BuddhaSide Privacy Policy

1. Scope and Product Boundaries

This policy applies to the BuddhaSide iOS, Android, and corresponding Web apps. The current app supports personal practice records, offline scripture reading, meditation, prayers, and the storage of temple-service requests. It does not represent any temple's official services and does not promise real-world outcomes.

Meditation, recitation, reflection, and practice-statistics features are intended to support stress management, relaxation, and mental acuity for cultural learning and general wellness. BuddhaSide is not a medical device and does not diagnose, treat, cure, or prevent any medical condition. It does not replace medical or mental-health advice. For medical or mental-health concerns, consult a qualified healthcare professional.

Registration and sign-in are optional. Signed-out users can use the core practice features, with related records stored on the current device. iOS users can purchase, restore, and use an Apple subscription without creating or signing in to a BuddhaSide account. Only clearly identified account-specific features, such as cloud synchronization and cloud light offerings, require sign-in. Fo Xiaobao is available only to users who are at least 18 years old, are signed in, have completed the account-level age-18-or-over confirmation, are accessing the service from a then-current supported region, and meet either of these membership conditions: the account has a current Apple App Store or Google Play subscription that the server has verified and bound to it; or the publisher has formally granted the account a complimentary membership through the operations console that is currently active or lifetime and has not been revoked. A region selected in the account profile is not sufficient by itself. An ordinary free account, referral-reward days alone, channel-campaign reward days alone, a server-side trial, or a local client membership state does not satisfy Fo Xiaobao's membership condition. Fo Xiaobao is unavailable unless all general conditions and at least one membership condition are met. Answers may be wrong. The publisher has confirmed that offline publication authorization was obtained for the 41 knowledge-source items currently bound to Fo Xiaobao, and those items are used only within the applicable authorization scope. Citing or using a source does not imply endorsement by any author, teacher, religious organization, or temple.

2. Data Processed on Your Device

When you choose to use the relevant features, the app may store the following data in its local application container:

• Necessary on-device copies of account details, subscription status, and automatically synchronized data;
• On-device incense, practice, private prayer, assisted-practice, practitioner-level, and merit-ledger records used for display; after sign-in, applicable data may synchronize with the account;
• Fo Xiaobao question-and-answer text and a temporary session identifier for the current daily allowance period; this record is isolated by account and used only to let you view it after leaving. You can continue the original context only while the server's temporary session remains active. The record is not synchronized with your account;
• Your home-devotion selection; Bodhisattvas or temples you add yourself, their names, and related photos that you choose to capture or select from your photo library and that the app crops and compresses locally;
• The names, times, and enabled states of daily practice reminders you create; when an Apple Watch is paired, these settings and prayer-bead counts synchronize between your iPhone and Apple Watch through Apple's WatchConnectivity; and
• Local settings needed to maintain functionality, such as interface state and completion times.

Core app features are available without sign-in, and related practice data and your home-devotion selection remain on the current device while signed out. After you choose to sign in, applicable data listed in Section 3 and the home-devotion preference synchronize automatically with your account. The home-devotion preference includes a built-in target's internal target ID when applicable, or a null marker meaning “no built-in target” when you choose a personally added target, together with a revision number and updated-at timestamp. This data is used only to restore the selection across devices signed in to the same account. Bodhisattvas or temples you add yourself, their names and photos, and any other personal assets are intentionally limited to on-device storage and are not uploaded by this app to the publisher's cloud. You select a region in your account profile, and the app does not read GPS data or infer precise location. To determine whether Fo Xiaobao is available in a then-current supported region, the network edge also derives a two-letter country or region code from the request network address and sends a signed code to the account server for validation; this is not precise location. These region details may be disclosed in the store's Data safety section as approximate location data. Depending on your system settings, Apple or your device operating system may also include the app container in a full-device backup or migration. Those system services are controlled by the relevant platform provider.

