Privacy Policy
This policy explains how Onward processes information for lesson, contact, bill, reminder and AI features, and how you can manage that information.
1. Scope and operator
1.1 Scope
This policy applies to the Onward iPhone app and its account sync services. The same free app is offered on the App Store in multiple countries and regions. Download availability is shown in the store. Initial AI activation supports known valid App Store storefronts outside mainland China. Initial activation is not offered on the mainland China storefront. Initial activation uses the current storefront reported by Apple at sign-in; an unknown, empty or invalid storefront does not grant access. Access is linked to the Onward account and remains when the same account changes devices or storefronts. Interface language and bookkeeping currency do not determine eligibility. Separate consent to AI data processing is required; declining or withdrawing consent does not affect manual features.
1.2 Operator and contact
Onward is provided by individual operator QIU LU. For questions about privacy, accounts or data processing, contact carrieing@outlook.com.
2. Information we process
2.1 Accounts and sign-in
When you use Sign in with Apple, we receive a sign-in identifier and any name or email you choose to share, including a hidden email address. Tencent CloudBase provides authentication, account sessions and account-based synchronization. Other sign-in methods are provided only as actually available in the app.
2.2 Business records and settings
Lessons, reminders, contact names, aliases and notes, courts, bills, income and expenses, conversations, and preferences you create are stored on your device and synchronized by account after sign-in. Cropped payment QR codes and brand images you choose may also be synchronized with settings. The app does not read your system contacts or request GPS location. Information you explicitly ask it to remember may be saved as personal preferences. Financial queries may also develop query or presentation preferences from your repeated explicit corrections, to adjust the scope and format of future results. These preferences are not used for advertising profiles and do not automatically change financial records based solely on inference. In “Settings → AI settings → AI memory,” you can view, correct, individually delete, or clear personal preferences. You can also ask in a conversation for a correction or for information to be forgotten. If you cannot do this yourself, contact the support email to request access, correction, or deletion. Deleting or forgetting an AI memory stops its use as an active preference; it does not erase every original conversation, historical record or copy. Contact support to request removal of specific information and review the scope.
2.3 Device permissions
Speech input starts only when you initiate it and allow microphone and speech recognition access. On-device recognition is used when supported. If the device does not support local recognition, the system may send audio and contextual recognition words, such as contact or court names, to Apple. Onward does not upload raw recordings to its own server. Saving a payment card may request permission to add photos; images are selected with the system picker. Notifications for lessons and reminders are delivered locally. Background reconciliation and local reconciliation reminders are not available in the initial release. You can adjust device permissions in iOS Settings. If you enable the Lock Screen agenda, selected event titles, times, venues and completion status may appear on the Lock Screen. You can turn this display off.
3. AI and third-party services
3.1 Text AI
When you use text AI, the text you submit, recent conversations, and business information needed to complete the task are sent to DeepSeek through Onward's service. Business information may include contact names, aliases and notes, lessons and courts, reminders, bill amounts, income and expenses, pricing rules, and current drafts. Text converted from speech enters this process only when you send it. Do not submit information about others that you are not entitled to process. DeepSeek's public privacy policy states that inputs and outputs may be used for model training and service optimization after encryption and de-identification. De-identification is not the same as anonymization. Onward does not promise that this API has opted out of this use. If you do not accept it, leave AI disabled; you can continue managing your business manually. You will be asked for your choice separately before submission. Declining still allows you to manage lessons, reminders, and bills manually.
3.2 Booking image recognition
AI recognition of court-booking images is not available in the initial release. Enter the date, court, and amount manually. If this feature becomes available later, we will first explain the specific provider, information processed, and purposes, and request separate authorization. Other sections of this policy explain local image selection, saving, and sharing.
3.3 Sync, sign-in and sharing
Account synchronization uses Tencent Cloud CloudBase. Apple processes information related to its sign-in and system services. In the initial release, payment cards are shared through the iOS system share sheet. The selected image is passed to WeChat or another destination only after you explicitly choose it. The app bundle includes WeChat OpenSDK 1.9.2, non-payment edition, but OpenSDK direct sharing to WeChat is neither configured nor enabled in the initial release. WeChat Pay and WeChat Login are not integrated. See “Third-party services” for each service's purposes and public information. Account linking requires a request from one person and acceptance by the other. Looking up an account using its link code displays its public nickname and default avatar to the person searching. After acceptance, lessons created by either person that include the other are synchronized automatically, including participant names or aliases, lesson type, date and time, venue, status, and creator profile. Only the recipient’s own related invoice, payment and refund information is shared; other participants’ finances, private notes and other personal events are not shared. Unlinking stops further lesson synchronization and removes received shared calendar entries; lessons you created, existing invoices and financial history remain. After account deletion, the link ends when the other person refreshes, but existing financial records are not thereby deleted from their account. Contact the support email for requests concerning related personal information.
3.4 Scheduled background reconciliation
Background AI reconciliation and local reconciliation reminders are not available in the initial release. New authorizations, schedules, and background execution are not accepted. Historical statuses, saved results, and existing financial records are retained. In “Settings → AI settings → Historical reconciliation settings,” you can view and cancel historical plans, read or withdraw historical background authorization, and disconnect historical push connections. Withdrawing or canceling cannot retrieve data already sent. Notifications for lessons and reminders are unaffected.
4. Storage and retention
4.1 Device and cloud
Device storage keeps business caches, login sessions, preferences and consent choices. After sign-in, relevant business records sync by account to Tencent CloudBase; the current business environment is in Shanghai, China. Distribution through a store in another country or region does not mean information is processed or stored only there.
