Privacy Policy隐私政策

OffMemory ("we", "the App") is built on a single principle: your notes are none of our business. This Privacy Policy explains, in plain language, exactly what the App does and does not do with your information.

1. The Short Version

• There is no cloud and no server behind the App. Your entries are encrypted on your device, and there is nowhere on our side for them to go.
• We never collect, transmit, store, share or sell any of your personal data, notes, images, mood marks, passwords or device identifiers.
• There is no sign-up step: no email address, no phone number, no registration form, no analytics, no crash reporting and no advertising SDK.
• Your note titles, bodies and images are encrypted with AES-256 and stored only on your own device. For local search, folder names and tag names are not encrypted (they are kept in plain text on your device); they likewise never leave your device.
• You can export an encrypted backup and restore it on a new device or after reinstalling. That file is created by you, kept by you, and stays encrypted with your password — we never receive it.
• You may also choose to export plain, unencrypted files: a .zip archive of readable Markdown plus images, a plain .txt file, or a single note as .md. These are created only when you explicitly select and confirm them, and anyone holding them can read them directly.
• The App's only network activity is Apple's in-app purchase channel, which is required to process the one-time unlock. Apple handles that transaction entirely; we receive no personal data from it.

2. Information We Collect

None. The App does not collect any information whatsoever — not personal information, not usage data, not device data, not diagnostics. Because we operate no backend at all, there is no server of ours that could receive such data even if we wanted to collect it.

3. How Your Data Is Stored

• Location: All notes, folders, tags, mood marks, favourites and images are stored in a local database inside the App's private sandbox on your device.
• Encryption: Note titles, note bodies and images are encrypted using the AES-256-CBC algorithm before they are written to disk. Your master encryption key is derived from your password using PBKDF2-HMAC-SHA256 and is stored in the system Keychain.
• No server, ever: We operate no backend at all. There is no sign-in, no sync service and no place where your data could be stored on our side.
• Automatic device backups: Any backup made by your operating system (for example, an iTunes or iCloud device backup) is created and controlled entirely by Apple. Such a backup may contain the App's encrypted database files. Those files remain encrypted, and your password and encryption keys are never included.
• System search (Spotlight, off by default): you can turn on "Search in Spotlight" under Settings → Security. When it is on, note titles are written into the iOS system search index as entries, so you can find them in Spotlight and open the note directly. Bodies, images, moods, tag names and folder names are never written to that index; notes marked as locked are not indexed; and these titles are unreadable while the device is locked (the index uses iOS complete file protection). Turning the switch off immediately clears whatever was already written.

4. Backups, Exports and Moving to a New Device

Version 1.1.0 lets you export an encrypted backup and import it on another iPhone or iPad, or after reinstalling the App.

• What the file is: a single archive containing your encrypted notes, images and mood data, produced on your device.
• Optional backup passphrase: you may protect the archive with a backup passphrase. If you do, an additional copy of your master key is wrapped with a key derived from that passphrase (PBKDF2 + AES-256-CBC), which is what allows the same archive to be restored on a different device. We do not store the passphrase and cannot recover it.
• Where it goes: wherever you choose — the Files app, iCloud Drive, an external drive, or AirDrop. That choice is entirely yours. The archive remains encrypted throughout and is never uploaded to us or to any third party by the App.
• Your responsibility: a backup file is only as safe as the place you keep it and the passphrase you choose. If you lose the passphrase and the original device, the archive cannot be opened.

Plain exports (optional, unencrypted): besides the encrypted backup, the App can also produce two plain export formats — a .zip archive of readable Markdown plus images, and a plain .txt file; an individual note can also be exported on its own as a .md file. Plain files are not protected by the App's encryption, anyone who obtains them can read them directly, and the App never chooses a plain format for you: one is created only after you explicitly select and confirm it. Please store or destroy these exports with the same care you would give any unencrypted file.

5. Passwords, Recovery and Passphrases — Please Read Carefully

Your password is never transmitted, never stored on any server, and cannot be recovered by us. We do not operate any server that could hold it. This is a deliberate design decision, and it is the reason true privacy is possible.

