Journey Poster Privacy Policy

Platform Scope

This set of legal documents uses common text across platforms. Platform-specific features and system capabilities apply only where actually provided on the relevant platform and permitted by applicable rules. The current iOS version does not provide invitation-code display, invitation-code sharing, invitation rewards, or custom gift-code redemption. Provisions about using those features do not apply to the current iOS version. Retaining those provisions does not mean that another platform has launched or that those features will be offered in the future.

These feature limitations do not exclude processing of account identifiers, entitlement sources, or necessary records that actually exist in the shared account system. Data processing, account merge, deletion, and necessary retention remain governed by the relevant rules in this set of documents and the records that actually exist. The absence of a user interface does not remove our personal-information protection obligations.

Important Summary

Journey Poster is the App's English display name. The same App is displayed as Photo Atlas in Simplified Chinese. Both names refer to the same operator, Bundle ID, account system, services, and this Policy and are collectively referred to as the “App.”

Journey Poster helps you organize photos you select into Journeys, map routes, and shareable works. The following points are especially important:

1. Journey Poster does not scan your entire photo library. It processes selected photos and their necessary resources. Live Photo creation may request Photos library access to retrieve selected original motion resources. Such resources may contain audio, but this version uses only the images and produces silent Live Photos. This is not microphone recording. This version does not request camera, microphone, or continuous device-location access.
2. Photo originals, embedded photo GPS, detailed places, full routes, and Live Photo video/audio are not uploaded to our business servers. Private iCloud sync is optional. The App currently syncs only a Live Photo work’s still cover to cloud work history, not its paired video or audio; that history cannot fully restore a dynamic work.
3. Apple MapKit processes coordinates necessary to display maps, resolve places, and calculate routes. Photo originals are not included in map requests.
4. Our servers store account and security data, a limited Journey summary, membership and export-credit records, Apple transaction-verification data, consent records, and minimal operational events. The current version does not automatically upload photo-derived city names, photos, photo asset identifiers, precise coordinates, automatically resolved detailed addresses, or route geometry. A Journey name you enter is still included in the limited summary.
5. You may delete your Journey Poster account in the App. The App disables the server account, removes related local App data, and sends Apple a request to delete the custom CloudKit Record Zone assigned to that Journey Poster account. Completion depends on the device, network, current iCloud account, and Apple services. The App retains a retry task until Apple confirms success and does not claim completion before confirmation. Originals and works saved in the system Photos library are not deleted.
6. We do not sell personal information, share it for cross-context behavioral advertising, or use photos or location data for third-party advertising.

If you do not agree with this Policy, do not register, sign in, or use a feature that requires the relevant information.

1. Who We Are and Scope

The entity responsible for the Journey Poster service is:

• Legal name: Shanghai Chongmu E - Commerce Co., Ltd.
• Chinese legal name: 上海冲沐电子商务有限责任公司
• Unified Social Credit Code: 91310113MA7F7N8C39
• Address: Floor 1-2, No. 148, Lane 999, Xiner Road, Baoshan District, Shanghai 200000, China
• Privacy email: zack@chongmuec.com
• Privacy Policy: https://chongmuec.com/en/legal/privacy/v2.1.1/

This Policy covers the Journey Poster iOS App, account services, support website, and processing directly related to those services. Apple, Google, Alibaba Cloud, and other providers may independently process information under their own terms and privacy policies. Their policies do not replace the obligations we have under applicable law.

For U.S. users, the terms “personal information” and “personal data” include information protected by applicable U.S. federal or state privacy law. References to a particular state right apply only if and to the extent the relevant law covers us, the user, and the processing. We may choose to honor a request more broadly even when a specific statute does not require it.

2. Information We Process and Why

2.1 Account registration, sign-in, linking, and account merge

Depending on the login methods actually offered in your version and region, we may process:

• a mainland China mobile number, SMS verification request, and verification result;
• an email address, an irreversible digest of the email verification code, and the verification result;
• a stable account identifier, verified email, and limited authorization information provided by Apple or Google;
• App installation identifier, device platform, session information, token digest, request IP address, request time, failure reason, and security signals; and
• identity verification, selected primary account, source-account identifiers, and merge result when you link, unlink, or merge login methods.

