Privacy Policy

1 Who we are

Hinokoe (一日书 / 一日書 / 日の声) is made by an individual developer in Australia.

• Developer: Chenhao Huang
• ABN: 76 628 118 781
• Location: Melbourne, Victoria, Australia
• Email: [email protected]

In this policy, “we” and “us” mean that developer. “The app” means Hinokoe for Apple Watch and iPhone. This website is hinokoe.com. The developer is also the person responsible for privacy (privacy officer / data protection officer) and can be reached at the email above.

2 What we process, and where

Recording, transcription, speaker separation, search and the daily page all happen on your Apple Watch and iPhone. Your audio is never uploaded to our servers, and it is never sent to any AI provider. Audio is stored, encrypted, in your own iCloud only if you turn on “Back up last 30 days of audio” (a Pro feature).

On your devices. The app keeps audio, transcripts, speaker groups, chapters, reviews, memories you’ve confirmed, place names, body signals (if you allow them), references to photos you took, calendar events used for Privacy Zones, and your voice profile (if you turn it on). The app has no account and doesn’t create a device ID. You can record with your Apple Watch, or with your iPhone when you tap “Record with iPhone”; both are handled the same way.

Cloud AI (optional, Pro). When you turn on cloud AI, the app sends only text to an AI provider (never audio, never values from the Health app, never precise location) to organize chapters, write daily and weekly reviews, pick out promises and memories, run the organizing templates you write, and answer your questions. Before each request, the app replaces names, phone numbers, email addresses, street addresses, ID numbers and card numbers with placeholders on your iPhone. The table that maps placeholders back to the real words stays in your iPhone’s memory and is never sent. Only the few memories relevant to a question are included. If you turn on “Let AI consider body signals”, a request may include labels such as “working out”, “asleep” or “tense”, never numbers. You can mark any passage “Don’t send to AI”, and the AI ledger in Settings shows every request and exactly what was sent.

Our relay server. Cloud AI requests go through our relay server on Cloudflare Workers. It receives the text, forwards it to the AI provider and discards it, and it doesn’t log request content. To run Pro and its daily limits, the server keeps, under a random ID the app creates (not linked to your name, email or device): your subscription status and expiry, today’s and this month’s usage counts, an App Attest key ID and counter that confirm requests come from a genuine copy of the app, and the IDs of recent requests. Logs contain only metadata: which model, how many tokens, how long it took and whether it succeeded. Cloudflare’s network logs include IP addresses and are kept for 3 to 7 days.

Your own API key (optional). If you use “Bring your own key”, AI requests go directly from your iPhone to the provider you choose, under your own agreement with that provider, and never pass through our servers. Your key is stored only in this iPhone’s Keychain and isn’t backed up. Before you confirm a provider, the app shows a summary of its data policy; some providers, such as some free tiers, may use your text for training. The same placeholder replacement and AI ledger apply.

Export to your AI assistant (optional). If you export a memory pack for an AI assistant you use, the files you export or sync are outside Hinokoe’s protection once they reach that assistant and its model provider. By default the pack contains summaries and key points only. Original words are included only if you choose, and other people’s words only after a second confirmation. Audio, your voice profile, body signals and precise location are never exported; phone numbers, ID numbers, card numbers, email addresses and street addresses are replaced with placeholders.

Apple. Your iCloud backup uses Apple’s CloudKit private database. Text fields are encrypted, and only when you turn on Advanced Data Protection for iCloud is Apple also unable to read them. Apple handles App Store purchases. To confirm your subscription, our server verifies the signed transaction from Apple and keeps only the random ID, product, status and dates. On supported devices, on-device AI uses Apple’s on-device model, and that processing stays on your iPhone. If you ask Hinokoe something through Siri or Shortcuts, Apple processes the request under its own privacy policy.

Diagnostics. The app collects performance data on your iPhone. A diagnostic report reaches us only if you choose to send one.

This website. hinokoe.com doesn’t use cookies or third-party analytics. Your language choice is saved in your own browser. Cloudflare, which hosts the site, keeps network logs including IP addresses for 3 to 7 days.

Beta waitlist. If you join the beta waitlist on our website, we keep your email address, your email language, the watch model, price answer and your answer to “What would you most like it to help you with?” if you choose to give them, and when you signed up and confirmed. We use your email only to invite you to the beta and to tell you when we launch; the watch model, price answer and what you wrote only help us plan testing, set the price and decide what to work on first. We only look at the totals, never publish them, and delete them along with your email. Please don’t include anyone else’s name or contact details in your answer. Your email is stored with Cloudflare, and confirmation and update emails are sent by our email provider, who acts only on our instructions. When we invite you to the beta, your email is given to Apple so TestFlight can send the invitation. We never sell it or share it with anyone else.

We don’t sell personal information, don’t use advertising or tracking SDKs, and don’t track you across other companies’ apps or websites.

