一句话：姨妈记没有账号，没有服务端，没有广告，也没有第三方分析。 你的周期、症状、体温与备注保存在这台设备上，我们不会收集、也不会收到它们。 只有你主动发邮件给支持时，我们才会看到你写的内容。

1. 收集什么

我们不收集以下任何一项：

• 账号、姓名、邮箱、电话号码或其他身份信息；
• 设备标识符、广告标识符（IDFA）、随机安装 ID；
• 使用统计、页面浏览、功能点击等行为分析数据；
• 崩溃日志或任何崩溃上报 SDK；
• 位置、通讯录、日历、照片或麦克风；
• 你记录的经期、症状、心情、精力、体温、宫颈黏液、排卵或验孕结果、 性生活、疗法与备注；
• 支付信息或账单地址。

App 里没有第三方 SDK，没有广告网络，也没有接入任何统计或归因服务。

例外——你主动联系我们时。如果你发邮件到 zhsoft88@icloud.com，我们会收到你的邮箱地址和邮件内容。 这些只用于回复你的问题、排查你报告的问题，处理完毕后即删除；法律要求保留的除外。 我们不会把它用于营销，也不会与任何第三方共享。请不要在邮件里附上不必要的健康数据。

2. 本机保存的数据

App 用 SwiftData 把数据保存在一个 App 与小组件共用的 App Group （group.com.zhuatang.yimaji）里，包含：

• 经期记录：每次经期的开始日、结束日与是否已确认；
• 每日记录：流量、症状及其程度、心情、精力、基础体温、 宫颈黏液、排卵测试、验孕结果、性生活及是否防护、疗法打卡、自定义症状标签、 备注，以及最后一次修改的时间；
• 档案与设置：目标模式（记录周期 / 备孕 / 怀孕 / 围绝经期）、 典型周期与经期长度、黄体期长度、摄氏或华氏、健康同步开关、应用锁开关、 各类提醒的时间、怀孕开始日；
• 疗法：药名、剂量与每天的时间点；
• 自定义症状：名称（Pro 最多 30 个）；
• 提醒规则：时间、星期或间隔；
• 购买状态缓存：Pro 是否有效、试用开始日期；
• 偏好设置：当前模式与显示选项，保存在 App Group 的 UserDefaults 里；
• 小组件快照：一份只含今天状态、本周条带和下一次经期等摘要的 JSON 文件，供小组件读取；
• 手表快照：手机写入独立 App Group （group.com.zhuatang.yimaji.watch）的周期摘要，以及手表快捷记录的动作队列。

这些数据只在这台设备上，不会上传到我们的服务器。我们没有服务器，也没有账号系统； App 不使用 iCloud 或 CloudKit 在你的设备之间同步这些数据。手表与手机之间的同步 由 WatchConnectivity 在同一对配对设备上完成。

3. 设备备份

我们不收集、不上传，也不用 iCloud/CloudKit 同步你的记录。但需要如实说明： 如果你开启 iCloud 备份或电脑备份，iOS 可能把 App 的数据（包括 App Group 里的数据库、 小组件快照和手表快照）纳入整机备份。这份备份由你、Apple 或你的电脑按你的设置管理， 我们无法访问其中的内容。关闭备份、排除 App 或删除备份由你在系统设置里决定。

4. Apple 健康

健康同步默认关闭，只有你主动打开后才会发生：

• 写入：月经流量、基础体温、宫颈黏液质量、排卵测试结果、 验孕测试结果、性生活，以及腹部绞痛、头痛、疲劳等症状记录。 只写入你亲手输入的值，从不写入预测。
• 读取：读取你在「健康」里记录的同类数据并合并进 App。 每条写入都带同步标识，重复同步不会产生重复记录。
• 在姨妈记里删除一条自己写入的记录，会同时删除由姨妈记写入「健康」的对应样本； 其他来源（例如健康 App 或医院设备）的样本不受影响。
• 读写都在设备上完成，经过 Apple 的 HealthKit，不经过我们的服务器。
• 权限可以随时在 iOS「设置 › 健康 › 数据访问与设备 › 姨妈记」里关闭。
• 删除 App 不会删除已经写入「健康」的记录；那些记录属于健康 App，需要你在那里单独删除。

健康数据不会用于广告、营销或任何形式的画像。

5. 通知

经期提醒、每日打卡提醒和用药提醒都通过本机的 UNUserNotificationCenter 安排，由 iOS 按你设定的时间发出，内容不经过任何服务器。通知正文可能包含经期日期、 药名和剂量，因此锁屏上也可能看到；你可以关闭锁屏预览，或在 iOS 「设置 › 通知 › 姨妈记」里关闭通知。

