Privacy Policy

Last updated: May 13, 2026 | Data controller: Beijing Baladuoduo Technology Co., Ltd. (“we”, “us”, or “the Company”).

This English version is provided for convenience. If there is any inconsistency with the Chinese text, the Chinese version shall prevail to the extent permitted by law.

1. Scope

This Policy applies to our official website, business contacts, customer service, events, recruitment, and mobile applications published or operated by us or our affiliates under our name through lawful channels. Supplemental notices inside an application apply together with this Policy; where they conflict, the supplemental notice governs for that application.

1.1 Application supplement — Slimage

This section is a supplemental notice for Slimage (on-device photo compression app, iOS / Android). Under Section 1 above, it prevails over the general provisions for that app:

• Fully on-device processing. Slimage has no backend server. Photos you select are compressed in device memory only; the resulting bytes are then either saved to your photo library or shared via the system share sheet at your explicit action. We never receive, transmit, or store your photos or any derivative data.
• No personal information collected. Slimage does not collect names, phone numbers, email addresses, account information (the app has no accounts), device identifiers (IDFA, IDFV, Android Advertising ID, OAID, IMEI, MAC address), IP address, coarse or precise location, contacts, calendar, microphone input, network traffic, crash logs, analytics events, or any form of telemetry. There is no profiling, automated decision-making, or targeted advertising. Accordingly, Sections 2, 4, 5, 6, 8, and 10 of this Policy (collection, sharing, third-party SDKs, retention, data-subject rights, California rights) have no records to act upon within the scope of Slimage.
• Operating-system permissions requested (limited strictly to the stated purposes):
  • Read photo library (iOS NSPhotoLibraryUsageDescription / Android READ_EXTERNAL_STORAGE, Android 12 and below only): so the system photo picker can present photos for you to choose from. On iOS 14 and later, the app uses Apple’s PHPickerViewController, an out-of-process system picker that does not scan your photo library. NSPhotoLibraryUsageDescription is still shipped to satisfy Apple’s binary static-analysis check performed during App Store submission.
  • Write to photo library (iOS NSPhotoLibraryAddUsageDescription / Android WRITE_EXTERNAL_STORAGE on Android 9 and below): only when you tap “Save” to write the compressed result back to your library.
• Local preferences: stored only via the operating system’s standard preference storage (iOS NSUserDefaults / Android SharedPreferences): chosen quality, output format, last target size, target unit (KB or MB), onboarding-completion flag, language, and theme. All cleared when you uninstall the app.
• Third-party components: only on-device open-source components (such as the Flutter framework, libjpeg-turbo, libwebp). None contain telemetry, analytics, advertising, or any network functionality. We have no third-party data processors.
• iOS Privacy Manifest: the app ships with a PrivacyInfo.xcprivacy declaring no tracking, no data types collected, and four “required-reason API” usages: NSUserDefaults (reason CA92.1 — the app’s own settings), FileTimestamp (reason C617.1 — files inside the app bundle), SystemBootTime (reason 35F9.1 — Flutter engine), DiskSpace (reason 85F4.1 — computing cache size).
• Children’s privacy: because no data is collected, Slimage is suitable for all ages and complies with COPPA (U.S.) and GDPR child-protection thresholds (under 16, or the lower age set by your EU member state) by holding no data on any user.
• Account and data deletion: the app has no user accounts. To remove all on-device data, uninstall the app.
• Contact: for any privacy question regarding Slimage, email service@baladuoduo.com.

2. Types of information

Depending on the service, we may collect identity and contact data; account data (registration phone or email, password hashes, nickname, avatar, third-party login identifiers); transaction data (orders, refunds, support records — sensitive payment data such as full card numbers and CVV are processed by licensed payment institutions and are not stored by us); technical and usage data (IP address, device model, OS version, coarse location, access logs, crash reports); app-related data (device identifiers such as IDFV/IDFA, Android Advertising ID, OAID; app version; interaction events; performance and diagnostic logs); and communications you send to us. Sensitive permissions (camera, photo library, microphone, Bluetooth, NFC, health data, precise location, etc.) are accessed only with your consent and only to provide the corresponding feature.

3. Purposes and legal bases

We process data to provide and improve services, respond to inquiries, comply with law, protect security, prevent fraud, resolve disputes, and—where you consent—for marketing and surveys (you may withdraw consent at any time).

