# 开口兽 Privacy Policy

Canonical: https://www.xunova.tech/en/kaikoushou/privacy/
Language: en

Read how 开口兽 handles authenticated cloud scenarios, check-in progress, optional local voice input, separate Azure AI permission, collections, account deletion, independent feedback and website analytics.



## Privacy policy

This policy covers 开口兽 and its account, learning-query and support services, provided by Hangzhou Xulian Information Technology Co., Ltd. Effective October 14, 2026; cloud scenarios/check-ins, on-device speech input, two-way translation and website disclosures updated October 15, 2026.
Contact info@xunova.tech about personal information, correction or deletion. Cloud word lookup and translation require separate explicit permission; signing in with Apple does not authorize sending queries to AI.


- [Privacy policy](https://www.xunova.tech/en/kaikoushou/privacy/)
- [Terms of service](https://www.xunova.tech/en/kaikoushou/terms/)
- [Help and support](https://www.xunova.tech/en/kaikoushou/support/)

## Accounts, optional profiles and learning collections



- Sign in with Apple binds an account to the stable subject identifier returned and verified by Apple. The server does not accept a client-declared account identity.
- A name and avatar are optional. If you share a name on first Apple authorization, the app temporarily keeps it locally in case network submission fails, then removes that temporary copy after cloud confirmation or explicit setup completion. A default name is offered when none is available and can be changed. Skipping setup does not mark it complete; signing in again does not overwrite a name you edited.
- Uploaded JPEG avatars are kept in a private Azure Blob container accessible only to the backend. They are served only through authenticated requests, without public URLs or shared access signatures (SAS).
- Original scenarios, dialogues, vocabulary and practice questions are fetched from an authenticated HTTPS catalog API, not a bundled question bank. Playback and local exercise responses do not themselves upload audio or answers or produce ability scores; deliberate check-ins and undo separately sync scene IDs and completion state. Cloud collections store the words, sentences, Chinese meanings and scenario references you deliberately save, linked to your account for restoration and deletion.
- Removing prototype features does not bulk-delete learning state already saved by older versions; account deletion removes that state. Legacy scoring-security records contain no answer text, model feedback or scores and expire on their existing schedule.
- Only hashes of session tokens and sign-in challenges/nonces are stored. When Apple returns a refresh token, it is encrypted with an application-configured key for later validation or attempted Apple authorization revocation during deletion. Plaintext tokens are not directly retained or disclosed.

## Cloud scenarios, current-run memory and check-in progress



- Catalog access requires sign-in and a connection. The server processes the authenticated session and catalog pagination/revision requests, returning original material with stable unique scene/turn IDs and a consistent revision. Questions stay only in current-run memory, without disk storage, a downloaded offline bank or a bundled first-launch catalog. Restarting requires an online reload; an account snapshot is not a question-bank copy.
- Deliberately marking a scenario completed or undoing that choice sends its scene ID and completion state to the account service. Completed IDs stay with the account to restore progress and count completed, untried or category totals. A check-in is your own learning-state record, not a test score, ability assessment or system inference.
- A read-only local account snapshot may retain completed IDs and other state for display or restoration, not offline question text. Account deletion removes cloud check-in records; signing out is not account deletion. Updating catalog material does not require resetting all earlier progress.
- Fetching scenarios or saving check-ins does not authorize Azure AI to process your input. Declining or withdrawing AI word/sentence-query permission does not disable local speech: Kokoro processes loaded text on device, while fetching or reloading the catalog still requires sign-in and a connection.

## Independent feedback and replies



- Feedback in Settings does not require a learning account; its support identity is separate. Only deliberate submission sends a subject, message, category, optional contact email, public app ID, version, build, platform, OS version and language to the shared support service. Continuing a conversation sends later messages. Email ownership is not verified and no automatic email or push reply is sent; reopen the conversation on the same device.
- Feedback does not attach a learning account, sign-in session, learning records, synchronization device identifier, photos, audio, location or logs. Supported devices use production App Attest to verify the app; the service keeps the verification public key and counter. This does not establish user identity, email ownership or message truth. Unsupported devices, including Mac, are marked unverified.
- Each conversation has an independent random access credential, kept in plaintext only in this device’s Keychain; the service keeps its digest. Drafts stay in entry-screen memory, are not written to disk or automatically uploaded, and may remain editable during the current run after failure or closing. Recovery after restarting, reinstalling or changing devices is not guaranteed; this is not account synchronization.
- Support text and an optional email may be linked to you, solely to handle support, not cross-app tracking or marketing. Conversations remain until an administrator deletes them; resolving one does not delete it. Deleting a learning account does not delete independent support conversations. Request deletion in the conversation. After text, email and messages are removed, a content-free duplicate-submission marker can remain; verification public keys and counters have separate retention.
- The shared support service uses Azure resources separate from the learning service. Feedback diagnostics contain only route templates, methods, status, duration, correlation UUIDs and finite failure categories, not bodies, emails, full conversation/key IDs, Authorization, assertions or challenges. Local redacted app logs roll at approximately 2 MiB in system-clearable Caches and are not uploaded; Console logs are OS-managed. Shared-service local logs roll at approximately 20 MiB and are cleaned after seven days. Infrastructure may still process connection information; zero platform-log retention is not promised.

