Version: 2026-10-15
Last updated: October 15, 2026
Effective arrangements: This Policy takes effect after formal publication and the required notice. Processing that needs separate or renewed consent begins only after the relevant notice and your consent. The version date does not mean consent has been obtained. Membership and payment processing begins only after the relevant feature opens and you actively use it.
北京爱星智联科技有限公司 (“we” or “us”) provides Cami to help you clarify goals, address practical difficulties, and sustain progress. This Policy explains personal information processing and your controls.
We process information lawfully, fairly, and only as necessary. Reading this Policy, accepting the Terms, choosing a communication style, or granting device permissions does not provide blanket authorization for other data uses. We will give any additional notice or obtain consent required before enabling a new purpose.
This Policy applies to the Cami App and related services we provide. Data processing varies by platform, version, and feature. Merely describing an optional feature here does not start collection when you do not use it. Independently supplied third-party services are addressed in Sections 4 and 9.
1. Personal information collection list
Accounts and login: Depending on your chosen method, phone numbers, verification results, third-party account identifiers, and necessary security information support registration, authentication, and account protection. Optional nicknames and avatars support profile display.
Membership and transactions: Once membership purchase, trial, or campaign entries become available, we process the Cami account identifier, registration time and existing-user eligibility, selected plan and channel, quote and order identifiers, transaction and subscription identifiers returned by the payment channel, actual amount and currency, agreement and charge status, benefit periods, trial and promotion eligibility, gift and invitation-code claims, and cancellation, refund, and dispute records. These support eligibility decisions, order creation and verification, delivery or withdrawal of benefits, prevention of duplicate claims or charges, customer service, reconciliation, and applicable obligations. Free and Standard AI service costs are measured by account and categories such as chat, speech, background tasks, and Mini Apps for allowance control and usage display; this is not a payment-account balance. Payment passwords, full card numbers, and channel verification codes are handled by the payment channel on its own screens. Do not submit them in Cami chat or feedback.
Conversation and action support: Text, selected images or files, submitted recordings and transcriptions, and relevant chats support understanding, replies, and requested functions. Plans, tasks, goals, reminders, progress, and review records support organization, feedback, and continued action.
Memory and preferences: Selected communication styles and goals, preferences, facts, and necessary context saved or extracted from interactions reduce repetition and support relevant suggestions and follow-up. Original chats, extracted memory, and functional records may be stored separately; see Section 7.
Mini Apps and records: Diaries, mood, diet, exercise, sleep, expenses, and other submitted information support recording, display, and calculation. Some records contain sensitive health, financial, or location information.
Speech and custom voices: Voice input involves recordings and transcriptions; playback involves text to synthesize. Custom voices use a submitted voice sample or written voice description, depending on the selected method, plus generated voice identifiers and necessary synthesis results. Samples may include sensitive information. Submit only your own voice.
Devices, notifications, and diagnostics: Device models, operating system and app versions, network status, IP addresses, push identifiers, and necessary operation, error, and security logs support delivery, account security, troubleshooting, and reliability. On Android, when you use carrier one-tap login, the number-verification SDK also processes the device identifiers ANDROID ID and OAID during pre-fetch to obtain the login token from the carrier and identify the available authentication channel; see Section 4. Submitted feedback descriptions, contact details, and attachments support investigation and responses.
Profile information: Birthdays, gender, occupation, biography, communication preferences, MBTI, and height, weight, and safety information needed for nutrition or exercise features support profile display, forms of address, calculations, and personalization. Disease, medication, pregnancy, and breastfeeding information is treated as sensitive and is not used for unrelated purposes.
Location and places: When you choose and authorize location-dependent features, precise or approximate location, coordinates, and place names support weather or nearby searches, saved places, check-ins, and converting coordinates to readable addresses. Saved places follow the associated record rules. Request and troubleshooting logs may contain query coordinates, so location processing is not necessarily free from retention.
Date of birth is optional. You may select “Skip for now” during onboarding without losing access to registration or features that do not require it. A birthday you explicitly confirm is used for profile display and age-dependent calculations. Without it, we do not assume that you are an adult or generate personalized nutrition targets that require age. We record the policy version you actively accept and the server timestamp as evidence of your age declaration and consent; a full date of birth is not required as proof of age.
2. Device permissions and Apple Health
We request device permissions when you actively use the relevant feature. Availability depends on device, operating system, and app version.