3 Your role and ours

You decide what to record. When your recordings include other people, you are responsible for following the laws where you are, for telling the people present, and for getting their consent where it is required. The app helps with a notice card, a pause button, “delete the last 5 minutes” and region-specific prompts, but these aren’t legal advice.

We provide the tool. We don’t receive your recordings or transcripts. When you use cloud AI, we pass your text to the AI provider on your behalf and don’t keep it.

Hinokoe 1.0 isn’t offered in the European Union or the United Kingdom.

4 Service providers

• Anthropic, PBC (United States) is our main provider for cloud AI. Under its commercial terms it doesn’t train models on your text, and it deletes inputs and outputs within 30 days. Content flagged by its automated safety systems may be kept longer, as described in its privacy center.
• OpenAI OpCo, LLC (United States) is our backup provider and takes over the same request only when Anthropic is temporarily unavailable. Under its API data policy it doesn’t train models on your text by default; abuse-monitoring logs (which may include requests and results) are kept for up to 30 days, or longer where the law requires or to prevent harm, as described in its API data guide.
• Cloudflare, Inc. (United States, global network) runs our relay server, the gateway that connects to the AI provider (set to log metadata only) and this website, under its data processing terms.
• Apple provides iCloud backup, App Store payments, Siri, and the on-device model used by on-device AI. When we invite you to the beta, TestFlight receives your email address.
• Our email provider sends waitlist confirmations and updates on our instructions and for no other purpose.

Before we add any other AI provider, we’ll update this list and ask for your consent again in the app.

5 How long we keep data, and how to delete it

• Audio: kept for the period you choose in Settings: 30, 90 (default) or 365 days, or forever. Your Apple Watch deletes its copy once your iPhone has received it.
• Text, reviews and memories: kept until you delete them. A deleted memory disappears from search, backups and AI requests.
• Delete the last 5 minutes: one tap on the watch or iPhone permanently deletes the audio, transcript and related data for that period, everywhere including backups. Only a note that you deleted that time range remains.
• Delete a time range or everything: in Settings you can delete a time range, or all recordings, transcripts, search data and your iCloud backup at once.
• iCloud backup: you can turn it off and delete it in the app, or in iOS Settings › [your name] › iCloud › Manage Account Storage.
• Cloud AI: our servers keep no content. The provider’s retention is described in section 4.
• Our server records: usage counts are kept for the current day and month; subscription records are deleted 12 months after your subscription ends.
• Deleting the app removes the data on your devices. An iCloud backup stays until you delete it.
• Emails you send us: kept for 2 years after our last exchange, then deleted.
• Beta waitlist: sign-ups that aren’t confirmed are deleted after 7 days, and confirmed ones within 90 days after launch; unsubscribing deletes yours right away.

6 Your choices and rights

• See and export your data: export any day or range as Markdown, plain text, JSON or audio.
• Correct it: edit transcripts, memories and speaker names in the app.
• Delete it: see section 5.
• Withdraw consent: turn off cloud AI or “Let AI consider body signals” at any time; delete your voice profile; change Microphone, Location, Health and Calendars permissions in iOS Settings.

Because your recordings and transcripts are not stored on our servers, we usually can’t see, correct or delete them for you; the app gives you those controls directly. For any question, request or complaint, email [email protected]. We don’t charge for requests. We reply within 15 business days. If you aren’t satisfied, you can contact your local privacy regulator (see section 11).

7 Health data

If you allow it, the app reads heart rate, workouts, sleep and heart rate variability from the Health app to label moments on your timeline: working out, asleep, and “relaxed” or “tense” (an estimate from heart rate variability, not a medical judgment). The app doesn’t infer anything about your body or mood from your voice. Health data stays on your devices and isn’t included in iCloud backups. It isn’t used for advertising, marketing or data mining, and isn’t given to anyone. It reaches cloud AI only as labels, and only if you turn on “Let AI consider body signals”. Hinokoe isn’t a medical device.

8 Location

If you allow it, the app uses your location to pause at Privacy Zones you set and to label chapters with place names. When your iPhone isn’t nearby, your Apple Watch can note an approximate location every 15 minutes; you can turn this off. Coordinates stay on your devices. Only place names are included in your iCloud backup, and location is never sent to AI.

9 Remember my voice (biometric information)

“Remember my voice” is optional and off until you choose it. The app asks the first time you tap “That’s me”, on a separate consent screen.