## Word lookup, two-way translation and on-device playback



- English playback and speech input are separate features. The complete Kokoro model ships with the app and generates English speech on device, without Siri voices, online speech services or speech-text uploads. Every playback performs fresh inference and plays audio directly from memory, without saving, caching or reusing generated audio. Legacy generated-audio caches are cleared at startup. A model and voice kept in the current process are not an audio cache. There is no AI ability or pronunciation scoring and no personal-profile data is sent to an AI model.
- Cloud definitions use GPT-4.1 mini hosted by Microsoft Azure OpenAI. Only query content is sent through the backend, not account identifiers, avatars, sessions or collections. Explicit permission is requested before the first query. After permission, the same word/sentence input automatically queries after a typing pause, not only after a button press. Withdraw cloud-processing permission in Settings to stop future queries; withdrawal cannot undo completed third-party processing. This choice is separate from authenticated catalog access and does not disable local playback of loaded text.
- Global Standard inference may process requests across Azure regions worldwide, not exclusively Japan East. Microsoft data-protection and safety-monitoring terms apply; the app does not use the DeepSeek website API.
- English-to-Chinese (en-zh) is the default. Chinese-to-English (zh-en) translates Chinese words or sentences into English with a short Chinese explanation. Neither direction caches or stores translation source text or results in a shared dictionary, account history or text-body application logs; Azure’s model-processing and safety-monitoring terms still apply. Both translation directions and new-word generation share usage limits. Only words and sentences deliberately saved enter a personal collection.
- Generated entries are labeled as AI content, may be wrong and are not an authoritative dictionary. Entries that pass format validation enter a generic shared dictionary separate from personal collections, without user identity; deleting an account does not delete generic definitions. Invalid responses are not stored as successful entries. Subscription billing and trial eligibility are not implemented.
- We require appropriate protection from the services we use, do not use queries for advertising and do not sell personal information. Microsoft describes its processing in the Azure OpenAI data-privacy and security documentation.
- [Azure OpenAI data privacy and security](https://learn.microsoft.com/legal/cognitive-services/openai/data-privacy)

## On-device speech input and deliberate pasting



- The app requests microphone and system speech-recognition permission only after you tap the blue voice-input button. System recognition requires on-device processing through requiresOnDeviceRecognition=true: English in the default English-to-Chinese direction, Chinese in Chinese-to-English. Unsupported devices, systems or language models report an error without cloud-recognition fallback. Cancelling, leaving the page or moving to the background stops recording; this is not continuous background listening.
- Audio and transcripts stay only in current-process memory. The app does not save them to disk, upload recordings or send recognition audio to Azure. Final recognized text fills the query input and is automatically queried only after separate Azure AI cloud-processing permission. Microphone/speech permission does not replace cloud-text permission; withdrawing cloud permission stops future queries. Clipboard text is read only when you tap the system Paste button, not through background clipboard monitoring, and follows the same query-permission rules.

## Storage regions, caches and logs



- The learning backend is currently hosted in Azure Japan East. Account and session state use Azure storage tables there; avatars use a private container in the same storage account. This does not restrict Global Standard inference or the separate support service to that region.
- Cloud account state is authoritative. Local data is a read-only cache for display or restoration, not the final source of truth.
- Diagnostics record request IDs, paths or routes, HTTP status and duration, not avatar contents or personal-profile bodies. Logs are designed to exclude access tokens, Authorization headers, Apple authorization codes and other secrets.
- The learning backend’s Log Analytics configuration checked on October 14, 2026 retains data for 30 days. Independent support-log retention is described above. Zero retention by infrastructure providers is not promised.

## Account deletion and ending sessions



- In-app account deletion removes the account, related sessions, cloud collections, scenario check-in state, scoring-idempotency or counter records, and uploaded avatars, including replaced photos awaiting cleanup. Storage failures return failure and preserve pending-cleanup state for retry rather than reporting false success. An avatar can also be deleted without deleting the account.
- The avatar-storage configuration checked on October 14, 2026 did not enable Blob soft deletion or version retention. Deleted photos are not retained as recoverable copies through those mechanisms. This is not a zero-retention guarantee for Azure infrastructure logs or provider processing.
- Account deletion continues if Apple authorization revocation fails; the response reports revocation success without exposing tokens. Signing out ends a session but does not delete the account or collections.
- There is no subscription feature or automatic subscription-cancellation flow. Independent support conversations require a separate deletion request.