3. Account and Cloud Processing

When you choose to register or sign in, the account server processes your email address, Dharma name or display name, region, email-verification status, account status, registration time, and most recent sign-in time. If you choose to confirm that you are at least 18 years old, the server also stores the confirmation version and confirmation time to control access to Fo Xiaobao; the app does not collect your date of birth or identity document for this confirmation. Your password is used only to create an irreversible salted hash; the server does not store plaintext passwords. The app stores only a revocable, time-limited session token on your device.

When an account that meets those membership conditions chooses to use Fo Xiaobao, the current question, recent conversation context, server-side role instructions, matched candidate knowledge summaries, and generated output are sent through the publisher's Fo Agent server to the Google Gemini API. The product shows no conversation-duration countdown and has no fixed three-minute conversation limit. The app stores question-and-answer text and a temporary session identifier on this device, isolated by account, for the current daily allowance period so you can view it after leaving. You can continue the original context only while the server's temporary session remains active. It automatically clears that record the next time the app runs or you open Fo Xiaobao after the allowance period ends, and does not synchronize it with your account. The publisher's server keeps question and answer text only in temporary memory. It clears that text after one hour without activity; each successfully delivered answer restarts the one-hour inactivity period, and ending the conversation clears it immediately. The server does not create a persistent transcript database. The service automatically records transcript-free session-start, successful-answer or safety-fallback, provider/model/prompt/knowledge version, retrieval route, candidate note identifiers and count, risk action, and closing-turn metadata. Only when you rate an answer does it also record Helpful or Needs improvement and the selected reason. These structured service records contain no free-text question or answer.

If you choose Sign in with Apple or Sign in with Google, the provider supplies a signed identity token to the app. The server verifies the token, audience, expiry, and random nonce, and processes the provider user identifier, provider-verified email, and any display name you consent to provide. An Apple email may be a private relay address. The server stores the provider-to-account link and does not receive your Apple or Google password. Email-and-password sign-in remains available.

Email verification and password recovery use random, single-use secure links. The server stores only a SHA-256 digest of each link token. Email-verification links are retained for no more than 24 hours, and password-recovery links for no more than 30 minutes. A link becomes invalid after it is used, expires, or is reissued. Resetting a password revokes the account's previous sign-in sessions.

After sign-in, as you use the relevant features, the app automatically synchronizes account details, subscription version, incense data, practice records, prayer data, assisted-practice requests, practitioner level and earned badges, and the merit ledger—including prayer-bead and sutra-copying counts and spending records—without requiring you to press a separate backup or synchronization control. This data is used to restore and merge records across your devices. After sign-in, the home-devotion preference also synchronizes. If you choose a built-in target, the server stores its internal target ID, revision number, and updated-at timestamp. If you choose a personally added target, the server stores only a null marker meaning “no built-in target,” together with the revision number and updated-at timestamp. The home-devotion preference is used only to restore the selection across devices signed in to the same account. The name, photo, and other assets of a personally added target are never uploaded and remain only on the current device. Unsaved drafts, passwords, and store credentials are also excluded from the practice snapshot. Concurrent changes use revision checks and merge by record identifier, date, and non-decreasing counters to reduce the risk of overwriting new records from another device.

Merit is an in-app practice-recording measure: each completed prayer-bead count and each copied sutra character records one merit point. Successfully saving one prayer records a spending entry of 108 merit points; successfully lighting one lamp records a spending entry of 1,000 merit points. Each Fo Xiaobao question that returns a successful, server-validated answer spends 108 merit points, with no more than 10 successful answers per account per UTC day. A timeout, service error, invalid answer, or other failure does not spend merit or count as a successful answer. The server uses an operation UUID to record reservation, completed deduction, or release idempotently. This persistent ledger contains account, operation ID, state, date, amount, and timestamps, but no question, answer, or conversation-context text. When the available balance is sufficient and a prayer is saved successfully, the app writes a fixed-type, fixed-amount spending entry and synchronizes it automatically with the practice snapshot; the cloud accepts only the defined spending types and canonical amounts. For a light offering, the server verifies available merit against the cloud practice snapshot and writes the 1,000-point spending entry in the same transaction that successfully reserves the light slot. A failed light offering or replay of the same idempotent request does not create a duplicate deduction. Merit is used only as an app feature record; it is not currency, a donation, proof of temple services, or an assessment of real-world spiritual merit, cannot be redeemed for cash, and does not promise any real-world outcome.

