OfficeFlow (displayed as word文档手机版 in Simplified Chinese) is provided by Zhou Zhong Fa for creating, editing, managing, recognizing, scanning, printing, and converting documents. This policy explains the information processed, its purposes, recipients, and your choices.
No registration is required. Documents are stored on your device by default. Only files you submit for online conversion are uploaded. Basic analytics and Apple ad attribution are optional; declining them does not affect document features or subscriptions. The app does not display third-party ads, sell personal information, or track you across apps.
1. Documents and online conversion
Imported, created, and generated files are stored in the app's Documents directory. Apple Vision OCR, scanning, PDF merging, splitting, compression, encryption, and image/PDF tools run on your device and do not upload document content.
When you select a file and start online conversion, the selected file, its name, the target format, and necessary technical information are sent over HTTPS to our backend and forwarded to CloudConvert. Our backend deletes its temporary copy after forwarding. CloudConvert removes task files and results according to its retention policy. Online services may process information outside your country, including through our backend in China and CloudConvert's infrastructure. Review the upload notice and avoid submitting highly sensitive information, trade secrets, or material subject to transfer restrictions. You can use on-device tools without uploading files.
2. Subscriptions and restoration
Apple handles App Store payments; we do not receive payment card details. The app verifies StoreKit-signed transactions on your device. Purchases, restoration, renewals, expiry, and revocation snapshots are synchronized with our subscription backend using Apple-signed credentials, product and transaction information, and a random member UUID. This supports verification, restoration, renewal records, support, and subscription conversion analysis.
Signed credentials can contain transaction and original transaction identifiers, product, price and currency, purchase/expiry/revocation dates, trial type, and environment. The random UUID is stored in Keychain/local settings and is passed to Apple as appAccountToken. We do not require your name, telephone number, or email address. Records are separated by app; another app's subscription does not unlock OfficeFlow. Association is restored using Apple-signed transactions, rather than a transaction number alone. Deleting the app does not cancel renewal, and Keychain identifiers may remain.
Usage information for refund handling
Profile → Privacy and Security provides a separate “Allow usage information to be shared with Apple when requesting a refund” toggle. It controls your optional permission to provide relevant usage information to Apple for refund handling, independently of analytics and ad attribution. The app reads the choice saved by our subscription service. Only when you change the toggle does it save your acceptance or refusal with your random member identifier. You may change or withdraw this permission in the same place. If saving fails, the app displays a message; check that your change has been saved successfully.
3. Optional analytics and ad attribution
The first-use dialog provides links to the terms and this policy. The separate analytics and attribution toggle is off by default. You may accept the terms and continue without enabling it. Cancel exits without recording consent. Existing users' saved choices are retained. You may change your choice in Profile → Privacy and Security. Turning it off stops subsequent optional collection and uploads; contact us to request deletion of previously submitted information. Necessary subscription and online conversion services remain available.
Umeng basic analytics
Umeng is initialized only with your permission and a confirmed mainland China region, based on the mainland China App Store storefront (CHN) or the member's previously confirmed domestic region. Umeng is not initialized and no data is reported to it for overseas users or while the region is unconfirmed. Reporting success, failure, or timeout does not affect startup, documents, subscriptions, or navigation. When enabled, Umeng measures installations, active users, and sessions. It processes SDK-generated identifiers such as UMID, ZID, and IDFV; device model; operating system and app version; launch/session times; and necessary network information such as IP addresses. Automatic page analytics and entry collection are disabled. We do not add custom button, purchase, or page events, send document content or member profiles to Umeng, integrate advertising identifier modules, or read IDFA, contacts, or precise location.
Apple Ads / AdServices
Apple ad attribution runs independently of Umeng and is unaffected by whether Umeng is enabled or its reporting result. When enabled, an attribution token is obtained from Apple and sent only to Apple's official attribution endpoint, not to Umeng. Apple's result may include attributed status, organization/campaign/ad group/keyword identifiers, country or region, conversion type, and available names or click dates. The result is uploaded over HTTPS to our backend with the same random member UUID and a random installation authentication token to measure Apple ad performance and subscription conversion. Network/token failures are not treated as organic installs. Later responses may fill missing fields for the same source. This is not used for personalized advertising across apps.
4. Recipients
| Service | Purpose and information | Policy |
|---|---|---|
| CloudConvert GmbH | Requested file conversion: selected file, name, format, and necessary technical information | CloudConvert Privacy Policy |
| Umeng+ (Umeng Tongxin (Beijing) Technology Co., Ltd. and Beijing Ruixun Lingtong Technology Co., Ltd.), UMCommon 7.5.8 / UMDevice 3.5.0 | Optional installation/activity analytics only with a confirmed mainland China region and user permission: identifiers, device/app, session, and network information; no custom events or page analytics | Umeng Privacy Policy |
| Apple | App Store purchases/restoration and optional AdServices attribution: signed transactions and attribution tokens | Apple Privacy Policy |
Our backend provides conversion, subscription verification, and attribution record services. Infrastructure may log request times, IP addresses, response status, and errors for security and reliability. We do not use these logs for cross-app advertising profiles.
5. Permissions and local storage
Camera access is requested for user-initiated scanning. Photo access is limited to photos you select or authorize. The system file picker accesses files you choose to import, open, or save. Denying a permission affects only the relevant feature; permissions can be changed in iOS Settings.
Preferences, random identifiers, and necessary caches use system storage. You can manage, export, back up, or delete local documents. Uninstalling normally removes sandbox files but does not cancel subscriptions.
6. Retention and security
Local documents remain until you delete them. Conversion files are removed as described above and under the provider's policy. Subscription, member association, and attribution records support ongoing verification, renewals, support, analytics, and auditing, and are handled when their purpose ends or we receive a legally valid deletion request. Records subject to legal retention duties may be retained. Umeng data follows its service policy and deletion process; you can also use Umeng's deletion request page. We limit retention to the necessary period and use HTTPS, access controls, and protected server configuration. Service secrets are not bundled in the app.
7. Your choices and rights
Withdraw optional analytics/attribution permission in Profile → Privacy and Security. Contact us for access, correction, deletion, or an explanation of processing. Depending on your location, applicable law may provide further rights, including objection, restriction, portability, or contacting your local data protection authority. You do not need to send original documents, passwords, or payment card details. Subscription inquiries may require your app version, a description of the issue, and relevant Apple order information for verification. We normally respond within 15 business days, subject to applicable requirements. Withdrawal does not affect prior lawful processing. Necessary transaction records may not be immediately deletable.
8. Children and policy updates
The app is not directed specifically at children and does not request age or contact information. Minors should use paid and online features with guardian guidance. Guardians can contact us about inappropriate data processing. Material changes will be communicated appropriately in the app; this page's update date records revisions.
9. Contact
Provider: Zhou Zhong Fa. Privacy and support: compass_ai@163.com.