Your core Ebbwell data — habits, check-ins, course progress, reflections, and preferences — is stored locally on your device by default. Using AI coaching sends the text and context described below to our backend and AI service providers. To authenticate devices, verify Pro access, and manage AI usage, our backend stores a randomly generated device identifier, an HMAC authentication token, the record's creation time, free/Pro status, Pro expiration time (if applicable), the original Apple transaction ID when Pro is verified, and the current month's AI call count, limit, and reset time in Cloudflare Workers KV. These device, entitlement, and usage records have no automatic expiration or scheduled deletion; they remain until removed. The monthly call count resets when the record is next accessed in a new month; this does not delete the device record. Request rate-limit counters are keyed by device identifier and expire 120 seconds after their last update. Registration rate-limit counters are keyed by IP address and expire 61 minutes after their last update (a one-hour window plus 60 seconds). Ebbwell 的核心数据——习惯、打卡记录、课程进度、反思笔记与偏好设置——默认存储在你的设备本地。使用智能教练时，下文列出的文本和相关信息会发送到我们的后端及 AI 服务提供商。为验证设备、核验 Pro 权益并管理 AI 用量，后端会在 Cloudflare Workers KV 中保存随机生成的设备标识符、HMAC 身份验证令牌、记录创建时间、免费版或 Pro 状态、Pro 到期时间（如适用）、核验 Pro 时的 Apple 原始交易 ID，以及当月 AI 调用次数、额度和重置时间。这些设备、订阅权益和用量记录没有自动过期时间，也不会定期删除；在被删除前会持续保留。进入新月份后，下次读取记录时会重置月度调用次数，但不会删除设备记录。请求限流计数以设备标识符区分，最后一次更新后 120 秒过期；注册限流计数以 IP 地址区分，最后一次更新后 61 分钟过期（1 小时的限流窗口加 60 秒）。
When you use the AI Coach, your reflection, craving note, or conversation text is sent through our secure API proxy to AI service providers to generate a response. Requests also include your habit name and type (when available), current streak in days, and locale (language and region setting). Craving feedback includes craving intensity; course reflection feedback includes the course, section, day, and reflection question. Companion chat also sends recent conversation history, including your messages and AI replies (currently up to 19 prior messages). Our backend does not persist this text or conversation history, and Ebbwell does not use it to train AI models. AI providers process this text and context under their own policies; any retention by a provider is governed by that provider and is not controlled by Ebbwell. The AI Coach provides supportive guidance, not medical advice. 使用智能教练时，你提交的反思、渴望记录中的笔记或对话文本会通过我们的安全 API 代理发送给 AI 服务提供商，用于生成回复。请求还会包含习惯名称和类型（如有）、当前连续坚持天数，以及语言和地区设置。渴望反馈还会发送渴望强度；课程反思反馈还会发送课程、章节、天数和反思问题。陪伴对话还会发送近期对话记录，包括你发送的消息和 AI 回复（目前最多 19 条历史消息）。我们的后端不会持久保存这些文本或对话记录，Ebbwell 也不会用它们训练 AI 模型。AI 服务提供商按照各自的政策处理这些文本和相关信息；提供商是否保留、保留多久由其自身政策决定，不受 Ebbwell 控制。智能教练旨在提供支持性指导，而非医疗建议。
Contacts access is used only to select trusted supporters in the Guardian feature. Notifications are used only to send daily reminders. You can disable these permissions in system Settings at any time, and related features may become unavailable. 通讯录权限仅用于你在「守护者」功能中选择可信联系人；通知权限仅用于发送每日提醒。你可以随时在系统设置中关闭这些权限，关闭后相关功能可能受限。
Subscription purchases are processed by the Apple App Store. We do not receive or store your full payment information (such as card numbers). We store your subscription entitlement status locally to unlock Pro features including the AI Coach. Our backend also verifies Apple transaction information and stores your free/Pro status, Pro expiration time (if applicable), and original transaction ID as described in Section 1. 订阅购买由 Apple App Store 处理。我们不会获取或存储你的完整支付信息（如银行卡号）。我们在本地保存订阅状态，用于解锁 Pro 功能（包括智能教练）。后端也会核验 Apple 交易信息，并按第 1 节所述保存免费版或 Pro 状态、Pro 到期时间（如适用）和原始交易 ID。
The current version does not enable third-party advertising tracking and does not collect cross-app behavior that directly identifies you. Our AI service keeps operational logs with request IDs, provider and model names, token counts, timings, and routing or error information. These operational log fields do not include your message text or device identifier. If we introduce analytics tools in the future, we will update this policy and provide appropriate choices. 当前版本不启用第三方广告追踪，不会收集可直接识别你身份的跨应用行为数据。我们的 AI 服务会记录运行日志，包括请求 ID、提供商和模型名称、Token 数量、耗时，以及路由或错误信息。这些运行日志字段不包含你的消息文本或设备标识符。若未来引入分析工具，我们会在隐私政策中更新说明并提供相应选择。
You can use "Delete Account Data" in the app's Settings to delete local habits, records, course progress, and related settings. This action does not delete the server-side device, subscription entitlement, or AI usage records described in Section 1. There is currently no in-app control or API endpoint to delete those server records. To request their removal, contact us via "Send Feedback" in the app or email soberly@uppervoid.app. This local deletion action also does not delete any text retained by AI providers under their own policies. 你可以在应用设置中使用「删除账户数据」，删除本机的习惯、记录、课程进度与相关设置。此操作不会删除第 1 节所述的服务器端设备、订阅权益或 AI 用量记录。目前没有用于删除这些服务器记录的应用内操作或 API 接口。如需申请删除，请通过应用内「发送反馈」或邮件 soberly@uppervoid.app 联系我们。本地删除操作也不会删除 AI 服务提供商依据其自身政策保留的文本。
If you have questions or requests about this Privacy Policy, contact us via "Send Feedback" in the app or email: soberly@uppervoid.app. 如对隐私政策有任何疑问或请求，请通过应用内「发送反馈」或邮件联系：soberly@uppervoid.app。