HeyCyan Privacy Policy

1. HeyCyan and the data controller

This Privacy Policy applies when you access or use the HeyCyan app and related services, including compatible smart glasses used through the app. HeyCyan is developed and operated by Shenzhen Qingcheng Future Technology Co., Ltd. ("we", "us" or "our"). The features available and how they work may differ by device model, app version, feature and region.

This policy explains how we collect, process, use and disclose personal information as the party responsible for the processing, and describes your choices and rights. Please read it together with the applicable terms of service. Applicable regional supplements form part of this policy for the users and circumstances to which they apply.

If you have questions about this policy or our processing of personal information, or wish to access or correct your information or withdraw consent, contact qcfeature@gmail.com.

2. General definitions

Personal information or personal data means information that identifies or relates to a natural person, either on its own or together with other information reasonably available. Photographs, videos, recordings, device identifiers and location information may also be personal information where the applicable legal conditions are met.

A controller is a natural or legal person, public authority or other body that, alone or jointly with others, determines the purposes and means of processing personal information. A processor processes personal information on behalf of a controller. A third party is another entity that is not the data subject, controller, processor or persons authorised by them, as defined by applicable law.

Data protection laws are the privacy and data protection laws and regulations applicable to the relevant processing. Purposes are the purposes for using personal information described in this policy. Consent must meet applicable legal requirements, including those concerning a voluntary, informed and clear indication of choice.

Unless otherwise stated, this policy does not cover the independent information-handling practices of third-party apps, websites, products or services that we do not own or control.

3. Collection and use of personal information

3.1 We may collect and process personal information relevant to the service when you use our services, register an account, participate in related activities or contact us. The information actually collected depends on the features, devices and app versions you use.

3.2 Information and uses include:

Account and profile information: When registering or using the service, you may provide an email address, phone number, username, password, profile picture, account type, registration method and profile details you choose to enter. Some features may use your date of birth or other details.

Device and operational information: To connect devices, maintain services or provide updates, we may process phone and glasses models, operating system, app and firmware versions, hardware version, Bluetooth device address, device binding information, country or region setting, IP address, network status, feature usage and necessary service, security or diagnostic records.

Content provided or generated when you use features: Depending on the feature, this may include photos, videos, audio recordings, speech transcripts, translated text, conversation content, questions you enter, relevant context, language settings and AI-generated results. Recording records may include information such as time, duration and language.

Location and device permissions: Where a device supports a feature, the feature needs the information and you have granted the relevant permission, the feature may use location information or access the camera, microphone, Bluetooth, notifications, SMS messages, phone state or contacts. Permission names and availability vary by operating system and device.

Support and transaction information: This may include the contact details, enquiries and attachments you send our support team. Relevant paid features may involve an order or transaction identifier. What we receive depends on the service you use and the information you provide.

We may obtain information directly from content you provide, necessary information generated when you use the app and device, and results returned by relevant service providers when providing their services.

Profile information and feature settings may also include preferences you choose to use, such as display, dictation, speaker distinction, subtitles and automatic recording. Recording information may include the recording date, identifier, type, start and end times, upload time, source language and target language.

When you use a location-related feature and grant the necessary permission, location information may be used to add a location to a recording. An IP address may be used to identify a region or provide localised services. Usage duration, feature usage frequency, device and app versions, subscription start and end information and logs you submit may be used to detect issues, provide support or improve the product. Paid services may involve an order or transaction identifier. Actual processing depends on the features enabled.

3.3 SMS, incoming calls and contacts

Where supported by the device and feature and after you grant the relevant permissions, HeyCyan may read an SMS sender's number, message content and receipt time to display SMS notifications on the connected glasses; read incoming-call status and number to display call alerts; and read contact names and numbers to match incoming calls or SMS messages.

Under the current feature description, unless otherwise stated in this policy or separately agreed by you, SMS, incoming-call and contact information is processed locally on the phone and displayed on the connected glasses. We do not actively upload SMS content, contacts or incoming-call status to the HeyCyan backend, and we do not use this information for advertising, user profiling or marketing analysis.

You can view, manage or revoke the relevant permissions in your phone's system settings. Revoking a permission may prevent alerts, number matching or other features that depend on it from working. Permission prompts and processing may vary by device, system and version.