Apple subscription entitlement is associated with the user's Apple ID purchase state and does not require a BuddhaSide account. After you choose to sign in, account-specific membership synchronization information and light-offering records may be associated with your account. When the publisher grants a complimentary membership through the operations console, the server stores the grant identifier, recipient account, membership plan, start and expiry times or lifetime marker, current status, grant or termination reason, and request and operation audit fields needed to prevent duplicate operations. This data is used only to grant, verify, replace, expire, or revoke complimentary membership; control access to member features including Fo Xiaobao; handle customer-support disputes; and prevent duplicate operations or abuse. A complimentary membership creates no Apple or Google payment data and is deleted with the account-linked data when the account is deleted. Light pools are separated by the country or region selected in your account, with 20 concurrently active slots for each region and temple. Changing your region moves you to the new regional pool. A submitted name and prayer text are returned only to the record owner. Other users in the same region see only the fixed anonymous label “A fellow practitioner” and do not receive another person's submitted name or prayer text. The operations console can view synchronization status and de-identified summaries for account details, subscription, complimentary membership, incense, practice, prayer count, assisted-practice count, and level. It does not read passwords, session tokens, prayer text, assisted-practice text, or the names, photos, or other personal assets of personally added Bodhisattvas or temples.

To provide account, subscription, cloud light-offering, and customer-support management features, and to monitor service use, security, and reliability, the publisher may generate first-party aggregate operational metrics from account identifiers, subscription status, in-app feature actions, and necessary technical identifiers. These metrics are used only for app functionality, account management, fraud prevention, security, and aggregate analytics. They are not used for advertising, data sales, cross-app tracking, or advertising profiles. The operations console does not use prayer text for analytics.

When you claim, share, or enter a referral promo code before subscribing, the server processes the referral campaign and personal code, the referral relationship between the referrer and new subscriber, a code snapshot, redemption and eligibility status, the selected country or region, store-verification results, each party's reward days and validity period, and the manual-review status and necessary audit records triggered by a refund, revocation, or suspected abuse. This data is used only to verify campaign eligibility and successful-subscription counts, issue and maintain membership rewards, prevent duplicate claims or reciprocal abuse, resolve disputes, and support financial reconciliation and campaign reporting. It is not used for advertising, data sales, or cross-app tracking.

When you choose to purchase a subscription, the iOS app initiates the transaction with Apple StoreKit 2 and the Android app with Google Play Billing. iOS does not require you to create or sign in to a BuddhaSide account. The app submits a random UUID generated on the device to StoreKit; it does not contain a name, email address, or other registration information. While signed out, the app provides membership content directly from the current Apple-signed entitlement verified by StoreKit. After you choose to sign in, Apple-signed transaction and renewal JWS data matching the current account identifier may be sent to the Core API for optional account membership synchronization. The server does not retain raw JWS data; it retains only an irreversible SHA-256 digest and necessary transaction identifiers, product, environment, purchase, expiry and revocation times, and account association. Whether signed in or not, an Apple subscription can still be purchased, restored, and managed through the user's Apple ID and StoreKit. The Android app sends the purchase token returned by Google Play to the Core API for verification. The server stores the token encrypted with AES-256-GCM, together with an irreversible token hash, product and plan, order, subscription and acknowledgement state, start and expiry times, auto-renewal, trial or test markers, and verification time. Google Play real-time developer notifications (RTDN) cause the server to query Google again and update entitlements after renewals, cancellations, refunds, or other state changes. Apple or Google processes your store account, payment method, billing, refunds, and subscription transactions. This app does not read or store your card number, store-account password, or full payment details.

