一句话：稳压记没有账号，没有服务端，没有广告，也没有第三方分析。 你的记录保存在这台 iPhone 上，我们不会收集、也不会收到它们。只有你主动发邮件给支持时， 我们才会看到你写的内容。

1. 收集什么

我们不收集以下任何一项：

• 账号、姓名、邮箱、电话号码或其他身份信息；
• 设备标识符、广告标识符（IDFA）、随机安装 ID；
• 使用统计、页面浏览、功能点击等行为分析数据；
• 崩溃日志或任何崩溃上报 SDK；
• 位置、通讯录、日历、照片图库；
• 你记录在 App 里的血压、心率、用药与提醒数据；
• 支付信息或账单地址。

App 里没有第三方 SDK，没有广告网络，也没有接入任何统计或归因服务。

例外——你主动联系我们时。如果你发邮件到 zhsoft88@icloud.com，我们会收到你的邮箱地址和邮件内容。 这些只用于回复你的问题、排查你报告的问题，处理完毕后即删除；法律要求保留的除外。 我们不会把它用于营销，也不会与任何第三方共享。请不要在邮件里附上不必要的健康数据。

2. 本机保存的数据

App 用 SwiftData 把数据保存在一个 App 与小组件共用的 App Group （group.com.zhuatang.wenyaji）里，包含：

• 档案：称呼、出生日期、性别、目标血压；
• 血压记录：高压、低压、心率、测量时间、晨间/晚间标记、备注；
• 用药与服药记录：药名、剂量、每日时间点，以及「已服用 / 延后 / 跳过」的结果；
• 提醒设置：量压提醒与用药提醒的时间、星期或间隔；
• 购买状态缓存：Pro 是否有效、试用开始日期；
• 偏好设置：当前档案、显示模式等，保存在 App Group 的 UserDefaults 里；
• 小组件快照：一份只含最近读数与提醒摘要的 JSON 文件，供小组件读取。

这些数据只在这台设备上，不会上传到我们的服务器。我们没有服务器，也没有账号系统； App 不使用 iCloud 或 CloudKit 在你的设备之间同步这些数据。

3. 设备备份

我们不收集、不上传，也不用 iCloud/CloudKit 同步你的记录。但需要如实说明： 如果你开启 iCloud 备份或电脑备份，iOS 可能把 App 的数据（包括 App Group 里的数据库和 小组件快照）纳入整机备份。这份备份由你、Apple 或你的电脑按你的设置管理， 我们无法访问其中的内容。关闭备份、排除 App 或删除备份由你在系统设置里决定。

4. Apple 健康

健康同步默认关闭，只有你主动打开后才会发生：

• 写入：主档案的每次血压以「收缩压 + 舒张压」的血压相关性 （HKCorrelation）写入「健康」，心率作为单独的数量样本写入。 写入带同步标识，重复写入不会产生重复记录。
• 读取：读取「健康」里最近 90 天的血压并导入，按同步标识去重。
• 家庭档案从不写入「健康」。
• 读写都在设备上完成，经过 Apple 的 HealthKit，不经过我们的服务器。
• 权限可以随时在 iOS「设置 › 健康 › 数据访问与设备 › 稳压记」里关闭。
• 删除 App 不会删除已经写入「健康」的记录；那些记录属于健康 App，需要你在那里单独删除。

健康数据不会用于广告、营销或任何形式的画像。

5. 通知

量压和用药提醒都通过本机的 UNUserNotificationCenter 安排，由 iOS 按你设定的时间 发出，内容不经过任何服务器。通知正文可能包含档案名、药名和剂量，因此锁屏上也可能看到； 你可以关闭锁屏预览，或在 iOS「设置 › 通知 › 稳压记」里关闭通知。

6. 相机与照片

拍照识别血压计屏幕完全在设备上完成：先用 Vision 与图像处理找出屏幕并校正，再按数字形状读出数值； 设备支持时，可能用 Apple 的设备端语言模型对不确定的结果做一次兜底。照片不会上传， Release 版本不会保存照片，也不会写入你的照片图库。识别结果只会填进确认页，你点保存后才写入记录。 相机权限可以随时在 iOS 设置里关闭；关闭后手动输入和语音不受影响。

7. 麦克风与语音

语音录入只使用设备上的语音识别，没有服务器兜底：

• iOS 26 及以上使用 SpeechTranscriber 与 SpeechAnalyzer， 识别模型按语言下载到本机；
• iOS 18–25 使用 SFSpeechRecognizer，并强制 requiresOnDeviceRecognition = true。

音频不会被保存，也不会写入任何记录；转写文字只存在于内存中，用于填进确认页。 设备或当前系统语言不支持本机识别时，语音入口会隐藏，而不会退化成联网识别； 手动输入始终可用。麦克风与语音识别权限可以随时在 iOS 设置里关闭。

8. 小组件

小组件不直接读取数据库，只读取 App 写在 App Group 里的那份 JSON 快照，内容限于最近读数、 7 天摘要和下一次提醒。快照只在本机，不经过网络。主屏幕和锁屏上的小组件旁边的人也能看到； 不需要时长按移除即可。快照是否进入设备备份，见第 3 节。