4. Sharing and processors

We do not sell your personal information. We may share data with service providers under contract, affiliates where permitted, authorities when required by law, and successors in a business transaction subject to applicable law. Cross-border transfers use appropriate safeguards where required.

4.1 iOS App Tracking Transparency & Android Advertising ID

Where our iOS apps need to read the IDFA or to track you across other apps and websites, we will request your permission through Apple’s system-level App Tracking Transparency (ATT) prompt before using the feature, in line with App Store Review Guideline 5.1.2 and Apple platform policies. If you choose “Ask App Not to Track,” or later disable tracking under Settings → Privacy & Security → Tracking, we will:

• stop reading IDFA and rely on SKAdNetwork, AdAttributionKit, or aggregated attribution;
• not share identifiers usable to re-identify you across apps or websites with third parties;
• not block access to the core features of the app because you declined tracking.

On Android, our use of the Advertising ID is similarly limited until you reset or delete the Advertising ID, and follows Google Play’s developer policies for Advertising ID.

5. Third-party SDKs and services

The following are categories of SDKs that our apps may integrate. The exact SDKs used by a given app are disclosed in that app’s in-app privacy notice or store listing.

• Authentication: WeChat Open Platform, QQ Connect, Sign in with Apple, Google Sign-In — used for third-party login; processes OpenID/UnionID, nickname, and avatar (with consent).
• Payments: WeChat Pay, Alipay, Apple In-App Purchase, Google Play Billing — used to complete orders; processes order ID, amount, and status.
• Push notifications: Apple APNs, Firebase Cloud Messaging, Huawei HMS Push, Mi Push, OPPO Push, vivo Push, GeTui — used to deliver notifications; processes device push tokens, app version, and device model.
• Analytics & crash reporting: Google Analytics for Firebase, Firebase Crashlytics, Umeng U-App, Sentry — used for active-user statistics and crash/performance triage; processes pseudonymous device identifiers, network type, stack traces, and event names.
• Maps and location (only when used): Amap, Baidu Maps, Apple MapKit, Google Maps SDK — processes coarse or precise location with permission.
• Media (where applicable): Douyin Open Platform SDK, Alibaba Cloud VOD, Tencent Cloud Live — processes upload metadata and playback heartbeats.

We sign data processing agreements with these processors, and apply standard contractual clauses, encryption-in-transit and minimization where transfers cross borders.

6. Retention

Account profile data is kept while the account is active and removed within 15 business days of deletion, with backup overwrite within 90 days. Orders, invoices and payment records are kept for at least 5 years as required by law. Login and risk-control logs are kept for 180 days; support and feedback records for 2 years. Anonymized aggregate data may be kept indefinitely as it is no longer personal data.

7. Security

We implement reasonable technical and organizational measures (encryption in transit and at rest, access control, least privilege, intrusion detection, periodic audits). No method of transmission or storage is 100% secure; please report suspected issues promptly.

8. Your rights

Where applicable law grants rights (such as access, correction, deletion, restriction, portability, objection, and withdrawal of consent), you may exercise them by contacting us. We may verify your identity before responding.

9. Account & data deletion

Our mobile apps provide an in-app account deletion path, and you may also submit a request in writing. The scope, retention exceptions and processing timeline are documented on our standalone Account & Data Deletion page.

10. California residents

If California privacy laws apply, you may have additional rights regarding access, deletion, correction, “sale/sharing,” and sensitive information. We do not sell personal information for money.

11. Children

Our services are intended for adults and business customers and are not designed for children under 14. If you believe we collected a child’s information without proper consent, contact us and we will take appropriate steps.

12. Third-party app marketplaces

When you download our apps through third-party marketplaces (Apple App Store, Google Play, Huawei AppGallery, Mi Store, OPPO Software Store, vivo App Store, Tencent MyApp), those operators may process information under their own policies and rules. Please review their terms and privacy notices.

13. Cookies

We may use cookies and similar technologies as described in our Cookie Policy.

14. Changes

We may update this Policy and will post material changes on this site or within relevant applications.

15. Contact

Beijing Baladuoduo Technology Co., Ltd.

We may ask for information reasonably necessary to verify requests and will respond within statutory or reasonable timelines.