隐私政策
TodayCue（“我们”）是一款供家长整理学校通知、家庭事项和提醒的 iPhone 应用。本政策说明我们在你使用 TodayCue 时如何处理信息。
1. 我们处理的信息
- 本地数据：家庭成员、事项、地点、提醒、需带物品、校历和设置默认仅以加密形式保存在设备上，不会自动上传。
- 账户信息：仅在你登录时处理邮箱地址或 Apple 登录标识、登录会话和账户状态。
- AI 输入：仅在你主动使用 AI 助手时处理本次提交的文字，或设备从 PDF、校历照片中提取的文字；邮件模式还会处理设备从粘贴内容中读取的网页链接名称和地址。原始校历照片不会发送给 AI。
- 购买信息：Apple 提供的订阅商品、交易状态、有效期及其与 TodayCue 账户的会员关联；我们不接收完整银行卡信息。
- 技术信息：随机安装标识、额度和保障安全及故障排查所需的有限日志。
2. 使用目的和法律依据
我们使用信息来提供账户登录、家庭事项管理、提醒、Widget、校历导入、AI 信息提取、订阅权益、客户支持、安全和故障排查。处理依据可能包括履行服务合同、你的同意、合法利益以及适用法律要求。
3. 学校与校历信息
TodayCue 不提供或预装任何学校的校历内容，也不提供学校名称名单。学校名称由你自行填写；只有在你主动选择 ICS、PDF 或照片后，相关校历才会被导入。请仅提交你有权处理的内容。你可以随时按学校清除自己导入的校历，清除操作不会消耗 AI 次数。
4. AI 助手
AI 功能默认不会处理你的内容。只有在你明确同意并主动提交后，本次相关文字、设备从 PDF 或校历照片中提取的文字，以及邮件模式读取的网页链接名称和地址，才会发送至我们的云端服务及 AI 服务提供商；原始校历照片不会发送给 AI。邮件链接先在设备上从富文本链接和可见网址中读取；AI 只能从这些链接中为相关事项建议附件，且你可在保存前取消选择。TodayCue 不把 AI 原文、链接或结果写入持久数据库，并在处理完成、取消或最长约 15 分钟后从运行内存清除。AI 结果可能有误，你应在保存前确认。
5. 游客模式与加密同步
你无需登录即可使用核心功能。游客内容只保存在本机。登录后，你可以读取并同步云端数据；TodayCue 会合并本机与云端记录，避免简单覆盖。同步快照在设备端使用 AES-GCM 加密，云端数据库只保存密文；本地缓存密钥由系统 Keychain 保护。
6. 你选择的照片、文件与附件
TodayCue 通过 Apple 提供的系统选择器读取你主动选择的照片或文件，不能浏览未选择的内容。头像和校历内容仅用于你要求的功能。每个事项最多可关联 5 个网页链接、图片或 PDF；单个本机文件最大 25 MB。图片和 PDF 会复制到本机 App 沙盒，文件名和网页链接可包含在设备端加密的同步快照中，但文件本体不会上传或跨设备同步。网页链接打开后由对应第三方网站处理。删除事项、附件或 App 会删除对应的本机附件文件。
7. 服务提供商
我们可能使用 Apple（登录、App Store 和订阅）、Google Cloud（云端托管）、OpenAI（AI 信息提取）以及邮件发送服务来完成对应功能。这些服务仅接收完成其功能所需的信息，并受各自条款和隐私措施约束。我们不出售个人信息，也不使用这些信息进行跨应用广告追踪。
8. 儿童与家庭资料
TodayCue 面向家长和监护人，不面向儿童直接注册。请仅提供管理家庭事项所需的儿童资料，并确保你有权提供和管理这些信息。请勿提交健康、身份文件或其他与提醒无关的敏感信息。
9. 保存与删除
你可以在 App 内删除账户及云端加密同步数据。本机数据不会因为登录、退出或删除云端账户而被覆盖；删除 App 可清除设备数据。为防止重复领取及处理退款，删除账户后我们可能保留不含邮箱的加密/哈希化订阅关联记录。法律、安全、反欺诈或争议处理所要求的有限记录可能保留更长时间。删除 TodayCue 账户不会自动取消 Apple 订阅。
10. 你的权利
根据所在地法律，你可能有权访问、更正、导出、删除、限制或反对处理个人信息，以及撤回同意。你可以通过 App 内功能或支持邮箱提出请求，并有权向当地数据保护机构投诉。
11. 安全与国际处理
我们使用 HTTPS、系统 Keychain、访问控制及其他合理措施保护信息。任何系统都无法保证绝对安全。服务提供商可能在你所在国家或地区以外处理数据；我们会依据适用法律采用相应保护措施。
12. 政策更新与联系
重要变更会通过 App 或本页面说明。隐私问题或权利请求请联系 support@today-cue.app。
Privacy Policy
TodayCue (“we”) is an iPhone app for parents to organize school notices, family tasks, calendars, and reminders. This policy explains how we handle information when you use TodayCue.
