Privacy Policy

Updated October 26, 2026 ·Terms of Service

Banke (WeTime) is operated in China by Beijing Zaowu Yinli Technology Co., Ltd. (北京造物引力科技有限公司). The developer name on Google Play is PopoVerse. Privacy and support contact details appear below.

Information we process

Google sign-in provides an account identifier, name and email for authentication. Text, photos, videos, voice notes, places and memory dates you submit support shared memories with friends, family and partners. App visits and posting dates are used to calculate shared growth.

iOS: Sign in with Apple

When available, Sign in with Apple provides an app-specific account identifier and the name and email you authorize. You may use Apple’s private relay email. We do not receive your Apple password or automatically merge Apple and Google accounts based only on email. The server validates credentials and encrypts refresh tokens used to revoke authorization. Account deletion first revokes Apple authorization, then deletes the account and credentials. If revocation fails, the account remains and you are asked to retry.

iOS: App Store purchases and subscriptions

When enabled, Glow and membership purchases use Apple StoreKit. Apple handles payment details; we do not receive card numbers or payment passwords. We process product and transaction IDs, purchase dates, subscription expiry, refund status and a random account-linked purchase token to validate purchases, grant Glow, restore purchases and handle refunds. Orders, Glow ledgers and anonymous reconciliation tokens remain after account deletion. Deleting WeTime does not cancel App Store subscriptions; cancel renewals in Apple’s subscription settings.

Phone sign-in and payments in China

Banke uses phone sign-in independently of the international WeTime account, which uses Google sign-in. When phone sign-in is enabled, requesting a code sends the phone number and code to Volcengine SMS. The server stores a keyed phone-number digest, trailing digits and the login session, not the plain-text verification code. Codes expire in five minutes, are single-use and subject to request and attempt limits. Accounts are not merged by matching display names.

The China channel integrates the Alipay App payment SDK, invoked only when you choose Alipay. Alipay processes payment-related order, device and network information. We store amounts, transaction IDs and the Glow ledger, not bank passwords. SeeAlipay SDK privacy notice. If SMS or local payments are not enabled, the app states that the service is unavailable.

Usage and diagnostics

To understand product use and improve reliability, we record page names, visit times, app versions, platforms and deduplicated visitor identifiers. Signed-in visits use a hashed account identifier. These statistics exclude memory content, media, prompts, precise location and advertising identifiers. Structured visit details and diagnostics, including key actions, request durations, status codes and pseudonymous request identifiers, are retained for six calendar months; associated visit records are removed on account deletion. Operational, payment and cost reports are available only to designated administrators.

Request arrival, completion and interruption lifecycle logs use bounded rotation (up to three 8 MiB files), with at most 72 hours of lookback; rotation may overwrite older records sooner. They exclude raw request bodies, query parameters, tokens and IP addresses and are managed separately from the structured visit and diagnostic details above.

Terms: Data use and optional measurement

Optional analytics and ad measurement

The simplified privacy notice in version 1.0.76 (161) accepts the Terms and Privacy Policy only. Its ordinary “Agree” action does not grant new Google app analytics, Google ad measurement or TikTok install measurement permission. Previously undecided optional measurement stays off. Existing grants, refusals and withdrawals are preserved; valid grants may resume measurement subject to existing eligibility rules. Manage or withdraw them separately in Settings. Declining does not limit memories, AI or shared growth.

Supported Google Play builds include Google Analytics for Firebase, with collection off by default. You can separately allow app analytics and ad measurement, and withdraw in Me → Settings → Analytics and ad measurement. Declining does not restrict memories, AI or shared growth. With permission, Google may process app-instance identifiers, device and network information (including IP-derived approximate location), app version, acquisition source, page and feature usage, and purchase events. Ad measurement attributes installs and purchases. Analytics ad-personalization and Android advertising-ID collection remain disabled; rewarded-ad personalization is managed separately.

We do not send memory content, photos, AI prompts, precise location, email or WeTime account IDs to this analytics service. Google processes the data and may store it outside your region. SeeGoogle Privacy PolicyandFirebase data privacy information. Withdrawing stops future collection on this device and resets its local analytics identifier; historical aggregate data is not instantly erased. Contact support below for further requests.

Optional TikTok install measurement

Supported Google Play builds keep TikTok install measurement off until explicit permission. Version 1.0.76 (161) provides data details in the Terms and this Privacy Policy. Ordinary agreement does not grant new measurement permission to this optional SDK. It stays off until you make a choice in Settings. Previous independent choices are preserved, and valid grants may resume measurement subject to existing eligibility rules. Rewarded-ad choices are unchanged. Only eligible new installations with explicit permission during their first-use flow start the TikTok App Events SDK. Upgrades, later opt-ins, and account changes are not reported as new installs.

