Privacy Policy

Ching (清數理財) · Last updated: 29 September 2026 · Effective: 29 September 2026

1. Data Controller

Ching (清數理財) is developed and maintained by I Love Working Limited, based in Hong Kong ("we", "us", "our").

Contact: hello@chikching.app

2. What We Collect

Ching is a local-first personal finance app. Your financial data (transactions, accounts, budgets, stock holdings) is stored in a SQLite database on your device only. No account or login is required.

Importing from another app. When you use "Import from another app", the file you select (a Money Manager backup or a 錢家有道 backup) is read and processed on your device only. It is never uploaded to our servers or to any third party. The password required for a 錢家有道 backup is used solely to decrypt that file on your device; it is not stored and never leaves your device. Before an import begins, Ching saves a backup of your existing data on your device as an unencrypted .chingbackup file for you to keep or delete.

3. AI Spending Insights (Optional)

When you enable the AI Spending Insights feature and give consent, a summary of your financial data is sent to our server for analysis:

• Account balances grouped by type (not individual account names), plus your total assets, total liabilities and net worth
• Charges per active credit card for the selected month, with currency (no account names or IDs)
• Transaction list for the selected month (date, category, merchant, amount — capped at 200 entries), plus per-category and per-merchant spending totals for the current and previous month
• Your list of category names
• Budget usage (if enabled in scope settings) and stock holdings (if enabled in scope settings)

Settings > AI & Privacy lets you exclude budget, investment and couple data from the snapshot. Grouped balances, the transaction list, merchant totals and category names are always included while the feature is enabled. Use "View Data Sent to AI" in the same screen to see the exact data before it is sent.

AI category suggestions. When AI Spending Insights is enabled (and, for captured payments, the category-suggestion option is on), the app may also send an individual transaction's merchant name and amount, together with your list of expense category names, to the same AI service to suggest a category. No other transaction details are sent for this purpose.

Images you share into Ching (receipt reading). When you share an image into Ching, Ching treats it as a receipt you want recorded: the image is uploaded over an encrypted connection to a cloud AI service, which reads the text and amounts to build a draft entry for you. Cloud receipt reading has its own consent switch, separate from AI Spending Insights: no image is uploaded until you give it, and the first time an upload would happen Ching asks you and keeps the image on your phone until you agree. Once you have agreed, the upload happens the moment you share — there is no preview step first. Unless you separately enable the optional failure diagnostics described below, Ching does not store your image on its servers: no copy is kept once reading completes. The image is processed by an AI model provider as described in Section 4. We use these services under API terms that prohibit use of your image for model training and for advertising, and we keep their optional data-sharing and training settings switched off — your image is used for receipt reading and, only with your separate diagnostic consent, investigating reading failures. If you do not want an image uploaded, do not share it into Ching — once you have agreed to cloud receipt reading, sharing an image is your instruction to upload it. Taking a photo with the in-app camera option, or choosing one from your photo library, is equally your instruction to upload that image.

Optional failure diagnostics. If you separately agree in the app, failed or apparently failed cloud readings (including a failed first model attempt rescued by a backup model) automatically retain the exact uploaded image, request settings, model responses, processing errors, app version and random request identifiers in a private Cloudflare R2 bucket. Images and responses can contain names, amounts, account details or other information visible in your image; they are readable by the developer solely to investigate and fix reading failures, not for advertising, profiling or model training. Access through our diagnostic tools expires seven days after the original request. Automatic deletion follows, normally within 24 hours. Declining does not prevent cloud reading. You can stop future collection in Settings > AI & Privacy; already retained evidence follows the same expiry. Earlier cloud-reading consent does not grant diagnostic retention. A voluntarily submitted problem report is a separate collection under Section 6 and its 90-day retention. Your phone also keeps the failed staged image and a local trace reference for up to 14 days, unless the image is still needed for a pending or saved entry. Runtime or network failures can prevent evidence from being saved.

Development and test builds only: a shared image the reading service could not parse may additionally be forwarded to the private developer notification channel described in Section 6, so the fault can be diagnosed; this never happens in the production build.

4. Where AI Data Goes

What each AI feature sends. AI Spending Insights sends the financial snapshot described in Section 3. Asking the AI a question sends the question you type, together with the earlier messages in that conversation. A category suggestion sends one transaction's merchant name and amount with your list of category names. Receipt reading sends the image you shared.