• If you forget your password, we cannot reset it for you, and we cannot recover your notes.
• The App offers security questions as a recovery mechanism. If you configure them, an additional encrypted copy of your master key is created locally. Answering your security questions correctly lets you set a new password while keeping your data.
• If you forget both your password and your security answers, the only remaining option is to erase all local data and start over. This erasure is permanent and irreversible.

6. Biometric Unlock (Face ID / Touch ID)

If you enable biometric unlock, the App asks iOS to store a credential in the device Keychain that can be released after a successful Face ID or Touch ID match. Biometric authentication is performed entirely on your device by the operating system. We never receive your face or fingerprint data, and no biometric information ever leaves your device.

7. Photos and Files

The App requests access to your photo library only in two situations, and only after you explicitly grant permission:

• Inserting an image: the selected image is encrypted and copied into the App's private storage.
• Exporting a backup or a plain export: the encrypted backup file, or a plain export file you explicitly chose (.zip / .txt), is written to the location you choose.

You may deny or revoke these permissions at any time in iOS Settings. Denying them does not affect any other feature.

8. Purchases

OffMemory offers a single one-time purchase that permanently unlocks writing. There is no subscription, no auto-renewal, no trial period and no advertising. All payment processing is handled by Apple through the App Store. We do not receive your name, email address, payment card number or any other personal information from Apple in connection with your purchase.

9. Third-Party Services and SDKs

The App contains no third-party analytics, advertising, crash-reporting, social or attribution SDKs. The only third-party component that makes any network request at all is Apple's StoreKit framework, which exists solely to process the one-time purchase described above.

10. Children's Privacy

The App is not directed to children under the age of 13 and does not knowingly collect any information from anyone. Because the App collects no data at all, no information from any user — including children — is ever obtained, stored or shared.

11. Data Retention and Deletion

Because we hold no data, there is nothing for us to retain or delete. You are in complete control of your local data at all times:

• Deleting a note moves it to the in-app Trash, where it is permanently deleted automatically after the retention period stated in the App (currently 7 days).
• Using "Erase All Data" in Settings permanently destroys all local notes, folders, tags, mood marks, images, backups held inside the App and encryption keys.
• Uninstalling the App removes all of its local data from your device. Any encrypted backup file you exported elsewhere remains wherever you saved it, and remains your responsibility.
• There is no cap on the number of entries you can store — the only limit is your device's free space. An encrypted backup you export can later be imported after reinstalling the App or on a new device, restoring your notes, images and moods.

These actions are irreversible.

12. Security

We protect your data with the following measures, all of which run locally on your device: AES-256-CBC encryption of note titles, bodies and images; PBKDF2-HMAC-SHA256 key derivation; storage of keys in the iOS Keychain; mandatory password unlock with brute-force protection (progressive lockout after repeated failures); optional Face ID / Touch ID; automatic re-lock when the App enters the background; an optional screenshot-blocking mode on note detail pages; and PBKDF2 + AES-256-CBC wrapping of the master key for passphrase-protected restore on a new device. No method of electronic storage is perfectly secure, and we cannot guarantee absolute security; however, we operate no server and cannot read your local data or an encrypted backup that you keep yourself.

13. This Website

This website is a static product page. It sets no cookies, runs no analytics, advertising or tracking scripts, and loads no third-party resources — all fonts and images are served from this domain. The only information stored in your browser is your language preference, which is kept in localStorage and never sent anywhere.

14. Changes to This Policy

If we update this Privacy Policy, the revised version will be posted on this page and included in the next release of the App, and the "Last updated" date above will change. Continued use of the App after an update constitutes acceptance of the revised policy.

15. Contact

If you have questions about this Privacy Policy, please reach us through the support information listed on this App's App Store page.

Remember: your password, security answers and backup passphrase exist only in your own memory. Guard them carefully, especially any passphrase needed for cross-device restore. If every recovery path is lost, your data is gone permanently — there is no exception.