6. 应用锁与面容 ID

打开应用锁后，每次冷启动都由 iOS 验证面容 ID 或设备密码。验证在这台设备上完成， 姨妈记不会收到、也不会保存任何面部或生物识别数据。解锁后切到后台时，App 切换器 里显示的是纯遮挡页，不是你的记录。应用锁可以随时在 App 内关闭；未设置设备密码时， 这个开关不可用，并会说明原因。

7. 小组件与 Apple Watch

小组件不直接读取数据库，只读取 App 写在 App Group 里的那份 JSON 快照，内容限于 今天的状态、本周条带和下一次经期等摘要。手表 App 读取手机写入手表 App Group 的周期摘要；手表上的快捷记录先排入动作队列，再由手机处理。快照只在本机和配对的 手表之间，不经过网络。主屏幕和锁屏上的小组件旁边的人也能看到；不需要时长按移除即可。 快照是否进入设备备份，见第 3 节。

8. 购买与试用

购买与试用都通过 Apple 的 App Store（StoreKit 2）完成，付款由 Apple 处理。 涉及的两个 App 内购买项目都是非消耗型商品：

• com.zhuatang.yimaji.pro.lifetime —— 终身 Yimaji Pro；
• com.zhuatang.yimaji.trial7 —— 0 元的三个月试用，不是订阅。 商品 ID 保留创建时的 trial7 名称，显示名称与说明写的是三个月。

App 只会知道购买是否有效以及交易的购买日期，不会拿到你的支付信息。 购买状态以 StoreKit 的 Transaction.currentEntitlements 为准；App Group 里的缓存 只用于冷启动时先画出正确界面，随后由 StoreKit 的结果覆盖。恢复购买在付费墙和「设置」里都有。 交易记录由 Apple 按 Apple 的隐私政策保存，我们无法访问。

9. 导出、备份文件与报告

• CSV 导出：在你点分享之前，导出文件只在本机的临时目录里，不会上传。
• 加密备份：备份文件（扩展名 .ymbk）包含这台设备上的全部记录， 包括疗法名称与剂量。文件用你选择的通行短语加密：AES-GCM 加密，密钥由 PBKDF2-HMAC-SHA256 从通行短语派生。通行短语只存在于你的输入和内存中， 我们既不保存也无法找回；忘记通行短语，备份就无法恢复。
• 恢复：先校验文件，再用备份替换这台设备上的全部记录。这个操作不可撤销， App 会要求你确认两次。
• PDF 报告：就诊摘要与 Pro 报告都在本机生成，只有你点分享时才会离开 App。

10. 追踪与广告

姨妈记不追踪你，不收集设备或广告标识符，不展示广告，也不把你的数据出售或共享给任何人。 我们没有接入第三方 SDK、分析服务、崩溃上报或云同步服务。

11. 技术说明（隐私清单）

App 内置的 PrivacyInfo.xcprivacy 写明：

• NSPrivacyTracking = false —— 不进行跨 App 追踪；
• NSPrivacyCollectedDataTypes 为空 —— 不收集数据；
• 只声明了一项必需理由 API：UserDefaults，理由代码 CA92.1 （仅供 App 自身读取自己写入的偏好设置）。

这也是 App Store 隐私问卷中选择「Data Not Collected」的依据。

12. 保留与删除

• 开发者不持有你的记录，因此不存在服务器端的保留期。
• 在「设置 › 数据 › 删除全部数据」里可以清空这台设备上的全部记录，App 会要求确认； 删除 App 会移除 App 内的全部数据。
• 已经写入 Apple 健康的记录要另外在健康 App 里删除。
• 你导出的 CSV、加密备份与 PDF 由你保管，删除 App 不会删除它们。
• 设备备份里的副本会随备份轮换和过期按你的备份设置消失。
• 支持邮件按第 1 节处理：回复完成即删除，法律要求保留的除外。

13. 你的权利

由于 App 的数据只在你的设备上、开发者并不持有，针对 App 内记录的访问、更正、导出或删除请求 没有可执行的对象——这些操作都在你的设备上完成（导出用 CSV 或加密备份，删除用 「设置 › 数据」）。对于我们确实持有的信息（你发给支持的邮件），你可以随时来信要求访问、 更正或删除。我们不会出售或共享个人信息。