3.4 Photos, recordings and media files

Ordinary photos, videos and audio recordings may be stored locally on the glasses or phone and can be synchronised, exported, managed or deleted using supported features. If you choose to use AI recognition, meeting summaries, real-time conversations or another connected feature, the images, audio or text needed for that feature may be transmitted to our backend and relevant service providers for processing. Local storage does not mean that connected features do not transmit data.

The device makes a shutter sound when taking a photo. The indicator on the front of the glasses remains lit during video recording, and the indicator remains lit or flashes during audio recording. The specific indicators may vary by model and feature. Please respect other people's privacy and comply with applicable local laws on photography, recording, sharing and other relevant activities. Device indicators do not replace any notice or consent required by law.

3.5 AI, speech and real-time conversations

When you choose to use a relevant feature, we process the content needed to provide it and provide necessary information to the relevant service providers. Not every provider receives all information. The information received depends on the feature, device and service configuration.

AI voice conversation: Microsoft speech services process and transcribe speech. Azure OpenAI processes relevant text to generate a response. If voice playback is used, Microsoft text-to-speech services process the response text.

Speech translation: Relevant speech, recognition results, language settings and translated text may be processed by Microsoft's speech recognition, translation and text-to-speech services to return translated content or speech.

Meeting summaries: A recording imported by the user is transcribed by Microsoft. The relevant text is processed by Azure OpenAI to extract topics and generate a summary and mind map.

Real-time chat and translation: Microsoft, Agora, the AWS-hosted backend and OpenAI may be involved in establishing and maintaining a session, transmitting speech and processing relevant content. Information processed may include session audio, recognised text, session identifiers, and device and network information. The actual path depends on the feature and configuration.

AI image recognition: Images and related information you choose to process are sent to the relevant recognition service. Depending on the content and feature, text information may be processed by OpenAI and image information by Alibaba Qwen. The recognition result is returned to the app. If voice playback is enabled, the relevant text may also be processed by Microsoft text-to-speech services.

Comic generation: Images and related requests you choose to use may be processed by Azure OpenAI. The comic image may be generated by Pollinations.ai and returned to the app. The information actually received by each service depends on its role in the processing and its configuration.

You can stop using AI features or end a real-time session to stop the corresponding further processing. Processing already completed is not automatically undone. Each provider's handling of data, logs and retention depends on its services, configuration and applicable agreement.

3.6 Firmware updates

To check for compatible firmware and provide an update package, the app may send technical information to the update service, such as the app identifier and version, hardware version, installed firmware version, operating-system identifier, Bluetooth device address, country or region setting and update channel. The service may also receive the network information needed to transmit requests and downloads.

This information is used to identify compatible versions and provide updates and forms part of operational and update records. Under the current feature description, firmware update checks do not require sending your AI conversations, photos, audio recordings, SMS messages or contacts. Please obtain applicable updates through the app store and the update method supported by your device.

3.7 Retention and deletion

AI content on our backend: Under our current processing arrangements, we process audio, images and text in AI requests and generated results temporarily to return AI results. We do not persistently store this AI content on our backend, including in backend logs and backups. This statement does not apply to necessary account, device, binding, update and service-operation records.

Third-party providers: Our backend non-storage statement does not mean that Microsoft, Agora, OpenAI, Alibaba Qwen, Pollinations.ai or other providers do not retain data. Their retention periods and processing practices depend on the specific services, configurations and agreements. We do not use users' AI content to train our own models. Whether a third party uses or retains content depends on the applicable service terms and configuration.

Device and local content: Chat history, photos, recordings, transcripts, translations or other files may be stored in the app, on your phone or on your glasses. You can manage them using the available history, media management and device settings.

Other information: Account, device binding, update, necessary service, security and support records are kept for as long as needed to provide services, maintain security, resolve issues or comply with applicable legal obligations. When those purposes and any other lawful basis for retention no longer apply, we delete or de-identify the information. The period depends on the category of data and applicable requirements. Information that must be retained by law is handled in accordance with applicable law.

Deleting an account, unbinding a device, uninstalling the app, deleting local files and deleting independent backups are different actions. Account deletion does not automatically remove every file on your phone, offline glasses or independent backups. If a device is offline, device-side deletion or unbinding may require the device to reconnect or an applicable reset.

