ALPHALITH · 日本 / Japan · 한국 / Korea · 台灣 / Taiwan · 香港 / Hong Kong

Privacy Policy and Personal Information Collection Statement (Hong Kong)

Effective 27 October 2026. ALPHALITH ("we") handles the personal data of users in Hong Kong in accordance with the Personal Data (Privacy) Ordinance (Cap. 486, "PDPO") and its six Data Protection Principles.

1. Purposes of collection (DPP1, DPP3)

What we collect and why

Anonymous account ID (no name, e-mail or phone number required) — to provide the app and prevent abuse.
Family profiles you enter (display name, relation, birth year, allergies, religious dietary rules, notes) — kept only on your device and never sent to our servers; used only to check ingredients and show the medical card. Allergies (health) and religious dietary rules (belief) are sensitive information: we ask for your separate consent in the app before they are saved, and never use them for statistics, advertising or third-party provision.
Location (with permission) — prayer times, Qibla and nearby halal spots. Exact location is not stored.
Photos / camera you choose — on-device text and barcode recognition and, only when the product is not in the database, AI checks. Ingredient verdicts are stored as shared product data not linked to you.
AI usage counts and a random install ID — to manage the 5 free AI trials and cost limits.
Purchase status (App Store / Google Play via RevenueCat) — to provide Premium. We never receive card details.
Advertising and push IDs (AdMob, OneSignal) — ads for free users and notifications. You can reset or disable them in your device settings.
Usage statistics — only if you opt in: monthly feature-usage counts, active days, language, coarse area and nationality if you set it. Never names, photos, scanned text, medical card content, allergies or exact locations. Stored under a keyed pseudonymous ID and shown to others only as aggregates of at least 5 users. Withdraw at any time in Settings (this deletes the statistics).

Providing any of this is optional. If you do not, the related feature (for example, family allergy alerts) will not work, but the rest of the app remains available.

Retention and deletion

Account: until you delete it. Family profiles are kept on your device only and are erased when you delete them or the app. AI usage counts: 90 days. Daily search areas: 120 days. Area statistics: 25 months. Operations logs: 90 days. Purchase events: 400 days. When the period ends or the purpose is achieved, electronic data is deleted irreversibly; we keep no paper records.

Security

HTTPS encryption, row-level access control, encrypted key storage (Vault), separation and pseudonymisation of statistics, and least-privilege access.

Business transfer

If the business is transferred (merger, business transfer, etc.) we will notify you in advance in the app, including the recipient, and you may withdraw consent and delete your data before the transfer.

2. Is it obligatory?

No. All personal data is supplied voluntarily. If you do not supply it, the related feature will not work, but the rest of the app remains available.

3. Classes of transferees

Our service providers (data processors) listed below, which process data on our behalf in the USA under contract; a successor in a merger or business transfer (announced in advance in the app); and persons to whom disclosure is required by law. We do not use or provide your data for direct marketing.

Recipient	Country	Data	Purpose
Supabase Inc.	USA (data stored in the project region)	Account ID, purchase status, opt-in statistics	Database and servers
Google LLC	USA	Images / text sent to AI, advertising ID, map search position, purchase data	Gemini API, AdMob, Maps, Google Play
OpenAI, L.L.C. (only if enabled)	USA	Images / text sent to AI	Backup AI
RevenueCat, Inc.	USA	Account ID, purchase data	Subscription management
OneSignal, Inc.	USA	Push ID, language	Notifications
Apple Inc.	USA	Purchase data	App Store

4. Accuracy, retention and security (DPP2, DPP4)

You can correct your family profiles in the app at any time. Data is not kept longer than necessary (see "Retention and deletion"). Processors are bound by contract to prevent unauthorised or accidental access, processing, erasure, loss or use.

5. Access and correction (DPP6, sections 18 and 22)

You may request access to and correction of your personal data. Send requests to our Data Protection Officer: [Name], contact@alphalith.net. We will respond within 40 days. We may charge a fee that is not excessive for a data access request.

6. Children

Users under 16 should use the app with a parent's consent; children's family-profile data is entered and managed by parents.

7. Complaints

You may also contact the Office of the Privacy Commissioner for Personal Data (www.pcpd.org.hk).

Operator: ALPHALITH · Address: [Address] · Contact: contact@alphalith.net

私隱政策及收集個人資料聲明（香港・中文摘要）

ALPHALITH依《個人資料（私隱）條例》（第486章）處理香港用戶的個人資料。

收集目的：提供應用程式、成分及過敏原確認、禮拜時間及附近清真地點、管理 5 次 AI 免費試用、提供進階版；使用統計只在您同意時收集。
過敏及宗教飲食限制只在您另行同意後儲存，不作統計、廣告或提供第三者。不使用您的資料作直接促銷。
所有資料均屬自願提供；不提供時相關功能無法使用。
轉移對象：上述在美國的服務供應商、業務承繼者（事先於應用程式內通知）及法律要求的人士。
您有權要求查閱及改正您的個人資料，請聯絡：[資料保障主任姓名]，[聯絡電子郵件]。查閱資料要求可能收取不超逾適度的費用。
亦可聯絡個人資料私隱專員公署（www.pcpd.org.hk）。

如中英文版本有歧異，以英文版本為準。