4. System Permissions

• Camera and photo library: Used only when you add a personal Bodhisattva or temple photo. The app opens the camera only after you choose “Take Photo,” and opens the system photo library only after you choose “Choose from Library.” Photos are processed locally, are not saved back to the system photo library by this app, and are not uploaded to the publisher.
• Notifications: Requested only when you add or enable a Practice Time, and used to show the reminder and play the system alert at the daily time you set. Based on your device and notification settings, Apple may forward the reminder to your paired Apple Watch and provide a wrist haptic.
• Background audio: Used only to continue meditation, scripture recitation, or devotional audio that you started when the device is locked or the app moves to the background.
• Permissions not used: The current version does not request access to the microphone, precise location, contacts, advertising tracking, or cross-app tracking.

You may revoke camera, photo-library, or notification access at any time in system settings. If you revoke access, the corresponding photo-capture, library-selection, or daily-reminder feature may become unavailable.

5. Network Access and Third-Party Services

Core content is included in the installation package. The app does not integrate advertising or third-party behavioral analytics SDKs. Registration, sign-in, automatic synchronization of necessary practice data, membership entitlements, and cloud-linked light offerings access the publisher-configured Core API. Apple or Google identity services are contacted only when you select the corresponding sign-in option and are governed by their respective privacy policies. Cloudflare Email Service sends email-verification and password-recovery messages on our behalf and may process the recipient address, sending domain, message content, sending time, and delivery or bounce status. Service credentials remain on the server and are not included in the app.

Fo Xiaobao calls the Google Gemini API through the publisher's server. That third-party artificial-intelligence service processes the current input, relevant conversation context, matched knowledge summaries, and generated output. The publisher limits service availability according to the configured service tier, the applicable third-party terms, and available regions, and disables optional project logging and dataset sharing that the publisher controls. Google may still process and retain inputs, context, and outputs for safety and abuse monitoring, and authorized personnel may review content flagged by its safety systems. Do not enter names, contact details, identity documents, health records, financial account details, or other information that identifies you or another person.

The current version does not provide SMS sign-in or SMS verification codes. Your device accesses an external website or system service only when you choose to open an external temple source, map, search, or similar link. The external provider may process your IP address, device information, or submitted search terms under its own policy.

Apple App Store, Google Play, StoreKit, Play Billing, operating-system services, full-device backups, and crash diagnostics are independently provided by the applicable platform and are not controlled by this app. You can view, change, or cancel a subscription through “Manage Subscription” in the app or through your system or store-account settings.

6. Retention, Deletion, and Your Controls

The on-device copy of Fo Xiaobao question-and-answer text is isolated by account and retained until the current daily allowance period ends; it is automatically cleared the next time the app runs or you open Fo Xiaobao after that period ends. It is not synchronized with your account and is also deleted when you sign out, delete your account, or clear local records. Text on the publisher's server exists only in temporary memory. The product shows no conversation-duration countdown and has no fixed three-minute conversation limit. Server text is cleared after one hour without activity; each successfully delivered answer restarts the one-hour inactivity period, ending the conversation clears it immediately, and after a network interruption it is cleared when the inactivity period expires. This action cannot delete data Google retains for safety and abuse monitoring. The publisher retains transcript-free structured service analytics and rating records for no more than 30 days, and configures necessary transcript-free platform access and error logs for no more than 30 days. The Fo Xiaobao merit ledger contains no question, answer, or conversation-context text and is retained with the account until account deletion.