Third-party login information: The account-retention rules above also apply to the third-party user identifier associated with your HeyCyan account and the profile information received through login. Authentication and session information is processed as needed to verify your identity, maintain your sign-in session and protect account security. See section 11 for managing authorisation and requesting account deletion.

3.8–3.9 AI and Microsoft Speech / Translation

When you choose to enable and use AI features, the information needed for a request can include your question, relevant conversation context, transcribed speech, selected images and language settings. Account and device information may also be used by our backend to authorise and route the request; technical identifiers used by our backend are not necessarily included in a model prompt.

For a backend-mediated Microsoft AI request, the relevant content is sent from your device or app through the HeyCyan backend to Microsoft's AI service, and the result is returned through the backend to your app or device. This describes that route; it does not describe every AI, speech or real-time communication path. Section 3.5 identifies the other providers and features.

Our backend temporarily processes AI content to return the requested result, as explained in section 3.7. We do not use users' AI content to train our own models. Our backend non-storage statement is limited to our own backend and is not a promise that Microsoft or any other provider retains no data. Microsoft's processing, safety monitoring and any service-side retention depend on the service, configuration and applicable terms. See Microsoft's data, privacy and security documentation for Azure-hosted models. Azure-hosted models operated by Microsoft are distinct from the consumer ChatGPT application and from a direct OpenAI API service.

HeyCyan integrates Microsoft speech services for supported speech recognition and translation features. Audio, recognised text, source and target language information, or text for speech synthesis may be processed as needed to return the requested result. Speech SDK requests may go directly from the app to Microsoft. Microsoft describes its real-time speech-to-text and speech-translation services as not retaining customer-provided data; batch transcription and other features can have different storage arrangements. See Microsoft's speech-to-text data and privacy documentation. This description does not guarantee that every HeyCyan speech feature uses the same Microsoft service mode or that other providers retain no data.

You can stop subsequent AI processing by stopping the relevant AI feature or ending the active session; you may also manage the relevant device permissions or contact us to withdraw consent where applicable. If the app offers a choice to defer enabling AI, selecting it leaves the relevant AI feature disabled until you choose to enable it. Withdrawing consent does not undo processing already carried out. Local records and recordings are described in section 3.7.

3.10 Agora real-time conversations

When you start a supported real-time conversation, HeyCyan may use Agora RTC/RTM and related services to establish the session, transmit real-time voice and exchange session messages. Processing may involve active-session audio, user or session identifiers such as UID and channel identifiers, authentication tokens, and necessary device, network and service-quality information. Recognised text, generated responses or images you choose to share may also be processed by the configured conversation pipeline.

The app obtains session authorisation from the HeyCyan backend and then communicates with Agora's services. Depending on the configured feature, Agora may connect the session to the relevant speech or AI providers. Contextual features may also send city or location information to the HeyCyan backend; this does not mean every such field is sent to Agora. Real-time media does not necessarily follow the backend-mediated AI route described above.

Agora's real-time transport, conversation services and diagnostic logs can have different retention arrangements. Whether service-side recordings, transcripts, session logs or diagnostic information are retained depends on the service, configuration and agreement. See Agora's Privacy Policy. End the conversation to stop further active-session transmission.

3.11 Third-party login: Apple and Google

When you choose Sign in with Apple, we receive an Apple-provided user identifier and the information Apple returns following your authorisation. We request your name and email address; these are received where provided by Apple and authorised by you. Your shared name may be used to initialise your HeyCyan nickname. If you choose Hide My Email, Apple provides a private relay email address instead of disclosing your personal email address to us through that login.

The app sends the identity token, authorisation code and necessary login-verification information to the HeyCyan backend to authenticate the login. We also process the resulting HeyCyan account identifier and session credentials to keep you signed in. We do not receive your Apple Account password.

Sign in with Google: Where Google login is available in your app version, you can choose to sign in using your Google Account. Following your authorisation, we may receive your Google-provided user identifier, email address, name and profile picture, depending on the information requested and returned by Google. We use this information to identify your account and provide the login and profile functions described in section 4.

Necessary Google authentication information, such as an identity token, is processed by the app and HeyCyan backend to verify the login. We also process the resulting HeyCyan account identifier and session credentials to keep you signed in. We do not receive your Google Account password. The retention rules in section 3.7 also apply to Google login information.