AI processing takes place outside Hong Kong. AI responses are cached on your device for up to 24 hours. To avoid re-processing identical requests, a copy of the AI-generated response (which may quote your merchant names and amounts) is also cached on our server for up to 4 hours and then deleted; the raw financial snapshot itself is never stored on our servers. To operate rate limits and quotas, our server keeps a registration record for your installation (a random install identifier, device model, app version, language, usage counters, and a shortened cryptographic hash of your IP address). Your full IP address is processed by our network provider to deliver the request and for short-term rate limiting.

5. Payment Notification Capture (Optional, Android Only)

If you enable "Auto-Capture Payments", the app uses Android's Notification Listener Service to read payment notifications from supported apps (Octopus, AlipayHK, Alipay, Google Pay, PayMe, HSBC, Hang Seng, BOCHK, Citibank HK, Samsung Pay, Standard Chartered, DBS Compass, ether.fi Cash, WeChat Pay, Futubull, Mox, PayPay).

• The app reads only the notification title and text to extract transaction amount, merchant name, and payment method
• This data is stored locally on your device only and is never transmitted to any server
• You must explicitly grant Notification Access permission — the app cannot read notifications without your consent
• You can revoke this permission at any time in Android Settings > Apps > Special App Access > Notification Access

6. Report Issue (Optional)

If you use the "Report Issue" feature in Settings, the following data is sent to our Cloudflare Worker for debugging purposes:

• App log files (covering roughly the last 24 hours of app activity — app events, errors, and timestamps). The logs are sanitized before upload so account and card numbers, phone numbers, and email addresses are masked, but they may still include transaction amounts, balances, budget figures, and notification text — such as merchant names — and your account and category display names, used only for debugging.
• A screenshot you select from your gallery (optional)
• Device information (model, manufacturer, OS version, app version, language, and internal diagnostic identifiers)
• A contact handle if you choose to provide one for follow-up (email, Threads, Instagram or Telegram)

This data is stored in Cloudflare KV for support purposes and is retained for up to 90 days, after which it is automatically deleted. The logs are sanitized so that account and card numbers, phone numbers, and email addresses are masked, but they may still include transaction amounts, balances, budget figures, and notification text such as merchant names, and your account and category display names. This information is used only to diagnose and fix the issue you report — never for advertising or profiling.

So we can respond quickly, a copy of your report text, contact handle and device summary is also delivered to a private developer notification channel, visible only to the developer. That channel is a messaging webhook we configure: it is currently a private Telegram chat (Telegram FZ-LLC, outside Hong Kong), and it can be pointed at another messaging provider (for example Discord or Slack) without changing what is sent. Any screenshot you attach is uploaded to the channel only while it is a Telegram chat; with any other provider the channel receives the text alert alone, which states only whether a screenshot was attached. Your per-install identifier is never sent to this channel, and the log file itself stays in the Cloudflare record described above — only a short technical status line may be quoted from it, when that line reports a data-repair problem we need to see immediately.

7. Partner Mode (Optional)

If you enable Partner Mode, selected transactions are synced between you and your partner via Cloudflare Workers. You choose whether to share all transactions or only split expenses.

The following data is stored on our Cloudflare database while the partnership is active and is readable on the server:

• A randomly generated device identifier (UUID)
• Your chosen display name (e.g., "Alice")
• A Firebase Cloud Messaging (FCM) token for push notification delivery
• Shared transaction fields — amount, shop/merchant name, description, category, account names, and dates

This data is deleted when either partner disconnects. Undelivered transactions are cleaned up after 24 hours. Inactive devices are purged after 30 days.

8. Feature Request Board (Optional)

The in-app Feature Request Board ("許願池") lets you suggest features and vote on suggestions. Submitting and voting send different things; both are stored in a Cloudflare D1 database (Cloudflare, Inc., USA / global network).

When you submit a wish, we receive and store:

• The wish title and description you type (free text)
• The per-install identifier described below
• Your device model, app version, build number, language setting and distribution channel (production / beta / dev), used for triage and debugging
• Whether your installation has Pro, used only as a prioritisation signal (it is not linked to your billing identity)

When you vote, we receive and store only the identifier of the wish you voted for, the same per-install identifier, the time of the vote, and whether your installation has Pro. A vote carries no free text, and no device model, app version, build number, language setting or distribution channel is sent or stored for a vote.