After permission, TikTok receives the first-launch install event and its time, app and SDK versions, an SDK-generated installation identifier, device model, operating-system version, language, screen size and density, network information including IP address and user agent, installer application, and available Google Play install-referrer information. These data help measure installs resulting from ads. An IP address may indicate approximate location. The SDK also requests necessary runtime configuration. This integration disables Android advertising-ID collection, enhanced data collection, automatic purchase, launch and next-day-retention events, and additional monitoring. We do not send WeTime account IDs, email, phone numbers, memories, photos, videos, AI prompts, or precise location.

Withdraw in Me → Settings → TikTok install measurement. Withdrawal stops further collection and sending, cancels cancellable requests, and clears unsent SDK data and local SDK identifiers. A local choice and install-deduplication record without account or advertising identifiers remains to prevent a repeat install. Data already delivered to TikTok cannot be recalled by a local switch. Contact the support address on this page for further requests. Failed cleanup stays disabled and can be retried.

TikTok may process data outside your region. See the TikTok Privacy Policy and TikTok Business Products Data Terms.

Optional rewarded ads

Supported Google Play builds let you choose to watch ads in World to earn Glow. Declining does not restrict existing memory features. Ads use Google AdMob / Google Mobile Ads SDK and User Messaging Platform (UMP); supported newer builds also integrate Pangle (TikTok Ad Network) through AdMob mediation. Watching an ad checks applicable regional privacy choices. You can reopen available choices through “Ad privacy options”.

Ad SDKs may process IP-derived approximate location, ad interactions and impressions, diagnostics, and device or account identifiers for advertising, measurement and fraud prevention. Android advertising-ID permission is disabled. In Google Play version 1.0.64 (149) and later, rewarded-ad personalization is enabled by default without a separate in-app opt-in; requests still follow Google UMP consent and applicable regional choices. Existing opt-outs remain and can be changed under “Ad personalization (optional)” in reward rules. Earlier builds request non-personalized ads by default, with optional personalization where supported. Applicable US opt-outs of sale, sharing or targeted advertising also pass to mediation partners. Declining or withdrawing does not prevent rewarded viewing. Allowing personalization does not guarantee personalized ads, and non-personalized ads still involve SDK processing. We record ad source, request consent mode, app version and impression revenue, not precise location. Reward parameters contain a random ticket, not memory content, photos, voice notes, precise location, email or account IDs. SeeGoogle Privacy PolicyandGoogle Ads SDK data disclosure、Pangle Privacy Policy。

We record hashed accounts, ad request/start/completion/close/failure events, and SDK-provided currency and revenue estimates. These details are retained for six calendar months and associated viewing records are removed on account deletion. Google-signature-verified reward transactions and Glow ledgers prevent duplicate rewards and support reconciliation under our ledger retention rules. Test ads and Glow are marked separately and earn no ad revenue.

Reports, feedback and security records

Reports and feedback submitted through Privacy & Help include the issue type, your description and issue location, account-linked identifier, case ID and handling history. Only you and authorized staff can view these; staff replies and review progress appear there, and submissions are not automatically public. Do not provide passwords, verification codes or full identity document numbers. Closed cases and handling records are cleared after six calendar months; open cases remain until closed. Account deletion removes your feedback content and handling records. If you cannot sign in, contact the support email below.

Posts, comments, chats, creation descriptions and AI text results pass server-side keyword review. Rejected content is not published or returned as a generation result, and a reason is displayed. Review records contain hashed account and content digests, category, outcome, rule version and time, not the original content; they are cleared after six calendar months. This text review is not comprehensive review of images, videos or audio.

Key API actions and staff handling are logged separately with hashed account identifiers, action type, time, status code and service domain, and cleared after six calendar months. These records exclude verification codes, login tokens, payment credentials, request bodies, full query parameters and device fingerprints. Staff access to feedback is also logged. Security records are separate from usage analytics and operational diagnostics, which likewise have six-month retention.

Reporting and blocking

Reports store the selected content ID, a text summary, reason, additional explanation, account-linked identifier and outcome, accessible only to the reporter and authorized staff. View case IDs and replies in Privacy & Help. Do not include passwords, verification codes or full identity numbers. Blocking hides each person’s community content when signed in and prevents new messages and calls in existing conversations; it does not delete shared memories or retract saved content. Unblock in report and block management. Account deletion removes your associated report content, handling records and block list.

Shared spaces and public community

Memories in a shared space are visible to its members by default. Question-locked content stays hidden until the other person answers correctly; authors can always view their own content. The server checks membership and media access. Only choosing “Share to community” makes the selected text, name, images, videos and published AI creations visible to community users, who may like, comment and remix the media. Do not publish another person’s private content.

You can withdraw your community post while keeping the original shared-space memory. Locking the original also stops community access. Withdrawal cannot recall content already saved, copied or remixed by others. We do not sell your private memories for advertising.

Device permissions

Photos and videos use the system picker. Voice recording and calls require microphone access; video calls also require camera access. Memory locations are entered manually. With permission, Together uses your location while in use to find nearby places; it does not track location in the background or read contacts. Revoke camera, microphone, location or notification access in system settings and continue using features that do not require it. See each provider’s notice for third-party device and network processing.

