ColorWander 朝色夕拾

Privacy Policy

Last updated: 2026-07-14

ColorWander ("we", "the app") is built by an independent developer (Bryant / chenzhenghao94@gmail.com). Photos are processed entirely on your device. Off-device requests are limited to: reverse-geocoding lookups that translate a photo's GPS coordinate into a city name, and anonymous usage statistics (no personal data, no photos — see below; you can turn this off in Settings → About). No accounts, no tracking SDKs, no advertising identifiers.

TL;DR

What we read from your device

• Photos you pick — When you pick a photo via PHPickerViewController, the app reads its pixel data, EXIF capture time, and GPS coordinate (if present) to build the card. The pixel data is never sent off-device.
• EXIF metadata — Capture time stays local. GPS coordinates are used to derive a city name for the caption (see below).
• Camera frames (if you choose) — If you tap "Take a photo" instead of picking from the library, the captured frame is processed identically to a picked photo. Declining the camera permission is fine — you just can't take a new photo in-app.
• Vision scene classifier (on-device only) — When a photo lacks GPS data and the Location caption is on, Apple's bundled Vision model classifies the scene (e.g. "beach", "indoor") on-device to suggest a fallback label. Neither the photo nor the label leaves your device.
• Live Photo motion + audio — When you pick a Live Photo and choose to export it as a Live Photo, AVFoundation reads the original motion (paired video) and audio track on-device, composes them with your designed card frame, and writes the result back to your Photos library. Pixel data, audio samples, and the resulting Live Photo never leave your device.

What we send off-device

• Apple's CLGeocoder — If your photo has GPS EXIF and you keep the Location caption on, the coordinates are sent to Apple's geocoder to translate them into a city name. ColorWander only receives the resulting text. The request goes through Apple's standard SDK over their secured channel.
• OpenStreetMap Nominatim (fallback) — When Apple's geocoder fails (which can happen on some Chinese carrier networks for overseas coordinates), the GPS coordinate is sent to OpenStreetMap's public reverse-geocode service at nominatim.openstreetmap.org. Requests go either directly to Nominatim or via a first-party HTTPS proxy at geo.bryantchen.cc/reverse that forwards the same request and caches short-lived responses to comply with Nominatim's usage policy. Only the GPS coordinate is sent — no photo, no identifier, no account ID. Requests carry a User-Agent string identifying the app.
• Anonymous usage statistics — The app sends a small set of anonymous product-interaction events (e.g. app_open, onboarding_completed, paywall_shown, export_completed) so we can understand which features are used and improve the app. Each event carries: a random per-install UUID (not your Apple ID, not the advertising identifier — it resets if you reinstall), app version, iOS version, device model, app language, and event-specific fields such as the layout name or paywall entry point. No photos, no captions you type, no names, no emails, no precise location, nothing that identifies you. You can turn this off any time in Settings → About → "Share anonymous usage data" — switching it off also deletes any queued, un-sent events on your device. To request deletion of already-uploaded anonymous events, email us and we will delete by best effort (the data is anonymous).
• App Store / StoreKit 2 — Purchases, restores, and subscription status checks are handled by iOS's built-in StoreKit. We do not run our own purchase server. ColorWander observes Apple-issued transaction objects to determine your tier; the verification chain is entirely Apple's. Your payment information is handled by Apple — we never see it.

What we do NOT collect

• No accounts or sign-in. No email signup, no account ID, no password.
• No tracking SDKs. No advertising ID (IDFA), no fingerprinting, no cross-app tracking. Usage statistics (above) are sent via a first-party, ~200-line uploader — no third-party analytics SDK is embedded.
• No content collection. Your photos, captions, and cards are never uploaded. Analytics events describe actions (e.g. "a card was exported with the stamp layout"), never content.
• No crash reporter. No remote error logging.
• No live location. We don't request CoreLocation and never read your device's current GPS — only GPS that's already baked into a photo's EXIF.

Permissions we request

You can change these any time in iOS Settings → ColorWander.

Local storage

• Saved card JPEGs live in your app's sandboxed Documents/photos/ directory.
• A small JSON metadata file (history.json) stores per-card caption text, layout name, dominant color hex, capture time, aspect ratio, and city name. No raw EXIF, no GPS, no path to your original photo.
• Preferences (appLanguage, appAppearance, hasSeenOnboarding, and a subscription cache) live in UserDefaults.
• Subscription entitlement state is also persisted by Apple's StoreKit via the system keychain.

To delete all of this, uninstall the app — iOS removes the sandbox and UserDefaults entries with it. StoreKit subscription state lives with your Apple ID and can be managed in Settings → [Your Apple ID] → Subscriptions.

Children

ColorWander is rated 4+ and does not knowingly collect any personal data from anyone, including children. There is no data collection to age-gate.

Third-party content

Bundled assets (fonts, geographic data, literary corpus) are static files. They do not phone home. License attributions are listed both in the Terms of Service and in Settings → About → Acknowledgements inside the app.

Changes

If this policy materially changes — for example, if we add a new off-device data flow — the date at the top will update and the change will be called out in a release note.

Contact

Questions or concerns: chenzhenghao94@gmail.com