Privacy · 隐私政策
Privacy
Last updated 2026-08-18 · 中文
The short version. We keep what a coupon needs to exist and reach the person you sent it to — nothing else.
What you write on a coupon never goes into analytics. Not the title, not the note, not your handwriting. That is enforced in our server code by a strict property allowlist, not by a promise to be careful.
No advertising SDKs. No cross-app tracking. Nothing sold to anyone.
What we store, and why
When you sign in
- An Apple account identifier. Sign in with Apple is the only way in. Apple gives us a stable identifier for you; it is meaningless outside this service.
- An email address from Apple — usually Apple’s private relay address, unless you chose to share your real one. We do not send email today. It is stored because Apple supplies it at sign-in.
- Your name, only if you allow it. Apple offers it once, at first authorization, and you can decline. If we have it, it appears on the coupons you send, as “a promise from ___”. If we don’t, the wording simply changes.
- A token from Apple that lets us revoke your sign-in when you delete your account — that revocation is required, and this is what makes it possible.
- A session token for your device, valid 90 days, so you are not asked to sign in every few minutes.
When you make a coupon
- The words you wrote (title and note), the handwritten signature you drew, which template and language you picked, and the times it was created and redeemed.
- The coupon image we render from all of that, stored so the link keeps working.
- A link key and an 8-character code — the two ways a coupon can be opened.
- The handwriting is uploaded the moment you finish drawing it, so it is stored even if you then abandon the coupon — but abandoned handwriting that never became part of a coupon is deleted automatically after 7 days. Handwriting on a finished coupon stays as long as the coupon does.
When you turn on notifications
- A device token from Apple, so we can tell you the moment your coupon is redeemed. Turn notifications off and we delete it on your next sign-out; deleting your account deletes it immediately.
- On devices that support it, a second Apple token that lets a redemption raise a live card on your lock screen. Deleting your account deletes it immediately; a token Apple reports dead is dropped on the spot.
When you reply to a redeemed coupon
- Which reply you picked and, if you wrote your own, the sentence you wrote, plus when you sent it. It is shown to the person who redeemed the coupon — that is its whole purpose. Like the coupon text, it never goes into analytics; only which kind of reply it was does.
When someone opens a coupon link
- No account is needed to open or redeem a coupon — that is deliberate.
- We set one cookie,
sid, holding a random identifier (HttpOnly, one year). It exists so we can tell that “opened → redeemed → kept in an album” was one person rather than three, which is the only way we can tell whether the product works. That identifier is sent to PostHog as the label on those events, and if you later claim the coupon into an account, we tell PostHog that the two are the same person. It is never used for advertising, and never sold.
Counters
- Short-lived per-user counts of preview renders and analytics events, purely to stop one client from burning the service down.
The line we do not cross
The text of a coupon — its title, its note, the handwriting — is never sent to analytics. Analytics events carry only which template was used, which language, and similar labels. Our server drops every other property before anything is sent, and refuses values that don’t look like our own short identifiers.
To be exact about the other direction: what you write is printed onto the coupon itself, and both the coupon page and its image can be read by anyone holding the link — see “Who can see a coupon” below.
We also do not use any advertising or attribution SDK, which is why the app never shows you a tracking permission prompt.
Who else handles it
- Apple — sign-in, and delivery of notifications.
- Cloudflare — hosting, the database, and image storage.
- PostHog — product analytics, subject to the line above.
Our database and images are placed in Cloudflare’s Asia-Pacific region — we ask for Singapore specifically, though Cloudflare treats that as a placement hint rather than a guarantee. Analytics events go to PostHog’s United States cloud.
Who can see a coupon
Anyone holding the link can open and redeem it, and the coupon image itself is served without a login so it can appear in a chat preview. That is how a coupon works — treat the link the way you would treat the coupon. Coupons are not listed anywhere public, and are not searchable.
How long we keep it
Coupons do not expire; a redeemed one stays as a keepsake for both people. If you delete your account:
- Your account is anonymized — the Apple identifier is scrambled beyond lookup, your email and your name are erased, and your sessions and push tokens (both kinds) are deleted.
- We ask Apple to revoke the sign-in. The token that lets us do that leaves your account immediately; if Apple cannot be reached right then, a copy waits in a retry queue — detached from your account — until the revocation goes through, and is deleted at that point.
- Coupons you already sent stay with the person you sent them to. They were a gift; taking them back by deleting your account would be the wrong default. They no longer carry your name.
- Coupons you had claimed into your own album lose their link to you. They are not deleted — whoever holds the link can still open them, and can claim them again with a new account.
- Coupon images and handwriting files stay in storage, because the coupons themselves stay.
Your choices
- Delete your account from Settings in the app, at any time, without asking us.
- Turn notifications off in iOS Settings.
- Skip the handwriting step — it is optional.
Children
Sweet IOU is made for couples and is not directed at children.
Changes
If this policy changes in a way that matters, we will change the date at the top and say so in the app.
Contact
Questions? Write to yyneo01@gmail.com.
