1. App and developer
App: 机账通（FleetLedger）
Android package: com.yuyuan.fleetledger
Developer, contracting entity and personal information controller: 眉山市源链网络科技有限责任公司
App filing: 蜀ICP备2026013936号-1A
Alibaba Mail (company email): developer@yuyuan.net.cn (Alibaba Cloud enterprise mail, stored in China)
QQ Mail (developer contact email): 582748196@qq.com (provided by Tencent and handled under its own privacy policy)
This policy covers the iOS and Android editions of FleetLedger. Services depend on the installed distribution edition, not the device brand.
The Apple App Store seller is the individual “远 余”.
2. Data, scenarios and purposes
We process the following information for the features you use. Login, cloud processing and subscription verification require acceptance of this policy. You may decline and skip login to use local records. The entries below describe the source, purpose, processing method and retention of each category.
Digital Vouchers (currently Work Hours Confirmation): when the feature is available and you choose to create a work hours confirmation, the app uploads the selected project, equipment, dates, work content and hours as a confirmation snapshot over HTTPS, together with the issuing account ID and contact information you enter. The purpose is to show and confirm work content and hours with external recipients you select, keep a confirmation audit, generate a PDF and link corrections. It does not confirm rates, amounts, receivables, debts, settlement or payment. Snapshots, confirmation audits and correction chains are stored on the developer's Alibaba Cloud servers in mainland China; PDFs are held in object storage in mainland China. The app may keep local records and temporary downloaded files.
Recipients: you send a link or PDF to external recipients through the system share sheet or another sharing method. A person holding a valid link can view the document and, after reviewing the project, equipment, dates, work content and hours, directly confirm or sign as selected by the sender. Links may be forwarded; possession does not verify the person's real identity or authority to act for someone else. The confirmation audit records the confirmation method and time, confirmed snapshot digest, statement version, and hashes of the IP address and browser information to trace the confirmation action. Once confirmed, the original content cannot be edited in place; the issuer must create a correction document, retaining the link between the original and corrections, the reason and confirmation status. A PDF is a downloadable, shareable document copy.
Signature confirmation: when a recipient submits a handwritten signature on a Work Hours Confirmation after checking the consent box, the service collects the handwritten signature image, signing time, IP address and user agent (browser information) as evidence of that confirmation. The retained signature image is only visible to the sender through authenticated account access, including the sender’s app confirmation document and PDF copies. The sender may choose to share PDF copies containing the signature. Holders of a valid link can view the confirmation status and time, but the link does not provide the retained signature image. Immediately after signing, the recipient can see the locally captured preview on that page. Signature evidence follows the same retention and deletion rules as the document’s confirmation audit, described in section 7.
Confirmation snapshots, confirmation audits, signature images and server-held PDFs follow the shared retention rules in section 7. Unconfirmed, expired and voided documents are kept for 7 days and then deleted automatically; all signed documents (direct confirmation, SMS verification, handwritten signature and missing or unknown confirmation methods) and their complete correction chains are kept permanently and deleted only when you delete them or delete your account. Retention is not linked to settlement. For an unconfirmed voucher whose link has expired, seven days starts at link expiry; for an expired voucher, at expiry; and for a voided voucher, at voiding.
Core Usage Analytics: after you agree to this policy, successful creation of work hours, payments, fuel, maintenance or Digital Vouchers by a signed-in account sends daily Beijing-time feature markers and only five environment fields (platform, brand, phone model, OS major version and app display version) to our own server. This supports core-operation activity, D1/D7 retention and compatibility analysis, including free accounts. We do not upload amounts, hours, customers, projects, user-named equipment, notes or voucher content, read your phone’s custom name, unique device or advertising identifiers, or record opens, views, operation counts or heartbeats. Environment combinations are stored separately and account-linked identities are deduplicated for totals; combinations are not phone counts. Signed-out operations or periods without an accepted privacy policy are not collected or backfilled. Analytics is on after you agree to this policy. Withdrawing privacy consent (available at any time under Devices → Settings → Withdraw Privacy Policy Consent) makes the app stop collection immediately and clears pending analytics records of all accounts on this device; analytics details already received by the server are not deleted immediately and are automatically deleted after at most 90 Beijing calendar days, counted by the analytics date. Daily details are kept for the most recent 90 Beijing calendar days including today; reports accept today and the preceding 7 calendar days. Older origins are compressed to a “before window” state without dates or environment fields, without permanent environment profiles; after privacy-consent withdrawal, this “before window” origin record and any analytics consent record left by earlier versions are not removed by the 90-day cleanup and are kept until account deletion. After account deletion is accepted, the server deletes this account’s analytics details and origin in the deletion process without waiting for the 90-day expiry (failures are retried and completion is within the 30-calendar-day deletion period in section 7), and recalculates retention.