1. Information we process
- Local data: family members, tasks, locations, reminders, items, calendars, and settings stay encrypted on the device by default and are not uploaded automatically.
- Account data, such as email or Apple sign-in identifier, session, and account status, only when you sign in.
- Text deliberately submitted for a specific AI request, including text extracted on-device from a PDF or calendar photo; in Email mode, this also includes the names and addresses of web links read from pasted content on the device. Original calendar photos are not sent to AI.
- Subscription product, transaction status, entitlement dates, and the membership link to a TodayCue account supplied or verified by Apple. We do not receive full payment-card details.
- A random installation identifier and limited logs needed for quota enforcement, security, and troubleshooting.
2. Why we process information
We process information to provide sign-in, family planning, reminders, widgets, calendar import, AI extraction, subscription entitlements, support, security, and troubleshooting. Depending on the context, our basis may be contract performance, consent, legitimate interests, or legal obligations.
3. School and calendar information
TodayCue does not provide or preinstall any school's calendar content or a list of school names. You enter the school name yourself, and calendars are imported only after you select an ICS file, PDF, or photos. Submit only content you are authorized to process. You can clear your imported calendar for any school at any time; clearing does not use an AI scan.
4. AI assistant
Content is sent only when you consent and submit a specific AI request. This may include text extracted on-device from a PDF or calendar photo; original calendar photos are not sent to AI. In Email mode, rich-text links and visible URLs are first read on-device; their names and addresses are sent with the text, and AI may only suggest attachments from that supplied list. You can deselect a suggested link before saving. TodayCue does not write AI source text, links, or results to its persistent database and removes them from runtime memory after completion, cancellation, or about 15 minutes. AI output can be inaccurate and must be reviewed.
5. Guest mode and encrypted sync
No sign-in is required for core features, and guest content stays on the device. After sign-in, cloud and local records are merged. Sync snapshots are AES-GCM encrypted on the device and the cloud database stores ciphertext only; the system Keychain protects the local cache key.
6. Photos, files, and attachments you select
TodayCue uses Apple system pickers to read only photos or files you deliberately select and cannot browse unselected content. Avatar and calendar content is used only for the feature you request. Each task can hold up to five web links, images, or PDFs, with a 25 MB limit per local file. Images and PDFs are copied into the app's local sandbox. Filenames and web links may be included in the device-encrypted sync snapshot, but file contents are not uploaded or synced across devices. A third-party site handles information after you open its link. Deleting the task, attachment, or app removes the corresponding local file.
7. Service providers
We may use Apple for sign-in, App Store, and subscriptions; Google Cloud for hosting; OpenAI for AI extraction; and an email delivery provider. They receive only information needed for their function. We do not sell personal information or use it for cross-app advertising tracking.
8. Children and family data
TodayCue is intended for parents and guardians, not for children to register directly. Provide only information needed to manage family tasks and only when you have authority to do so.
9. Retention and deletion
You can delete the account and encrypted cloud-sync data in the app. Local data is not overwritten by sign-in, sign-out, or cloud-account deletion; deleting the app clears device data. We may retain an encrypted or hashed subscription-link record without the email after account deletion to prevent duplicate claims and handle refunds. Limited records may remain where required for law, security, fraud prevention, or disputes. Deleting a TodayCue account does not cancel an Apple subscription.
10. Your rights
Depending on your location, you may request access, correction, export, deletion, restriction, or objection, and may withdraw consent. Use the in-app controls or contact us.
11. Security and international processing
We use application-layer AES-GCM encryption, HTTPS, system Keychain, and access controls. No system is completely secure. Providers may process data outside your country under applicable safeguards.
12. Changes and contact
Material changes will be communicated in the app or on this page. Contact support@today-cue.app for privacy questions or rights requests.