Ganzhou Xiaomai Information Technology Co., Ltd. (“we”, “us”) operates Xpic, an iOS app that translates the text in a photo and paints the translation back into the image. This policy explains what the app collects, what happens to the photos you send us, how long anything is kept, and what choices you have.
Xpic has no login screen. There is no username, email address, phone number, or password anywhere in the product. When the app first launches it generates a random identifier for your installation and uses that to keep track of your translation allowance and subscription. We cannot tell who you are from it, and it is not Apple’s advertising identifier (IDFA).
| Data | Why |
|---|---|
| Installation identifier (random, generated by the app) | Track your free allowance and subscription entitlement |
| App version, platform | Diagnose failures and serve the right behaviour per version |
| Device language, app language | Localise responses, and pick a sensible default target language |
| Request timestamp and a one-time nonce | Sign requests so third parties cannot replay them |
When you take a photo or pick one from your library and ask for a translation, that image is uploaded to our servers. This is the only user content we receive, and it is used solely to produce that one translation. We do not browse, index, or otherwise access your photo library — the app only ever receives the specific image you selected.
If you subscribe, Apple tells us that a valid subscription exists, what product it is for, and when it expires or renews. Payment is handled entirely by Apple. We never see your card number, billing address, or Apple ID.
This is the part worth reading carefully, because it involves a third party.
Provider commitment: the images you send are not used to train or improve any AI model. We do not use them to train anything ourselves, and we only route translations through a provider whose terms prohibit training on the content submitted to it. A provider that does not offer that commitment does not get used.
Which provider handles a given translation is a server-side configuration choice and may change. The commitment above applies to whichever provider is in use — it is a condition of using one, not a statement about one particular company.
| What | Kept for |
|---|---|
| Uploaded photos and generated translations | About 2 hours, then deleted automatically. There is no user content library and no long-term image storage. |
| Links to a translated image | About 60 minutes |
| Installation identifier, allowance counters, subscription records | Up to 7 years, to meet tax and audit obligations for paid subscriptions |
| Server logs | Short-term, for reliability and abuse investigation |
We do not sell your data, and we do not share it for advertising. It reaches exactly two kinds of third party:
We may also disclose information where we are legally required to, or where it is necessary to investigate abuse of the service.
Our servers are operated in the United States. We are incorporated in China, and the AI provider that performs the translation may be located in a third country. So wherever you are, using Xpic involves transferring your image across borders: it is uploaded to our servers in the United States, passed to the provider for that single request, and deleted on the schedule in section 4.
If you are in the European Economic Area or the United Kingdom, the law requires us to name a legal basis for each thing we do with your data. Ours are:
| What | Basis |
|---|---|
| Processing the photo you sent, to return a translation | Performance of a contract — you asked for this specific translation |
| Installation identifier and allowance counters | Performance of a contract — without them we cannot apply the free allowance or your subscription |
| Subscription and payment records kept for 7 years | Legal obligation — tax and accounting rules |
| Request signing, server logs, abuse investigation | Legitimate interests — keeping the service working and not defrauded |
We do not rely on consent for any of the above, and we do not process your data for advertising, profiling, or automated decisions that produce legal effects for you.
A note on sensitive content. We do not seek out special category data (health, religion, biometrics, and similar). But a translation app gets pointed at prescriptions, documents, and signs, and photos can contain faces. Whatever is in the photo is your choice, not something we ask for — and it is deleted on the schedule in section 4, never indexed, never used to train anything, and never used to identify anyone.
Traffic between the app and our servers is encrypted with HTTPS and each request is signed, so it cannot be replayed or tampered with in transit. Access to production systems is restricted. No system is perfectly secure, so we keep the amount of data we hold — and how long we hold it — deliberately small.
Xpic is not directed at children under 13, and we do not knowingly collect their information. If you believe a child has used the app to send us images, contact us and we will delete the associated records.
If we change this policy materially we will update the date at the top and, where the change affects how your images are handled, surface a notice in the app. Questions, requests, or complaints: wushenggoo@gmail.com.