Masterpiece (世界名画) Privacy Policy

Last updated: November 11, 2026. Effective: November 11, 2026.

Operator: Jinan Matrix Information Technology Co., Ltd. ("we", "us")

This policy explains how the Masterpiece iOS app (the "App") collects, uses, stores and protects your information. We follow data minimization: you can browse and purchase without an account; the App contains no advertising SDKs and no third-party analytics SDKs; we do not track you across apps or websites, and we do not sell your information. If this English version differs from the Chinese version, the Chinese version prevails.

1. Information We Collect

Anonymous install identifier (install_id): a random UUID generated on first launch and stored in your device Keychain. It is used to create an anonymous session, check access rights on our server and count your daily free quota. It is not the advertising identifier (IDFA), which we never access.
Session and device information: platform (iOS), app version, App Store environment (production/sandbox), and network logs such as IP address and request time, used for security, rate limiting and troubleshooting.
Account information (only if you sign in):
- Sign in with Apple: your Apple user identifier and the email you choose to share (possibly an Apple private relay address). We store Apple's refresh token encrypted so we can revoke it when you delete your account. We never receive your Apple ID password.
- Email code sign-in: your email address. Codes are stored only as hashes for 10 minutes; the requesting install_id and IP are recorded to prevent abuse.
- Linking and unlinking: associations between your Apple identity, verified email and App account, and whether Apple authorization needs renewal. These let different sign-in methods access the same account, verify unlinking and email changes, and prevent identities from being linked to the wrong account. Verification codes are stored as hashes and scoped to the relevant session and operation.
Purchase information: signed App Store transaction records (product, original transaction ID, purchase/expiry dates, refund status). Payment is handled by Apple; we never receive your card or payment details.
User content: favorites and daily free-quota claims (artwork and local date). Favorites stay on your device unless you sign in, after which they are synced.
Push information (only if you allow notifications): APNs device token, time zone, language, notification preferences, chosen daily reveal time and necessary delivery status, used for daily artwork and exhibition notifications, preventing duplicate delivery and handling invalid devices.

Recent searches and viewing positions stay on your device only.

2. Device Permissions

Add to Photos: requested only when you save an artwork; write-only, we cannot read your photo library.
Notifications: for the daily artwork reminder; can be turned off any time in Settings.

The App does not use location, contacts or microphone. Declining a permission does not affect other features.

3. How We Use Information

To provide browsing, viewing, commentary and the daily artwork, and to check access rights on our server;
To verify and restore subscriptions, legacy purchases and gifted benefits, and to process renewal and refund notifications from Apple;
To sign you in, sync favorites across devices, send sign-in code emails and daily notifications;
To keep the service secure, prevent abuse and fix problems.

We do not use your information for advertising or profiling.

4. Sharing and Service Providers

We do not sell or rent your personal information. We work only with:

Apple: Sign in with Apple, App Store purchases and transaction verification, and Apple Push Notification service, subject to Apple's privacy policy;
Tencent Cloud: servers, database, object storage and CDN for images, and its email service for sign-in codes.

Otherwise we disclose information only when required by law or by competent authorities.

5. Storage Location and Retention

Your information is stored on Tencent Cloud servers located in mainland China. If you use the App outside mainland China, your information is transferred to and processed in mainland China. We keep information only as long as necessary: account data until you delete your account; network logs for the shortest necessary period. After deletion, purchases are unlinked from the deleted account, but necessary transaction identifiers, Apple-signed transaction records, purchase and refund status, and gift claim and validity records are retained for verification, restoring purchases, accounting, refunds and preventing duplicate gifts. While Apple token revocation is pending, we may retain the encrypted token and processing status needed to complete it; the revocation record is deleted after successful revocation. Retained records do not restore deleted favorites or sign-in identities.

6. Security

All traffic uses HTTPS. Session tokens and sign-in codes are stored only as hashes; Apple refresh tokens are encrypted; access is strictly limited. No method of protection is completely secure.

7. Your Rights and Account Deletion

Access, linking and correction: manage Apple and email sign-in methods under Me → Account. Linked methods access the same App account. Unlinking or changing an email requires verification of the retained sign-in method and relevant credentials. You cannot remove the last sign-in method. Unlinking does not delete the account, favorites or purchase benefits, or transfer benefits to another account.
Stop using Sign in with Apple in Settings: removing Masterpiece under iOS Settings → Apple Account → Sign in with Apple (names may vary by iOS version) revokes Apple's authorization; it does not delete your App account or remove the Apple association within the App. On receiving Apple's revocation notification, we invalidate existing sessions and discard the revoked Apple refresh token, while retaining your account and Apple identity association so that reauthorization can recover the same account and benefits. A linked email can still sign in. In the App, choose to authorize Apple again, or verify your email to remove the Apple link. If Apple is your only sign-in method, first link an email before removing it.
Delete your account: use Me → Account → Delete Account; you do not need to cancel a subscription first. We delete your account, Apple and email sign-in identities, favorites, sessions and free-quota claims, unbind purchases and unlink push devices from the account. If we still hold an active Apple token, we request revocation and retry failures in the background. Signing in again with the same email or Apple identity creates a new account and cannot recover deleted account data. Deletion does not cancel subscriptions or automatically issue refunds; manage these separately through Apple. Restore Purchases with the App Store Apple Account used for the purchase can recover verified, still-valid subscriptions or unrefunded legacy purchases. It does not recover favorites, grant another Pro gift or restart an already-claimed gift period. See the Terms of Use.
Withdraw consent: turn off notifications or photo access in Settings, or sign out; your device then gets a new anonymous identity.

8. Children

The App is intended for a general audience and not directed to children under 14 (or the equivalent minimum age in your jurisdiction). We do not knowingly collect children's personal information. Parents who believe we have done so may contact us for deletion.

9. Changes

We may update this policy and will post the new version and date on this page; material changes will be notified in the App.

10. Contact Us

Email: askrsw@163.com. We will respond within 15 business days.