14. 儿童隐私

姨妈记不是面向 13 岁以下儿童设计的产品，我们不会有意收集儿童的个人信息。 如果未成年人使用，应由监护人阅读本政策并管理设备上的记录。App Store 的年龄分级为 12+， 因为内容涉及医疗与治疗信息。

15. 政策变更

如果这份政策发生变化，我们会更新本页并修改顶部的生效日期。涉及数据收集方式的重大变更， 会在本页显著说明；需要你重新同意时，会在 App 内另行征求。

16. 联系我们

对隐私有疑问，或想行使第 13 节的权利，请来信： zhsoft88@icloud.com。我们会在几个工作日内回复。

---

In one sentence: Yimaji has no accounts, no server, no ads and no third-party analytics. Your cycle, symptoms, temperature and notes stay on this device; we never collect or receive them. The only thing we ever see is what you write if you email support yourself.

1. What we collect

We do not collect any of the following:

• accounts, names, email addresses, phone numbers or other identifiers;
• device identifiers, advertising identifiers (IDFA) or random install IDs;
• usage statistics, screen views, feature taps or other behavioural analytics;
• crash logs or any crash-reporting SDK;
• location, contacts, calendar, photos or the microphone;
• the periods, symptoms, mood, energy, temperature, cervical mucus, ovulation or pregnancy test results, sexual activity, therapies or notes you record;
• payment details or billing addresses.

The app contains no third-party SDKs, no ad network and no analytics or attribution service.

The one exception — when you contact us. If you email zhsoft88@icloud.com, we receive your address and what you wrote. We use it only to answer your question and investigate what you reported, and delete it once the matter is closed, unless the law requires us to keep it. We never use it for marketing and never share it. Please do not attach health data you do not need to send.

2. Data stored on this device

The app stores its data with SwiftData in an App Group shared with the widgets (group.com.zhuatang.yimaji), containing:

• Periods: the start and end day of each period and whether it is confirmed;
• Daily logs: flow, symptoms and their severity, mood, energy, basal body temperature, cervical mucus, ovulation test, pregnancy test, sexual activity and whether it was protected, therapy check-ins, custom symptom tags, notes, and when each day was last changed;
• Profile and settings: goal mode (tracking, trying to conceive, pregnancy or perimenopause), typical cycle and period length, luteal length, Celsius or Fahrenheit, the Health sync switch, the App Lock switch, reminder times and the pregnancy start day;
• Therapies: name, dose and daily times;
• Custom symptoms: their names (up to 30 with Pro);
• Reminder rules: times, weekdays or intervals;
• Purchase cache: whether Pro is active and when a trial started;
• Preferences: the current mode and display options in the App Group's UserDefaults;
• Widget snapshot: a JSON file holding only today's state, the week strip and the next period summary, read by the widgets;
• Watch snapshot: the cycle summary the phone writes into a separate App Group (group.com.zhuatang.yimaji.watch), plus the queue of quick-log actions from the watch.

This data stays on the device and is never uploaded to a server of ours. We have no server and no accounts, and the app does not sync this data between your devices through iCloud or CloudKit. Phone-to-watch sync uses WatchConnectivity between the paired devices.

3. Device backups

We do not collect or upload your data, and we do not sync it through iCloud or CloudKit. To be accurate, though: if you use iCloud Backup or a computer backup, iOS may include the app's data — including the App Group database and the widget and watch snapshots — in a full-device backup. That backup is managed by you and Apple (or your computer) under your settings, and we cannot access its contents. Turning backups off, excluding the app or deleting a backup is your choice in system settings.

4. Apple Health

Health sync is off by default and only happens after you turn it on:

• Writing: menstrual flow, basal body temperature, cervical mucus quality, ovulation test results, pregnancy test results, sexual activity, and symptom samples such as abdominal cramps, headache and fatigue. Only values you entered yourself are written — never predictions.
• Reading: records of the same kinds that you keep in Health are read and merged into the app. Every write carries a sync identifier, so repeating a sync does not duplicate anything.
• Deleting a record you made in Yimaji also deletes the matching sample Yimaji wrote to Health; samples from other sources (the Health app, a clinic device) are untouched.
• Reading and writing happen on the device through Apple's HealthKit, never through a server of ours.
• You can revoke access anytime in iOS Settings › Health › Data Access & Devices › Yimaji.
• Deleting the app does not delete records already written to Health; those belong to the Health app and must be deleted there.

Health data is never used for advertising, marketing or profiling of any kind.