Data: Device, hours, fuel, project money, maintenance and selected avatars
Scenario: When you enter, edit or select files
Purpose: Records, statistics and export
Method: Local input and selection; no upload solely for local bookkeeping
Retention: Until you delete records, clear app data or uninstall; you manage system backups and exports
Location: Your device
Data: Phone number, login credentials, internal account ID and consent version
Scenario: Consented login or session restoration
Purpose: Identity, account isolation, backup and entitlement ownership
Method: HTTPS account API; tokens in system secure storage
Retention: Held while the account exists; deletion within 30 calendar days; token expiry does not mean server records are deleted
Location: Your device; SQLite on Chengdu ECS
Data: Phone number, code verification request, send/check results and request IDs
Scenario: When you request or submit login/deletion codes
Purpose: SMS identity verification and abuse prevention
Method: Developer server calls Aliyun verification API
Retention: Codes expire as displayed; verification and abuse-prevention records are kept for the purpose and deleted when that purpose ends
Location: Our account server is on Chengdu ECS; Alibaba Cloud DYPNS handles information under its applicable terms and policies
Data: Encrypted backups, backup metadata and account ID
Scenario: Manual backup, list or restore
Purpose: Backup and device migration
Method: Client-side encryption, HTTPS upload and account-authorized download
Retention: Until deletion request or account closure; cloud deletion within 15 days after verification and acceptance; account deletion follows the 30-calendar-day process; exports managed separately
Location: Backup objects: Hangzhou OSS; metadata: SQLite on Chengdu ECS
Data: Device registration metadata, business changes, account ID and conflicts
Scenario: Only with sync configured and consented, at startup, foreground or manual sync
Purpose: Multi-device account consistency
Method: Upload/download changes through developer sync API
Retention: Held with the account; included in 30-calendar-day account deletion
Location: SQLite on Chengdu ECS
Data: Store transaction IDs, verification information, account/subscription linkage and entitlement state
Scenario: Consented iOS purchase, restore or verification. Android starts a one-time 365-day order after consent; unrecognized channels do not start payment
Purpose: Verify entitlement and avoid duplicate processing
Method: iOS uses Apple payment. On Android the developer server signs the amount when you start a payment. No bank card numbers or payment passwords
Retention: Our own IAP (in-app purchase) transaction, subscription verification, entitlement and account-linked records are kept while the account exists and deleted on account deletion. Apple retains its own App Store purchase records independently under its privacy policy: https://www.apple.com/legal/privacy/data/en/app-store/
Location: Our records: SQLite on Chengdu ECS; Apple transaction queries involve cross-border processing by US and Irish recipients
Data: Email content, contact details and attachments you send
Scenario: When you contact us or make a privacy request
Purpose: Support, identity verification and request handling
Method: Email; only information needed for the request
Retention: Support/request records are kept for 1 year after handling is completed, then deleted
Location: Company email uses Alibaba Cloud enterprise mail, stored in China; QQ Mail is provided by Tencent and handled under its own policy
Data: Server access information such as IP, time, endpoint and result
Scenario: Network API or public support-site access
Purpose: Service delivery, security and troubleshooting
Method: Network and developer-server/hosting access records; GitHub Pages logs visitor IP addresses and other technical information
Retention: Access/security logs are kept for the purpose and deleted when that purpose ends
Location: Developer API servers are on Chengdu ECS; GitHub Pages may process website access information in the US
Data: Server-verified account link, five daily Boolean feature markers and platform, device_brand, device_model, os_major_version, app_version; no business content or unique device identifiers
Scenario: After agreeing to the current privacy policy, signing in, and successfully using the related features
Purpose: Core-operation activity, D1/D7 retention and compatibility analysis; no operation counts
Method: Own HTTPS API idempotently merges account, date and five-field environment combinations
Retention: Details are automatically deleted after 90 Beijing calendar days including today, counted by analytics date (also after privacy-consent withdrawal; no immediate deletion); older origins compress to before-window, and after withdrawal the before-window origin and any earlier analytics consent record are kept until account deletion. Account deletion deletes details, origin and consent records in the deletion process
Location: Independent SQLite on our Alibaba Cloud server in mainland China; local analytics queue excluded from business backups and sync
3. Permissions and system features
Photos: when you choose a device avatar, the system picker returns the selected image. iOS may request photo access; manage it under Settings → FleetLedger → Photos. Android uses the system picker without requesting access to all photos or all files. Denial leaves default avatars and bookkeeping available.