4. Purposes and legal bases for using personal information

Depending on the features you use, we process the information needed to provide account registration and login, device connection and binding, photography, video and media management, voice conversation, translation, real-time chat, image recognition, meeting summaries, comic generation and other services you choose.

For third-party login, we use the information described in section 3.11 to verify your identity, create or access your HeyCyan account, associate the identifier provided by Apple or Google with that account, initialise your profile where applicable, maintain your login session and protect account security.

We may also use necessary information to check for and provide app or firmware updates, handle support requests, maintain service security, troubleshoot issues, improve products and comply with applicable legal obligations.

If you do not provide the information or permission needed for a feature, that feature may not work, but other features that do not depend on it are generally unaffected. For new processing purposes, we will inform you as required by applicable law and obtain your consent where required.

Where applicable law requires a legal basis, processing may be based on your consent, the need to perform a contract or pre-contractual measures you request, compliance with a legal obligation, or our or a third party's legitimate interests where those interests are not overridden by your rights and interests. Other legal bases are used only where they actually apply. See the European supplement for more information.

For new purposes outside this policy, we will inform you in advance and obtain consent where required by applicable law.

5. Disclosure and service providers

To provide the features you use, we may provide necessary information to providers of cloud infrastructure, speech, AI, real-time communication or other necessary technical services. These include Amazon Web Services (AWS), Microsoft, Agora, OpenAI, Alibaba Qwen / Alibaba Cloud and Pollinations.ai. Providers' roles and the information they receive vary by feature, actual processing path and configuration.

For example, AWS provides cloud infrastructure for the overseas backend; Microsoft provides some AI, speech, translation and speech synthesis services; and Agora provides real-time communication services. The other listed providers may participate in relevant AI or cloud features. See section 3.5 for the relationship between features and data categories.

Apple login: Apple provides the Sign in with Apple authentication service. When you choose it, necessary authentication information is exchanged with Apple to complete the authorisation and verify the login. Apple handles information for its own authentication service under its privacy notices; HeyCyan handles the information it receives as described in section 3.11 and this policy.

Google login: Google provides the Sign in with Google authentication service where available. When you choose it, necessary authentication information is exchanged with Google to complete the authorisation and verify the login. Google handles information for its own authentication service under its privacy notices; HeyCyan handles the information it receives as described in section 3.11 and this policy.

To provide support, comply with legal obligations, protect legitimate rights and interests or conduct business-related activities, we may also provide necessary information to professional advisers, service providers or relevant authorities as permitted by applicable law. Where personal information must be provided to other entities, we will meet applicable notice and other legal obligations.

As permitted by applicable law, recipients may include account administration, payment processing and after-sales service providers, professional advisers or insurers. Where a business transfer, reorganisation or similar transaction involves personal information, we will take the measures required by applicable law.

Where required by law, we use appropriate arrangements to define service providers' responsibilities and security requirements for processing personal information. Actual recipients and data categories depend on the feature and arrangements involved.

Provider privacy and data-handling information

The following links provide the relevant providers' general or product-specific descriptions. The rules that apply to HeyCyan depend on the services actually used, their configuration and the applicable agreements. A provider's general privacy notice may also describe its own websites or direct customer relationships, which may differ from processing on our behalf.

• Apple login: Sign in with Apple & Privacy.
• Google login: Google Privacy Policy and How Sign in with Google works.
• Microsoft Azure-hosted AI: Data, privacy and security for models sold by Azure.
• Microsoft Speech: Speech-to-text data and privacy information.
• Agora: Agora Privacy Policy, including its descriptions of processing as a controller or processor.
• AWS: AWS data privacy information about cloud customer data and controls.
• Alibaba Cloud: Alibaba Cloud International Website Privacy Policy. Where Alibaba Cloud Model Studio is used, see its security and privacy information; applicable product terms and configurations govern the relevant service.
• OpenAI: Data controls in the OpenAI platform, relevant to direct OpenAI API services where used; Azure-hosted services are described separately above.
• Pollinations.ai: Pollinations.ai Privacy Policy. Its description includes possible temporary caches and processing by downstream providers, depending on the service and route.

These links do not imply that every provider receives all data or that any provider retains no information. Depending on the service and route, third-party processing, storage, safety checks and downstream providers may be governed by different terms and configurations. Our own backend practices are described separately in section 3.7.