When a new wish is submitted (and when it reaches vote milestones), its title and an excerpt of its description are forwarded to a private developer notification channel, visible only to the developer, so we can review it promptly. That channel is the same one described in section 6 — a messaging webhook we configure, currently a private Telegram chat (Telegram FZ-LLC, outside Hong Kong).

Opening the board sends your identifier so the server can show you your own wishes that are still under review; no board activity is recorded server-side when you only read the board (standard short-lived request logs aside). While a wish is still under review, you can edit or delete it yourself in the app. Once a wish has been declined you can still delete it in the app, but it can no longer be edited. Once a wish is on the public board, you can no longer edit or delete it in the app — contact us and we will delete it and its associated data for you.

9. Analytics

We use Firebase Analytics (operated by Google LLC, USA) to understand app usage patterns. Firebase collects:

• Interaction events — which features are used, session duration, screen views (a defined set of interaction event types). No exact transaction amounts, merchant names or account balances are included; a small number of events carry only a coarse spending band (for example "under $100")
• Device information — device model, operating system version, app version, language, country/region
• Identifiers — an anonymous Firebase App Instance ID (not linked to your identity). We do not collect or use the Advertising ID at all

Firebase Analytics does not receive your financial data. We do not use analytics data for advertising or user profiling. You can review Firebase's privacy documentation.

10. Crash Diagnostics

We use Firebase Crashlytics (operated by Google LLC, USA) to detect and fix app crashes and unhandled errors. When the app encounters a crash or uncaught error, a crash report is sent to Google/Firebase. This is active for all non-debug builds and helps us keep the app stable.

• Crash stack traces — the technical error message and code call-stack at the moment of the crash
• Custom diagnostic keys — a coarse device-model bucket (e.g. "android_android14"), build source (production / beta / dev), platform, and app version, so crashes can be grouped
• Standard device state collected by Crashlytics (OS version, available memory, and an anonymous installation identifier)

We never attach your transaction list, balances, accounts or stock holdings to a crash report. The error message is sanitized before upload so account and card numbers, phone numbers, and email addresses are masked, but it may still include the transaction amount and the merchant name being processed at the moment of the crash — those are preserved deliberately, because they are the diagnostic payload that lets us find the fault. Crash reports are used only for debugging. They are not used for advertising or profiling. You can review Firebase's privacy documentation.

11. Cloud Backup (Optional)

If you enable Cloud Backup, an encrypted copy of your data is stored on Cloudflare R2 (Cloudflare, Inc., USA) so you can restore it on a new device.

What leaves your device for Cloud Backup:

• The encrypted backup blob (ciphertext only — unreadable without your passphrase)
• A small non-sensitive manifest containing counts and metadata only: number of transactions, number of receipts, encrypted file size, upload timestamp, and schema version
• A wrapped (encrypted) data key and a random salt, so you can restore on a new device with your passphrase
• A one-way cryptographic hash (not the original value) of your device's Android ID, used to recognise the same physical device across reinstalls
• A one-way verification value derived from your passphrase — not the passphrase itself, and not usable to decrypt your backup — used to check you hold the correct passphrase before a restore
• Your subscription status (active / expired), so backup limits can be applied

The manifest contains no transaction amounts, merchant names, account names, or balances — only counts. If you lose your passphrase, your backup cannot be recovered, because we do not hold the key.

For security monitoring, backup operations are recorded in a server-side audit log containing the request's IP address and technical metadata.

12. Stock Price Lookup

If you record stock holdings, the app fetches current market prices to show their value. These price and symbol-lookup requests are sent to Yahoo Finance (a third-party market-data service operated by Yahoo) directly from your device, which returns the requested quote.

• Only the stock symbol (ticker) for the price you are viewing is sent — no transaction amounts, account names, balances, or your full holdings list are included
• Because the request goes directly from your device, your device's IP address is visible to the provider as part of the network request
• Price data is used solely to display the current value of your holdings inside the app

13. Push Notifications

We use Firebase Cloud Messaging (FCM) to deliver push notifications (e.g., partner sync alerts). When you grant notification permission, a unique device token is generated by Firebase and sent to Google's servers to route notifications to your device. This token does not contain personal or financial information. You can disable push notifications at any time in your device settings.

