Aiotto Privacy Policy — version 2026-10-18

This notice identifies the recipients and processing used by Aiotto's cloud services. The separate, versioned text-AI and cloud-read-aloud permission controls described below are introduced in version 1.0.11 (build 61) and later, once that update is available. Earlier builds may not display these controls; users who do not want the disclosed cloud sharing should not invoke those cloud functions in an earlier build. Availability of an update is not implied by the publication date of this policy.

Information Aiotto processes

Aiotto is local-first. Recordings, imported media, transcripts, translations, notes, tags, summaries, playback progress, downloaded podcasts and local statistics are stored in the App's private container. Imported and recorded media are excluded from device backup. The remaining private index may be included in an operating-system backup according to the user's Apple backup settings. Aiotto does not use an advertising or analytics SDK and does not sell personal information or use it for cross-app tracking.

When the user chooses account or cloud functions, Aiotto may process:

An explicitly submitted external webpage/video URL is retained with its account-scoped import/retrieval job so that processing can resume and retries can remain idempotent. Aiotto does not read the user's general browser history.

The client stores only the opaque session credential in an API-origin-scoped Keychain item. It never contains provider API keys, signing secrets or internal server paths. Network requests use encrypted transport to the public Aiotto API boundary. A failed task does not create a result, and the client does not automatically replay a non-idempotent upload after an ambiguous response.

Third-party cloud AI recipients and purposes

Using the Aiotto API does not mean processing stays on the device or only with Aiotto. The following third-party services receive the data needed for the cloud function you choose. Aiotto's backend runs on Cloudflare, Inc. using Workers, D1 databases and R2 storage; Cloudflare processes API requests, account/job records and stored processing copies as infrastructure provider. Tencent Cloud object storage is also used for signed direct uploads and original video storage.

These services process data outside your device. Their applicable service terms, processing arrangements and legal obligations also govern their handling of data. Aiotto's backend expiry periods below do not establish a supplier's retention period.

Provider data handling

DeepSeek's Open Platform Terms require disclosure and lawful authorization and provide for necessary assistance with end-user privacy-rights requests. They incorporate the User Agreement at https://cdn.deepseek.com/policies/zh-CN/deepseek-terms-of-use.html, whose section 4.3 permits de-identified inputs and outputs to be used for training and service optimization. Aiotto has not verified an API-specific opt-out or a complete supplier content/log retention schedule and does not promise API zero retention or no training. Consumer-chat settings must not be assumed to control API processing. The consumer privacy policy does not itself describe downstream App users' personal-data processing.

For recording recognition 2.0, simultaneous interpretation 2.0 and speech synthesis 2.0, Volcano Engine confirmed in its support reply of 2026-10-07 that the generative-model service terms apply. It stated that these services do not retain submitted audio, text, transcripts or synthesized audio by default; necessary troubleshooting logs are retained for approximately 7 days and then automatically cleared. Ending a session stops processing but does not immediately delete those logs. This supplier statement is separate from the Aiotto server caches and results described below.

The same reply states that, without a separate training-authorization agreement, inputs and outputs are not used to train, retrain or improve foundation models. Necessary safety detection/filtering does not itself use that data for model training. For S2S interpretation, zero-shot voice replication is processed only within the current session for translated speech; the supplier states that voice features are not retained or used for identity recognition or training. A fixed provider voice avoids that session voice-sampling path. This statement does not imply that every voice feature is disabled in the App.

Application and territorial permission remain subject to the supplier's written authorization and service order. The data-handling reply is not an authorization for Aiotto or overseas service use. The provider's published terms specify mainland China as the default licensed territory; additional application or overseas coverage must be confirmed separately.

Aiotto does not promise that every provider retains no logs, never improves models or immediately erases all supplier copies. Do not submit confidential or sensitive material unless you are authorized to share it and accept the disclosed cloud processing.

The linked provider documents are supplied for transparency; a link does not replace Aiotto's permission controls or extend a provider's published promises. Tencent's speech synthesis FAQ distinguishes API use from console history; Aiotto does not interpret it as a guarantee that every technical log or backup has zero retention. You can contact Aiotto at the privacy address above for questions about processing or a deletion request involving a submitted item.