• Camera: Taking pictures for AI or your avatar and scanning QR codes or barcodes in Mini Apps.
• Photo access: Selecting images, avatars, or Mini App attachments such as meal photos. Limited photo access can be selected where supported.
• Saving photos: Saving posters, generated images, or Mini App exports when you choose Save. Saving locally does not automatically upload an image.
• File selection: Accessing only files you choose and submit; opening the picker does not provide access to all device files.
• Microphone: Voice input, conversations, and custom-voice recording that you initiate. Speech recognition sends the recording to the speech provider; custom voices follow Section 3.
• Location: Weather or nearby queries, saving places, and check-ins you initiate. Sharing with map providers follows Section 4.
• Notifications: Reminders, task and goal notifications, and necessary service messages. System permission and in-app push-reminder settings are managed separately.
• Phone status: On Android, used for carrier one-tap login token verification. Requested only when you actively use one-tap login; declining it does not affect other login methods or features.
• Screen Time / Family Controls: Selecting and blocking distracting apps for focus rules you enable, where supported.
Refusing optional permission affects its feature, not features that do not need it. You can change or withdraw device permission in system settings. Device permissions do not replace separate consent for third-party AI, sensitive information, or other processing that requires it.
On Android devices, the app listens for the system boot-completed broadcast (auto-start on boot), solely to restore the sleep/wake reminders you have set and re-register the corresponding alarms after you restart your device. The app does not launch other features or collect information through this broadcast.
After you actively connect Apple Health and authorize access, Cami reads active energy, sample start and end times, and HealthKit sample identifiers for authorized dates. It does not read unauthorized data types or write to Apple Health. These fields are sent to Cami's server for energy validation, sample deduplication, and overlap checks against manual exercise records for the same day. Daily summaries also contribute to exercise expenditure in nutrition reports.
Health daily records retain dates, total active energy, synchronization times, and necessary status, not sample identifiers or start/end details. Apple Health daily summaries are kept for no more than two calendar years from the recorded date; resynchronization does not restart this period. This supports review and comparison across years but does not guarantee retention for the full two years. These summaries are not used for goal recommendations unrelated to nutrition or exercise.
HealthKit data is not used for advertising, marketing, unrelated data mining, or general-purpose AI model training, or given to advertising or marketing SDKs. Revoke system access to stop future reads and use record management or a privacy request to seek deletion of earlier data. Revocation does not automatically delete stored summaries. Features not requiring Apple Health remain available.
Device permissions govern device access and do not replace other legally required processing consent.
3. Third-party AI data processing
For replies, memory and enabled AI features, Cami shares only the text, images, files, recordings and relevant conversations, profile details, memories and task information needed by the feature, excluding login credentials and payment information. Before sharing personal information, the first-use or renewed-consent page names the recipients, data and purposes. The ordinary agreement checkbox confirms the Terms, Privacy Policy and age declaration only. AI permission is recorded only when you select “Agree and continue”. Historical device consent, ordinary policy consent, device permissions, payment and past AI use do not replace this explicit action. Other processing requiring separate consent is handled before that feature is enabled. You may leave this flow without selecting the AI button. Signed-in users can withdraw AI permission separately under Settings → Permissions → Privacy permissions. This pauses further AI processing and services that depend on it, while agreements, personal information controls and necessary account operations remain accessible. Withdrawing the entire Privacy Policy also pauses the account and signs it out on all devices. Withdrawal does not automatically delete history or recall data already sent or processing already started. Recipients are listed in Section 4.
Using AI does not grant blanket authorization to train general-purpose models on private chats, memories, or Mini App records. Any proposed training requires a separate explanation of purposes, scope, and participants and applicable notice and consent procedures. HealthKit remains subject to Section 2.
Some content may include sensitive health, financial, or location information. Please submit only what the relevant feature needs. This Policy, a general agreement checkbox, and device permissions do not authorize additional purposes or general-purpose model training. Any purpose requiring additional notice and consent is handled before that processing.
Voice samples and features: The custom-voice page asks you to confirm that you submit only your own voice and explains before upload that the sample is sent to Alibaba Cloud to extract voice features, create a voice, and synthesize speech. A voice may be imitated; leaks or misuse could cause identity confusion, impersonation, or reputational harm. Original recordings are not kept for later rebuilding by default. If you choose to retain one, Section 5 describes its purpose and cleanup. Do not upload another person's voice.
