PoLang Privacy Policy

Last updated: September 18, 2026 | Effective: September 18, 2026

Core promise: PoLang is a smart photo gallery app (with camera capability) built privacy-first. We believe your photos, face data, and voice are highly sensitive personal information. That's why PoLang adopts an On-Device First architecture — photos, videos, faces, voice and other media data are processed locally on your device and never uploaded to any cloud server.

1. Information We Collect

PoLang accesses your device and data only to the minimum extent necessary for each feature. Depending on the features you use, the following types of information may be involved:

1.1 Camera & Image Data

Data type	Purpose	Handling
Camera preview frames	Real-time beauty preview, capture	Local GPU only, never uploaded
Captured photos	Saved to gallery, local editing	Stored in the device gallery, never uploaded
Face landmarks	Drive beauty effects (slim face, enlarge eyes, etc.)	Local MediaPipe/MNN real-time, never uploaded
Gallery photos / videos	Browse and edit existing photos	Local read only, never uploaded

1.2 Voice Data

Data type	Purpose	Handling
Voice command recordings	Voice camera control	Discarded immediately after local ASR, never uploaded
Wake-word audio	Trigger voice interaction	Local real-time detection, never uploaded

1.3 Device & Network Information

Data type	Purpose	Handling
Network connection state	Decide whether remote LLM orchestration is available (optional)	Local check only, no network details collected
Bluetooth state	Detect Bluetooth accessories (e.g. remote shutter)	Local detection only, never uploaded
Device storage space	Check free space before model download	Local check only, never uploaded

1.4 Account Data (Email Registration)

Data type	Purpose	Handling
Email address	Account registration & login identifier, LLM free-trial quota billing (default 100 calls/account)	Stored on api.polang.net; only the email and the SHA-256 hash of the login token are kept; no plaintext password is collected (verification-code login)

1.5 Device Identifier (Guest Trial Quota)

Data type	Purpose	Handling
Device identifier (Android device ID / locally generated ID)	LLM free-trial call counting for unregistered guests	Sent to api.polang.net; only call counts are tallied by identifier; not used to identify individuals, not shared with third parties. Deletable in Settings → Data & Privacy → Clear guest data

2. App Permissions

PoLang requests the following Android system permissions, each tied directly to a specific feature:

Permission	Level	Purpose	Required
CAMERA	Dangerous	Camera preview, capture, recording	Yes (core feature)
RECORD_AUDIO	Dangerous	Voice command recording, video audio	No (voice optional)
READ_MEDIA_IMAGES	Dangerous	Read gallery images for organizing, search and editing	Yes (gallery core)
READ_MEDIA_VIDEO	Dangerous	Read gallery videos for organizing and playback	Yes (gallery core)
ACCESS_MEDIA_LOCATION	Dangerous	Read photo EXIF location for place grouping and place search (local only, never uploaded)	No (place features optional)
MANAGE_MEDIA	Dangerous	"No more delete prompts" switch (off by default): when enabled, delete/trash actions skip system confirmation; items still go to the system recycle bin and can be restored	No (off by default, requires manual grant)
READ_EXTERNAL_STORAGE	Dangerous	Read gallery on Android 12 and below	No (gallery optional)
WRITE_EXTERNAL_STORAGE	Dangerous	Save photos on Android 9 and below	No (legacy only)
BLUETOOTH_CONNECT	Normal	Connect Bluetooth accessories (e.g. shutter remote)	No (accessory optional)
INTERNET	Normal	AI chat remote inference (text/metadata only, never photos or videos)	No (media works offline; AI chat needs network)
ACCESS_NETWORK_STATE	Normal	Network status detection (e.g. silent model pre-download on WiFi only)	Yes
POST_NOTIFICATIONS	Normal	Model download and gallery scan progress/completion notifications	No (notifications optional)
FOREGROUND_SERVICE	Normal	Background model download service	Yes (model download)
FOREGROUND_SERVICE_DATA_SYNC	Normal	Gallery tagging scan foreground service (data sync type, all processing on-device)	Yes (tagging scan)
SCHEDULE_EXACT_ALARM	Normal	Scheduled dispatch for idle-time automatic scanning	No (auto scan optional)
WAKE_LOCK	Normal	Keep CPU awake during scan/download to prevent task interruption	Yes (background tasks)
SYSTEM_ALERT_WINDOW	Dangerous	Floating chat bubble (AI assistant entry over other apps, off by default)	No (floating bubble optional, requires manual grant)
REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	Normal	Background scan keep-alive (request battery optimization whitelist, not requested by default)	No (optional, requires manual grant)

