一句话：手写原页只有你能打开，随时可以删掉或导出。我们不卖数据、不投广告、不用你的内容训练任何模型。
我们保存什么
- 登录。你的邮箱（验证码登录）或 Apple 账号给我们的匿名标识。不建密码，不填名字。
- 手写原页。你拍下的那一页，存在只有你能打开的私有存储前缀里，默认保存。设置里可以关掉「保存手写原页」（关掉后照片只用来识别，读完即删），也可以一下删掉全部原页。
- 由原页派生的文字。转录、回信、周信、段落与它们的向量索引（用来让回信和出题记得你写过什么）。改转录时原始转录一起保留。
- 设置。问题语言、翻面时长、回信时机、时区、通知时间。
- 使用数据。只有数字和标签——写了几天、拍照还是打字、读信花了几秒、付费墙出现过几次、从哪个短链来。不含任何日记内容。
- 推送令牌。只在你允许通知后。
- 订阅状态。来自 Apple 与 RevenueCat：是否试用、到期日、产品、兑换码。我们看不到你的支付方式。
用来做什么
读你的字、写回信、出明天的问题、写周信、导入旧本子、在你定的时间推一条通知、算几个产品指标。没有别的。
谁替我们处理
- Supabase（美国）：数据库、登录、原页存储。
- Fly.io：运行服务端。
- 模型供应商：读页与回信由 OpenAI 的模型完成；原页与转录作为请求发送，按其 API 政策短期保留、不用于训练。若改用 Anthropic 或 Google 的模型，这一行会更新。
- Mailgun（美国）：验证码邮件、导出、推送不可用时的回信邮件。
- RevenueCat 与 Apple：App 内购与订阅状态。
- Expo：推送通知的投递。
数据保存在美国。各处理方都只拿到完成其工作所需的那部分。
删除与导出
- 删一篇是硬删：转录、回信、段落、原页一起没了。
- 「删除所有原页」只删照片，文字留着。
- 「删除账号」立刻删光：所有表、你的存储前缀、登录身份、RevenueCat 里的客户记录。App Store 的订阅本身要在系统订阅页取消。
- 随时导出 markdown（分享面板，或发到你自己的邮箱）。免费用户也能导。
安全
数据库行级安全：只有本人能读自己的行；原页通过短期签名地址访问；模型密钥只在服务端。v1 没有任何分享面。
儿童
FlipWrite 不面向 13 岁以下的人。
变更与联系
数据控制者是 Eventaly LLC（美国）。政策有改动会更新上面的生效日期。问题写到 hello@flipwrite.app。
In one line: your handwritten pages can only be opened by you, and can be deleted or exported at any time. We do not sell data, show ads, or train any model on your writing.
What we store
- Sign-in. Your email (one-time code) or the anonymous identifier Apple gives us. No password, no name.
- Handwritten pages. The photo you take, in a private storage prefix only you can open, kept by default. You can turn off "keep handwritten pages" (the photo is then used for recognition only and deleted right after), or delete every page with one tap.
- Text derived from the page. The transcript, the letter back, weekly letters, paragraphs and their vector index (so letters and prompts remember what you wrote). The original transcript is kept alongside your edits.
- Settings. Question language, flip minutes, when the letter arrives, time zone, notification hours.
- Usage numbers. Counts and labels only — days written, photo vs typed, seconds to read, how often the paywall showed, which short link you came from. Never diary content.
- Push token. Only after you allow notifications.
- Subscription status. From Apple and RevenueCat: trial or not, renewal date, product, offer code. We never see your payment method.
What it is used for
Reading your page, writing the letter, tomorrow's questions, the weekly letter, importing an old notebook, one notification at the hour you chose, a handful of product metrics. Nothing else.
Who processes it for us
- Supabase (US): database, sign-in, page storage.
- Fly.io: runs the server.
- Model provider: pages are read and letters written by OpenAI models; the page and transcript are sent as a request, retained briefly under their API policy, not used for training. If we move to Anthropic or Google models this line changes.
- Mailgun (US): sign-in codes, exports, the letter by email when push is unavailable.
- RevenueCat and Apple: in-app purchase and subscription status.
- Expo: push notification delivery.
Data lives in the United States. Each processor receives only what its job needs.
Deletion and export
- Deleting an entry is a hard delete: transcript, letter, paragraphs and pages go together.
- "Delete all pages" removes the photos and keeps the text.
- "Delete account" removes everything at once: every table, your storage prefix, your sign-in, your RevenueCat customer record. The App Store subscription itself is cancelled in iOS Settings.
- Export to markdown at any time (share sheet, or to your own inbox). Free users can export too.
Security
Row-level security in the database: only you can read your rows; pages are served by short-lived signed URLs; model keys never leave the server. v1 has no sharing surface at all.
Children
FlipWrite is not for people under 13.
Changes and contact
The data controller is Eventaly LLC, United States. Changes move the effective date above. Questions: hello@flipwrite.app.