Files and sharing: user-initiated import, export and sharing use the system picker or share sheet. You choose the recipient, who controls the shared copy.
Network: Android INTERNET and ACCESS_NETWORK_STATE support consented network features. They do not authorize access to contacts, SMS or location.
This edition does not request contacts, location, microphone, SMS-reading or camera permissions. The app itself does not read IMEI or advertising identifiers for tracking. You enter verification codes manually. Store reviews, email and browser links open only on your action.
4. Third-party services
We do not sell personal information or integrate advertising, push, crash reporting or map SDKs. Core usage analytics is processed by our own server. SMS verification uses a server API, not an embedded Aliyun one-tap-login SDK. Services are listed below. Local Flutter storage and file-picker plugins do not receive permission to upload business records to their authors.
System sharing hands the content you select to your chosen app, which handles it under its own policy.
Entity: Alibaba Cloud Computing (Beijing) Co., Ltd. and Alibaba Cloud Computing Co., Ltd. (as specified in their published terms)
Service: Aliyun Number Verification SMS
Data: Phone number, verification parameters, request IDs and results
Purpose: Send and verify SMS codes
Scenario: User requests or submits account verification codes; Work Hours Confirmation SMS is currently off
Method: Server API; not a client one-tap-login SDK
Entity: Apple Inc. (US), Apple Distribution International (Ireland; applicable entities per Apple’s published terms)
Service: App Store / StoreKit / App Store Server API
Data: Transaction information, subscription linkage and state
Purpose: Purchase, restore and verify subscriptions
Scenario: Consented iOS store edition only
Method: System store interfaces; our IAP backend sends transaction IDs to api.storekit.apple.com for subscription queries involving cross-border processing; payment credentials are handled by the store
https://www.apple.com/legal/privacy/data/en/app-store/
Entity: Apple (applicable entities per Apple’s published terms and privacy policy)
Service: TestFlight beta testing
Data: Tester email addresses and crash/diagnostic data
Purpose: Provide beta testing, diagnose issues and improve the app
Scenario: The app has used TestFlight; when testers participate in TestFlight beta testing
Method: The app has used TestFlight for beta testing. During beta testing, tester email addresses and crash/diagnostic data are processed by Apple and may be processed outside mainland China, under Apple’s TestFlight & Privacy notice and privacy policy.
https://www.apple.com/legal/privacy/en-ww/
https://www.apple.com/legal/privacy/data/en/test-flight/
Entity: 支付宝（杭州）数字服务技术有限公司
Service: App Alipay client SDK (Android APP pay)
Data: Android ID, OAID, sensor list, screen density, carrier information, Wi-Fi parameters, network type, plus the changeable device identifiers, basic device information and network information in the privacy statement appendix
Purpose: Protect account and payment security and keep the payment service stable; meet anti-money-laundering, counter-terrorist-financing and anti-fraud duties; choose and optimize the network path
Scenario: Recognized Android store editions only. After you accept the current policy and start a one-time Plus or Pro payment, the SDK reads the information above for that payment request. It is not initialized and does not collect before consent, including at launch. iOS does not include this SDK
Method: Official Android SDK 15.8.40. PayTask is created only inside the payment method. Alipay's own app handles the payment password and bank card. The privacy statement link is below
https://opendocs.alipay.com/common/02kiq3.md
Entity: Alibaba Cloud Computing Co., Ltd. (as specified in its published terms)
Service: ECS/OSS hosting for account, backup, sync, subscription verification and Work Hours Confirmation
Data: Corresponding account/cloud data in section 2
Purpose: Host data and network services
Scenario: Consented use of network features
Method: Chengdu ECS and SQLite; cloud backup objects in Hangzhou OSS and Work Hours Confirmation objects in Chengdu OSS
Entity: GitHub, Inc.