Service providers and AI

WeTime 的应用后端和私有存储使用海外 Railway 服务，登录由 Google 提供。Banke and WeTime have separate accounts, spaces and Glow balances; records are not merged or synchronized across products. Banke’s app registration is京ICP备2026064620号-2A。

When you use pet AI chat, your input, recent conversation and pet growth state go to Volcengine for a reply. Chat rewriting and interpretation send your selected draft, messages, context and selected message media to Volcengine. When transcription is enabled, selected audio and necessary user identifiers go to Volcengine speech recognition. Private rewrite, interpretation and transcription results are accessible only to the requester for 24 hours, and may expire earlier if messages are withdrawn or access changes. This does not mean provider logs or backups are deleted at the same time. Review AI responses before use; ordinary chat does not automatically trigger these private AI requests. Automatic memory organization is described below.

Calls in the background

During a call you initiate or accept, switching apps may continue using the microphone, enabled camera and network to maintain the call, with a call notification or system window. Return to mute, turn off the camera or hang up. Hanging up stops this call’s audio/video capture, connection and call service. No recording or camera use starts this way without an initiated or accepted call. Permissions or battery limits may interrupt background calls.

Messaging and audio/video calls

Messaging processes sent text, images, videos, audio, conversation members and delivery state for communication. When calls are enabled, Tencent Cloud TRTC SDK (Shenzhen Tencent Computer Systems Co., Ltd.) processes call media, room and user identifiers, and device model, OS, IP address, Wi-Fi state and other connection/diagnostic information. During video capture, the device accelerometer may locally adjust orientation. The server stores call state and duration. SeeTencent Cloud TRTC SDK privacy guide. Unconfigured or unavailable features are marked unavailable.

Nearby recommendations and product sources

Together uses your device location to calculate straight-line distances. Locations sent to the server are rounded to an area of about 1 km for nearby searches through Photon / OpenStreetMap; Wikipedia geographic data may be used if map services are unavailable. Precise coordinates are not saved to accounts, posts or location history, or shared with space members. Results are briefly cached by area.

Product information includes Taobao affiliate products and public merchant content; images may load from the source platform. Clicking promotional links opens platforms such as Taobao, which handle their own sign-in, orders, payments and privacy. Links include an affiliate placement identifier, and qualifying transactions may earn us a commission. Product-list requests do not send shared-space memories, chats or phone numbers to Taobao affiliates. Revoke location access at any time and continue browsing products and playing shared games.

Messages and system notifications

New memories and replies create in-app notifications. When system notifications are enabled internationally, a device push identifier is linked to your account and notifications use Google Firebase Cloud Messaging. OPPO push registers a device identifier only in supported China builds with the service enabled and after you turn notifications on. Providers process push/app identifiers and necessary device/network information. Pushes exclude memory text, photos, videos, audio and reply content. Turn off system notifications without losing in-app messages. Signing out or deleting your account removes the push association.

When iOS notifications are enabled, Expo and Apple APNs deliver them. The server stores session-linked device push identifiers and sends necessary notification types and navigation identifiers. System calls use PushKit / CallKit through APNs with call/conversation identifiers and information needed to display the call. TRTC carries call media, not push payloads. Device Keychain stores credentials for background answering and clears them on sign-out. Sign-out or account deletion stops server delivery to that session’s devices. Turning notifications off does not cancel subscriptions.

Retention and deletion

Records remain until you delete them or your account. Account deletion removes your login details, posts, attachments, replies, likes and activity, and leaves shared spaces. Other members’ posts remain; empty spaces are deleted. Database deletion is immediate; attachments enter a cleanup queue and access stops before physical removal. Payment orders, Glow ledgers and account digests preventing repeated trials remain to reconcile payments, refunds and purchased rights. Signing in again does not reissue claimed trial Glow. Rate limits store digest counters, not raw IPs, for up to two days. Infrastructure backups, logs and provider retention follow their respective policies; immediate erasure of every backup is not promised.

Request account and data deletion

Automatic AI organization and memory stickers

With automatic organization enabled, new shared photos, representative video frames, post text, places and dates go to Volcengine vision services to organize shared experiences. This setting is currently on by default. Only published content visible to both members is processed; phone galleries and unpublished drafts are not scanned. Turn it off in memory-book settings or remove an experience from the book. Older posts require separate selection and authorization. Creating memory stickers or AI images/videos sends selected reference media and instructions to the relevant Volcengine generation service. Tasks requiring Glow display usage for confirmation at the creation entry. Results appear privately in your creations or shared space unless you explicitly publish them to the community. Deleting source content stops access to its linked derivatives.

Contact and feedback

For privacy, data deletion or reports, contact 1554374411@qq.com。

This notice applies to current WeTime and Banke channel versions and will be updated when processing changes.