9. 购买与试用

购买与试用都通过 Apple 的 App Store（StoreKit 2）完成，付款由 Apple 处理。 涉及的 App 内购买项目是两个非消耗型商品：

• com.zhuatang.wenyaji.pro —— 终身 Pro；
• com.zhuatang.wenyaji.trial7 —— 0 元的 7 天试用，不是订阅。

App 只会知道购买是否有效以及交易的购买日期，不会拿到你的支付信息。 购买状态以 StoreKit 的 Transaction.currentEntitlements 为准；App Group 里的缓存 只用于冷启动时先画出正确界面，随后由 StoreKit 的结果覆盖。恢复购买在付费墙和「设置」里都有。 交易记录由 Apple 按 Apple 的隐私政策保存，我们无法访问。

10. 追踪与广告

稳压记不追踪你，不收集设备或广告标识符，不展示广告，也不把你的数据出售或共享给任何人。 我们没有接入第三方 SDK、分析服务、崩溃上报或云同步服务。

11. 技术说明（隐私清单）

App 内置的 PrivacyInfo.xcprivacy 写明：

• NSPrivacyTracking = false —— 不进行跨 App 追踪；
• NSPrivacyCollectedDataTypes 为空 —— 不收集数据；
• 只声明了一项必需理由 API：UserDefaults，理由代码 CA92.1 （仅供 App 自身读取自己写入的偏好设置）。

这也是 App Store 隐私问卷中选择「Data Not Collected」的依据。

12. 保留与删除

• 开发者不持有你的记录，因此不存在服务器端的保留期。
• 在「设置 › 数据」里可以清除当前档案的全部血压与服药记录；在「设置 › 家庭档案」里左滑 可以删除整个档案（至少保留一个）；删除 App 会移除 App 内的全部数据。
• 已经写入 Apple 健康的记录要另外在健康 App 里删除。
• 设备备份里的副本会随备份轮换和过期按你的备份设置消失。
• 支持邮件按第 1 节处理：回复完成即删除，法律要求保留的除外。

13. 你的权利

由于 App 的数据只在你的设备上、开发者并不持有，针对 App 内记录的访问、更正、导出或删除请求 没有可执行的对象——这些操作都在你的设备上完成。对于我们确实持有的信息（你发给支持的邮件）， 你可以随时来信要求访问、更正或删除。我们不会出售或共享个人信息。

14. 儿童隐私

稳压记不是面向 13 岁以下儿童设计的产品，我们不会有意收集儿童的个人信息。 家长可以为孩子建立一个家庭档案来记录血压，该档案只保存在设备上，不会上传给我们， 也不会写入 Apple 健康。

15. 政策变更

如果这份政策发生变化，我们会更新本页并修改顶部的生效日期。涉及数据收集方式的重大变更， 会在本页显著说明；需要你重新同意时，会在 App 内另行征求。

16. 联系我们

对隐私有疑问，或想行使第 13 节的权利，请来信： zhsoft88@icloud.com。我们会在几个工作日内回复。

---

In one sentence: WenYaJi has no accounts, no server, no ads and no third-party analytics. Your records stay on this iPhone; we never collect or receive them. The only thing we ever see is what you write if you email support yourself.

1. What we collect

We do not collect any of the following:

• accounts, names, email addresses, phone numbers or other identifiers;
• device identifiers, advertising identifiers (IDFA) or random install IDs;
• usage statistics, screen views, feature taps or other behavioural analytics;
• crash logs or any crash-reporting SDK;
• location, contacts, calendar or photo library;
• the blood pressure, heart rate, medication or reminder data you enter;
• payment details or billing addresses.

The app contains no third-party SDKs, no ad network and no analytics or attribution service.

The one exception — when you contact us. If you email zhsoft88@icloud.com, we receive your address and what you wrote. We use it only to answer your question and investigate what you reported, and delete it once the matter is closed, unless the law requires us to keep it. We never use it for marketing and never share it. Please do not attach health data you do not need to send.

2. Data stored on this device

The app stores its data with SwiftData in an App Group shared with the widget (group.com.zhuatang.wenyaji), containing:

• Profiles: name, date of birth, sex and target blood pressure;
• Readings: systolic, diastolic, pulse, time, morning/evening flag and notes;
• Medications and dose logs: name, dose, daily times, and the Taken / Snooze / Skip outcome;
• Reminder settings: times, weekdays or intervals for measurement and medication reminders;
• Purchase cache: whether Pro is active and when a trial started;
• Preferences: the active profile, display mode and similar settings in the App Group's UserDefaults;
• Widget snapshot: a JSON file holding only the latest reading and a reminder summary, read by the widget.

This data stays on the device and is never uploaded to a server of ours. We have no server and no accounts, and the app does not sync this data between your devices through iCloud or CloudKit.

3. Device backups

We do not collect or upload your data, and we do not sync it through iCloud or CloudKit. To be accurate, though: if you use iCloud Backup or a computer backup, iOS may include the app's data — including the App Group database and the widget snapshot — in a full-device backup. That backup is managed by you and Apple (or your computer) under your settings, and we cannot access its contents. Turning backups off, excluding the app or deleting a backup is your choice in system settings.