## Your choices and contact



- Settings lets you edit a name, change or delete an avatar, withdraw cloud-language-processing permission and delete an account. Contact Hangzhou Xulian Information Technology Co., Ltd. at info@xunova.tech, mentioning 开口兽, for access, correction or deletion. Do not send passwords, Apple verification codes or access tokens. We may verify the relationship between a request and the data to protect other people.
- The app is not used for cross-app tracking and has no advertising. We do not intentionally collect information from children; minors should use it with a guardian. Do not place sensitive personal information in queries or feedback. Material changes will be reflected in this policy and, where needed, renewed permission.
- [Privacy support: info@xunova.tech](mailto:info@xunova.tech)

## Website visits and email support



- This official website uses Microsoft Clarity to analyze visits and interactions. Hosting and security infrastructure may process IP addresses, requested URLs, browser and device information. Website analytics are separate from the app’s cloud-language permission, collections and independent feedback service. The app’s lack of advertising does not mean that the website has no visit analytics or identifiers.
- Email providers process the address and content you voluntarily send to respond and meet necessary obligations. Website, email and cloud services retain necessary records under their configurations and policies; zero provider-log retention is not promised. Do not email sensitive learning text or credentials.

## Products and official pages

- [开口兽 | English Practice, Two-Way Translation & Local Speech | XUNOVA](https://www.xunova.tech/en/kaikoushou/)
- [开口兽 Privacy Policy | XUNOVA](https://www.xunova.tech/en/kaikoushou/privacy/)
- [开口兽 Terms of Service | XUNOVA](https://www.xunova.tech/en/kaikoushou/terms/)
- [开口兽 Help and Support | XUNOVA](https://www.xunova.tech/en/kaikoushou/support/)
- [XUNOVA App Directory | English, Video, Cycling, Music & Time](https://www.xunova.tech/en/apps/)
- [FocusGo | Homework Habits & Intentional Time | XUNOVA](https://www.xunova.tech/en/focusgo/)
- [FocusGo Privacy Policy | XUNOVA](https://www.xunova.tech/en/focusgo/privacy/)
- [FocusGo Help & Support | XUNOVA](https://www.xunova.tech/en/focusgo/support/)
- [XUNOVA | Native Apps for Mac, iPhone & iPad](https://www.xunova.tech/en/)
- [Haibao AI Video Player for Mac, iPhone & iPad | XUNOVA](https://www.xunova.tech/en/haibao/)
- [AI Video Player for Mac with Bilingual Subtitles | Haibao](https://www.xunova.tech/en/haibao/mac/)
- [iPhone Video Player with AI Subtitles & Wi-Fi Import | Haibao](https://www.xunova.tech/en/haibao/ios/)
- [Haibao Help Center | XUNOVA](https://www.xunova.tech/en/haibao/help/)
- [Haibao Privacy Policy | XUNOVA](https://www.xunova.tech/en/haibao/privacy/)
- [Haibao Terms of Service | XUNOVA](https://www.xunova.tech/en/haibao/terms/)
- [Haibao Compliance Notes | XUNOVA](https://www.xunova.tech/en/haibao/compliance/)
- [BikeX GPS Cycling & Video | Routes, Progress & Sharing | XUNOVA](https://www.xunova.tech/en/bikex/)
- [BikeX Help Center | XUNOVA](https://www.xunova.tech/en/bikex/help/)
- [BikeX Privacy Policy | XUNOVA](https://www.xunova.tech/en/bikex/privacy/)
- [BikeX Terms of Service | XUNOVA](https://www.xunova.tech/en/bikex/terms/)
- [BikeX Compliance Notes | XUNOVA](https://www.xunova.tech/en/bikex/compliance/)
- [Tinyo Music | Apple Music Discovery, Charts & Favorites | XUNOVA](https://www.xunova.tech/en/tinyo/)
- [Tinyo Help Center | XUNOVA](https://www.xunova.tech/en/tinyo/help/)
- [Tinyo Privacy Policy | XUNOVA](https://www.xunova.tech/en/tinyo/privacy/)
- [Tinyo Terms of Service | XUNOVA](https://www.xunova.tech/en/tinyo/terms/)
- [Tinyo Compliance Notes | XUNOVA](https://www.xunova.tech/en/tinyo/compliance/)