We use this information to create and protect an account, maintain sessions, prevent verification-code abuse, link login methods, detect account conflicts, and carry out an irreversible account merge only after confirmation.

After a complete account merge, historical transactions, entitlements, and audit facts retain their original source-account references and are connected to the retained account. We do not rewrite original payment facts merely to simplify the interface.

Google Sign-In processing applies only when the App displays a Google Sign-In option and you choose it. A version that does not display that option does not send a Google OAuth request for sign-in.

2.2 Legal consent records

When you agree to the Terms of Service, this Privacy Policy, a separate photo-location notice, or the Paid Services Agreement, we record:

• the permanent document ID, version, and locale presented to you;
• the public URL and SHA-256 digest of the source document;
• the action, time, App version, Build, and device record; and
• the Journey Poster account associated with the action.

We use these records to identify the exact text presented, manage updates, and resolve disputes. The SHA-256 digest allows us to verify that a retained source file matches the text associated with the consent record. The digest does not contain the legal text, photos, or location information.

Consent records identify the language actually presented. Preparing or publishing an updated document does not itself change your historical consent or replace an affirmative action required from you.

2.3 Photos you select and embedded metadata

When you use the system photo picker, the App processes the selected photo content, local asset identifier, capture time, dimensions, orientation, and any coordinates embedded in that photo. We use this information to order photos, create Journey nodes, display places, plan routes, apply templates, and export works.

Precise photo coordinates and a route inferred from several photo locations may be considered sensitive personal information under some laws. Before first using photo location to generate a map, the App provides a prominent separate explanation and obtains separate, affirmative consent. If you decline, the related map-generation flow is not enabled.

For Live Photo preview or export, the App may request Photos library access to obtain the selected original asset’s motion video. Limited access permits only authorized resources that are actually available. The App does not scan the entire library or record new sound through the microphone. Ordinary photos may become still segments in the locally composed work; original motion may be trimmed, faded, or combined to fit its duration and transitions. Source resources may contain audio, but this version does not mix, copy, or output audio tracks. Previews and newly composed Live Photos are silent; originals and existing works in Photos remain unchanged.

If a selected photo or original Live Photo video exists only in iCloud Photos, the App requests its download through Apple Photos when you use the relevant feature. This may use network data and depends on Apple, connectivity, and your system settings.

2.4 Journeys, local files, and private iCloud sync

The App stores Journey names, photo copies or references, capture times, coordinates, place labels, route geometry, map caches, template drafts, crops, and generated works locally.

When iCloud is available and sync is enabled, the App may write the following to the CloudKit Private Database associated with the iCloud Apple ID currently signed in on the device:

• Journey metadata and complete snapshot versions;
• selected photos and thumbnails;
• photo times, coordinates, and place labels;
• route segments, coordinate systems, and map-display data;
• template drafts and synced still works; Live Photo work history includes only the still cover, not its paired video or audio; and
• deletion tombstones, sync state, file size, and integrity information.

iCloud sync is available to free users and members and is not conditioned on membership. The data is in the current user's private CloudKit database and is governed by Apple iCloud and CloudKit rules. After switching the iCloud Apple ID, the App cannot automatically access the former account's private database. Reinstallation or device migration can restore only Journeys whose complete snapshots were confirmed as synced.

Our servers keep a limited Journey summary for account lists, product limits, and reconciliation, such as a Journey ID, name, time range, photo count, distance, duration, transportation type, and installation ID.

The current version disables automatic city-summary uploads and does not add photo-derived city statistics to our business servers. Historical records, if any, remain subject to their original purposes, necessary retention, and access limits; disabling a feature does not establish that all historical records have been erased. A future change requires the corresponding notice and any necessary consent.

Summary uploads exclude photo content, local photo asset identifiers, coordinates, automatically resolved detailed addresses, and route geometry. A Journey name you enter is still saved as part of the summary; do not include personal information you do not want uploaded in that name.

2.5 Apple Maps

Apple MapKit and Apple Maps process information needed for map display, reverse geocoding, place labels, and walking or driving routes. That information may include coordinates, origins, destinations, intermediate points, route type, map viewport, IP address, and basic device or network information.