4. Apple Health

Health sync is off by default and only happens after you turn it on:

• Writing: each reading of the primary profile is written to Health as a blood pressure correlation (HKCorrelation) of systolic and diastolic; heart rate is written as its own quantity sample. Writes carry a sync identifier, so repeating one does not duplicate it.
• Reading: the last 90 days of blood pressure are read from Health and imported, de-duplicated by sync identifier.
• Family profiles are never written to Health.
• Reading and writing happen on the device through Apple's HealthKit, never through a server of ours.
• You can revoke access anytime in iOS Settings › Health › Data Access & Devices › WenYaJi.
• Deleting the app does not delete records already written to Health; those belong to the Health app and must be deleted there.

Health data is never used for advertising, marketing or profiling of any kind.

5. Notifications

Measurement and medication reminders are scheduled locally with UNUserNotificationCenter. iOS delivers them at the times you set, and their content never passes through a server. The text can include the profile name, medication name and dose, so it may be visible on the Lock Screen; you can turn off Lock Screen previews or turn notifications off in iOS Settings › Notifications › WenYaJi.

6. Camera and photos

Scanning a meter's screen runs entirely on the device: Vision and image processing locate and rectify the display, then the digits are read from their shape. Where the device supports it, Apple's on-device language model may be used once to refine an uncertain result. Photos are never uploaded, never saved and never written to your photo library in a Release build. Recognised values only fill the confirmation screen, and are saved only when you tap Save. Camera access can be revoked in iOS Settings at any time; manual entry and voice are unaffected.

7. Microphone and speech

Voice entry uses on-device speech recognition only, with no server fallback:

• iOS 26 and later uses SpeechTranscriber and SpeechAnalyzer, with the language model downloaded to the device;
• iOS 18–25 uses SFSpeechRecognizer with requiresOnDeviceRecognition = true.

Audio is never stored and never written to a record; the transcript lives in memory only long enough to fill the confirmation screen. If the device or the current system language cannot recognise speech offline, the voice row is hidden rather than falling back to the network, and manual entry is always available. Microphone and speech permissions can be revoked in iOS Settings at any time.

8. Widgets

The widget never opens the database; it reads the JSON snapshot the app writes into the App Group, limited to the latest reading, a 7-day summary and the next reminder. The snapshot stays on the device and never crosses the network. Anyone near your screen can see what a widget shows — remove it if you would rather they did not. See section 3 for whether the snapshot is included in device backups.

9. Purchases and the trial

Purchases and the trial run through Apple's App Store (StoreKit 2); Apple processes payment. Two non-consumable products are involved:

• com.zhuatang.wenyaji.pro — lifetime Pro;
• com.zhuatang.wenyaji.trial7 — a $0 7-day trial, not a subscription.

The app only learns whether a purchase is active and its purchase date; it never receives your payment details. Entitlement comes from StoreKit's Transaction.currentEntitlements; the App Group cache only paints the first frame at launch and is replaced once StoreKit answers. Restore Purchases is available in the paywall and in Settings. Apple keeps the transaction history under Apple's privacy policy; we cannot access it.

10. Tracking and ads

WenYaJi does not track you, does not collect device or advertising identifiers, shows no ads and never sells or shares your data. There are no third-party SDKs, analytics services, crash reporters or cloud-sync services.

11. Technical note (privacy manifest)

The app ships a PrivacyInfo.xcprivacy that states:

• NSPrivacyTracking = false — no cross-app tracking;
• NSPrivacyCollectedDataTypes is empty — no data collected;
• one required-reason API is declared: UserDefaults, reason CA92.1 (the app only reads the preferences it wrote itself).

This is also the basis for answering “Data Not Collected” in App Store Connect.

12. Retention and deletion

• The developer holds none of your records, so there is no server-side retention period.
• Settings › Data clears all readings and dose logs for the current profile; swipe a profile in Settings › Family Profiles to delete the profile itself (one profile always remains); deleting the app removes everything inside it.
• Records already written to Apple Health must be deleted separately in the Health app.
• Copies inside device backups disappear as those backups rotate and expire under your backup settings.
• Support email is handled as described in section 1: deleted once answered, unless the law requires otherwise.

13. Your rights

Because the app's data lives only on your device and the developer does not hold it, a request to access, correct, export or delete in-app records has nothing to act on — those actions happen on your device. For the information we do hold (email you send to support), you can write at any time to request access, correction or deletion. We do not sell or share personal information.

14. Children's privacy

WenYaJi is not designed for children under 13, and we do not knowingly collect personal information from children. A parent can create a family profile to record a child's readings; that profile stays on the device, is never uploaded to us and is never written to Apple Health.

15. Changes to this policy

If this policy changes we will update this page and the effective date at the top. Material changes to how data is handled will be called out on this page, and where your consent is required it will be requested separately in the app.

16. Contact

Questions about privacy, or to exercise the rights in section 13, email zhsoft88@icloud.com. We usually reply within a few business days.