AI services and third-party providers / AI 服务说明（第三方服务商清单）

Aiotto calls the third-party AI and speech services below only when you start a cloud feature and have allowed the matching sharing permission. Local reading, notes, Otto offline transcription and the device voice do not use them.

只有在你主动使用云端功能并已允许相应的数据共享时，Aiotto 才会调用以下第三方服务。本地阅读、笔记、Otto 离线转写和设备朗读不会使用它们。

Uploaded files are stored temporarily on Cloudflare and Tencent Cloud infrastructure. Otto offline transcription runs open-source models on the device; see Third-party licenses. Filing numbers are those published by each provider.

上传的文件会在 Cloudflare 和腾讯云基础设施中暂存。Otto 离线转写在本机运行开源模型，详见第三方许可。备案号以各服务商公示为准。

App filing number / App 备案号: 粤ICP备2026096958号-1A (https://beian.miit.gov.cn/).

Cloud AI consent and local alternatives

Cloud AI is optional. From Aiotto 1.0.12, there are separate, versioned sharing permissions: text AI (summaries, mind maps, minutes, translation, explanations and AI definitions), cloud transcription (cloud transcription, speaker separation, word timing, podcast/video audio transcription and Otto live transcription/translation) and cloud read aloud. Aiotto 1.0.13 adds cloud article reading (a WeChat Official Account article the iPhone could not read). Before the first request under a permission version, Aiotto shows a notice that identifies the data categories, purpose and the fact that a third-party AI or speech service provider processes the data, with a link to this policy. That link opens the "AI services and third-party providers" section of this policy on the web (https://aiotto.top/privacy_policy#ai-services), which names each model, service and provider (DeepSeek / 杭州深度求索人工智能基础技术研究有限公司 for text AI and cloud article reading; Doubao Speech / 北京火山引擎科技有限公司 for cloud transcription, Otto and premium read aloud; Tencent Cloud / 腾讯云计算（北京）有限责任公司 for natural and large-model read aloud), the data sent and, where applicable, the generative-AI filing information. The App itself does not list provider names or filing numbers. Settings and the registration notice link to this policy. Each permission requires an affirmative choice before transmission. Granting one permission does not grant the others. A change to the relevant recipient/data scope requires a new permission version and affirmative agreement.

Permission is not implied by installing the App, signing in, buying Pro, opening an item, selecting a voice or accepting general terms. Declining sends no content for that cloud function and does not prevent local recording, playback, reading, editing, offline transcription or device read aloud. Each cloud action remains user initiated after permission is granted; permission does not upload the library automatically. Actions that use cloud transcription minutes still show a short confirmation before they start.

The first sign-in/create-account entry presents a bottom-sheet notice with a separate, unchecked general agreement to the Terms of Use and acknowledgement of this policy. Checking the box alone does not save acceptance: the user must also choose Agree and continue. Not now closes registration and keeps the local features available without saving the checkbox choice. A confirmed choice is remembered on the current installation for the applicable agreement version and is not an AI-sharing permission. The same notice offers a second, optional and unchecked box that grants the text AI, cloud transcription and cloud read-aloud permissions at once; leaving it unchecked does not affect registration. Cloud article reading is not part of that box and is asked for separately when it is first needed. The permissions can also be reviewed and granted individually on the account page. Opening these notices or granting permission alone sends no Memo content and does not send an email verification challenge. Users can sign in without granting any cloud-AI permission. Saved scoped permission avoids a repeated sharing notice during routine use, unless it is withdrawn or the recipient/data scope changes.

When saving an original video or transcribing a source video's audio, the App asks the user once, on that installation, to confirm they own or are permitted to process the source; later actions of that kind do not repeat the question.

