Journey Poster Privacy Policy

This Policy applies to Photo Atlas 2.0.0, displayed as Journey Poster in English.

1. Controller

Shanghai Chongmu E - Commerce Co., Ltd. (registration number 91310113MA7F7N8C39) is responsible for this processing. Address: Floor 1-2, No. 148, Lane 999, Xiner Road, Baoshan District, Shanghai 200000, China. Email: zack@chongmuec.com.

2. Information, Purposes, and Scope

Accounts and consent

Depending on your chosen sign-in method, we process phone or email, verification results, Apple or Google account identifiers and necessary authorization data, account links, installation identifiers, session-credential digests, IP, request times, and security records. These support authentication, account protection, linking, and an account merge you verify and confirm. Third-party accounts are separate; a merge does not rewrite original payment evidence.

We retain the document version, language, time, account, App version, and necessary verification evidence of your consent to establish your actual choice and resolve updates or disputes. Continued use does not replace legally required separate consent.

Selected photos, location, and works

We process photos you select, necessary motion resources, local asset identifiers, capture time, dimensions, orientation, and embedded GPS to organize Journeys, associate places and routes, and create and save works. We do not scan the entire library. Source motion may contain audio, which this version does not use; new dynamic works are silent and originals remain unchanged. The App does not request camera, microphone, or continuous location access.

Precise location and movement patterns may be sensitive personal information. We explain necessity, purpose, and effects and obtain legally required consent before use. Refusal affects dependent functions, not an unrelated purpose. Processing is on your device and saving adds the work to Photos at your request. Reading resources and saving are separate permission purposes. iCloud-only resources may require network downloads. Works you separately share may expose photos, locations, and text; recipients process their copies under their own rules.

Device, private iCloud, and our servers

Ordinary photo Journeys, location, routes, edited text, and works are mainly stored on your device. Optional private CloudKit sync can include Journeys, selected resources, template drafts, and supported still works. Edited text follows its ordinary or Health-derived storage scope without changing original-photo GPS. Only content actually synced may be restored, subject to the Apple account, device, network, and storage conditions. App work history retains only a still cover for a Live Photo, not a complete motion-file backup, and cannot restore a complete video. System Photos and iCloud Photos are separate Apple services that may synchronize saved works according to your settings.

Our servers retain account, security, transaction, entitlement, consent, necessary operational data, and a limited Journey summary: identifier, name you enter, time range, photo count, distance, duration, transportation type, and installation identifier. Photo originals, asset identifiers, GPS, detailed places, and complete routes are not automatically uploaded to our business servers.

Optional Health information

Only after your voluntary choice and consent under the Workout Notice, we read selected HealthKit workouts/routes, walking, running or cycling distance and available speed, including activity type, source and identifier, start/end, duration, pauses, elevation, and timestamped coordinates, altitude, and accuracy. This is for workout review, photo association, and works. We do not read unrelated categories such as heart rate or blood glucose, write or delete Health records, or track a live workout.

Raw Health records, workout statistics, content-association records, edits, works, and related thumbnails remain in an account-isolated protected local workspace excluded from system backup, App CloudKit, ordinary Journey summaries, product analytics, and crash attachments. Limited action analysis under the combined authorization is described below. Billing may transmit account, format, file, and random settlement identifiers but not Health identifiers, workout times, complete routes, or Health statistics.

Records and works can reveal sensitive locations or routines. Refusal or withdrawal does not disable ordinary photo functions. System permission, the combined workout-processing and feature-use-analysis authorization, and saving a work are separate choices. Saved Photos content may sync through your Apple settings; copies you separately share are outside App control. The geographic requests below can still disclose a region. New purposes, recipients, or international processing require the applicable prior notice and choice. Combined authorization for workout processing and feature-use analysis does not replace the independent choice for Microsoft terrain and imagery services; those services retain their own notice, legally required consent and separate withdrawal.

Workout-service improvement and combined authorization

After you expressly agree to the combined workout-processing and feature-use-analysis arrangement, we record actions in workout review and work creation, their occurrence times, route source, template, App version, results and necessary operation timings, linked to necessary account, Journey and workflow identifiers. We use these to check workflow completion, understand template use and improve rendering and saving reliability. These records may reveal your use of workout features and are handled with restrictions appropriate to sensitive associated information. They do not include raw Health records, workout start/end times or measurements, route coordinates, photo content, titles, place descriptions or filenames. They are not used for advertising, marketing or profiling unrelated to the workout service. They are sent to our business servers and processed for these limited purposes by us and Alibaba Cloud as our infrastructure provider, without third-party advertising or analytics services.