Service: GitHub Pages public support site
Data: Visitor IP addresses and other technical access information; the app passes no account or ledger parameters
Purpose: Host and display support documents
Scenario: User opens the website in a browser; the in-app policy is displayed offline
Method: Browser access to GitHub Pages; technical access information may be processed in the US
https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement
Entity: Alibaba Cloud Computing Co., Ltd. (as specified in its published terms)
Service: Alibaba Cloud enterprise mail
Data: User-sent email content, addresses, headers and attachments
Purpose: Receive and handle support and privacy requests
Scenario: User sends an email
Method: Company email developer@yuyuan.net.cn uses Alibaba Cloud enterprise mail, stored in China
https://help.aliyun.com/zh/document_detail/466827.html
Entity: Tencent (as specified in QQ Mail’s own published policy)
Service: QQ Mail
Data: User-sent email content, addresses, headers and attachments
Purpose: Receive and handle support and privacy requests
Scenario: User sends an email
Method: Developer contact email 582748196@qq.com is provided by Tencent and handled under its own privacy policy
https://wx.mail.qq.com/list/readtemplate?name=app_intro.html#/agreement/privacy
5. Storage locations and international processing
The business database and selected avatars are initially stored on your device. For editions distributed in mainland China, Hong Kong and Macao, our account, cloud sync and IAP subscription verification data is stored in SQLite on Alibaba Cloud ECS in Chengdu (cn-chengdu). Cloud backup objects are stored in Hangzhou OSS; Work Hours Confirmation objects, including PDFs, are stored in Chengdu OSS. When users in Hong Kong or Macao use these network features, the relevant data is sent to mainland China servers.
These storage locations do not describe every third party’s processing. Account SMS uses the Alibaba Cloud DYPNS server API; Work Hours Confirmation SMS is currently off. The SMS provider handles information under its applicable terms and policies. GitHub Pages hosts the support site. GitHub logs visitor IP addresses and other access information and may process it in the US. The app passes no account or ledger parameters when opening the fixed support URL. Company email developer@yuyuan.net.cn uses Alibaba Cloud enterprise mail, stored in China. QQ Mail 582748196@qq.com is provided by Tencent and handled under its own policy.
iOS uses App Store / StoreKit. Our IAP backend sends transaction IDs to api.storekit.apple.com to query subscription status, involving cross-border processing by recipients including Apple Inc. (US) and Apple Distribution International (Ireland), under Apple’s privacy policy. This subscription query does not upload the ledger. The app does not integrate Sign in with Apple, APNs or iCloud. See section 4 for providers and privacy policies.
The app has used TestFlight for beta testing. During beta testing, tester email addresses and crash/diagnostic data are processed by Apple and may be processed outside mainland China, under Apple’s TestFlight & Privacy notice and privacy policy.
https://www.apple.com/legal/privacy/data/en/test-flight/
https://www.apple.com/legal/privacy/en-ww/
Self-hosted core usage analytics is processed with our account service on Alibaba Cloud servers in mainland China.
6. Security
Production account and backup endpoints require HTTPS. Login tokens use system secure storage. Servers validate identity and isolate account data. Cloud backups use client-side encryption and require the corresponding key for restoration. Application diagnostic logs redact phone numbers, tokens and subscription identifiers.
The local business database is not an end-to-end encrypted database. Device access, system backups and exported files also affect security. Protect your device and exports. We will investigate personal-information incidents, take remedial action and notify affected users as required.