3. How We Process Data

3.1 On-Device First Principle

PoLang's core architecture follows the On-Device First principle:

Local VLM tagging: the Qwen3-VL-2B vision-language model runs on-device to tag your photos; image content is never uploaded
Local face detection: MediaPipe / MNN multi-engine face detection all execute locally on GPU/CPU
Local OCR: ML Kit text recognition runs on-device
Local beauty rendering: the OpenGL ES pipeline runs entirely on-device

3.2 Privacy-Tier Guard

PoLang has a built-in PrivacyGuard tiering system that automatically classifies and routes each command:

Tier	Data type	Policy
RESTRICTED	Coordinates, face data	Forced local execution; network transfer never allowed
SENSITIVE	Photos, OCR content	Forced local execution; network transfer never allowed
PUBLIC	Camera control commands (e.g. "take a photo")	Local-first; user may opt into remote orchestration

3.3 AI Chat Inference (Remote)

AI chat and command parsing run on a remote large language model (DeepSeek / Tongyi and other OpenAI-compatible endpoints) and require a network connection:

Non-media data such as conversation text and commands is sent to the remote inference service to generate replies; your photo/video files are never uploaded
Media processing — face detection, OCR, beauty, tagging, matting — always runs on-device, unaffected by remote inference
After signing in to a PoLang account, you may use the official api.polang.net gateway for a free inference quota; the gateway records only call counts and token usage — it never stores conversation content
You may also configure your own OpenAI-compatible API in Settings (using your own token; PoLang neither holds nor relays any credentials)

4. Data Storage & Retention

4.1 Photos & Videos

Captured photos and videos are saved to the system gallery, managed by Android
PoLang keeps no extra copies of photos in its private directory
You can delete photos anytime via the system gallery

4.2 Conversation Memory

Full Agent conversation history is stored in the on-device database and can be viewed across sessions; it never leaves the device
The context sent to the remote model carries at most the last 10 messages (text only)
You can clear all conversation memory in Settings
Uninstalling the app clears all local data

4.3 Model Files

AI model files (LLM, face detection, ASR, etc.) are stored in the app's private directory after download
Model files are used only for local inference and never uploaded
You can delete downloaded models in Settings to free up space

4.4 Account Data Retention

After you delete your account, the data is retained for 90 days (for anti-fraud and recovery from accidental deletion), then permanently deleted, including usage logs
To delete, go to Settings → Account → Delete account, or email budao.gs@gmail.com to request deletion

5. Data Sharing & Third Parties

Important: PoLang never sells, rents, or shares any of your data with third parties.

Third-party open-source components used by PoLang and how they handle data:

Component	Purpose	Handling
MediaPipe	Face landmark detection	Fully local, no network communication
MNN	Neural-network inference engine	Fully local, no network communication
ML Kit	OCR text recognition	Fully local, no network communication
Sherpa-ONNX	Speech recognition (ASR)	Fully local, no network communication

6. Your Rights

As a PoLang user, you have the following rights:

Access: all photos and videos you capture are stored locally and accessible anytime
Deletion: delete photos, clear conversation memory, or remove downloaded models anytime; signed-in users can delete their account at Settings → Account → Delete account; unregistered guests can clear device-level guest records at Settings → Data & Privacy → Clear guest data; deletion can also be requested by email
Withdraw consent: revoke any granted permission in system settings anytime
Offline use: media features such as tagging, face detection, beauty, and gallery search work offline; AI chat requires a network
Data portability: your photos live in the standard gallery and can be freely exported

7. Children's Privacy

PoLang is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe we may have collected a child's information, contact us and we will delete it promptly.

8. Security Measures

PoLang takes the following technical and organizational measures to protect your data:

Local processing architecture: sensitive data never leaves the device, reducing exposure at the root
Least-privilege principle: only permissions necessary for a feature are requested
Open-source & auditable: core code is open for community security review
Account data minimization: email registration stores only the email and a SHA-256 hash of the token, with no plaintext password (verification-code login), and provides an account-deletion entry point

9. Policy Updates

We may update this privacy policy from time to time. Material changes will be announced via in-app notice or the changelog. Continued use of PoLang constitutes acceptance of the revised policy.

10. Contact Us

If you have any questions or suggestions about this privacy policy, reach us at:

GitHub Issues: https://github.com/littleseven/polang/issues
Project homepage: https://github.com/littleseven/polang
Email: budao.gs@gmail.com