HashRay（井彩记账）隐私政策

Welcome to HashRay. Your privacy matters to us. This Privacy Policy explains what information we collect, how we use, store and protect it, and the rights you have — especially account deletion.

1. Information We Collect

HashRay integrates no advertising, analytics or tracking SDKs, and never sells your data to third parties. We collect only what is necessary to provide the bookkeeping service:

1.1 Information You Provide

• Account information: your registration email (for sign-in and recovery) and password (stored only as an irreversible hash — we cannot read your plaintext password).
• Transaction data: entries you add or auto-capture, including amount, type, tags, notes, timestamp, and any location you voluntarily provide.
• Membership records: redeemed membership benefits (codes stored only as hashes).

1.2 Information Collected Automatically

• Device information: a device identifier (SHA-256 hashed, not reversible to hardware), platform, device model, OS version and app version — used for multi-device sign-in, session management and security.
• Auto-recording: when you enable "Auto Record" and grant Notification Access and Accessibility Service permissions, the app reads payment notifications (e.g. Alipay, WeChat Pay) to extract the amount and payee into a draft entry. Processing happens primarily on your device; only entries you confirm are synced to the server.
• Network & operational data: access time and sync records, used for synchronization and troubleshooting.

2. How We Use Information

• Deliver core bookkeeping: transactions, tags, statistics, budgets, periodic billing, repayment reminders;
• Multi-device sign-in and data sync;
• Send verification emails (registration, password reset, account deletion);
• Provide membership benefits and redemption codes;
• Protect account and data security (e.g. banned-device detection, anti-abuse rate limiting).

3. Storage & Security

• Location: your data is stored on servers in mainland China (Alibaba Cloud), using PostgreSQL and Redis.
• Encryption in transit: all network communication uses HTTPS.
• Password protection: passwords are one-way hashed with BCrypt; a database leak cannot reveal plaintext.
• Access control: only authorized operations staff can access production; administrator actions are audited.

4. Sharing & Third Parties

We do not sell, rent or trade your personal information to any third party, and there is no advertising or behavioral tracking. The only third-party processing:

• Email service providers (SMTP / Resend): to deliver verification codes to your registered email — only your email address and the code are passed.

5. Data Retention

• While your account exists, we keep your transaction and account data to provide the service;
• Session tokens (refresh tokens) expire after 30 days;
• After account deletion, see Section 6.

6. Your Rights: Account Deletion

• In-app deletion: open the app → Settings → Delete Account, and follow the confirmation steps. Your account can no longer sign in or sync.
• Web deletion: visit https://api.cxsz365.top/account-deletion, enter your registered email and complete email-code verification. This works even if you have uninstalled the app.

Processing Timeline

The deletion request takes effect immediately (account disabled, all sessions revoked). Within a 30-day grace period, the server performs a full physical purge of your account and all associated data (transactions, tags, budgets, periodic billing, sync records, device records, membership benefits, etc.), which cannot be undone. To restore your account during the grace period, contact support@cxsz365.top.

Data Retention Disclosure

For security and anti-fraud compliance, the following data may be retained in de-identified form after deletion: administrator audit logs (your email and other personal identifiers are masked; only operation traces are kept). No other personal information is retained.

We do not share your personal data with third parties for advertising or analytics. If third-party processors are onboarded in the future, deletion requests will be propagated to them.

7. Children's Privacy

HashRay is not intended for children under 13 and we do not knowingly collect their personal information. If you believe we have collected such information, please contact us and we will delete it.

8. Changes to This Policy

We may update this policy from time to time. Material changes (e.g. collection scope, sharing parties) will be notified via prominent in-app notice or email. Updates take effect upon publication.

9. Contact Us

If you have any questions, comments or complaints about this policy or your personal data, please contact us:

• Email: support@cxsz365.top
• You can also submit feedback from the Settings screen in the app.