7. Retention and deletion
Category-specific retention is listed in section 2. Signing out or uninstalling does not delete server data or cancel a store subscription.
Unconfirmed, expired and voided Digital Vouchers (currently Work Hours Confirmation) are kept for 7 days and then deleted automatically. For unconfirmed documents, the clock starts at creation; for unconfirmed documents whose link has expired and for expired documents, at link expiry; and for voided documents, at the voiding time. Seven days means 604800 elapsed seconds in UTC. A document becomes eligible for automatic cleanup only at or after its applicable deadline. An unconfirmed document whose link is still valid seven days after creation is held and its valid link is never deleted early under this rule. Once the link expires, the seven-day clock is recalculated from link expiry.
All signed (confirmed) documents are kept permanently and deleted only when you delete them or delete your account, including direct confirmation, SMS verification, handwritten signature and historical documents with missing or unknown confirmation methods. Link expiry, failed PDF generation or replacement by a correction does not change that rule. Every explicitly linked complete correction chain is also kept indefinitely, including unconfirmed, expired and voided members and unsuccessful correction branches. Indefinite retention is subject to your active deletion requests, including account deletion, through existing procedures. Voiding a document does not delete it. Retention is not linked to settlement.
Missing or invalid seven-day starting times, contradictory confirmation evidence, unknown document states, and correction chains with missing links, cycles or cross-account links are held for review. Accounts undergoing deletion, already deleted or with an unverified account state are also excluded from seven-day cleanup; the existing account-deletion process, deadlines and link rules remain as set out below. Confirmation snapshots, confirmation audits, signature images and server-held PDFs follow the same rule as their document.
Logging in counts as agreeing to the current privacy policy. You can withdraw privacy consent at any time under Devices → Settings → Withdraw Privacy Policy Consent; declining when an updated policy is shown also withdraws it. After withdrawal, the app immediately stops collection, clears pending analytics records of all accounts on this device and signs you out; your local ledger stays, and you must agree to this policy again before logging in or using network features. Analytics details already received by the server are not deleted immediately and are automatically deleted after at most 90 days; the compressed “before window” origin record and any analytics consent record left by earlier versions are kept until account deletion. Account deletion deletes this account’s analytics details immediately. After login, use Devices → Account Center → Account Management → Delete Account to verify identity and submit a request, or contact section 13. The account-deletion period is 30 calendar days after identity verification and acceptance of the deletion request, covering account, backup, sync, subscription-linked data and Digital Vouchers (currently Work Hours Confirmation). Our own IAP records are kept while the account exists and deleted on account deletion; Apple retains its own purchase records under its policy. SMS verification and abuse-prevention records and access and security logs are retained for their respective purposes and deleted when those purposes end; the 30 calendar days do not apply to them. Account migration backups follow the existing 29-day technical cleanup rule.
Once deletion starts, the old login cannot create, share or confirm digital vouchers, generate or download PDFs, or create corrections. Digital Voucher links already sent that are still valid and not voided when deletion is accepted remain available for recipients to view or confirm until D - 1 day (86400 seconds). Links expire immediately at D - 86400 seconds, where D is the deadline of the same 30-calendar-day account-deletion period. Snapshots, confirmation audits (including signature images, signing times, IP addresses and user agents as signature evidence), server-held PDFs and the complete correction chain are removed together with account deletion. The indefinite-retention and seven-day rules above do not change this active account-deletion process. Already expired or voided links are not restored.
You and recipients manage PDFs, screenshots and other copies already downloaded, exported, forwarded or saved. The developer cannot remotely delete or recall those copies by deleting server records or invalidating links.
After identity verification and acceptance of a cloud-data deletion request, we complete deletion within 15 days. Account deletion and its linked data follow the 30-calendar-day account-deletion process in section 7.