Settings / Legal and support / Cloud AI permissions shows the status and details for each permission. The Withdraw all Cloud AI permissions control revokes all four permissions, cancels active text-AI and cloud read-aloud tasks in Aiotto, and prevents new requests until the user affirmatively grants the relevant permission again. Revocation does not recall a request already sent, delete cloud records, or delete a result already saved on the device. If withdrawal cannot be saved, the App blocks these functions in the current session and asks the user to retry withdrawal before reopening the App. Local processing, offline transcription and the device read-aloud voice do not send content to these AI providers and need no permission. Local-processing information and the privacy, terms, support and third-party licence links are available under Settings / Legal and support. Ordinary feature labels and notices use Aiotto/Otto product names and "third-party AI service provider" rather than technical model names; the AI services section of this policy identifies the third-party data recipients. Withdrawing a cloud permission does not withdraw the system microphone permission.

Explicit network actions

Optional offline languages: only when the user taps Download, the App fetches public model files from Hugging Face and its HTTPS artifact CDN. This exposes ordinary network metadata (such as IP address) to that host, but sends no recording, transcript, account token or cookies. After verification, the downloaded model runs entirely on the device, can be removed in Settings, and is excluded from device backups. The built-in offline model needs no download.

Local recordings are never uploaded automatically. Audio is sent only after the user confirms cloud transcription. When speaker separation is available, the same confirmed audio may be processed by Doubao Speech to assign task-local labels such as speaker-1; Aiotto does not use these labels to identify a person or enroll a voice. User-entered speaker display names are not sent back to the audio transcription service, but can accompany source segments in a separately authorized text-AI request to DeepSeek. Native transcript text or explicitly saved readable-document fragments are sent only after the user chooses summary, one-tap translation or mind map and has granted the versioned text-AI permission. Saving or opening a document does not start AI processing. Exact-selection tools send the selected passage and its containing segment so the requested result can preserve context. These requests pass through the authenticated Aiotto API to DeepSeek as disclosed above; provider credentials stay server-side and are not included in the App. Saved document fragments carry stable local IDs but no playback timestamps; Aiotto does not infer or send fabricated timing for them. Account deletion immediately revokes the local session and asks the service to delete account-scoped data that is no longer required for security, fraud prevention, transaction records or law. Backend retention periods and account deletion are described below. They are not guarantees about independent supplier-side storage or legal obligations.

Podcast charts and searches send the selected storefront or search text to Apple's public podcast directory. Opening a public feed or downloading an episode connects directly to the publisher or media host. Those providers may receive ordinary network metadata and apply their own policies.

The Audiobooks tab does not fetch a built-in ebook catalog or news feed. EPUB, PDF, text and readable web documents appear there only after the user imports or saves them. Importing a web page connects to the address chosen by the user; that site may receive ordinary network metadata and apply its own policy. Aiotto downloads and reads the page on the iPhone. If the iPhone cannot read a WeChat Official Account article, the App offers cloud article reading: only after the separate permission does it send the article link, without share or sign-in parameters, through the authenticated Aiotto API to DeepSeek's web page reading service, which returns the page title and text. Each cloud read uses one URL import of the allowance. The saved document stays local until the user separately chooses and confirms summary, one-tap translation or mind map; that operation sends only the bounded readable fragments needed for the selected result.

Read aloud for local text, saved web pages, PDF pages and parsed EPUB chapters can use the device voice without sending text to Aiotto and without cloud-sharing permission. Cloud read aloud, including cloud-voice previews, requires the separate cloud-voice permission described above and an explicit user action. For that choice, Aiotto sends the current bounded paragraph (up to 1,200 characters), selected voice/language and request identifier through the authenticated Aiotto API to Tencent Cloud for natural/large-model voices or Doubao Speech / Volcano Engine for premium voices, and receives synthesized MP3 audio. No original audio, images or entire library is included in this read-aloud request. The App keeps returned audio in a bounded memory cache for playback and does not save it as publisher or source audio. Provider credentials, speaker identifiers and internal service paths remain server-side. Cloud voices are presented separately from the device voice so synthesized speech is not confused with publisher audio.