Health and lifestyle records: Whether ordinary diet, sleep, or mood entries are sensitive depends on their content and context. Disease, treatment, mental health, and information that may reveal health status receive sensitive-health protection. Section 2 describes processing after connecting Apple Health. Recognition and other AI actions you explicitly initiate in a Mini App process your submitted content according to that feature notice. A leak could expose health or private life.
Expenses and other sensitive records: Amounts, categories, and notes support bookkeeping and calculations. Entries may contain financial accounts, identity, precise movements, or other sensitive information; disclosure could reveal assets, activities, or identity. Do not submit full bank-card numbers, payment passwords, or verification codes for ordinary bookkeeping.
Manage data through record pages or our contact email. Request deletion of extracted memories or restrictions on their use by email. Section 7 explains withdrawal and deletion. Processing not requiring consent by law follows the applicable legal basis.
We may process relevant information without consent where necessary to fulfill an applicable legal obligation or, in an emergency, to protect a person's life, health, or property. This does not include continuous precise-location collection, reading address books, routine monitoring, or routine sharing of moods, chats, or health records with relatives or others.
4. Third parties and SDKs
Cami uses cloud, model, authentication, and push providers. Some act on our instructions to deliver the functions described here; others decide their own purposes and means. For an independently acting recipient, we will explain its name, contact details, purpose, method, and data categories and obtain any required consent. A provider's own rules do not remove our responsibilities.
The following providers receive the information needed for the relevant function. Carrier authentication and system push may also involve your carrier or device platform, subject to the feature notice and platform rules.
Alibaba Cloud Computing Co., Ltd. (阿里云计算有限公司): provides AI, voice, file storage and notifications (Android push uses the Alibaba Cloud push SDK / EMAS). It processes necessary text and context, images or files, audio or voice samples, device and network information, push identifiers and necessary logs for the feature used. Contact Alibaba Cloud support tickets or 400-80-13260; privacy policy: https://terms.aliyun.com/legal-agreement/terms/suit_bu1_ali_cloud/suit_bu1_ali_cloud202107091605_49213.html .
Hangzhou DeepSeek Artificial Intelligence Basic Technology Research Co., Ltd. and affiliates participating in the service: provides AI content processing using necessary text, context, images or file content and call information. Contact and privacy policy: https://cdn.deepseek.com/policies/zh-CN/deepseek-privacy-policy.html .
Beijing Volcano Engine Technology Co., Ltd. (北京火山引擎科技有限公司) and relevant service affiliates: provides AI and voice services using necessary text, context, images, recordings and call logs. Business contact: service@volcengine.com; privacy and security information: https://www.volcengine.com/trust/privacy .
Number-verification SDK (号码认证 SDK, Jiguang JVerification, including JCore): provided by Shenzhen Hexun Huagu Information Technology Co., Ltd. (深圳市和讯华谷信息技术有限公司); it carries carrier one-tap login authentication (including the China Unicom authentication channel, 联通认证), verification messages, and notifications for older versions. When you actively use one-tap login, the SDK processes the device identifiers ANDROID ID and OAID, device, network and carrier information, and necessary logs during pre-fetch, to obtain the login token from the carrier gateway and identify the available authentication channel; authentication processes the necessary phone number or verification result. Other login methods are available. Contact: support@jiguang.cn or compliance@jiguang.cn; privacy policy: https://www.jiguang.cn/license/privacy .
Apple, WeChat, and carrier authentication: When you choose the relevant login method, authorization identifiers, necessary account information, and verification results are processed. WeChat capabilities are provided by the WeChat OpenSDK. System push platforms also handle push tokens and necessary message content.
Membership payment channels: After membership purchasing opens, iOS in-app purchases use Apple's App Store and StoreKit. Apple handles purchase and payment information and provides Cami with the product, transaction, subscription status, and signed evidence needed to verify subscriptions and refunds; see Apple's privacy policy (https://www.apple.com.cn/legal/privacy/) for its contact details and rules. When Android users actively choose WeChat Pay or Alipay, payment is invoked through the WeChat OpenSDK or the Alipay SDK, and we submit the merchant order number, product, amount, and other data needed to place the order with the selected channel and receive the transaction results needed to verify charges, renewals, cancellations, and refunds. WeChat Pay is provided by Tenpay Payment Technology Co., Ltd. (财付通支付科技有限公司), reachable at 95017; see Tenpay's privacy policy (https://pay.wechatpay.cn/xdc/weardeviceagreementweb/html/agreement/tenpay_user_privacy). Alipay is provided by Alipay (China) Network Technology Co., Ltd. (支付宝（中国）网络技术有限公司), reachable at 95188; see Alipay's agreements and privacy policies (https://render.alipay.com/p/c/17qjvbnlkcw0). The channel's rules govern payment accounts, cards, and verification information it collects. Cami does not receive full payment passwords, verification codes, or card numbers merely from a payment result. An unopened channel does not initialize a payment SDK or create an order under this Policy. Before enabling a channel, we will check its contracted entity, actual fields, and agreements and update the third-party sharing list.