• On-device practice, prayer, and assisted-practice records remain until you sign out, delete your account in the app, confirm deletion under “Me → Settings & Subscription → Privacy Policy,” or delete the app. “Clear Local Records” does not automatically delete the signed-in account's cloud data, which is restored under the automatic synchronization rules after you sign in again;
• You can separately delete or replace a personal Bodhisattva or temple photo under “Bodhisattvas & Temples”;
• You can choose a different home-screen Bodhisattva or temple under “Bodhisattvas & Temples.” After sign-in, the home-devotion preference is stored with your account and contains only a built-in target's internal target ID when applicable—or a null “no built-in target” marker—together with a revision number and updated-at timestamp. The names, photos, and other assets of personally added targets remain only on the device;
• Your account remains until you complete the two-step deletion confirmation under “Me → Settings & Subscription → Privacy Policy.” Account deletion removes the account, Apple or Google identity links, active sessions, synchronized practice data, the synchronized home-devotion preference, membership-entitlement association, and cloud light-offering records linked to that account, and automatically deletes on-device practice, prayer, and assisted-practice records;
• After account deletion, identifiers directly linking that account to referral-code, redemption, and reward ledgers are removed or set to null. De-identified code snapshots, campaign, redemption, reward, manual-review, and audit records may be retained to preserve rewards already received by the other participant, count successful subscriptions, reconcile financial records, prevent duplicate redemption or fraud, and handle refunds, abuse, and disputes. These records are not used for marketing, restoring the deleted account's rewards, or relinking that account;
• Deleting your app account or the app does not automatically cancel a store subscription. You must cancel it separately through subscription management in the Apple App Store or Google Play;
• Email-verification and password-recovery tokens become invalid after use, reissue, or expiration and are deleted with the account; and
• Account deletion removes Google Play purchase-token ciphertext, the account association, product, order and subscription state, and related RTDN records. Solely to prevent replay or relinking of a deleted account's purchase token, or restoration through a delayed RTDN retry, we retain only the irreversible SHA-256 purchase-token hash, deletion time, reason, and scheduled deletion time. It is not used to restore entitlements or for marketing. The hash is kept until the later of 90 days after account deletion or 60 days after the subscription expiry time, and is then removed; and
• Account deletion removes the Apple transaction's app-account association and app-account identifier, but retains a de-identified Apple transaction anti-replay marker: transaction identifiers, an irreversible SHA-256 hash of the signed payload, product, environment, and purchase, expiry, revocation, and signed-state times. The original JWS is not retained. While that marker remains within its retention period, verified renewal, expiry, refund, or revocation notifications received after deletion update only the marker and never grant an entitlement or relink an account. The marker is deleted by a monthly cleanup job 425 days after the latest of its most recent verified signed-state time and its recorded purchase, expiry, or revocation time, unless applicable law requires longer retention. It is not used for marketing or automatic entitlement restoration;
• An Apple subscription that remains active after account deletion is not automatically linked to a newly created app account. Contact support before deletion if you intend to keep using it. You may request manual review after deletion, but relinking cannot be guaranteed; and
• Deleting the app removes its local application container. Copies in system backups are handled according to your platform backup settings and the platform's policies.

When you sign out or delete your account in the app, on-device practice, prayer, and assisted-practice records are deleted automatically. Account deletion also removes the synchronized home-devotion preference from the account, including its internal target ID or null marker, revision number, and updated-at timestamp. Your Dharma name, region, on-device home-devotion selection, and the names, photos, and other assets of personally added targets remain on the current device.

7. Security and Children's Privacy

The app applies length, type, and capacity limits to local input. The account service uses salted password hashes, rate limiting, email verification, single-use tokens, revocable sessions, and HTTPS transport. No storage or transmission method can guarantee absolute security. Please protect your device passcode, email account, and app-account password.

The app is not directed specifically to children and does not knowingly collect children's personal data. Except for Fo Xiaobao, if a guardian permits a minor to use other features, the guardian should review the content and system permissions together with the minor. Fo Xiaobao is expressly limited to users who are at least 18 years old; users must actively confirm age eligibility on their account, and anyone under 18 must not use it.

8. Changes and Contact

The operator and publisher of this app is NOVASHOT SPORTS TECHNOLOGY LIMITED. If a feature or data-processing practice changes materially, the publisher will update the policy version and effective date and, when appropriate, provide an in-app notice.

For questions about privacy or data controls, email support@buddhaside.com. The publisher will continue to provide a public HTTPS version of this policy and a valid support channel on the Apple App Store and Google Play product pages.