14. Purchases and Subscriptions

If you purchase the Pro subscription through Google Play, payment is handled entirely by Google — we never see your payment card or billing details. To activate and maintain Pro, the app sends the store-issued purchase token and product ID to our billing server (Cloudflare Workers), which verifies them with Google Play and stores the resulting subscription state (active / expired) and expiry date. Google also notifies our server when your subscription changes (renewal, cancellation, refund). This processing is necessary to deliver the subscription you purchased.

When your subscription changes state — a new purchase, a cancellation (auto-renew turned off), a restart, or a revocation such as a refund or an expiry — a short alert is also delivered to the same private developer notification channel described in section 6. That alert carries the product ID, the resulting subscription state and expiry date, and a shortened one-way hash of the store purchase token. It never carries the purchase token itself or payment details. If you separately choose to submit subscriber feedback and consent to follow-up, the alert may also include that feedback and your chosen contact details, as described below.

Optional subscriber feedback and follow-up

After subscribing, or when you return after choosing not to renew, you may share a main reason and optional comments. You may skip this without affecting your purchase, cancellation or remaining paid access. If you separately opt in, you may provide an email address or Threads handle for the developer to contact you about your experience. A reason-only update preserves an earlier contact choice; use the withdrawal control to remove it.

Your submitted reason, comments, consent choice and contact details are linked to a one-way hash of the verified subscription and stored on Cloudflare KV for up to 365 days after your latest submission. Feedback is delivered to the developer's private notification channel (currently Telegram); a later cancellation alert may include the saved purchase reason and consented contact. These submissions contain no ledger entries, balances or transaction history, and contact details and free text are not sent to Firebase Analytics. Store ownership proofs and a separate deletion credential are kept in device secure storage and are excluded from Ching ledger backups.

In Settings > Ching Pro feedback, you can withdraw permission to contact you and delete stored contact details and comments, including after your subscription expires. Reason codes may remain until the retention period ends. Copies already delivered to the developer's notification channel cannot be recalled automatically; contact hello@chikching.app to request their deletion or deletion of all feedback. Sharing contact details is optional and does not sign you up to a marketing list.

15. Basic App Service Connections

Like most apps, Ching makes a small number of routine network requests that do not depend on any optional feature: checking our server for the minimum supported version, feature availability and service announcements; fetching published exchange rates from the Hong Kong Monetary Authority's public API; and downloading the Noto Sans TC font from Google Fonts when first needed. These requests carry no financial or personal content. Like any internet request, they necessarily expose your device's IP address and standard request metadata to the responding server.

16. Legal Basis for Processing

• AI Spending Insights: Consent — you explicitly enable this feature and agree via an in-app consent dialog. You may withdraw consent at any time by disabling the feature.
• Receipt reading (images you share): Consent — cloud receipt reading has its own consent switch, separate from AI Spending Insights. No image is uploaded until you give it: the first time an upload would happen, Ching asks you and the image stays on your phone until you agree. After that, sharing an image into Ching is your instruction to read that image. You may turn off cloud receipt reading at any time in Settings > AI & Privacy.
• Report Issue: Consent — you actively choose to submit a bug report. No data is sent without your action.
• Partner Mode: Consent — you choose to enable syncing and select what data to share.
• Feature Request Board: Consent — submitting a wish or voting is a voluntary act; nothing is sent unless you use the feature.
• Cloud Backup: Consent — you explicitly enable Cloud Backup and set a passphrase.
• Notification Capture: Consent — you explicitly grant notification listener permission.
• Subscriber feedback: Consent — submitting feedback and allowing follow-up are separate voluntary choices.
• Purchases: Contractual necessity — verifying your purchase is required to deliver the subscription.
• Basic service connections: Legitimate interest — version, availability, exchange-rate and font requests are necessary for the app to function; they carry no personal content.
• Stock Prices: Legitimate interest — fetching market prices for the holdings you record is necessary to display their current value.
• Analytics & Crash Diagnostics: Legitimate interest — we collect anonymised usage and crash data to improve and stabilise the app. Firebase Analytics does not receive your financial data; a crash report may include the transaction amount and merchant name present in the error message at the moment of a crash, used only for debugging.