The Alibaba Cloud OSS object storage used by Cami is in the Beijing region within China. Other model, speech, authentication, and push services process relevant business data under their actual production configurations. Different functions call only the services they need. We will update the disclosure and complete applicable procedures if a provider, production region, processing role, or purpose changes.
We do not sell personal information or share it for targeted advertising. Disclosure for legal requirements, lawful emergency protection, or another lawful basis is limited to necessity. Public disclosure and business transfers require applicable notice about recipients and rules and any required consent.
5. Retention, deletion, and location
Information may be stored on your device, Cami servers, and provider systems. The rules below describe retention by category. When a period expires, a purpose ends, or deletion is required, we delete or anonymize the information. Legally retained exceptions are managed separately and not used for unrelated purposes.
Account information: Retained for login and management during the service relationship, then handled under account-closure rules. Chats, goals, memory, and Mini App records: Retained for continued use, review, and cross-device access until deletion, account closure, or the purpose ends. Chats, extracted memories, and functional records may be stored independently and need separate management; deleting chats does not automatically delete every derived record.
Membership eligibility, orders, and payment records: Trial and promotion eligibility, invitation-code use, and the membership entitlement ledger are retained during the account relationship to prevent duplicate claims, verify benefits, and resolve disputes. Orders, agreements, charges, refunds, reconciliation, and necessary customer-service records are retained during the transaction relationship and after-sale handling. After account closure, transaction, financial, or dispute records that must be retained by law are restricted to those purposes for the applicable statutory period and dispute handling. That period is determined by when the order or dispute is completed and the legal requirements applicable to each record; after it ends, we delete or anonymize the data. Account closure does not immediately erase payment facts that still need verification, and retained records are not used for new marketing purposes.
Original custom-voice recordings: By default, recordings are not retained for later rebuilding and enter cleanup after creation completes or fails. If you separately choose retention, a recording is kept for rebuilding until you delete the voice or the purpose ends.
Generated voices: A voice is retained for synthesis while in use. A pending voice is scheduled for cleanup after 30 days; a replaced voice is kept for 30 days to support historical audio, then scheduled for cleanup. Deleting a voice disables its configuration and schedules cleanup of its cloud voice and recording.
Apple Health daily summaries: These are kept for no more than two calendar years from the recorded date in China Standard Time. Expired summaries stop being used for queries, synchronization, or analysis and are deleted. Resynchronization does not extend the period. You may request earlier deletion.
Account closure disables the account, revokes sessions, stops push notifications, and processes related memory and data. Other account data enters later cleanup. Copies across all storage locations do not disappear simultaneously. The account cannot be restored after closure is complete.
Information legally requiring retention, or backups technically difficult to delete immediately, is retained only within lawful limits with safeguards and without other processing, then deleted when the conditions permit. Contact us about deletion status.
Storage and cross-border processing: Cami-controlled servers and Alibaba Cloud OSS object storage are currently in Beijing, China. The actual processing regions of other model, speech, authentication, and push services depend on their production configurations and service arrangements. Apple, WeChat, carriers, and device makers process information needed for your chosen platform login or system push under their own rules. Cami does not itself provide personal information to an undisclosed overseas recipient. Before future cross-border provision, we will identify the recipient, contact, purpose, method, categories, retention, and rights channel and complete applicable procedures.
6. Information security
We use transmission protection, access controls, necessary masking, and access limited to work duties. Internet services cannot guarantee absolute security. For a personal information security incident, we take remedial measures, report, and notify affected users as required by law.
Protect devices and credentials, share exports and screenshots carefully, and adjust lock-screen previews as needed.
7. Your personal information rights
You may lawfully access, copy, correct, supplement, or delete information, withdraw consent, request account closure, and ask us to explain processing rules.