Map requests do not include photo originals. Apple may use service providers depending on region, operating-system version, and its service arrangements. See Apple Maps & Privacy. Map results can be incomplete or inaccurate and must not be used for real-time navigation, emergency response, or safety-critical decisions.

2.6 Saving, sharing, and generated works

Saving requests permission to add to Photos and writes a single image, long image, or Live Photo to the system library. A Live Photo contains a paired still image and video, without an audio track in newly composed works in this version. Access to read original resources serves a different purpose from permission to save a work.

Composition runs on the device and creates photo copies, map and text layers, video segments, and temporary encoding files. Normal cleanup removes temporary material no longer needed; an interrupted operation may leave caches for later cleanup or uninstallation. Finished works and reusable caches can remain in App storage or Photos. Preview completion does not mean every local file is immediately erased.

The current template flow saves to Photos, where you choose recipients and sharing channels. Other apps may receive only a still image, convert the format, or omit audio. Review visible photos, places, routes, and text before sharing. Recipients and third-party platforms process the content you choose to share under their own rules.

2.7 Lifetime Unlock, historical entitlements, and Apple in-app purchases

Platform and data-processing clarification: the shared account system may still generate, store, and return an invitation-code identifier for an iOS account through account or membership APIs. This does not mean that the current iOS version provides invitation or redemption features. Invitation relationships, gift-code records, and entitlement-source records that actually exist may still be processed as necessary for account association, entitlement reconciliation, abuse prevention, support, or disputes, and retained or deleted under the purposes, periods, and access restrictions in this Policy. Removing a user interface does not mean these records do not exist, and this clarification does not introduce a new collection purpose or extend retention.

To provide paid services, we process active or revoked Lifetime Unlock status, purchase time and entitlement source, free and historical export-credit ledgers, work-settlement identifiers, output format and file size, and Apple-provided product ID, transaction ID, original transaction ID, App Account Token, environment, price, currency, and refund or revocation results. Historical membership expiration, subscription renewal state, invitation or gift-code records are processed only where they exist and are needed for the stated purposes. Work settlement does not upload photos, video, audio, GPS, or complete routes.

Apple processes payment. We do not receive your Apple Account password, complete card number, or card security code. We verify signed Apple transactions and use App Store Server Notifications to prevent duplicate grants and to process renewals, refunds, and revocations.

2.8 Operations, security, product events, and support

We record limited events needed to secure and operate the service, such as account ID, Journey public ID and name snapshot, page or button event, template code, product code, success or failure, error class, timing, cache status, App version, and timestamp.

Operational events must not contain photo binaries, photo filenames, Photos asset identifiers, coordinates, detailed addresses, route geometry, verification codes, or login secrets.

When you contact support, we process what you submit, such as your email address, description, redacted screenshot, App and iOS versions, and necessary order details. Please remove unrelated photos, location, phone numbers, verification codes, and payment details before sending a screenshot.

3. Sources, Purposes, and Disclosure Categories

We collect information from you, your device and selected photos, Apple or Google when you choose their login or platform services, Apple transaction systems, and our security or operational systems.

“Recipient categories” identifies service providers or independent platform providers necessary for the requested feature. It does not mean that every item in a row is sent to every recipient.

4. Device Permissions and System Capabilities

This version does not request camera, microphone, or continuous device-location access. You can change permissions in iOS Settings. Withdrawal does not affect processing lawfully completed before withdrawal but can prevent the feature from continuing.

5. Service Providers and Platform Services

We require service providers acting on our behalf to use information only for the contracted service and to apply appropriate safeguards. Platform providers such as Apple and Google may also act independently under their own rules.

We do not use third-party advertising SDKs in the described release. We do not sell personal information or share it for cross-context behavioral advertising or targeted advertising. We do not use or disclose sensitive personal information to infer characteristics about you or for advertising. If those practices materially change, we will update this Policy and provide any notice, consent, or opt-out required by law.