17. International Data Transfers

When you use optional features that transmit data, your information may be processed outside Hong Kong:

• AI features (AI Spending Insights, questions you ask the AI, category suggestions, receipt reading): Processed outside Hong Kong, through our servers and service providers, by AI model providers (currently Anthropic and Google)
• Stock Prices: Sent to Yahoo Finance (Yahoo Inc., primarily United States)
• Cloud Backup: Encrypted backups stored on Cloudflare R2 (global network)
• Report Issue: Processed via Cloudflare Workers (global network)
• Feature Request Board: Stored via Cloudflare (global network); developer alerts delivered to the developer notification channel (currently Telegram, outside Hong Kong)
• Purchases: Verified with Google (United States); subscription-change alerts delivered to the developer notification channel (currently Telegram, outside Hong Kong)
• Basic service connections: Exchange-rate requests to the Hong Kong Monetary Authority stay within Hong Kong; font delivery is handled by Google (United States)
• Analytics, Crash Diagnostics & Push Notifications: Processed by Google (United States)
• Partner Mode: Processed via Cloudflare Workers (global network)

These transfers are necessary to provide the services you have opted into. Our service providers maintain appropriate security safeguards for cross-border data processing.

18. Third-Party Service Providers

The following table summarises all third-party services that may process your data when you use optional features:

Service	Provider	Purpose	Data Processed	Privacy Policy
Cloudflare Workers, R2 & D1	Cloudflare, Inc. (USA)	AI request routing, Partner Mode sync, Report Issue, encrypted Cloud Backup storage, Feature Request Board storage	Financial snapshot, bug reports, end-to-end-encrypted backup blob + count-only manifest, IP address, request metadata, feature requests (title, description, install identifier, device context)	Link
Yahoo Finance	Yahoo Inc. (USA)	Stock price & symbol lookup	Stock symbol (ticker), IP address	Link
AI service providers (currently Anthropic and Google)	Anthropic, PBC (USA); Google LLC (USA)	AI Spending Insights, answering the questions you ask the AI, category suggestions, and reading images you share	Financial snapshot (grouped balances, transactions), the questions you ask and the earlier messages in that conversation, merchant name and amount, shared images	Anthropic · Google
Firebase Analytics	Google LLC (USA)	App usage analytics	Interaction events, device info, app-instance ID	Link
Firebase Crashlytics	Google LLC (USA)	Crash diagnostics	Crash stack traces, device-model bucket, build source, app version (the error message may include the transaction amount and merchant name present at the moment of a crash)	Link
Firebase Cloud Messaging	Google LLC (USA)	Push notifications	Device token (FCM token)	Link
Developer alert channel	Configurable messaging webhook — currently Telegram (Telegram FZ-LLC, outside Hong Kong); may be pointed at another provider such as Discord or Slack	Instant notification to the developer of new bug reports, new feature requests, and Pro subscription events (purchase, cancellation, restart, refund/revocation)	Bug-report text, contact handle, device summary and screenshot (the screenshot only while the channel is Telegram); feature-request title and description excerpt; subscription product ID, subscription state and expiry date, a shortened one-way hash of the purchase token (never the token itself), voluntarily submitted subscriber feedback and separately consented follow-up contact details	telegram.org/privacy
Google Play Billing	Google LLC (USA)	Pro subscription purchase verification	Purchase token, product ID, subscription state and expiry	Link
Google Fonts	Google LLC (USA)	Font delivery (Noto Sans TC)	IP address, standard request metadata	Link
HKMA Open API	Hong Kong Monetary Authority (Hong Kong)	Published exchange rates	No user data; IP address as part of the request	Link

We do not use any advertising networks, social media SDKs, or other third-party tracking services beyond those listed above.

19. Cookies and Local Storage

Ching is a native mobile application and does not use cookies. All app preferences are stored locally on your device using standard Android/iOS storage mechanisms (SharedPreferences / UserDefaults). We do not set cookies or run tracking scripts on this privacy policy page; our hosting provider may set strictly necessary operational cookies.