Profiles and records: Manage profiles, chats, and functional records through their pages. Request deletion of extracted memories or restrictions on their use through our contact email. Contact us where self-service cannot fulfill a request.
Personalized information: You can request restrictions on personalized recommendations and proactive messages through our contact email. Existing opt-outs remain effective after the page entry is removed. Settings → Push Reminders → Proactive push manages notifications and does not replace requests to restrict personalized chat messages. Requested conversations, task reminders you set, agreed follow-ups, phase confirmations, action and progress feedback, and essential account notices continue under their own rules. Delivered messages cannot be recalled.
Export and closure: Settings → Account and Security provides these functions. Scope follows the interface and export results; identity verification may be required. Request legally accessible information missing from self-service by email. Exports exclude passwords, tokens, and authentication credentials.
You can review this Policy and withdraw consent under Settings → Permissions → Privacy permissions. Withdrawing pauses this account and signs it out on all devices. Push notifications and scheduled AI services stop, including proactive care, task follow-ups, report generation, and background memory processing. Before using Cami again, you need to confirm the ordinary agreements, explicitly authorize AI processing through the AI consent button, and sign in again. Missed reminders and scheduled services will not be replayed.
Withdrawing privacy consent also withdraws third-party AI permission. This does not delete your account or history. To resume, confirm the ordinary agreements, explicitly authorize AI processing through the AI consent button, and sign in again. Ordinary privacy consent does not override an existing AI refusal or withdrawal. Pushes already sent and processing already started may not be recallable. Local reminders on other offline devices are cleared when those devices synchronize.
Withdrawal and deletion: Revoke device permissions through system settings and other consents through relevant features or email. Withdrawal does not affect prior lawful processing or automatically delete existing content; specify deletion too if wanted. We stop future processing based on withdrawn consent and explain functional effects. Uninstalling does not close an account or delete server data.
Send personal-information requests to haohao@ixingtech.com. Settings → Help and Feedback → Complaints and appeals accepts complaints and appeals and provides receipt numbers. We verify identity only as necessary and provide a result within 15 working days of receipt. Complex requests receive reasons, progress, and an estimated completion time within that period; shorter statutory deadlines prevail. A response deadline is different from deletion completion across every medium. If unable to comply, we explain the basis and available appeal routes. Do not send passwords or codes.
After a person's death, close relatives may, for their own lawful and legitimate interests, request access, copying, correction, or deletion of relevant personal information unless the deceased made other arrangements. We verify identity, relationship, death, and necessity and protect others' rights. This is not automatic account inheritance or unconditional access to all private conversations.
8. Minors
Cami is for users aged 14 or older and does not serve children under 14. Users aged 14 to 17 should read this Policy with a parent or guardian and use the service with their consent and guidance.
Information about children under 14 is sensitive. If inadvertently collected, we stop relevant service and unnecessary processing and delete it or apply other lawful protection, except required retention. Guardians may contact us for verification or deletion. Guardian consent does not override the minimum age.
9. Sharing and third-party content
When sharing, exporting, or visiting third-party services, consider recipients, scope, and personal information included. Cami remains responsible for its own processing; independently supplied services follow their own rules.
10. Policy changes and contact
We publish policy versions, update dates, and effective arrangements; the actual publication date is shown in the app and on the website when formally released. Before significant changes to categories, purposes, methods, recipients, or principal rights take effect, we prominently display a summary and full text in the app or another suitable channel. Required renewed consent precedes processing; preselection or continued use is not a substitute. Refusing optional new purposes does not expand prior authorization or remove unrelated features.
Personal information processor: 北京爱星智联科技有限公司. Telephone: +86 13126613568.
Registered and correspondence address: Room 3318, Floor 33, Building 5, Courtyard 2, Jiangmidian Street, Tongzhou District, Beijing. App filing number: 京ICP备2026059385号-2A. haohao@ixingtech.com is Cami's official personal-information contact. The in-app complaints and appeals entry is Settings → Help and Feedback → Complaints and appeals; personal-information rights requests use this email. Customer-service personnel or the technical team handle requests according to category. The website policy is available at https://realcami.cn/privacy.
Explain your request, the account information needed for verification, and a reply method. Section 7 governs handling. For a voice-impersonation complaint, minor-protection request, or deceased-person request, explain the relevant matter so that we can verify only what is needed.