/region, the anonymous user ID and device ID, and the IP address at upload time.

Images are downscaled on your device (longest side up to 1024 px) and re-encoded before upload, which removes EXIF data such as the photo’s location. Collected images are used internally to improve the App only; they are not published, sold or used for advertising. If you do not wish to take part, contact us to delete collected content (see Section 10).

2.10 Device Profile

To understand device compatibility (for example camera issues on certain models), the App may collect device and system information on some devices: brand, manufacturer, model, hardware and board information, OS version and security patch, system build information (including the build fingerprint), CPU architecture and core count, memory and storage capacity, display parameters, language and time zone, and whether the device is an emulator. On Android this may also include system properties (excluding hardware identifiers such as MAC address, serial number and IMEI) and the Widevine DRM device identifier. We do not read the list of other apps installed on your device.

2.11 Permissions

The App does not read your location, contacts, clipboard content or list of installed apps.

3. Purposes and Legal Bases

4. Retention

Data past its retention period is deleted or anonymised unless the law requires otherwise. Uninstalling the App removes local data on your device (drafts, preferences, local logs, etc.).

5. Security

We protect data with encryption in transit (HTTPS), access controls and private storage. Drawing materials and feedback attachments are kept in private storage and can be viewed only by authorised staff through temporary links.

6. Storage and International Transfers

• Our servers: in-app events, user profiles, feedback, session information of sampled drawing materials and device profiles are stored on Alibaba Cloud (Singapore).
• File storage: feedback screenshots, runtime logs and sampled drawing images are stored in Cloudflare R2 private storage.
• Push service: our self-hosted push service runs on Alibaba Cloud (Hangzhou, mainland China) and stores push tokens, the anonymous user ID, device brand, OS version, app version and language; notifications are delivered to your device through Google Firebase Cloud Messaging.
• Third-party providers: Google (US / EU), RevenueCat (US), Apple (US / EU).

For transfers from the European Economic Area, the United Kingdom and similar regions to the countries above, we rely on the Standard Contractual Clauses (SCCs) or equivalent safeguards offered by our providers.

7. Who We Share Data With

We do not sell your personal information. We do not share it with third parties except the providers listed above, where required by law, or where necessary to protect the safety of users and the public.

8. Advertising and Tracking Choices

• iOS: go to “Settings › Privacy & Security › Tracking” to turn off “Allow Apps to Request to Track” or tracking for this App.
• Android: go to “Settings › Google › Ads” to delete or reset your Advertising ID.
• Notifications: you can turn off notifications for the App in system settings at any time.
• The App currently shows non-personalised ads only; subscribers do not see ads.

9. Your Rights

Under applicable laws (GDPR / UK GDPR / LGPD / CCPA, etc.) you may:

• access and obtain a copy of data linked to your anonymous user ID or device ID;
• request correction or deletion (where technically feasible), including deletion of collected drawing materials and feedback;
• object to or restrict processing for analytics, drawing-material sampling, device profiling or advertising;
• request an export of your subscription records;
• lodge a complaint with your local supervisory authority.

10. How to Delete Your Data

1. Uninstall the App to delete drafts, preferences and local logs on your device.
2. Delete data on our servers: email support@xiaoheigohome.com with your device model, OS version and app version; if you have submitted feedback before, include its content or time so we can locate your records. After verification we will, within 30 days, delete the in-app events, user profile, feedback, drawing materials and device profile linked to your device, and ask providers such as RevenueCat to delete the corresponding records.

11. Children’s Privacy

The App is rated 4+ on the App Store and E for Everyone on Google Play. It is intended for a general audience and is not directed at children. We do not knowingly collect personal information from children under 13 (or the age set by local law). If you believe a child has provided us with information without parental consent, please contact us and we will delete it.

12. Changes and Contact

If we update this Policy because of feature or legal changes, we will update the “Last updated” date at the top; for material changes we will notify you in the App and obtain your consent where required by law.

Contact:

• Email: support@xiaoheigohome.com
• Address: F2594, No. 18 Yinchun Road, Maigaoqiao Innovation Park, Qixia District, Nanjing, Jiangsu, China

If you are not satisfied with our response, you may complain to your local data protection authority.

Permanent URL: https://static.xiaoheigohome.com/zivo/legal/privacy-policy/v2.0/index.html