Core Usage Analytics: after you agree to this policy, successful creation of work hours, payments, fuel, maintenance or Digital Vouchers by a signed-in account sends daily Beijing-time feature markers and only five environment fields (platform, brand, phone model, OS major version and app display version) to our own server. This supports core-operation activity, D1/D7 retention and compatibility analysis, including free accounts. We do not upload amounts, hours, customers, projects, user-named equipment, notes or voucher content, read your phone’s custom name, unique device or advertising identifiers, or record opens, views, operation counts or heartbeats. Environment combinations are stored separately and account-linked identities are deduplicated for totals; combinations are not phone counts. Signed-out operations or periods without an accepted privacy policy are not collected or backfilled. Analytics is on after you agree to this policy. Withdrawing privacy consent (available at any time under Devices → Settings → Withdraw Privacy Policy Consent) makes the app stop collection immediately and clears pending analytics records of all accounts on this device; analytics details already received by the server are not deleted immediately and are automatically deleted after at most 90 Beijing calendar days, counted by the analytics date. Daily details are kept for the most recent 90 Beijing calendar days including today; reports accept today and the preceding 7 calendar days. Older origins are compressed to a “before window” state without dates or environment fields, without permanent environment profiles; after privacy-consent withdrawal, this “before window” origin record and any analytics consent record left by earlier versions are not removed by the 90-day cleanup and are kept until account deletion. After account deletion is accepted, the server deletes this account’s analytics details and origin in the deletion process without waiting for the 90-day expiry (failures are retried and completion is within the 30-calendar-day deletion period in section 7), and recalculates retention.
8. Access, correction, copies and deletion
Access and correction: view and edit your entries on device, work-hour, fuel, maintenance and project-account pages. View account information in Account Center.
Copies: use available exports, or request a personal-information copy by company email free of charge, even if a local-backup feature requires a paid plan.
Deletion: delete your business entries on their respective pages. Request Digital Voucher, cloud and account data deletion through account deletion or email. Contact us to change a login phone number or information you cannot edit yourself. A paid plan is not required to exercise these rights.
We verify only the identity information needed for the request, report the outcome and explain requests we cannot fulfill.
After identity verification and acceptance of a cloud-data deletion request, we complete deletion within 15 days. Account deletion and its linked data follow the 30-calendar-day account-deletion process in section 7.
9. Withdrawing consent and permissions
Logging in counts as agreeing to the current privacy policy. You can withdraw privacy consent at any time under Devices → Settings → Withdraw Privacy Policy Consent (declining when an updated policy is shown also withdraws it): the app immediately stops analytics, clears pending analytics records of all accounts on this device and signs you out, and you must agree to this policy again before logging in or using network features. Analytics details already received by the server are automatically deleted after at most 90 days; the “before window” origin record and any analytics consent record left by earlier versions are kept until account deletion. To delete your account, use Devices → Account Center → Account Management → Delete Account; account deletion deletes analytics details in the deletion process. Once deletion starts, the old login loses access to account network features. Prior lawful processing is unaffected. Account and linked-data deletion follows the 30-calendar-day rule in section 7; Our own IAP transaction, subscription verification, entitlement and account-linked records are kept while the account exists and deleted on account deletion. Apple retains its own purchase records under its own policy. SMS and logs are retained for their purposes and deleted when those purposes end. Deleting the account does not automatically cancel store subscriptions. Revoke photo permissions in system settings.
Core Usage Analytics: after you agree to this policy, successful creation of work hours, payments, fuel, maintenance or Digital Vouchers by a signed-in account sends daily Beijing-time feature markers and only five environment fields (platform, brand, phone model, OS major version and app display version) to our own server. This supports core-operation activity, D1/D7 retention and compatibility analysis, including free accounts. We do not upload amounts, hours, customers, projects, user-named equipment, notes or voucher content, read your phone’s custom name, unique device or advertising identifiers, or record opens, views, operation counts or heartbeats. Environment combinations are stored separately and account-linked identities are deduplicated for totals; combinations are not phone counts. Signed-out operations or periods without an accepted privacy policy are not collected or backfilled. Analytics is on after you agree to this policy. Withdrawing privacy consent (available at any time under Devices → Settings → Withdraw Privacy Policy Consent) makes the app stop collection immediately and clears pending analytics records of all accounts on this device; analytics details already received by the server are not deleted immediately and are automatically deleted after at most 90 Beijing calendar days, counted by the analytics date. Daily details are kept for the most recent 90 Beijing calendar days including today; reports accept today and the preceding 7 calendar days. Older origins are compressed to a “before window” state without dates or environment fields, without permanent environment profiles; after privacy-consent withdrawal, this “before window” origin record and any analytics consent record left by earlier versions are not removed by the 90-day cleanup and are kept until account deletion. After account deletion is accepted, the server deletes this account’s analytics details and origin in the deletion process without waiting for the 90-day expiry (failures are retried and completion is within the 30-calendar-day deletion period in section 7), and recalculates retention.
