Privacy Policy

Last updated: August 28, 2026

DiShu ("we," "our," or "the app") is operated by Siyu Zhang as an individual developer. We are the data controller for personal information processed through the app. This policy explains what data we collect, why, how we use and share it, and the rights you have.

If you have questions, contact us at support@dishu.link.

1. Information We Collect

Account information

• Authentication identifier. When you sign in with Apple or Google, we receive a unique identifier we use to recognize your account on return visits. We do not receive or store your Apple ID or Google account password.
• Email address. If you choose to share your email when signing in, we store it. If you sign in with Apple and choose to hide your email, we receive only Apple's private relay address (an address ending in @privaterelay.appleid.com). We do not attempt to identify your real email through the relay.
• Profile information. Your chosen display name (nickname) and optional avatar photo.

Location data

• Precise location. The app uses your device's GPS to show nearby notes and to let you place new ones. Location is sent to our server when you actively use the app to search for or create notes. We do not track your location in the background.

User-generated content

• Notes. The text content you create and the geographic coordinates where you placed each note.
• Reports and blocks. When you report content or block another user, we store that action and link it to your account so we can enforce community rules.

Technical and security data

• IP address and basic request metadata. Our servers automatically log IP addresses and request metadata (timestamps, request types) for security, abuse prevention, and basic operation. These logs are retained for a limited period and are not used for advertising or profiling.
• Authentication tokens. Short-lived access tokens and refresh tokens are issued to your device after sign-in to keep you logged in. Tokens are stored on your device in the iOS Keychain and presented to our server with each request.
• Crash and diagnostic data. If the app encounters an error, we may receive a basic crash report (no personal content). We do not currently use any third-party analytics SDK; if that changes, we will update this policy and the App Store privacy labels.

2. How We Use Your Information

• To authenticate your account and maintain your session
• To display your profile (nickname, avatar) to other users
• To show notes near your current location
• To place your notes at the correct geographic position
• To enforce our community guidelines (processing reports and blocks)
• To detect and prevent fraud, abuse, and security incidents
• To respond to support requests and user inquiries
• To comply with legal obligations and respond to valid legal requests

We do not use your information for advertising, profiling, or training machine-learning models for unrelated purposes.

3. Legal Bases for Processing (EU/EEA/UK Users)

If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases under the GDPR / UK GDPR:

• Performance of a contract (Article 6(1)(b)) — to provide the Service you have signed up for, including authenticating you, showing nearby notes, and saving content you create.
• Legitimate interests (Article 6(1)(f)) — for security, fraud and abuse prevention, enforcement of community rules, and basic server logging. We have considered the impact on you and believe these uses do not override your rights.
• Legal obligation (Article 6(1)(c)) — to respond to legally binding requests and to comply with applicable law.
• Consent (Article 6(1)(a)) — where we explicitly ask for it (for example, location permission via the operating system).

4. Data Storage, Location, and Security

• Account, content, and report data is stored on managed cloud database infrastructure.
• Avatar images are stored using a third-party cloud object-storage provider with global infrastructure.
• Authentication tokens are stored on your device using the iOS Keychain.
• All communication between the app and our servers is encrypted in transit (TLS).
• Database backups may retain copies of your data for a limited period after deletion before being overwritten in the normal backup rotation.
• If you are in the EU/EEA or UK, your data may be processed outside that region. We work to apply appropriate safeguards (such as Standard Contractual Clauses or equivalent mechanisms) for international transfers.

5. Data Sharing

We do not sell, rent, or share your personal information with third parties for advertising, profiling, or any commercial purpose. We do not use third-party analytics or advertising services.

We share information only with:

• Apple and Google — for sign-in authentication. Their privacy policies apply to those services. See Apple's privacy policy and Google's privacy policy.
• Cloud object-storage and content-delivery provider — for storage and delivery of avatar images.
• Cloud database / hosting provider — who hosts our backend infrastructure under our instructions.
• Other users of the app — see Section 6.

Legal disclosure. We may disclose information when we reasonably believe it is required by law, by valid legal process, or to protect the rights, safety, or property of our users, the public, or us.