5. Notifications

Period, daily check-in and medication reminders are scheduled locally with UNUserNotificationCenter. iOS delivers them at the times you set, and their content never passes through a server. The text can include period dates, medication names and doses, so it may be visible on the Lock Screen; you can turn off Lock Screen previews or turn notifications off in iOS Settings › Notifications › Yimaji.

6. App Lock and Face ID

With App Lock on, every cold launch is checked by iOS using Face ID or the device passcode. The check happens on this device, and Yimaji never receives or stores any face or biometric data. After unlocking, the App Switcher shows a plain cover rather than your records. App Lock can be turned off in the app at any time; on a device without a passcode the switch is unavailable and says why.

7. Widgets and Apple Watch

Widgets never open the database; they read the JSON snapshot the app writes into the App Group, limited to today's state, the week strip and the next period summary. The watch app reads the cycle summary the phone writes into the watch's App Group; quick-log actions on the watch queue up and are processed by the phone. The snapshots stay on the device and the paired watch and never cross the network. Anyone near your screen can see what a widget shows — remove it if you would rather they did not. See section 3 for whether the snapshots are included in device backups.

8. Purchases and the trial

Purchases and the trial run through Apple's App Store (StoreKit 2); Apple processes payment. Both in-app purchase products are non-consumables:

• com.zhuatang.yimaji.pro.lifetime — lifetime Yimaji Pro;
• com.zhuatang.yimaji.trial7 — a $0 three-month trial, not a subscription. The product ID keeps the trial7 name it was created with; its display name and description say three months.

The app only learns whether a purchase is active and its purchase date; it never receives your payment details. Entitlement comes from StoreKit's Transaction.currentEntitlements; the App Group cache only paints the first frame at launch and is replaced once StoreKit answers. Restore Purchases is available in the paywall and in Settings. Apple keeps the transaction history under Apple's privacy policy; we cannot access it.

9. Export, backup files and reports

• CSV export: the file stays in a temporary folder on the device until you share it, and is never uploaded.
• Encrypted backup: the backup file (extension .ymbk) holds every record on this device, including therapy names and doses. It is encrypted with a passphrase you choose: AES-GCM, with the key derived from the passphrase by PBKDF2-HMAC-SHA256. The passphrase exists only in your input and in memory; we neither store nor recover it, and a backup whose passphrase is forgotten cannot be restored.
• Restore: the file is validated first, then the backup replaces every record on this device. This cannot be undone, and the app asks you to confirm twice.
• PDF reports: the visit summary and the Pro report are generated on the device and leave the app only when you share them.

10. Tracking and ads

Yimaji does not track you, does not collect device or advertising identifiers, shows no ads and never sells or shares your data. There are no third-party SDKs, analytics services, crash reporters or cloud-sync services.

11. Technical note (privacy manifest)

The app ships a PrivacyInfo.xcprivacy that states:

• NSPrivacyTracking = false — no cross-app tracking;
• NSPrivacyCollectedDataTypes is empty — no data collected;
• one required-reason API is declared: UserDefaults, reason CA92.1 (the app only reads the preferences it wrote itself).

This is also the basis for answering “Data Not Collected” in App Store Connect.

12. Retention and deletion

• The developer holds none of your records, so there is no server-side retention period.
• Settings › Data › Delete All Data clears every record on this device after a confirmation; deleting the app removes everything inside it.
• Records already written to Apple Health must be deleted separately in the Health app.
• CSV files, encrypted backups and PDF reports you exported are yours to keep; deleting the app does not delete them.
• Copies inside device backups disappear as those backups rotate and expire under your backup settings.
• Support email is handled as described in section 1: deleted once answered, unless the law requires otherwise.

13. Your rights

Because the app's data lives only on your device and the developer does not hold it, a request to access, correct, export or delete in-app records has nothing to act on — those actions happen on your device (export with CSV or an encrypted backup, delete in Settings › Data). For the information we do hold (email you send to support), you can write at any time to request access, correction or deletion. We do not sell or share personal information.

14. Children's privacy

Yimaji is not designed for children under 13, and we do not knowingly collect personal information from children. Where a minor uses the app, a guardian should read this policy and manage the records on the device. The App Store age rating is 12+ because the content concerns medical and treatment information.

15. Changes to this policy

If this policy changes we will update this page and the effective date at the top. Material changes to how data is handled will be called out on this page, and where your consent is required it will be requested separately in the app.

16. Contact

Questions about privacy, or to exercise the rights in section 13, email zhsoft88@icloud.com. We usually reply within a few business days.