10. Minors
FleetLedger is intended for construction-equipment business management, not children, especially those under 14. Minors should use it with guardian guidance and also contact us by email. Guardians who find child information processed without their consent should contact the company email so we can verify and stop processing or delete it.
11. Policy changes
New purposes, services or channel capabilities require updated policy and store disclosures. A changed consent scope triggers a new in-app notice; acceptance of an older policy is not automatically treated as acceptance of the new version. You may decline and continue with local features.
12. Version and effect
Policy version: privacy-v11
Effective date: 2026-10-16
Logging in counts as agreeing to the current privacy policy; you may also explicitly accept it. The current policy is shown on first installation and policy updates. You may decline and skip login to use local features without authorizing store or other network processing. You can withdraw privacy consent at any time under Devices → Settings → Withdraw Privacy Policy Consent; declining when an updated policy is shown also withdraws it. After withdrawal, the app immediately stops collection, clears pending analytics records of all accounts on this device and signs you out; your local ledger stays, and you must agree to this policy again before logging in or using network features. Analytics details already received by the server are not deleted immediately and are automatically deleted after at most 90 days; the compressed “before window” origin record and any analytics consent record left by earlier versions are kept until account deletion. Account deletion deletes this account’s analytics details immediately.
Core Usage Analytics: after you agree to this policy, successful creation of work hours, payments, fuel, maintenance or Digital Vouchers by a signed-in account sends daily Beijing-time feature markers and only five environment fields (platform, brand, phone model, OS major version and app display version) to our own server. This supports core-operation activity, D1/D7 retention and compatibility analysis, including free accounts. We do not upload amounts, hours, customers, projects, user-named equipment, notes or voucher content, read your phone’s custom name, unique device or advertising identifiers, or record opens, views, operation counts or heartbeats. Environment combinations are stored separately and account-linked identities are deduplicated for totals; combinations are not phone counts. Signed-out operations or periods without an accepted privacy policy are not collected or backfilled. Analytics is on after you agree to this policy. Withdrawing privacy consent (available at any time under Devices → Settings → Withdraw Privacy Policy Consent) makes the app stop collection immediately and clears pending analytics records of all accounts on this device; analytics details already received by the server are not deleted immediately and are automatically deleted after at most 90 Beijing calendar days, counted by the analytics date. Daily details are kept for the most recent 90 Beijing calendar days including today; reports accept today and the preceding 7 calendar days. Older origins are compressed to a “before window” state without dates or environment fields, without permanent environment profiles; after privacy-consent withdrawal, this “before window” origin record and any analytics consent record left by earlier versions are not removed by the 90-day cleanup and are kept until account deletion. After account deletion is accepted, the server deletes this account’s analytics details and origin in the deletion process without waiting for the 90-day expiry (failures are retried and completion is within the 30-calendar-day deletion period in section 7), and recalculates retention.
Core feature activity analytics is on by default after you agree to this policy; it stops when you withdraw privacy consent or delete your account.
13. Contact and requests
Developer, contracting entity and controller: 眉山市源链网络科技有限责任公司
Alibaba Mail (company email): developer@yuyuan.net.cn (Alibaba Cloud enterprise mail, stored in China)
QQ Mail (developer contact email): 582748196@qq.com (provided by Tencent and handled under its own privacy policy)
Use either email for privacy complaints, access, correction, copies, deletion or other requests. Explain the feature and request without sending passwords or full payment credentials. We will respond by email within 3 days with next steps. Account and linked-data deletion follows the 30-calendar-day period in section 7.
After identity verification and acceptance of a cloud-data deletion request, we complete deletion within 15 days. Account deletion and its linked data follow the 30-calendar-day account-deletion process in section 7.