• What it is: a voice reference (a voiceprint) made from your own speech, so the app can label your lines as “Me”. You can optionally read aloud for 20 seconds on your iPhone to make it more accurate; that reading is used only to build your voice reference and is deleted once the reference is made.
• Where it’s kept: only in the app’s database on this iPhone. It isn’t uploaded, isn’t included in iCloud backups and is never received by us. On a new iPhone you confirm “That’s me” again.
• Retention and destruction: it’s destroyed when you delete it in Settings › Remember my voice, when you delete the app, or 3 years after you last use it, whichever comes first.
• No sale, no sharing: it’s never sold, leased, traded or shared.
• Only for you: the app doesn’t create voice profiles of anyone else. Other people’s voice features are used only to separate speakers within one day and are deleted once that day is processed. Only the labels (A, B, C) and any names you add are kept, and voices aren’t matched across days.
• The app doesn’t infer emotions or health from voices.
• The time you gave consent is recorded on your iPhone.
• In the Canadian App Store, “Remember my voice” isn’t available in version 1.0.

10 Age

Hinokoe is for people 18 and older. It isn’t directed at children under 13, and we don’t knowingly collect their information.

11 Regional information

Australia

As a small business under the Privacy Act 1988, we may not be required to follow the Australian Privacy Principles, but we choose to handle personal information in line with them. Text you send with cloud AI is disclosed to Anthropic in the United States (or to OpenAI when Anthropic is unavailable), and our relay runs on Cloudflare’s global network. You can complain to us first, and then to the Office of the Australian Information Commissioner at oaic.gov.au.

United States

We don’t sell or share personal information and don’t use it for targeted advertising. We don’t track you across other sites, so “Do Not Track” signals don’t change anything. For state biometric laws (such as Illinois, Texas, Washington and Colorado), section 9 is our written retention and destruction policy: your voice profile stays on your iPhone, we never receive it, and it’s destroyed no later than 3 years after your last use. We don’t collect consumer health data off your device and don’t infer health from voices.

Japan

• Business operator: Chenhao Huang, Melbourne, Victoria, Australia. Representative: Chenhao Huang.
• Purposes of use: providing the app’s features; cloud AI processing you turn on; Pro subscription and daily limits; support and replies to requests; the beta.
• Provision to a third party in a foreign country (APPI Article 28): when you turn on cloud AI, you consent in the app to your text being provided to Anthropic, PBC in the United States, or to our backup provider OpenAI OpCo, LLC when Anthropic is temporarily unavailable. According to the Personal Information Protection Commission’s survey (information as of October 2021), the United States has no comprehensive federal law on personal information; sector-specific federal laws (such as the ECPA, GLBA and HIPAA) and state laws (such as California’s CCPA) apply, and compared with the OECD Privacy Guidelines, federal law has no provisions corresponding to the data quality, purpose specification, openness and accountability principles. Both commit under their commercial terms not to use the data for training, and maintain security measures; Anthropic deletes it within 30 days, and OpenAI keeps abuse-monitoring logs for up to 30 days (longer where the law requires). Our relay on Cloudflare doesn’t store the content.
• Security measures: a designated responsible person (the developer); data on devices and in backups is encrypted; our servers don’t store request content and keep only the minimum records above; access to logs and server settings is limited to the developer with two-factor authentication; data processed outside Japan is limited to the United States providers named in section 4.
• Requests for disclosure, correction, suspension of use or deletion: email [email protected]. We’ll confirm your request using the app’s anonymous ID or the email you used, and there’s no fee. Most data is on your devices and can be handled directly in the app.
• Complaints: [email protected].

South Korea

• Items and purposes: as described in sections 2 and 7; most data is processed only on your devices.
• Overseas transfer: if you turn on cloud AI, the text of the request (with names and numbers replaced by placeholders) is transferred to Anthropic, PBC, United States ([email protected]), over an encrypted connection each time a request is made, to produce AI results; it’s deleted within 30 days. If Anthropic is temporarily unavailable, it’s transferred instead to OpenAI OpCo, LLC, United States ([email protected]), for the same purpose, and kept for up to 30 days. Our relay runs on Cloudflare, Inc., United States, which doesn’t store the content. You can refuse by leaving cloud AI off; recording, transcription and search still work.
• Destruction: data you delete in the app is erased right away; data on our server is erased automatically at the end of the periods in section 5.
• Your rights: you can ask to access, correct, delete or suspend processing of your personal information by emailing [email protected].
• Privacy officer: Chenhao Huang, [email protected].

Singapore

Data protection officer: Chenhao Huang, [email protected].

Canada

We handle personal information in line with PIPEDA. “Remember my voice” isn’t offered in the Canadian App Store in version 1.0.

Hong Kong

We follow the six data protection principles of the Personal Data (Privacy) Ordinance. Contact [email protected].

Taiwan

Collector: Chenhao Huang. Purposes, categories, period, area, recipients and methods of use are described in sections 2 to 5. You may ask to inquire, review, copy, correct, stop processing or delete your personal data by emailing [email protected]. If you don’t provide optional data (for example location or health data), the related features won’t work; everything else still does.

12 Changes to this policy

We’ll post changes on this page and update the date at the top. For important changes, we’ll tell you in the app before they take effect. This policy is available in English, 简体中文, 繁體中文, 日本語 and 한국어; if they differ, the English version applies.