Privacy Policy

Effective: May 29, 2026 · Last updated: May 29, 2026

Yi (问易) is a local-first I Ching app. AI interpretation runs entirely on your device; your castings, notes and reflections stay on your phone by default; and optional cross-device sync is end-to-end encrypted, so our servers only ever see ciphertext they cannot read. In short: we cannot read any of your records.

1. How we handle your data

Data that stays on your device (we never receive it)

Your castings and hexagrams, personal notes, reviews and reflections, and the AI interpretations generated on-device are all stored locally on your device (SwiftData) by default. Until you turn on sync, none of this leaves your device or reaches us or any third party.

Account data (only if you use Sign in with Apple)

When you enable cloud sync, we authenticate you via Sign in with Apple and store only:

• the stable user identifier (sub) Apple provides, to identify your account;
• an optional relay email address, kept only if Apple shares one with us, for essential account notices;
• basic timestamps such as account creation and last-active time.

We do not receive your real name, Apple password, contacts, or precise location.

End-to-end encrypted sync data

With sync on, your records are encrypted with AES-256-GCM before they leave your device. Our server stores only: the ciphertext, the encryption nonce, and minimal sync metadata (record type, client timestamps, a monotonic sync cursor, and a deletion flag). The decryption key is never uploaded — it lives only in your iCloud Keychain and syncs between your own devices via Apple's end-to-end encryption. We are therefore technically unable to read synced content.

Technical logs

To keep the service secure and reliable, the server temporarily logs ordinary request information (such as IP address, time, and endpoint). These logs are not used for profiling or advertising and are purged routinely.

2. On-device AI & optional cloud interpretation

By default, interpretations are produced by a model running on your device. Your question text and hexagrams are not sent to our servers or to any cloud LLM in order to generate a reading.

Some devices do not support on-device AI. On those devices, paid members may explicitly opt in to cloud interpretation (under Profile · Cloud AI) for deeper / bilingual readings. Only when you have consented and used that feature does Yi send the minimum information needed to generate the reading: the hexagram number, the changing-line positions, the resulting hexagram's name, and the question text you typed. We do not send your reflections, history, account email, or any encryption key. Cloud interpretation is relayed through our server to a third-party AI model provider; this transfer uses HTTPS but, unlike end-to-end-encrypted sync, is not end-to-end encrypted to the model. We do not retain the prompt or the generated text. You can turn this off at any time.

3. What we do not do

• No advertising, no profiling, no cross-app tracking (we do not use the IDFA);
• No third-party analytics or ad SDKs;
• We do not sell or rent your data, nor share your records with third parties;
• We do not read or analyze the content of your castings, notes, or interpretations.

4. Where data is stored

Account and encrypted sync data are stored on servers located in Japan (Tokyo). Wherever data is stored, synced content always remains end-to-end encrypted ciphertext.

5. Retention, export and deletion

• Export anytime: you can export all your data as plain-text files from within the app, even while signed out or offline.
• Sign out: clears only this device's session credentials, keeping your local data and key.
• Delete everything: "Delete all data" in Settings removes every record on the device, deletes all ciphertext and account information associated with your account on the server, and deletes the on-device end-to-end encryption key. This action is irreversible.

6. Sign in with Apple

We use Apple's Sign in with Apple. You may hide your email and use Apple's private relay address. You can revoke Yi's access anytime via iOS Settings → your Apple Account → Sign in with Apple; after revoking, please also delete your account in the app to purge server-side data.

7. Children

Yi is not directed to children under 13, and we do not knowingly collect personal information from children.

8. Changes to this policy

If we make material changes, we will update the effective date at the top of this page and, where appropriate, notify you in the app.

9. Contact us

For any questions about this policy or your data, contact support@oneyi.net.