20. Data Retention

• Local data (transactions, accounts, budgets) — stored on your device indefinitely until you uninstall the app, clear app data, or delete individual entries
• AI Spending Insights cache — responses cached on your device for up to 24 hours, then automatically deleted. AI model providers may retain a request for a limited period under their own published policies; it is not used to train models
• AI service registration records — the per-install AI registration record (random install identifier, device model, app version, language, usage counters) is kept while the AI service operates; contact us to have yours deleted.
• Cloud Backup data — your end-to-end-encrypted backup is retained on Cloudflare R2 until you replace it with a newer backup or disable Cloud Backup, at which point it is deleted. If your Pro subscription ends, the backup is kept for 3 months after the subscription ends and will be deleted after that without further notice. We can never read its contents
• Optional image-reading diagnostics — developer diagnostic-tool access for seven days after the request; automatic deletion afterwards, normally within 24 hours (Section 3).
• Report Issue data — logs, screenshots, and device info stored in Cloudflare KV for up to 90 days, then automatically deleted
• Subscriber feedback — Cloudflare records expire 365 days after the latest submission; consented contact and comments can be removed earlier in Settings > Ching Pro feedback. Developer-channel copies are retained until manually cleared.
• Feature Request Board data — wishes, votes and their associated device context are kept for as long as the suggestion remains relevant to product planning. There is no automatic expiry: the board is reviewed manually, and entries that have been implemented, declined, or are no longer relevant are deleted during those reviews. We carry out these reviews on a best-effort basis, without a fixed schedule. You can delete your own wish in the app while it is under review or after it is declined (editing is possible only while it is still under review); in all other cases, contact us and we will delete it.
• Developer alert channel — copies of bug-report, feature-request and subscription-event alerts delivered to the developer's private notification channel are retained there until manually cleared.
• Partner Mode data — transaction data on our server is automatically deleted after your partner retrieves it. Undelivered transactions are cleaned up after 24 hours. Inactive devices are purged after 30 days
• Firebase Analytics — Google retains analytics data for up to 14 months, after which it is automatically deleted
• Firebase Crashlytics — Google retains crash reports for up to 90 days, after which they are automatically deleted
• FCM device tokens — tokens are refreshed periodically by Firebase; old tokens are invalidated automatically

21. What We Do Not Do

Ching has never sold your data and has never used your data for advertising — and we have no plans ever to do so. In particular:

• We do not sell or share your data with advertisers
• We do not use your financial data for model training
• We do not permanently store your financial data on our servers
• We do not require an account or collect your identity
• We do not use cookies or web-based tracking technologies
• We do not profile you for marketing purposes
• We do not share your data with any advertising networks or data brokers

AI Insights provides automated analysis based on your transaction data. Output is informational only and is not an investment recommendation, solicitation, or a substitute for advice from a licensed professional. Ching does not hold any Hong Kong SFC licence and does not provide regulated advisory services. No automated decisions with legal or similarly significant effects are made about you.

22. Your Rights

Under the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486) and applicable data protection laws, you have the right to:

• Access your data: Since most data is stored locally on your device, you can view it directly in the app. For server-side data (Partner Mode, Report Issue, Feature Request Board, AI registration records), contact us.
• Correct your data: Request correction of any inaccurate personal data we hold.
• Delete your data: Delete all local data by uninstalling the app or clearing app data. For server-side deletion (Partner Mode, Report Issue, Feature Request Board, AI registration records), contact us or disconnect Partner Mode within the app.
• Export your data: Use the in-app backup feature (Settings > Backup & Restore) to export your data.
• Withdraw consent: Disable AI Spending Insights, cloud receipt reading, Partner Mode, or notification capture at any time in Settings. Withdrawal does not affect prior lawful processing.
• Opt out of analytics: Uninstall the app to stop all analytics collection. Analytics data is collected under a random app-instance identifier; we cannot link it to your name or contact details, and it cannot be deleted individually.

To exercise these rights, contact us at hello@chikching.app. We will respond within 40 days as required by Hong Kong law.

If you believe your data privacy rights have been violated, you may lodge a complaint with the Office of the Privacy Commissioner for Personal Data (PCPD).

23. Children's Privacy

Ching is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

24. Security

We protect your data through: local-first architecture (data stays on your device by default), encrypted API key storage (Flutter Secure Storage), client-side AES-256-GCM end-to-end encryption for Cloud Backup (so backup contents are unreadable by us or Cloudflare), encrypted HTTPS connections for all server communications, and API key authentication for server endpoints.

25. Changes to This Policy

This policy may be updated to reflect changes in our practices or legal requirements. We encourage you to review this page periodically. The "Last updated" date at the top indicates when the policy was last revised. Continued use of the app after changes constitutes acceptance of the updated policy. If an update would involve using personal data we have already collected for a new purpose, we will ask for your express consent before doing so, as the Ordinance requires.

26. Contact

For questions, data access requests, deletion requests, or concerns:

Email: hello@chikching.app

For formal data access or correction requests under the Personal Data (Privacy) Ordinance (Cap. 486), we will respond within 40 days as required by law.

In the event of any inconsistency between the English and Chinese versions of this policy, the English version shall prevail.