This list sets out, item by item, the personal information KelvinAI collects: what it is, what it is for and how long it is kept. It is part of the Privacy Policy; which providers receive information is in Third-Party Sharing.
Content kept only on your own devices and never uploaded to the server (for example AI conversations and files on your computer, and local settings) is not listed here.
Account and sign-in
Account
What we collect
Username and a salted hash of your password (never the plaintext password)
What it's for
Signing in and recognising your account
How long we keep it
Until you delete your account
Phone number
What we collect
The phone number linked to your account; for a sub-account, the record of verifying with the member's own number
What it's for
Under Chinese regulations, users in mainland China need a linked phone number before using AI or sending messages; signing in with a code and resetting your password
How long we keep it
While it is linked; deleted when you change or unlink it or delete your account
SMS verification codes
What we collect
The receiving phone number, the code (stored encrypted) and delivery status
What it's for
Confirming the number is really yours
How long we keep it
Deleted within 24 hours
Anti-abuse counters
What we collect
Counts per IP address and per phone number (stored only as a digest that cannot be reversed)
What it's for
Stopping bulk code requests and repeated code guessing
How long we keep it
Per-IP counts after about an hour, per-number counts within 24 hours
Recent verification
What we collect
This sign-in's session id, how you verified (for example a phone code) and when
What it's for
Lets you set a new password without the old one right after signing in again with a code
How long we keep it
Deleted after 10 minutes
Google account (optional)
What we collect
Google user id and verified email
What it's for
Recognising your account when you sign in with Google
How long we keep it
The user id until you unlink Google or delete your account; the email until you delete your account
Apple account (optional, iOS / iPadOS)
What we collect
The user identifier Apple assigns to this app and the authorization token Apple returns (stored encrypted); never your name or email
What it's for
Recognising your account when you use Sign in with Apple; asking Apple to revoke the authorization when you delete your account or unlink Apple
How long we keep it
The identifier until you unlink Apple or delete your account; the token is deleted once Apple has revoked the authorization
Consent and the rules for your account
Consent records
What we collect
Which policy version you agreed to, when, where (for example the sign-up or sign-in page), which rules applied and the kind of device; a choice not to agree to a new version yet
What it's for
Recording which version you agreed to
How long we keep it
Until you delete your account
Visitor region
What we collect
Whether your IP address is in mainland China or elsewhere, looked up in an offline IP database on our own servers (DB-IP)
What it's for
Deciding which sign-in methods the sign-in page shows, which models are available and whether generated images and videos get the “AI生成” (AI-generated) mark
How long we keep it
Used for that one decision only; IP addresses are generally not stored
Rules for your account
What we collect
Mainland China or elsewhere, plus what it was based on and when
What it's for
Deciding whether the account needs a linked phone number
How long we keep it
Until you delete your account
Device time zone and App Store region
What we collect
Your device's time zone, sent by the app when you sign in, sign up, link a phone number or refresh your account details; on iPhone / iPad, the country or region of your App Store; the kind of device
What it's for
Helping decide the rules and sign-in options: they only ever make the result mainland China, never elsewhere
How long we keep it
Not stored after use; the kind of device is kept only in consent records
Dates of mainland China visits
What we collect
For accounts under the rules for elsewhere, the dates of visits from a mainland China IP address (dates only, no IP address)
What it's for
Moving the account to the mainland China rules once there are 7 such days within 30 days
How long we keep it
Deleted after 35 days
Account security records
What we collect
The time and type of actions such as deciding the rules, linking / changing / unlinking a phone number, agreeing or not yet agreeing to the policies, linking or unlinking a third-party sign-in and changing your password; phone numbers only masked plus a digest that cannot be reversed
What it's for
Keeping your account secure and keeping records as the law requires
How long we keep it
Until you delete your account; then switched to an anonymous code that can't be traced back to you and kept for at most 180 more days
Profile and devices
Profile
What we collect
The nickname, avatar, gender, region and bio you choose to fill in
What it's for
Letting contacts and group members recognise you
How long we keep it
Until you change it or delete your account
Devices
What we collect
Names, platforms and last-seen times of the phones and computers you sign in on
What it's for
Letting your phone find your computer and keeping your devices in sync
How long we keep it
Deleted when you delete your account
Push token (iPhone / iPad)
What we collect
The push token the system assigns when you turn on new-message notifications
What it's for
Sending you new-message notifications
How long we keep it
Deleted when you delete your account
When you use features
Mail account configuration and credentials
What we collect
