Privacy Policy

1. Principles

We do not sell people. We do not sell drafts. We do not sell Learn progress, Play stars, CultIQ reading state, questions to the guide, or house-audio listening.

Data minimization: the local free desk works without an account. We ask for server-side identity only when you choose credits, login, or optional refine.

The guide is short help that opens published doors — not live customer chat.

2. Desk drafts

Desk drafts and letter history default to this device. They are not uploaded to Orenay servers unless you use an optional feature that explicitly sends content (for example DeepSeek refine).

There is no cloud restore of letter body text from a wiped device. Export or copy what you need before clearing local data. questions to the guide stay on-device for routing; we do not sell them.

3. On-device Learn, Play, CultIQ, guide

Learn progress (including cosmology tools you open), Play stars, CultIQ reading state, guide panel state, and house audio playback position stay on-device by default.

Play: no children’s leaderboard, no ranking against other kids, and we do not store play transcripts as a chat log. CultIQ is yours alone — not a public scoreboard. Embed widgets may send anonymous usage counts only — never visitor identity for sale.

3b. House audio (Hear)

Hear plays Orenay house recordings when available. If none are available, your device may speak the words instead — that is a backup, not the guide's voice.

House audio packs stay on this device unless you use an optional path that you confirm. We do not sell listening history. Missing packs stay empty rather than pretending a voice is live.

3c. The guide

Asks you type for routing stay on this device by default. We may count anonymous feature use (that a guide was opened) — never the ask text for sale. There is no live chat transcript.

4. Optional account

An optional account / login exists for credits and preferences only. It is never required for the local free desk or for reading these legal pages.

If you create an account, we store what is needed to authenticate and manage credits — not your full Desk letter history as a product of login. Email-first abroad; a China mobile path is labeled honestly when it exists and is not invented here.

5. Children and Play

Play is a cultural space for families, not a social network. We do not run child rankings. We do not store play session transcripts as chat logs.

Parent gate: a four-digit code you set stays hashed on this device only. It unlocks parent tools (postcard / save image, optional friend link for the older age band). It is not an account password and is never uploaded as plaintext.

Younger bands: practices stay on-device by default. A parent may save or share a postcard image after the gate — that is a picture for the family, not a public feed.

Older band (guardian-set): after the parent gate, a one-time friend link may be copied or shared to someone you know. There is no open discovery, comments, or leaderboard.

Guardians supervise device use as they see fit. Details that used to sit as on-screen footnotes live here instead — Play stays warm and quiet.

6. Anonymous product signals

We may collect anonymous aggregate product signals to improve shared customs notes and the product: market, channel, feature used (including Desk, Learn, Play, CultIQ, guide, Hear, embeds), copied?, buyer-replied? (yes/no), and gap requests.

These signals do not include letter bodies, drafts, polished text, text of questions to the guide, Play transcripts, or house-audio waveforms. We do not sell people, drafts, profiles, or personal content. Early product diagnostics stay minimized. Contact: privacy@orenay.cn.

6b. How signals relate to the free desk

Free desk and metered trial refine credits help you try the product; anonymous aggregate signals help improve shared customs notes — never by selling people, drafts, or profiles.

Letter bodies default on-device. Optional AI refine (精修) sends draft text only when you confirm. We do not fine-tune models on your mail. Usage summaries may inform human review of note updates — never auto-written from your content. Contact: privacy@orenay.cn.

7. Third parties

DeepSeek: only when you confirm an AI review of a letter, the text of that letter is sent to DeepSeek to improve it. Nothing is sent without your confirmation.

Alipay: handles payments for paid plans and company deposits, under its own terms. WeChat Pay is not open yet.

House audio is ours (or our licensors’). Sites that embed Orenay widgets receive anonymous counts only. We do not give your drafts to advertisers.

8. Your choices

You can clear local Orenay data on the Delete local data page. That wipes desk history, language bridge, stars, guide local state, house-audio position, and the anonymous event log on this device.

You may request access or deletion of optional server-side account data by emailing privacy@orenay.cn. We will process deletion requests in line with applicable law and early product capacity — without inventing a filing number, a certified officer title, or a government badge here.

8b. How to delete your data

On this device: use the button at the end of this page. Your data here is cleared at once.

Your account: sign in and open orenay.cn/delete to ask for deletion. We delete your account and the data linked to it within 30 days, and a notice in Orenay confirms your request. You can also email privacy@orenay.cn with the subject “Delete my data” from your account's email address.

9. Contact

Privacy questions: privacy@orenay.cn. Early product — we answer as a product team, not as a law firm.

Delete your data

On this device

This clears what Orenay saved in this browser: desk history, stars, guide progress and the anonymous event log. It happens at once.

Your account

Ask us to delete your account and the data linked to it: your pages, messages, notices and settings. We do it within 30 days. A notice in Orenay confirms your request, and you can cancel until that date.

Payment records are kept without your name, because tax law requires it.

You can also write to us: privacy@orenay.cn