For a recognized public YouTube link, Aiotto provides an Open in YouTube button. Tapping it opens the public watch URL in the external browser or YouTube app; no YouTube web player is loaded inside Aiotto. Aiotto sends no account credential, transcript, translation or note with the handoff and receives no external playback clock. Imported subtitles and local media remain separate results. Only local media playback and validated native timestamps drive transcript highlighting. Public artwork requests may disclose ordinary network metadata to the artwork host. External services apply their own privacy policies.

An exact HTTPS b23.tv or bili2233.cn path that already contains a valid BV or av identity is normalized entirely on device. When the user confirms Import for an opaque token on either short-link host, Aiotto makes a response-header-only check directly with that short-link host without a Cookie, account credential, authorization header or Referer. The check starts with HEAD; if the host does not redirect that request, Aiotto may send one Range: bytes=0-0 GET fallback and still does not consume or parse its response body. It follows at most three first-party redirects and stops unless the destination is a recognized full Bilibili BV or av public-video link. Aiotto does not parse the response page or send the short link through the Aiotto API. This request can still disclose ordinary network/device metadata, including the IP address and user agent, to Bilibili. Only the normalized full destination is stored.

For a recognized full Bilibili BV or av link, including one produced by that short-link check, Aiotto sends the normalized public watch URL to its authenticated import service only after the user taps Import. The service returns bounded publisher subtitle choices as short-lived opaque tokens; it does not return a provider credential or Cookie to the App. If the user chooses a publisher subtitle, Aiotto imports its native timestamped segments. If no publisher subtitle exists, audio transcription is requested only after the user explicitly enables the no-subtitle fallback. Declining that choice stores only the normalized watch URL.

From Aiotto 1.0.12, a Bilibili Memo can show Bilibili's official public web player. Nothing is loaded from Bilibili until the user taps Load Bilibili video. The player then loads directly from Bilibili's public player route (player.bilibili.com, or the Bilibili mobile player page it selects for iOS) in a private, non-persistent web view: cookies and website data set there are kept only in memory and discarded when the Memo is closed, and the view cannot navigate away from the reconstructed player route. Loading the player discloses ordinary network and device metadata, including the IP address and user agent, to Bilibili, which applies its own privacy policy to that playback. Aiotto sends no account credential, transcript, translation or note to Bilibili and does not use a Bilibili account session. To highlight imported captions, the App reads only the public video element's playback time, duration and play/pause state inside the player; it does not read captions, cookies or other page content. Tapping Open in Bilibili still hands the public watch URL to the system's external browser or Bilibili app. Imported captions and downloaded local audio/video remain independent results in Aiotto.

The App does not use a Bilibili account session, Cookie, internal Bilibili API or direct media extractor. Provider integration, if required to fulfil the selected import, stays behind Aiotto's provider-neutral authenticated service boundary.

When the user taps Import for a YouTube link, or chooses cloud reading for a WeChat article, Aiotto sends that link through its authenticated API so the service can return native timed captions or the article text. A YouTube caption result does not imply that original audio is available. Original audio is requested only after the user separately taps Attach original audio; the service keeps the account-scoped processing copy temporarily and the App downloads the completed media through the same authenticated API boundary.

Importing a full Bilibili link sends only its normalized public URL through Aiotto's authenticated API after the user taps Import. A short Bilibili link is first sent only to its exact first-party short-link host for the bounded redirect check described above; only a successfully normalized full destination can then enter the import API. Publisher subtitles are preferred. When none is available, the App presents a separate audio-transcription consent switch and does not upload or process source audio unless the user enables it. Completed text records whether it came from a publisher transcript or Aiotto Cloud and retains only validated native segment/word timestamps.

When the user explicitly requests EPUB parsing, Aiotto uploads only the selected book through the authenticated API. The legacy path accepts up to 20 MiB; larger supported books use a signed direct-storage upload instead of buffering the entire book through the API worker. Uploaded books have a 24-hour expiry; the account-scoped parse job has a 7-day expiry, and the parsed document metadata and chapters have a 1-year expiry. Scheduled deletion may occur later as explained below. Account deletion can make them eligible for earlier removal. The App requests one chapter at a time and does not automatically upload local PDF files. A failed parse does not produce a document and does not consume the completed-work allowance. A whole-book summary and mind map start only after the user chooses chapters, sees the estimated AI allowance and confirms; chapter text goes to text AI only for chosen chapters that have no summary yet, and the results stay on the iPhone with the book's chapter cache.