Mailbox address, label, provider, account icon, encrypted app password or OAuth tokens, and browser-authorization session state
What it's for
Syncing mail configuration across devices; the relay handles browser authorization and decrypts OAuth tokens for renewal or supported revocation, while devices connect to mail independently
How long we keep it
Configuration and credentials until mailbox removal or account deletion; removal clears fields but keeps a sync deletion marker until account deletion. Authorization sessions expire after 10 minutes; completion clears the temporary token envelope, with remaining state removed during service cleanup or account deletion
Chats and collaboration
What we collect
Private and group messages (text, images, files, voice, location), contacts and groups, Moments posts and comments, cloud-drive files, cloud docs and tables, and your organisation's (OA) approvals, notices, attendance and payslips
What it's for
Delivering them to other people and syncing across your devices
How long we keep it
Chat messages deleted after 90 days, chat files after 120 days; for the rest see "How long we keep it" in the Privacy Policy
Location
What we collect
Coordinates and search terms when you share a location or look up places, routes or weather; your location and on-site photos for field attendance check-ins
What it's for
Location messages, place lookups and organisation attendance
How long we keep it
A location you send is kept with the message or attendance record it belongs to
Voice
What we collect
Audio and text for voice input, voice calls with AI colleagues and read-aloud
What it's for
Turning speech into text and text into speech
How long we keep it
The server keeps no recordings or call transcripts
Mail content sent to AI
What we collect
Mail or attachments you send to AI, or relevant content and tool results from mailbox work and automatic tasks you request; adding a mailbox or reading mail does not by itself send it to AI
What it's for
Processing by the model you select under your instructions or configured tasks; separate from mail-account configuration sync
How long we keep it
Follows the relevant AI conversation, cloud task or sharing feature; local mail indexes, drafts and outgoing content and provider-held mail remain in their respective locations, and configuration removal does not delete provider-held mail
Official-model conversations
What we collect
The messages, images, files and tool results you send to the AI
What it's for
Passing them to the model provider for an answer
How long we keep it
The server records usage only, not the text; only when investigating a rare "context too long" failure is that one request kept, for at most 48 hours
AI feature records
What we collect
AI colleagues' replies in group chats; Cloud Muse's workspace, conversations and generated files, and the domain, port, traffic and duration when it goes online; conversations you share; for calls the AI places for you, the number, the callee's name, the task and the text record of the call; web reports you publish with Report Hub and what visitors submit on them
What it's for
Providing these features; preventing abuse of Cloud Muse's network access
How long we keep it
AI colleagues' replies follow group messages (90 days); call records after 90 days and Cloud Muse network records after 180 days; the rest until you delete it or your account
Usage and top-ups
What we collect
For each use of an official model, the model name, token counts and credits spent; top-up records (credits, amount, currency, part of the order number)
What it's for
Billing and accounting
How long we keep it
Per-model usage statistics for about 70 days; top-up records until you delete your account, with Apple purchase transaction ids kept for accounting
Feedback
What we collect
What you write in the desktop app's Feedback, screenshots, and diagnostic logs if you choose to attach them (keys, tokens and similar are removed before sending)
What it's for
Investigating and fixing problems
How long we keep it
Deleted when you delete your account
Content-review records
What we collect
For public profile details (nickname, avatar, bio, group name and so on), the check result, category and the first few words
What it's for
Checking public information others can see before it is shown
How long we keep it
Deleted after 180 days
Device permissions
Requested from the system only when you use the feature that needs them; you can turn them off at any time in your system settings.
Location
What we collect
Your phone's current location
What it's for
Sharing a location, finding nearby places and field attendance; on Android, obtained through the AMap location component
How long we keep it
Not stored on its own; a location you send is kept with its message or attendance record
Microphone
What we collect
What you say
What it's for
Voice input, voice messages and voice calls
How long we keep it
Voice messages are kept as chat messages; no recordings are kept for voice input or calls
Camera
What we collect
Photos or videos you take
What it's for
Taking photos to send and for field attendance
How long we keep it
Kept with the message or record you send
Photos
What we collect
The images and videos you pick
What it's for
Picking images and videos to send; saving images and videos to your photo library
How long we keep it
Only what you pick is uploaded, and it is kept with the message
Installed apps (Android only)
What we collect
Names, package names and icons of the apps installed on your phone
What it's for
Listing them for you to choose from when you pick "App" under "+" in a chat to send an installer
How long we keep it
Read on the phone only and never uploaded; only the installer you pick is uploaded