Before enabling the workout features covered by the Workout Notice, you must expressly confirm both workout-information processing and the feature-use analysis described above. One confirmation covers both; subsequent relevant actions are then recorded automatically, without backfilling earlier actions. Neither is enabled before confirmation. If you decline or withdraw this combined authorization, the relevant workout processing and analysis will not start or will stop; ordinary photo features and legally protected paid entitlements are unaffected. You may withdraw through the corresponding App management option or the contact channels stated here. We must stop the relevant processing, analysis collection and transmission, clear unsent records, and delete or lawfully anonymize analysis details and intermediate records still linked to you, as required by law. Necessary transaction, security and consent evidence is retained separately for its limited purposes without adding Health-analysis labels. This arrangement does not limit your statutory personal-information rights or remedies.

Maps, terrain, and recipients

Apple Maps processes coordinates, origins, destinations, intermediate points, regions, and basic network information needed for maps, place lookup, and routing. 3D content uses NASADEM elevation and Copernicus Sentinel imagery. Microsoft Planetary Computer receives the geographic bounding box, dataset/search/crop parameters, IP, time, and basic request information needed to return geographic material. These requests do not attach photo originals, credentials, complete route-point sequences, or workout statistics, but a region can still reveal a photo or workout location.

Geographic results may be inaccurate, incomplete, or out of date, and are not for navigation, medical, surveying, or safety decisions.

Purchases, operation, and support

We process purchase status, product and transaction identifiers, account association, price and currency, refunds/revocations, entitlements, export ledgers, and necessary settlement information. Historical subscriptions, credits, or entitlement-source records are used only where needed for reconciliation, fraud prevention, or disputes, not offered for sale merely because a record remains. Apple processes payments; we do not receive Apple passwords, complete payment-card numbers, or security codes.

For security, reliability, and product analysis of ordinary non-Health workflows, we process necessary account, installation and Journey identifiers, Journey-name summaries, page or action events, template, result, error category, timing, and App version. Ordinary logs and events must not include photo content, file/asset identifiers, precise coordinates, detailed addresses, route geometry, verification codes, or login secrets.

Support processes account, contact email, issue description, time, necessary transaction information, and redacted material you submit, to respond, investigate, and handle complaints. Feedback does not automatically attach photos or Health records and is not used for marketing. Do not send unrelated location, raw Health files, passwords, or verification codes. Local diagnostics do not automatically upload merely because they exist; additional automatic reporting requires the relevant prior explanation and legally required choice.

3. Sources and Recipient Categories

Information comes from you, your device and selected resources, the platforms you choose, transaction systems, and necessary operational/security records. The categories include identifiers, customer and transaction records, electronic activity, precise geolocation, optional Health information, visual/motion content, necessary Journey attributes, and account-security information, for the purposes described above.

This does not mean all information is sent to every recipient. Providers acting for us must follow contracted purposes and safeguards; independent platforms also act under their own privacy obligations. We do not sell personal information, share it for cross-context behavioral advertising, use it for targeted advertising, or use sensitive information to infer characteristics or for advertising. Material changes require applicable notice, consent, or opt-out.

4. Permissions

Photo access, saving to Photos, private iCloud, and Health permissions are requested for their respective purposes and can be managed in system settings. Refusal can limit dependent functions, not unrelated functions or legally protected paid rights.

5. International Processing

Account and business data are mainly processed using mainland-China infrastructure. If you use the App elsewhere, those data are transferred to China, where laws may differ. Apple and Google process information according to account, region, and service arrangements. Microsoft may process the geographic region and network information needed for geographic services in the United States or other operating countries.

Regions and IP information may involve international personal-data transfers. Before processing that requires it, we provide the applicable overseas recipient/contact, purposes, methods, categories, and rights process, and implement required transfer conditions, notice, and separate consent. Another provider’s policy does not discharge our obligations or waive mandatory local rights.

6. U.S. State Privacy Rights

Where applicable, you may confirm processing and access data; obtain portable copies; correct or delete data; opt out of sale, cross-context sharing, targeted advertising or certain profiling; limit specified sensitive-data uses; appeal a refusal; and receive non-discriminatory treatment for exercising rights. We do not make decisions with legal or similarly significant effects through profiling, or currently engage in the sale, advertising sharing, or targeted advertising described above. If a legally recognized preference signal becomes relevant, we honor it as required by law.

Send requests to zack@chongmuec.com, identifying the right and account involved and, where relevant, your state. Authorized agents may act where permitted, subject to necessary proof of authority and identity verification. Verified requests are generally answered within 45 days or the shorter applicable statutory period; a permitted extension will be explained. You may appeal by replying to our decision, and complain to your competent regulator or attorney general.

Rights are subject to lawful exceptions for completing transactions, security, fraud prevention, legal obligations, claims, and others’ rights. Reasonable requests are not charged unless applicable law permits a fee for manifestly unfounded, excessive, or repetitive requests.

