PoLang Privacy Policy

Last updated: July 17, 2026 | Effective: July 17, 2026

查看中文版

1. Information We Collect

PoLang accesses your device and data only to the minimum extent necessary for each feature. Depending on the features you use, the following types of information may be involved:

1.1 Camera & Image Data

Data type	Purpose	Handling
Camera preview frames	Real-time beauty preview, capture	Local GPU only, never uploaded
Captured photos	Saved to gallery, local editing	Stored in the device gallery, never uploaded
Face landmarks	Drive beauty effects (slim face, enlarge eyes, etc.)	Local MediaPipe/NCNN real-time, never uploaded
Gallery photos / videos	Browse and edit existing photos	Local read only, never uploaded

1.2 Voice Data

Data type	Purpose	Handling
Voice command recordings	Voice camera control	Discarded immediately after local ASR, never uploaded
Wake-word audio	Trigger voice interaction	Local real-time detection, never uploaded

1.3 Device & Network Information

Data type	Purpose	Handling
Network connection state	Decide whether remote LLM orchestration is available (optional)	Local check only, no network details collected
Bluetooth state	Detect Bluetooth accessories (e.g. remote shutter)	Local detection only, never uploaded
Device storage space	Check free space before model download	Local check only, never uploaded

1.4 Account Data (Email Registration)

Data type	Purpose	Handling
Email address	Account registration & login identifier, LLM free-trial quota billing (default 100 calls/account)	Stored on api.polang.net; only the email and the SHA-256 hash of the login token are kept; no plaintext password is collected (verification-code login)

1.5 Device Identifier (Guest Trial Quota)

Data type	Purpose	Handling
Device identifier (Android device ID / locally generated ID)	LLM free-trial call counting for unregistered guests	Sent to api.polang.net; only call counts are tallied by identifier; not used to identify individuals, not shared with third parties. Deletable in Settings → Data & Privacy → Clear guest data

2. App Permissions

PoLang requests the following Android system permissions, each tied directly to a specific feature:

Permission	Level	Purpose	Required
CAMERA	Dangerous	Camera preview, capture, recording	Yes (core feature)
RECORD_AUDIO	Dangerous	Voice command recording, video audio	No (voice optional)
READ_MEDIA_IMAGES	Dangerous	Read gallery images for editing	No (gallery optional)
READ_MEDIA_VIDEO	Dangerous	Read gallery videos for editing	No (gallery optional)
READ_EXTERNAL_STORAGE	Dangerous	Read gallery on Android 12 and below	No (gallery optional)
WRITE_EXTERNAL_STORAGE	Dangerous	Save photos on Android 9 and below	No (legacy only)
BLUETOOTH_CONNECT	Normal	Connect Bluetooth accessories (e.g. shutter remote)	No (accessory optional)
INTERNET	Normal	Remote LLM orchestration (user-configured)	No (fully offline capable)
FOREGROUND_SERVICE	Normal	Background model download service	Yes (model download)

3. How We Process Data

3.1 On-Device First Principle

PoLang's core architecture follows the On-Device First principle:

• Local LLM inference: the Qwen3.5-2B large language model runs on-device via MNN-LLM; your conversations never leave the device
• Local face detection: MediaPipe / NCNN / MNN multi-engine face detection all execute locally on GPU/CPU
• Local OCR: ML Kit text recognition runs on-device
• Local beauty rendering: the OpenGL ES pipeline runs entirely on-device

3.2 Privacy-Tier Guard

PoLang has a built-in PrivacyGuard tiering system that automatically classifies and routes each command:

Tier	Data type	Policy
RESTRICTED	Coordinates, face data	Forced local execution; network transfer never allowed
SENSITIVE	Photos, OCR content	Forced local execution; network transfer never allowed
PUBLIC	Camera control commands (e.g. "take a photo")	Local-first; user may opt into remote orchestration

3.3 Remote Mode (Optional)

PoLang lets users opt in to a remote LLM API (e.g. Kimi / an OpenAI-compatible endpoint):

• Remote mode is off by default and requires you to manually configure an API token in Settings
• Even with remote mode on, RESTRICTED and SENSITIVE commands still run locally
• Only PUBLIC commands (e.g. camera control) may route to the remote endpoint
• Remote API calls use your own token; PoLang neither holds nor relays any API credentials
• After signing in to a PoLang account, you may use the official api.polang.net gateway for a free LLM trial quota; the gateway records only call counts and token usage — it never stores conversation content

4. Data Storage & Retention

4.1 Photos & Videos

• Captured photos and videos are saved to the system gallery, managed by Android
• PoLang keeps no extra copies of photos in its private directory
• You can delete photos anytime via the system gallery

4.2 Conversation Memory

• Agent conversation context is stored in the on-device database
• At most the last 10 turns of history are retained
• You can clear all conversation memory in Settings
• Uninstalling the app clears all local data

4.3 Model Files

• AI model files (LLM, face detection, ASR, etc.) are stored in the app's private directory after download
• Model files are used only for local inference and never uploaded
• You can delete downloaded models in Settings to free up space

4.4 Account Data Retention

• After you delete your account, the data is retained for 90 days (for anti-fraud and recovery from accidental deletion), then permanently deleted, including usage logs
• To delete, go to Settings → Account → Delete account, or email budao.gs@gmail.com to request deletion

5. Data Sharing & Third Parties

Third-party open-source components used by PoLang and how they handle data:

Component	Purpose	Handling
MediaPipe	Face landmark detection	Fully local, no network communication
MNN / NCNN	Neural-network inference engine	Fully local, no network communication
ML Kit	OCR text recognition	Fully local, no network communication
Sherpa-ONNX	Speech recognition (ASR)	Fully local, no network communication

6. Your Rights

As a PoLang user, you have the following rights:

• Access: all photos and videos you capture are stored locally and accessible anytime
• Deletion: delete photos, clear conversation memory, or remove downloaded models anytime; signed-in users can delete their account at Settings → Account → Delete account; unregistered guests can clear device-level guest records at Settings → Data & Privacy → Clear guest data; deletion can also be requested by email
• Withdraw consent: revoke any granted permission in system settings anytime
• Offline use: core features work fully without a network
• Data portability: your photos live in the standard gallery and can be freely exported

7. Children's Privacy

PoLang is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe we may have collected a child's information, contact us and we will delete it promptly.

8. Security Measures

PoLang takes the following technical and organizational measures to protect your data:

• Local processing architecture: sensitive data never leaves the device, reducing exposure at the root
• Least-privilege principle: only permissions necessary for a feature are requested
• Open-source & auditable: core code is open for community security review
• Account data minimization: email registration stores only the email and a SHA-256 hash of the token, with no plaintext password (verification-code login), and provides an account-deletion entry point

9. Policy Updates

We may update this privacy policy from time to time. Material changes will be announced via in-app notice or the changelog. Continued use of PoLang constitutes acceptance of the revised policy.

10. Contact Us

If you have any questions or suggestions about this privacy policy, reach us at:

• GitHub Issues: https://github.com/littleseven/langchain4android/issues
• Project homepage: https://github.com/littleseven/langchain4android
• Email: budao.gs@gmail.com