隐私政策（中文）
最后更新 2026-08-18
一句话版。我们只保存「让一张券成立、并送到对方手里」所必需的东西。
你写在券上的话，永远不会进入埋点。标题、寄语、手写签名，一个字都不会。这不是靠我们小心，是服务端一份严格的字段白名单在机器层面兜住的。
不接任何广告 SDK，不做跨应用追踪，不把数据卖给任何人。
我们存了什么，为什么
你登录时
- 一个 Apple 账号标识。「使用 Apple 登录」是唯一的登录方式；这个标识离开本服务没有任何意义。
- Apple 给的邮箱地址——通常是 Apple 的私有转发地址，除非你选择了共享真实邮箱。我们目前不发任何邮件，存着只是因为 Apple 在登录时给了它。
- 你的名字，只在你同意时。Apple 只在首次授权时给一次，而且你可以拒绝。有名字时，它会出现在你送出的券上（「a promise from ___」）；没有就换一种说法，不会替你编一个。
- 一枚来自 Apple 的令牌，用于在你注销时撤销这次登录授权——那一步是必须做的，靠的就是它。
- 一枚会话令牌，90 天有效，免得你每隔几分钟就要重新登录一次。
你做一张券时
- 你写的字（标题与寄语）、你画的手写签名、选的模板与语言、以及做出来和被兑现的时间。
- 据此渲染出的券面图，存起来是为了那条链接一直能打开。
- 一个链接钥匙和一个 8 位短码——一张券只有这两种打开方式。
- 手写在你画完的那一刻就上传了，所以即使你随后放弃了这张券，它也会先存下来——但没有做成券的手写会在 7 天后自动删除。做成了券的手写随券保留。
你打开通知时
- 一枚 Apple 的设备令牌，好在你的券被兑现的那一刻告诉你。关掉通知后它会在你下次登出时删除；注销账号会立刻删除。
- 在支持的设备上，还有第二枚 Apple 令牌，用来让一次兑现在你的锁屏上立起一张实时卡片。注销账号会立刻删除它；Apple 报告已失效的令牌当场丢弃。
你回应一张被兑现的券时
- 你选了哪种回应；如果你自己写了一句，还有你写的那句话和发出的时间。它会展示给兑券的那个人——这就是它存在的全部意义。和券上的文案一样，它不会进入埋点，只有「哪一类回应」会。
有人打开一条券链接时
- 不需要账号就能打开和兑换——这是刻意的。
- 我们只种一枚 cookie（
sid，一个随机标识，HttpOnly，一年）。它的用处是让我们知道「打开 → 兑换 → 收进册子」是同一个人而不是三个人——那是我们判断这个产品成不成立的唯一办法。这个标识会作为事件的身份发给 PostHog；你之后若把这张券认领进账号，我们会告诉 PostHog 这两个身份是同一个人。它不用于广告，也不出售。
计数
- 按用户记的预览次数与埋点次数，短期保留，只为防止某个客户端把服务打垮。
我们不越的那条线
券上的内容——标题、寄语、手写——永远不会进入埋点。埋点事件只带「用了哪个模板」「哪种语言」这类标签。服务端在发出之前会丢掉其余所有字段，并拒收长得不像我们自己签发的短标识的值。
另一个方向也说清楚：你写的字会印在券面上，而券页与券图对拿到链接的人是可读的——见下面「谁能看到一张券」。
我们也不接任何广告或归因 SDK——这也是这个 App 从不向你弹追踪授权框的原因。
还有谁经手
- Apple——登录，以及通知的投递。
- Cloudflare——托管、数据库与图片存储。
- PostHog——产品埋点，受上面那条线约束。
数据库与图片放在 Cloudflare 的亚太区域——我们明确指定了新加坡，但 Cloudflare 把它当作放置建议而不是保证。埋点事件发往 PostHog 的美国云。
谁能看到一张券
拿到链接的人就能打开并兑换它，券面图本身也不需要登录即可取到（这样它才能在聊天里显示成一张大图）。券本来就是这么用的——请把那条链接当成券本身来对待。券不会出现在任何公开列表里，也搜不到。
保存多久
券不会过期；兑现过的券会作为纪念留给双方。如果你注销账号：
- 账号会被匿名化——Apple 标识被打散到不可反查，邮箱与名字清空，所有会话与两类推送令牌删除。
- 我们会请求 Apple 撤销这次登录授权。用于撤销的那枚令牌会立刻从你的账号上抹掉；万一当时联系不上 Apple，会有一份副本留在重试队列里（已与你的账号脱钩），撤销成功后删除。
- 你已经送出的券，留在对方那里。那是一份礼物，用「注销」把它收回去是错的默认值。它们不再带着你的名字。
- 你曾认领进自己册子的券会与你解除关联。券本身不会被删除——持有链接的人仍然打得开，也可以用新账号重新认领。
- 券面图与手写文件会留在存储里，因为券本身留着。
你的选择
- 随时在 App 的设置页里注销账号，不用问我们。
- 在 iOS 设置里关掉通知。
- 跳过手写这一步——它是可选的。
儿童
Sweet IOU 面向情侣，不面向儿童。
变更
本政策若发生实质变化，我们会更新顶部的日期，并在 App 内说明。
联系
有问题请写信到 yyneo01@gmail.com。