7. Retention

We keep data only as long as reasonably necessary, then delete or anonymize it, or restrict it to storage and necessary security where deletion is lawfully deferred:

• Local material, works and caches follow use, deletion, cleanup or uninstallation; interruptions can leave temporary files. Expiry does not mean every cache file is physically erased immediately. Photos copies remain under your control.
• Private iCloud content remains until deletion or the account-related cleanup request; completion depends on Apple confirmation, with retry and accurate pending/failure information.
• Accounts and login identities remain while active; on deletion they are disabled and unnecessary direct identifiers are deleted or deidentified. A deleted-account phone number may be retained up to 30 days to limit abusive repeated registration.
• Verification codes are used only during their validity. Ordinary verification audit, including contact, IP, device and result, is generally retained no longer than six months from the request. Session-credential digests last at most 30 days and are invalidated by logout, revocation or rotation.
• Necessary transaction, entitlement, refund, consent, accounting, security and dispute records follow contractual needs, law and applicable claim periods with restricted access, not blanket indefinite retention.
• Operational events follow necessary operational, security and analysis periods. Ordinary support feedback is deleted or anonymized within six months after closure; necessary complaint, transaction, dispute or legal records follow their own limited purposes and periods.
• For the workout-service analysis described here, we retain action records and necessary associations long term while the service-checking, troubleshooting and quality-analysis purposes described above continue and retention remains necessary, subject to review of that continuing necessity. When the purpose is fulfilled, retention is no longer necessary, you withdraw the relevant consent, delete your account or make a lawful deletion request, we delete or anonymize analysis records still linked to you as required by applicable law. Necessary transaction, security and consent evidence follows its separate purposes and applicable retention periods; analysis does not justify expanding its scope or retaining it indefinitely.
• Protected workout copies remain for your use. Account-deletion cleanup includes related workout copies on the current device; pending or failed cleanup is reported. Sign-out or permission withdrawal does not itself erase copies. You may request cessation or deletion without deleting the whole account. Cleanup does not delete source Health records, Photos or all independent geographic caches.

A lawful separate deletion request need not wait for a routine period to expire. Backup residuals follow necessary rotation and access restrictions, rather than a promise that all copies disappear at once.

8. Security

We use transmission protection, access controls, least privilege, credential safeguards and necessary auditing. Internet and device storage cannot be guaranteed absolutely secure. Personal-data incidents are investigated, mitigated, reported and notified as required by law; this does not exclude our responsibility.

9. Your Choices and Account Deletion

You may request access, copies, correction, deletion, withdrawal, explanation, account deletion or review through available App controls or zack@chongmuec.com, including when you cannot sign in. We perform only necessary verification and explain refusals. General replies are normally within 15 business days; mandatory statutory periods, including Section 6, prevail. You may seek internal review, complain to competent authorities or bring a claim in a court with jurisdiction.

You may request deletion of specified personal information at zack@chongmuec.com, identifying the account and requested scope. After necessary identity and scope verification, we handle the request manually and promptly and inform you of the outcome. A targeted request concerns only verified data belonging to you within that scope; it does not delete the whole account or unrelated data. We explain and restrict processing of any necessary records that must lawfully be retained. Data held only on your device must be handled through that device; we will help explain the available means. You need not provide raw Health records, passwords or verification codes to make a request.

Deleting specified existing records is distinct from withdrawing consent or stopping future collection. We address each according to your actual request. If you also request withdrawal or cessation, we handle that request as required by law; deleting existing records alone does not discharge our duty to stop processing when required.

Sign-out does not delete an account or content. Account deletion disables login and sessions, clears related current-device App data, and requests deletion of that App account’s private iCloud content, not the whole iCloud account or other users’ data. Cloud completion depends on the original Apple account, device, network and Apple services; an unconfirmed request is not completed cleanup. Uninstallation does not itself delete the account or cloud data.

Deletion, uninstallation or permission withdrawal does not cancel Apple subscriptions, request refunds, or erase source Health records, Photos or shared copies. Necessary records remain under Section 7. See the Account Deletion Instructions.

10. Children and Teens

This general-audience service is not directed to children under 13. We do not knowingly collect their online personal information without legally sufficient parental authorization; a child under 13 must not create an account or use account-based features. If discovered, we disable the account and delete information as legally required, subject to limited security/legal retention. Parents may contact the above email. Users aged 13–17 need any legally required parent involvement. We do not knowingly sell or share data of under-16s for advertising. Additional mandatory local child-protection requirements also apply.

11. Changes and Contact

Material changes in purposes, methods, categories, recipients, international transfers or important rights receive prominent notice and legally required fresh consent. Formatting or non-substantive corrections do not automatically require it.

Contact zack@chongmuec.com or the controller address in Section 1. Support information explains further complaint channels. Mandatory rights and remedies in your place of residence are not limited by this Policy.