Privacy Policy

1. Scope and drafting baseline

This Privacy Policy applies to the Zinuto desktop software, the related account services, subscription and entitlement services, and the identity, email verification, payment recovery, and support processes directly connected to those functions, all provided by Qingchuang Juejin (Qingdao) Information Technology Co., Ltd. (“we”, “us”, or “our”).

This policy is drafted based on the product implementation that exists as of April 4, 2026. It describes only processing activities that are actually implemented and actually enabled at this time. Reserved fields, placeholders, roadmap items, or possible future functionality are not treated as current facts. If the product, distribution channels, or third-party dependencies change, this policy may be updated accordingly.

Zinuto is a desktop-first trading training and replay application. Its purpose is to let users train, replay, journal, analyze, and experiment with indicators locally using historical or imported market data. It is not a live trading terminal that connects to a real brokerage account to place real market orders.

2. Overview of the data handling model

Zinuto uses a local-first, account-in-the-cloud model:

• Local storage by default: training records, challenge records, Replay Notes, user-imported data, custom indicator scripts, chart context, and most application preferences are stored 100% on the user’s device and are not automatically uploaded to the cloud
• Minimum necessary cloud storage: only account identity, subscription or entitlement data, and billing audit records are stored in the cloud
• Optional cloud storage: market settings snapshots are uploaded only if the user explicitly enables that capability

3. Cloud data storage

All cloud data is stored on Alibaba Cloud servers located in mainland China. No cross-border cloud transfer is performed by default. We store only the following categories of necessary information:

We explicitly do not store the following in the cloud by default: training records, simulated orders, position data, cash-flow records, Replay Notes, custom indicator scripts, imported market data, trading preferences, personal contact information other than the registered email address, geolocation data, or device hardware fingerprints.

4. Information we process

4.1 Account and identity verification information

If you register, sign in, verify an email address, reset a password, or use Google / Apple sign-in, we process only the information that is directly necessary for those flows:

• email address, unique account identifier, and display name
• Google / Apple account identifier used for sign-in
• verification status and account creation / update timestamps
• local session caches needed to preserve the sign-in flow

Important note: we do not collect, store, or use your Google / Apple password, payment details, contacts, photos, geolocation, or any other non-essential personal information from those providers. We cannot access your credentials on the third-party platform, and we do not use the sign-in data for any purpose outside the scope described here.

4.2 Subscription, entitlements, and billing

If you use account-based entitlements or purchase a subscription through a supported distribution channel, we process only the minimum information needed to evaluate entitlement status and maintain billing records:

• subscription plan code, status, effective time, and expiration time
• auto-renewal status and transaction identifiers
• billing event records and Apple IAP verification data used for audit purposes

4.3 Optional market settings snapshots

If you explicitly enable cloud-based market settings snapshots, we process the snapshot version, configuration data, checksum, and update time associated with that snapshot. This feature is used only for syncing basic market settings across devices and does not include training records or personal trading data. You can disable the feature and delete uploaded snapshots from the application settings at any time.

4.4 Locally stored content that is not uploaded by default

The following categories of content are stored on your device by default and are not automatically uploaded to the cloud:

• free training sessions, challenge sessions, and historical replay records
• simulated orders, fills, position snapshots, and fee or cash-flow records
• Replay Notes titles, bodies, and context archives
• custom indicator scripts, parameter input, and revision history
• all imported market data and related local file metadata
• training statistics, challenge scores, and honor progress
• application display preferences and training rule parameters

5. Third-party service providers

Zinuto depends on a limited set of third-party services to provide core functionality, and data exchange with those providers follows a minimum-necessary model:

1. Alibaba Cloud for servers, database infrastructure, and related security services. Account and subscription data are stored on Alibaba Cloud infrastructure in mainland China.
2. External SMTP services for email verification codes and password reset emails. Only the email address and verification context required to send the message are transmitted.
3. Google / Apple OAuth as identity providers for sign-in. The sign-in flow is initiated through the official Google / Apple system in the browser, and we receive only the account identifier and public email address needed to complete authentication.
4. Apple App Store for subscription purchases when applicable. Apple processes payment-related information and we receive only the verified subscription state returned by Apple.
5. Operating system capabilities, including the system browser for sign-in and macOS Keychain for local session storage where supported.

6. Processing activities that are not currently implemented

• We do not integrate third-party analytics or advertising SDKs such as Sentry, PostHog, Mixpanel, or Firebase Analytics into the current product build.
• We do not integrate any remote AI inference service in the current product build. The “AI reference documents” feature in custom indicators is a local static documentation viewer.
• We do not proactively send local user content to third-party services.
• We do not collect device fingerprints, browsing history, geolocation, or unrelated behavioral profile data.

If you copy or paste data into an external AI tool or another third-party service yourself, that transmission is initiated by you and is outside Zinuto’s built-in data upload path.

7. Data retention

• Local data remains on your device until you delete it, run a cleanup or reset action, or uninstall the app and remove its related local data
• Cloud account and subscription data is retained while the account exists and afterward only for the period reasonably necessary to satisfy billing, audit, dispute resolution, and legal obligations
• Market settings snapshots remain available until they are overwritten, deleted, or removed as part of account deletion
• Session caches remain until sign-out, expiration, or local cleanup

8. Your control over your data

Zinuto is designed to give you meaningful control over your data:

1. Guest mode: you can use local training features without registering or signing in, which means no cloud account data is created for that workflow
2. Local data management: the product provides deletion and reset actions for training history, individual records, imported sources, and full local resets
3. Cloud data management: you can sign out, disable market settings snapshots, or contact us to request deletion of your cloud account and related cloud data
4. Downgrade or sign-out behavior: when membership is downgraded or you sign out, Zinuto keeps your local data and only locks features that exceed the current entitlement level

9. Security measures

We use reasonable security measures to protect the data we process:

• local API requests are bridged through Tauri native commands and the local backend listens only on a Unix socket instead of exposing a public network port
• account session data uses macOS Keychain where available
• cloud data uses encrypted transport and storage consistent with Alibaba Cloud security controls
• access to cloud-side data is restricted and audited

Even with these measures, no software system, device, or network transmission can be guaranteed to be absolutely secure. You remain responsible for protecting your device, system account, email account, and third-party sign-in credentials.

10. Cross-border data handling

All cloud data is stored on Alibaba Cloud infrastructure in mainland China, and Zinuto does not perform cross-border cloud transfer by default. If you choose Google or Apple sign-in, the authentication process itself is handled through Google’s or Apple’s own global infrastructure and remains subject to their respective privacy policies.

11. Policy updates and contact information

We may update this Privacy Policy in response to changes in product functionality, third-party dependencies, applicable law, or distribution channel requirements. If an update materially affects your rights or obligations, we will notify you through the app, the website, or another reasonable channel.

If you have questions about this Privacy Policy, account data handling, subscription verification, or data rights requests, please contact us:

• Operating entity: Qingchuang Juejin (Qingdao) Information Technology Co., Ltd.
• Contact email: dev@zinuto.com