6. U.S. State Privacy Disclosures and Rights

Depending on your state and whether the applicable law covers the processing, you may have the right to:

• confirm whether we process your personal data and access it;
• obtain a portable copy of certain personal data;
• correct inaccurate personal data;
• delete personal data, subject to lawful exceptions;
• opt out of sale, sharing for cross-context behavioral advertising, targeted advertising, or certain profiling;
• limit certain uses or disclosures of sensitive personal information;
• appeal a refusal to act on a request; and
• receive equal service and not be discriminated against for exercising a privacy right.

Journey Poster does not currently sell personal information, share it for cross-context behavioral advertising, use it for targeted advertising, or make decisions producing legal or similarly significant effects through profiling. We therefore do not display a “Do Not Sell or Share” link for the practices described in this release. If a legally recognized preference signal becomes relevant to our practices, we will process it as required by applicable law.

To submit a request, use the in-App controls described below or email zack@chongmuec.com with “U.S. Privacy Request” in the subject line. State the request type, your state of residence, and the Journey Poster account involved. Do not send a password, verification code, full payment-card information, or unrelated photo original.

We will verify a request using information reasonably related to the account and the risk of the request. An authorized agent may submit a request where permitted by law, but we may require proof of authority and direct identity confirmation. For an applicable verified U.S. state-law request, we generally respond within 45 days or the shorter period required by law. If a lawful extension is necessary, we will explain it. You may appeal a refusal by replying to our decision with “Privacy Appeal.”

These rights are subject to exceptions, including information needed to complete a transaction, secure the service, prevent fraud, comply with law, establish or defend legal claims, or protect another person. We do not charge for a reasonable request unless applicable law permits a fee for requests that are manifestly unfounded, excessive, or repetitive.

7. Retention

We retain information for the shortest period reasonably necessary for the described purpose, subject to legal, security, transaction, and dispute requirements:

• Local Journeys, photo copies, generated images/paired video, and related caches: removed through feature cleanup, local deletion, account-deletion cleanup, or uninstallation as applicable. Interruptions may temporarily leave caches. You control photos and Live Photos saved in the system Photos library.
• Private CloudKit copies: until you delete a Journey, delete the relevant iCloud private data, or the App sends and Apple confirms the account-Zone deletion request. If the request is not confirmed, the App retains a retry task; actual completion depends on the device, network, current iCloud account, and Apple services.
• Active account and login identities: while the account remains active. On deletion, identities and sessions are disabled immediately and direct login identifiers no longer needed are deleted or deidentified.
• Phone number on a deleted account: up to 30 days solely to limit abusive repeated deletion and registration, then removed from the main account record or deidentified.
• SMS and email verification: a code or digest is valid only for the short period shown in the interface. Ordinary audit records, including destination phone or email, IP, device, result, and provider request ID, are generally retained no longer than six months from the request. Records directly related to a specific security event, complaint, or dispute may be isolated and retained until resolution or expiration of the applicable limitation period, then deleted or anonymized.
• Refresh token: only a digest is stored, for no longer than 30 days, and it is revoked on logout, rotation, merge, or account deletion.
• Consent, transaction, entitlement, refund, tax, and financial records: for the period necessary to perform the agreement, verify Apple transactions, meet accounting or tax requirements, protect consumers, and resolve disputes. Only necessary fields are retained.
• Confirmed security incidents, complaints, and disputes: until the matter and applicable appeal, regulatory, or legal-claim period end, with restricted access and use.
• Product and API events: only as long as reasonably needed for product operation, security, cost control, and debugging, with restricted access.

At the end of the applicable period, we delete or anonymize the information, or restrict processing to storage and necessary security where deletion must be deferred.

8. Security

We use measures such as HTTPS, token digests, access controls, least privilege, network isolation, verification-code rate limits, signed-transaction validation, idempotent entitlement ledgers, and necessary audit records. Photos, coordinates, detailed addresses, and route geometry must not be placed in ordinary server logs or product events.

No internet or storage system can be guaranteed absolutely secure. If personal information is or may have been compromised, we will investigate, mitigate, and provide any notice required by applicable law.