4.2 Business and operational records
Business records are retained as needed to provide account services. Successful account deletion removes cloud business data, associated money-upgrade snapshots and operation receipts, and AI access. Upgrade snapshots are reviewed for removal after acceptance when rollback, disputes or legal preservation no longer require them; operation receipts remain while safe retries and result recovery need them. Minimal account associations, request identifiers, status and timestamps are retained separately to prevent old credentials or requests from recreating deleted data. They are restricted to security protection and removed after confirming they are no longer necessary. Digests for concluded identity verification are manually cleared against a reviewed list after the recovery window ends and no unresolved request or preservation need remains. These are not scheduled automatic deletions. Application diagnostics include request identifiers, endpoints, status, stages, durations and versions, without conversation bodies, images or login tokens. Central application logging is not enabled, but platform authentication, access, security and audit records follow applicable rules and necessary periods; they are not promised to disappear immediately with business data. Contact support to establish the scope, outcome and retention grounds for particular records. The app does not include advertising tracking, advertising SDKs, third-party analytics or crash-collection SDKs.
4.3 AI caches and data already sent
The DeepSeek API uses context caching on disk. Its public documentation states that caches are automatically cleared after they are no longer used, typically within hours to days. This duration applies only to caches and does not represent the retention period for all logs or data already sent. Withdrawing authorization or deleting your Onward account does not automatically withdraw data already sent to DeepSeek. To request deletion, contact the email address in this policy. We will process your request, seek assistance from the provider when needed, and explain the outcome and any scope that must be retained by law.
4.4 Support emails
Support emails and necessary attachments are used to handle feedback, data requests, and complaints. We retain only information needed to resolve the issue, check the outcome, and settle related disputes, and for no longer than necessary for those purposes. Once an issue is closed and the information is no longer needed, we will delete or anonymize it. Where retention is required by law, only necessary information will be retained for the prescribed period. You can use the support email to request deletion or ask about retention of specific records.
5. Your choices and rights
5.1 Consent and withdrawal
You can manage text AI authorization in “Settings → AI settings.” Image AI is not available in the initial release. Withdrawal stops future submissions and cancels in-flight requests on your device. Canceling cannot retrieve data already sent to a provider. Withdrawal does not delete existing business records.
5.2 Access, correction and deletion
You can view and correct business records in the app, or use the email above to request access, correction, or deletion, or to make a privacy complaint. We will review requests manually and process and respond to them promptly as required by law. We verify identity only when genuinely necessary to protect account or information security; identity verification is not a universal prerequisite for ordinary feedback or reports about AI content. If further investigation or coordination is needed, we will explain progress and the expected response time. For information processed by providers, we will request assistance where necessary and explain the outcome or any legal reason it cannot be deleted.
5.3 Signing out and account deletion
Signing out only ends the current session and does not delete cloud business data. You can request account deletion in “Settings → Account and security → Delete account.” Rely on the result shown in the app. If deletion fails or is only partially completed, follow the instructions or contact support. Content saved to Photos, exported, or shared with others is not deleted when your account is deleted.
6. Other people's and minors' information
6.1 Other people's information
Before entering information about students or others, ensure you have the appropriate lawful basis for processing it, and explain the purposes, storage, and sharing arrangements to the person or their guardian. Enter only information needed to manage lessons and finances. Prefer aliases where possible, and avoid entering identity document numbers, health information, or other unrelated sensitive information in notes or conversations. Your agreement to use Onward or enable AI does not automatically mean that other people have agreed to the processing of their information, nor does it replace separate consent required by law. We remain responsible for protecting personal information as required by law.
6.2 Minors' information
Minors should read these Terms and the Privacy Policy with a parent or other guardian and obtain any consent required by law. Student records link lessons and financial records, and aliases may be used. When a record relates to an identifiable person, there must be an appropriate lawful basis for processing their information.
6.3 Special rules for information about students under 14
Personal information about children under 14 is sensitive personal information. Processing must be limited to names or aliases, lesson dates and times, courts, related amounts, and other information necessary for scheduling, identifying contacts, and managing the corresponding finances. This information may reveal a student's identity, activities, or financial dealings, and a leak may affect their privacy and safety. Before entering it, explain these purposes, the scope, and the processing described in this policy to a parent or other guardian, and obtain guardian consent as required by law. The app does not require students' identity document numbers, home addresses, or health information for these functions.
6.4 Sending information to AI and guardian choices
Sending student information to an AI service carries risks associated with providing information to a third party. Account users enabling AI must separately confirm that they have a lawful basis for processing the relevant student information and have provided required notices and obtained separate consent as required by law. Do not send information that identifies a student to AI without the necessary authorization. Declining AI processing does not affect manual management. Do not attach student information when you only need general questions answered or writing assistance.
6.5 Protection and rights requests
We apply access controls and security measures appropriate to the risks of minors' information as required by law, and process it only within the scope and period necessary for the purposes. A user's submission does not relieve us of our own obligations. Parents or other guardians may use the support email to request information about, correct, or delete information about the child in their care, or withdraw the relevant consent. We verify guardianship and authority only to the extent necessary and do not require full identity documents at first contact. If we discover processing of minors' information without lawful authorization, we will investigate and take measures required by law, such as stopping the relevant processing or deleting the information. We will explain the basis and scope of anything that must be retained by law.
7. Policy updates
7.1 Notice of updates
We will update this policy if processing purposes, data scope or providers change significantly, and request consent again where needed.