Business transfers. If we transfer the app or its underlying business to another party, your information may be transferred as part of that change, subject to this policy or an updated policy of equivalent protection.

6. Your Content and Other Users

Notes you create are visible to other users near the location where you placed them. Your display name and avatar are shown alongside your content. By posting content, you accept that it will be publicly visible within the app at a location precision of approximately 65 meters.

If you block another user, their content will be hidden from you and your content will be hidden from them.

7. Data Retention and Deletion

• While your account is active. We keep account, content, and related operational data as long as your account exists.
• When you delete your account (Settings → Delete Account):
  • Your profile information (nickname, email, avatar) is permanently removed from our servers.
  • Authentication tokens, sessions, sign-in provider records, the reports you filed, and the blocks you created are deleted.
  • Notes you posted are reattributed to a generic "Deleted User" identifier so they remain visible at their location but are no longer linked to your identity.
  • Backups containing the deleted data may persist for a limited period before being overwritten in the normal backup rotation.
• If you wish to permanently remove specific notes before deleting your account, please remove them first from within the app or contact us.
• Server logs (IP addresses, request metadata) are retained for a limited period and are not linked to deleted accounts after that.

8. Your Rights

Everyone

• You can access, edit, or delete your profile information at any time from within the app (Settings).
• You can delete your account at any time, which removes the personal information described in Section 7.
• You can contact us at support@dishu.link for any privacy question.

EU / EEA / UK users (GDPR / UK GDPR)

If you are in the EU, EEA, or UK, you have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — ask us to delete your data ("right to be forgotten"), subject to limits where we have a legal basis to keep it.
• Restriction — ask us to limit processing in certain circumstances.
• Objection — object to processing based on legitimate interests.
• Portability — receive your data in a structured, machine-readable format and ask us to transfer it to another service where technically feasible.
• Withdraw consent — where we rely on consent, you can withdraw it at any time without affecting prior processing.
• Lodge a complaint with your local data-protection supervisory authority. We encourage you to reach out to us first so we can try to resolve the matter directly.

To exercise these rights, contact us at support@dishu.link. We may need to verify your identity before responding.

California residents (CCPA / CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act, as amended by the CPRA:

• Right to know the categories of personal information we collect, the purposes for which we use it, and the categories of third parties we share it with (described in Sections 1, 2, and 5).
• Right to delete personal information we have collected about you, subject to legal exceptions.
• Right to correct inaccurate personal information.
• Right to opt out of "sale" or "sharing" of your personal information. We do not sell or share your personal information as those terms are defined in the CCPA, so there is nothing to opt out of.
• Right to limit use of sensitive personal information. We do not use sensitive personal information for purposes that would require this opt-out.
• Right to non-discrimination for exercising any of these rights.

The categories of personal information we collect, in CCPA terms, include identifiers (account ID, email, IP address), internet or network activity (request metadata), geolocation data, and user-generated content. To exercise your rights, contact us at support@dishu.link.

9. Children's Privacy

DiShu is not intended for children under 13, or under the higher minimum age that applies in your country (for example, 14, 15, or 16 in parts of the European Union). We do not knowingly collect personal information from anyone under the applicable minimum age. If we learn we have collected data from such a user, we will delete it promptly. If you believe a child has provided us with personal information, please contact us at support@dishu.link.

10. International Users

Our infrastructure may be located outside your country of residence. By using the app, you understand that your information will be transferred to and processed in those locations. Where required, we work to apply appropriate safeguards (such as Standard Contractual Clauses) for transfers from the EU/EEA, UK, or other regulated jurisdictions.

11. Changes to This Policy

We may update this privacy policy from time to time. The "Last updated" date at the top reflects the most recent revision. For material changes that affect your rights, we will provide reasonable notice within the app or by email before the changes take effect. Continued use of the app after the changes take effect constitutes acceptance of the updated policy.

12. Contact Us

If you have questions about this privacy policy or your data, or wish to exercise any of the rights described above, contact us at:

support@dishu.link