Privacy Policy

Version v1.0 · 2026-10-10 (same as Settings › Privacy Notice in the app)

1. What this notice covers

This notice explains what data Panny collects, where it is kept, what it is used for, and how you can view, take, or delete it. It is provided under Article 8 of Taiwan's Personal Data Protection Act.

2. Who collects it and how to reach us

Operator: n239 (developer of Panny)

Contact: panny@n239.xyz

If you have any questions about this notice or your data, just email us.

3. Where your data is kept and what it's for

Kept on your phone

Your conversations, photos you attach, draw questions and results, emotion entries and notes, decision details, custom emotion tags, your name, birth details (birth date, time, gender, and birthplace), and tone setting are all kept on your phone. Some of it leaves your phone only in the cases listed below.

AI features (only after you agree in the app)

Before you use AI, the app explains what will be sent and asks for your consent. Nothing is sent to AI until you agree. You can turn it off and withdraw consent anytime in Settings › AI Features.

While it's on, the following is sent through Firebase to Google Gemini to generate replies:

Google processes this content, possibly outside Taiwan, and may keep it briefly to detect abuse. We don't keep this content or use it to train models. If you turn AI off, your conversations stay on your phone; you just won't get AI replies.

Photos (when you attach one)

The app only receives the one photo you pick in the system photo picker. It can't see the rest of your photo library. The photo is downscaled and stripped of extra information such as where and when it was taken, then kept on your phone. If you sign in for backup, it's included in your encrypted backup; while AI is on, it's sent to Google Gemini along with that message.

Birthplace (when you choose "Other place")

Picking a city from the list sends nothing. When you type a place under "Other place", only the text you typed is sent to Apple Maps to look up its coordinates and time zone. No location permission is needed, and your current location is never sent. The result is kept only on your phone and is not sent to AI.

Account and encrypted backup (if you choose to sign in)

Signing in is optional; you can use Panny without it. You can sign in with Apple or Google. Sign in with Apple doesn't give us your name or email; Google sign-in gives us only your account ID and email, used to confirm it's you, and no other permissions.

Once you're signed in, your conversations, photos, draws, emotions, decisions, and birth settings are encrypted on your phone before they're uploaded, and the backup updates each time you leave the app. The decryption key is kept only in your iCloud Keychain. Our servers don't have the key and can't read the contents; the backup's only purpose is restoring your data if you delete the app or switch phones. Encrypted backups are stored in Taiwan (Google Cloud asia-east1).

You can sign out or delete your cloud backup in Settings at any time, or delete your account in Settings › Delete Account, which deletes both your account and your cloud backup.

AI usage count

To work out your plan's allowance, we record how many times you use AI each month and each day. Only the count is recorded, never the content, and it isn't used for anything else.

Confirming the genuine app (App Check)

When the app connects to our service, it uses Apple's App Attest to confirm the request comes from the genuine Panny app. This is to prevent abuse, not to identify or track you.

Voice (when you choose to speak while logging an emotion)

This needs microphone and speech recognition permission. What you say is turned into text on your phone only. Nothing is recorded or uploaded. If your phone can't recognize speech on the device, the app switches back to typing and never sends your voice anywhere else. The text works just like anything you type and is kept on your phone.

Bedtime reminder (when you turn it on)

Reminders are scheduled on your phone and don't go through our servers. The wording is always the same (shown in the app's language) and doesn't change based on how often you use the app.

Subscriptions and payment

Payment is handled by Apple; we never receive your card or payment details. The app checks with Apple, on your phone only, whether your subscription is active, which plan it is, and when the current period ends, to set your AI reply allowance. This information isn't uploaded to our servers. Subscriptions renew automatically, and you can cancel anytime in iPhone Settings › your name › Subscriptions.

4. What we don't collect

Audio recordings, your current location, contacts, photos you didn't pick, how long you use the app, how often you open it, streaks of daily use, or advertising identifiers. We don't show ads, we don't track you, and we never sell any data.

5. Health-related data

Emotions, intensity, and body sensations may count as health-related personal data. These entries are kept on your phone. They leave it only when you sign in for backup (encrypted, so we can't read them), or, after you've agreed to use AI, when you log a decision and I look through your conversations and moods for what you need to decide, or mention them in a conversation, in which case they're sent to Google Gemini to generate a reply.

6. How long and where data is kept

Data on your phone is in your own hands and is deleted when you delete the app. Encrypted backups are stored in Taiwan (Google Cloud asia-east1) until you delete your cloud backup or your account. Account data is kept until you delete your account. We don't keep content sent to Google Gemini; Google may keep it briefly to detect abuse, possibly outside Taiwan. Usage counts are kept only as long as needed to work out your allowance.

7. Your rights

Under Article 3 of Taiwan's Personal Data Protection Act, you can: ask about and view your data; get a copy (Settings › Export all data); add to or correct it (edit it directly in the app); have us stop collecting, processing, and using it (turn off Settings › AI Features, or sign out and delete your cloud backup); and ask us to delete it (Settings › Delete Account, which deletes your account and cloud backup).

If you need our help, email panny@n239.xyz. We'll reply to requests to view your data within 15 days, and finish corrections, stopping use, and deletion within 30 days. If we need more time, we'll tell you why first.

8. If you choose not to provide data

Without AI turned on and without an account, logging emotions and decisions, drawing cards, and your birth chart all still work. You just won't get AI replies, and you won't be able to restore from the cloud when you switch phones (you can export a file and keep it yourself instead).

9. This is not medical care or counseling

Panny is an AI tool for journaling and sorting through your thoughts. It is not counseling, mental health care, or a medical service, and it doesn't make any psychological assessment.

If you are in danger or thinking about harming yourself, contact your local emergency number or a crisis line now. In Taiwan call 1925; in the US or Canada call or text 988; in the UK or Ireland call Samaritans on 116 123; elsewhere see findahelpline.com.

10. Changes to this notice

When this notice changes, we'll let you know when you open the app. We won't send separate push notifications.