9. International Processing

Shanghai Chongmu E - Commerce Co., Ltd. is established in China. Account, authentication, security, purchase, consent, limited Journey-summary data (without automatic photo-derived city uploads in this version), and operational data described in this Policy is primarily processed using infrastructure located in mainland China. If you use Journey Poster from the United States or another country, that information is transferred to and processed in China, where privacy laws may differ from those in your jurisdiction.

Private CloudKit information, Apple login, Apple Maps, and StoreKit information is processed by Apple according to your Apple account, region, and Apple's service arrangements. Google account validation, only when the App offers Google Sign-In and you select it, may be processed by Google outside your country.

Where law requires a transfer mechanism, notice, consent, contractual safeguard, or other measure, we will implement the applicable requirement. This section does not waive any mandatory local rights.

10. Your Choices and Account Deletion

You can:

• manage login methods, iCloud sync, and Journeys in the App;
• adjust Photos and iCloud permissions in iOS Settings;
• delete a Journey or applicable local or iCloud content through the App;
• delete your account under “My Account” > “Settings” > “Account & Security” > “Delete Account”; or
• contact zack@chongmuec.com for access, correction, deletion, portability, consent withdrawal, explanation, complaint, or appeal.

Logging out revokes the current session but does not delete the account, server entitlements, local Journeys, or private iCloud copies.

Account deletion disables the server account, login identities, sessions, and registered devices, and removes Journey data, caches, and App photo copies from the current device. The App sends Apple a request to delete only the custom Record Zone for the current Journey Poster account in the App's CloudKit container and in the CloudKit Private Database of the iCloud Apple ID currently signed in on that device.

The Zone request includes synced Journeys, selected photos and thumbnails, photo times and locations, routes, drafts, synced works, deletion tombstones, sync state, and integrity data in that Zone. It does not delete the entire iCloud account, Zones for other Journey Poster accounts, originals in the system Photos library, or works already saved there.

The App retries an unconfirmed CloudKit deletion request. Completion depends on the device remaining signed in to the original iCloud Apple ID, network availability, and Apple services. The App displays cloud cleanup as complete only after Apple confirms success. Switching to another iCloud Apple ID prevents the App from accessing the former Apple ID's private database, and our server cannot delete across Apple accounts on your behalf.

Deleting the Journey Poster account does not cancel an Apple subscription or request a refund. Uninstalling deletes the App sandbox but does not delete the Journey Poster account, cancel a subscription, delete system Photos content, or automatically remove a synced private CloudKit copy.

11. Children and Teens

Journey Poster is a general-audience service and is not directed to children under 13. We do not knowingly collect personal information online from a child under 13. A child under 13 must not create an account or use account-based features.

If we learn that we collected personal information from a child under 13 without legally sufficient parental authorization, we will disable the account and delete the information as required, subject to limited security or legal retention. A parent or guardian may contact zack@chongmuec.com with “Child Privacy” in the subject line.

Users aged 13 through 17 may use the service only if permitted by the law of their location and with parent or guardian involvement where required. We do not knowingly sell or share personal information of users under 16 for cross-context behavioral advertising.

12. Changes to This Policy

We may update this Policy when features, data practices, providers, laws, or security needs change. If a change materially affects processing purposes, methods, information categories, third parties, international transfers, paid-service obligations, or important user rights, we will provide prominent notice and obtain renewed consent where required.

Formatting, typographical, or non-substantive link corrections generally do not require renewed consent. We retain historical versions, publication dates, public URLs, locales, and SHA-256 digests under our legal-document governance process.

13. Contact and Complaints

For privacy, account, iCloud, or personal-data questions:

• Email: zack@chongmuec.com
• Operator: Shanghai Chongmu E - Commerce Co., Ltd.
• Address: Floor 1-2, No. 148, Lane 999, Xiner Road, Baoshan District, Shanghai 200000, China
• Support: https://chongmuec.com/en/legal/support/v1.1.1/

General support inquiries are normally answered within 15 business days after we receive enough information. Applicable verified U.S. privacy requests are handled within the period required by the relevant law, generally 45 days unless a shorter period applies.

If you are not satisfied with our response, you may request an internal privacy appeal and may contact the attorney general, privacy regulator, consumer-protection authority, or court with jurisdiction in your place of residence. Nothing in this Policy limits a mandatory right or remedy under applicable law.