When the user selects Otto and confirms the live-audio notice, Aiotto streams microphone audio through the authenticated Aiotto API to Doubao Speech for simultaneous source transcription and translation while keeping the device recording as the local safety copy. The user may choose subtitles only or subtitles plus translated speech for headphone playback. In the latter mode, the authenticated service returns short-lived synthesized interpretation audio separately from the source recording and bilingual subtitle pairs. The App stores only final validated bilingual pairs; translated speech is queued only in memory for playback, and pause, cancellation or disconnection clears queued audio and provisional text. Aiotto does not silently substitute local text or synthetic speech for a missing server result.

Backend retention and protection

The following are Aiotto backend expiry settings, not retention promises by DeepSeek, Volcano Engine, Tencent Cloud or Cloudflare. Expired records/files are removed by scheduled cleanup; cleanup is batched and retried after failures, so physical deletion can occur after the expiry time.

Aiotto uses HTTPS to its public API and to the listed cloud-AI endpoints, authenticated account-scoped access to jobs/results, server-side provider credentials and short-lived media download/upload grants. Session and request identifiers are protected with secret-bound digests where used for verification or idempotency. These controls reduce exposure but do not make cloud processing equivalent to on-device processing or guarantee absolute security. No client-side setting can retrospectively prevent a processor from receiving a request already transmitted.

Cloud-account deletion immediately marks the account inactive and revokes its sessions. A retryable background process removes account-scoped uploads, generated results, transcripts, parsed documents, speech caches and usage records. This is not an immediate physical-erasure guarantee. You may also request access, correction or deletion through ; requests concerning data already sent to a processor require any applicable cooperation from that processor. Removing a local item alone does not issue a cloud-account deletion request, and revoking AI permission alone does not delete cloud records.

Subscriptions and purchase records

Aiotto Pro is an optional auto-renewable monthly or yearly Apple subscription. Apple handles payment information; Aiotto does not receive card numbers, bank details, an Apple Account password or an Apple Account email from StoreKit. The App sends Apple-signed installation proof and transactions to the authenticated Aiotto service to verify their authenticity and associate subscription access with the signed-in Aiotto account. Sandbox and Production are kept separate using verified Apple data, not an unsigned client choice. These purchase records are linked to that account, used for App functionality and fraud prevention, and are not used for advertising or tracking.

Apple subscription notifications and bounded history recovery update access after renewals, expiration, billing recovery or revocation. The service stores validated subscription status and secret-bound transaction digests rather than raw signed transaction payloads or raw Apple transaction identifiers. Notification processing records are retained for at most 400 days. After account deletion, an unlinkable-to-the-deleted-account transaction-ownership digest may remain to prevent the same purchase being fraudulently reassigned; it expires after 400 days without a verified Apple event. Deleting the Aiotto account does not cancel Apple billing. Manage or cancel subscriptions in Apple's subscription settings.

Disabled network functions in this release

This release does not enable Sign in with Apple, cloud meeting-minutes generation or cross-item review generation. Subscription purchase and server-backed restore are enabled for signed-in accounts; prices are loaded from Apple's StoreKit. Compiled fail-closed boundaries for those functions do not collect data while their release flags are disabled. Any later enablement requires a new privacy, provider, retention and App Store review.

User choices and deletion

Users can delete individual local items in Aiotto. Uninstalling the App removes its private local container subject to the operating system's behavior. Users can sign out or request cloud-account deletion in Settings; local study data is not silently deleted with the cloud account. Requests for access, correction or deletion can be sent to .

Aiotto is not directed to children under 13. If the operator learns that personal information from a child was processed without the required consent, reasonable steps will be taken to delete it. Reasonable access controls, encrypted transport and audit measures are used, but no Internet service can guarantee absolute security.

The policy may be updated when product behavior, providers or law changes. The public page will identify the effective date of the applicable version.