Privacy Policy
Hushot is an on-device photo editor. This policy describes exactly what leaves your device, why it leaves, and how to remove it. It describes what the app actually does; if you find a discrepancy, write to the address at the bottom and we will fix it.
Two things are worth saying first, because they are the parts people care about most: your photos never leave your device, and we do not track you across other apps or websites.
Your photos stay on your device
When you pick a photo, Hushot makes its own copy inside the app's private storage. Cropping, filters, redaction, drawing, text, watermarks and export all run on this device using Core Image and Metal. We never upload your photos, and we do not send them to any server, cloud service or third-party AI service.
When you export, the result is written by you, to the place you chose — usually the system photo library. That step happens only after you confirm it, and the app asks for add-only access to your library so it can write the finished file without needing to read your whole library.
What we collect, and why
- Subscription status (only if you subscribe): after the App Store completes a purchase, the app reads Apple's signed transaction to check whether your subscription is active. The check happens on your device. We never receive your payment details, and we do not keep receipts or transaction identifiers.
- Diagnostics, on by default with at most one upload per day (you can switch it off in Settings → Data & About): the app sends a technical log of what it did — action names, times and outcomes — so we can find crashes and stalls. Identifiers are redacted before upload; the log never contains your photos, your typed text, or your Apple Account identifier.
- Nothing else. There is no account, no advertising identifier, no cross-app tracking, and no data broker involved.
Subscriptions and payments
Hushot Pro is sold by Apple through the App Store. Apple processes the payment; we never see your card number, billing address or Apple Account password.
The trial, the subscription period and any refund are all managed by Apple. The app stores one thing on your device: the current entitlement level and, if a trial has started, the date it started. That record is used only to decide whether to show the upgrade screen.
You can manage or cancel the subscription in Settings → Apple ID → Subscriptions. “Restore Purchases” reads transactions already associated with your Apple Account; it does not create a new charge.
What we do not do
- We do not upload your photos, or any part of them.
- We do not use your photos or your edits to train any model — ours or anyone else's.
- We do not show ads, and we do not track you across other apps or websites.
- We do not require an account. Everything works without one.
- We do not sell or share your data. There is no data to sell: we do not have accounts, and we do not build advertising profiles.
Photos and metadata
Hushot removes common metadata from exported images by default — GPS location, device model, lens information and capture timestamps — so that a photo you share does not carry where and how it was taken.
This is not a promise of anonymisation. It is a specific, named list of fields that are removed. Other metadata fields, if any, may remain.
Children
Hushot is not directed at children under 13, and we do not knowingly collect personal information from them. Because the app has no accounts and does not collect photos, the data we do receive (a redacted diagnostic log) does not identify you.
Changes to this policy
If this policy changes, the updated date at the top of this page changes too. Material changes will also be mentioned in the app's release notes on the App Store.
隐私政策
Hushot 是一款端侧图片编辑 App。本政策说明到底什么数据会离开你的设备、为什么离开、以及如何删除。
本文描述的就是 App 实际做的事；如果你发现与实际不符，请写信到页面下方的邮箱，我们会修正。
你的照片留在设备上
选图之后，Hushot 会在 App 自己的存储里拷贝一份。裁剪、滤镜、打码、画笔、文字、水印与导出，全部用 Core Image 与 Metal 在本机完成。我们从不上传你的照片，也不把它们交给任何服务器、云服务或第三方 AI 服务。
导出时，成品由你确认后写到���选定的地方（通常是系统相册）。这一步只在你确认之后发生；App 只申请相册的「添加」权限，用来写入成品，不需要读取你的整个相册。
我们收集什么，为什么
- 订阅状态（仅在你订阅后）：App Store 完成购买后，App 会读取 Apple 签名过的交易信息，用来判断订阅是否有效。这个判断在本机完成。我们拿不到你的付款信息，也不保留收据或交易号。
- 诊断日志，默认开启、每天最多一次（可在设置 →「数据与关于」关闭）：App 会发送一份技术日志（动作名、时间、结果），用来排查崩溃与卡顿。上传前会先脱敏；日志里没有你的照片、你输入的文字，也没有你的 Apple 账户标识。
- 此外没有了。本 App 没有账号、不使用广告标识符、不做跨 App 追踪，也不涉及任何数据经纪商。
订阅与付款
Hushot Pro 由 Apple 通过 App Store 销售。付款由 Apple 处理；我们看不到你的卡号、账单地址或 Apple 账户密码。
试用、订阅周期与退款全部由 Apple 管理。App 在本机只存两样东西：当前权益等级，以及（若已开始试用）试用开始日期。它们只用于决定要不要显示升级页。
你可以在「设置 → Apple ID → 订阅」里管理或取消订阅。「恢复购买」读取的是已关联到你 Apple 账户的交易，不会产生新扣费。
我们不做什么
- 不上传你的照片或照片的任何部分。
- 不用你的照片或编辑结果训练任何模型——我们的或别人的。
- 不投广告，也不在其它 App 或网站之间追踪你。
- 不强制要账号——所有功能不用账号也能用。
- 不出售也不共享你的数据。其实也没有数据可卖：我们没有账号，也不建立广告画像。
照片与元数据
Hushot 默认在导出时移除常见的元数据——GPS 位置、设备型号、镜头信息与拍摄时间——这样分享出去的照片不会带着「在哪里、怎么拍的」。
这不是「匿名化」的承诺。它是一份具体的、列明的字段清单被移除；其它元数据字段（若有）可能仍然保留。
未成年人
Hushot 不面向 13 岁以下儿童，我们也不会有意收集他们的个人信息。由于本 App 没有账号、不收集照片，我们确实收到的那点数据（一份脱敏的诊断日志）也不指向你本人。
政策变更
本政策若有变更，页面顶部的更新时间会跟着变；有实质变更时也会写进 App Store 上的版本说明。