6. Information about other people

If you upload, share or provide another person's photos, videos, voice or other personal information, please ensure you have an appropriate basis to provide it and comply with applicable notice, consent and other legal requirements. We remain responsible for our own processing activities as required by applicable law.

If you provide a child's personal information, comply with applicable age requirements and involve a parent or guardian in authorisation where required. Contact us if you believe we have improperly processed a child's personal information.

7. International transfers of personal information

The overseas HeyCyan backend uses AWS resources located in the western United States. Microsoft speech resources are configured in East Asia, West Europe, East US, Japan West and North Europe. The actual processing location depends on the services, configurations and routing used and is not fixed individually by the user's country. We also use Alibaba Cloud.

When you use relevant services, personal information may be transferred, processed or stored outside your country or region. The backend location does not mean that every provider or every processing activity is in the same place. Other providers' actual processing and storage locations depend on the services and agreements used. We handle international transfers in accordance with applicable law and use appropriate safeguards where required.

8. Information security

Depending on the services involved, we use account access controls, security updates and other appropriate technical and organisational measures to reduce the risk of unauthorised access, disclosure, modification or loss of personal information. Security measures cannot eliminate every risk. Please protect your account credentials and install applicable app and firmware updates.

If a security incident involves personal information, we will assess and handle it in accordance with applicable law and notify affected individuals and authorities where legally required. Product security issues can be reported to kaifa@wireless.cn. For personal information matters, contact qcfeature@gmail.com.

9. Cookies and similar technologies

Our website may use necessary cookies or similar technologies to support basic functions. Where actually used, functionality, analytics or performance cookies may also be involved. Such technologies can remember settings, help us understand website use or provide relevant functions.

Where required by applicable law, we will explain the purposes of non-essential cookies and obtain consent. You can manage cookies through browser settings. Disabling necessary cookies may affect parts of the website. Cookies used by third-party websites or services are handled by those third parties under their applicable notices.

10. Third-party websites

Third-party websites, apps or products may have their own privacy notices. Their independent collection and handling of information depend on those notices and your relationship with them. This does not affect the responsibility we bear under applicable law for our own processing.

11. Your choices and rights concerning personal information

You can manage permissions in your phone's settings, choose whether to use relevant features, stop using AI features or end a real-time session. Where processing is based on consent, you may withdraw it. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

You can request account deletion in the HeyCyan app. You can also contact qcfeature@gmail.com to request access to, correction or deletion of personal information, restriction of processing or withdrawal of consent. Depending on applicable law, you may also have rights to object to processing and data portability.

Managing third-party login: You can manage or stop using Sign in with Apple for HeyCyan in your Apple Account settings. If you use Google login, you can review or remove HeyCyan's Sign in with Google connection in your Google Account settings. Stopping either authorisation can affect subsequent sign-in with that provider, but is separate from requesting deletion of your HeyCyan account and does not by itself delete information already held by us. To request deletion of your HeyCyan account, including its associated third-party login information, use the account-deletion option in the app. Retention and any applicable exceptions are described in section 3.7.

To handle a request, we may ask for information proportionate to the request to verify your identity, and we will respond within the period required by applicable law. Where permitted or required by law, we may be unable to fulfil a request in full; we will explain as required. You can also contact a competent data protection authority.

When you request access or correction, we may need information proportionate to the request to verify your identity and understand your request. We will respond within the period required by applicable law. If the law permits more time or prevents us from fulfilling a request, we will explain as required.

Where permitted by law, certain requests may incur a reasonable fee. If applicable, we will inform you in advance. Nothing in this policy limits rights granted to you by applicable law.

12. Changes to this Privacy Policy

We may update this policy as features, service providers, information-handling practices or applicable law change. We will notify you of material changes through this page, the app or another appropriate method at least 30 days before they take effect, unless the law requires earlier implementation. Non-material changes or clarifications take effect as stated when published.

Where the law requires renewed consent for processing under an updated policy, we will obtain it as required. We recommend reviewing the latest version periodically.

13. Regional terms

Where required by applicable law, users in regions including the European Economic Area (EEA), the United Kingdom, Canada, Japan and the United States may have additional rights or be protected by specific rules. If applicable regional supplemental terms conflict with this policy, the applicable regional terms prevail for the relevant region to the extent permitted by law.

You may contact qcfeature@gmail.com about the personal information rights applicable in your region. The following supplement applies to users in the EEA and UK where relevant law applies.