InnerVibe 369 privacy policy
Policy version: 2026-10-30
Effective date: October 30, 2026
Last updated: October 25, 2026
This policy explains what data InnerVibe 369 (Chinese name 心頻369, Android package com.qtlives.ycg, "the app") collects about you, what we use it for, where it is stored, how long we keep it, and how you can see, correct, or delete it. The app is offered on Google Play in Taiwan. We handle your personal data under Taiwan's Personal Data Protection Act ("the PDPA").
1. Who we are
The app is run by Chen Peng-Cheng as an individual, who is also the app's developer on Google Play ("we" or "us"). For any privacy question, email info@qtlives.biz.
2. About the service
Every reading in the app is produced live by our quantum devices. Readings are for personal reference only. The service is not a medical device and does not diagnose, treat, cure, or prevent any disease.
3. What we collect and why
The table lists every kind of personal data we collect. The category codes are the personal data categories published under the PDPA.
| Data | Where it comes from | What we use it for | Category code |
|---|---|---|---|
| Google account ID and email address | Google provides them when you sign in with your Google account | To create your account and sign you in. Your email address appears on the Settings screen, and we use it to answer your messages and to tell you about your account | C001 identifying information |
| Your name and date of birth | You enter them when you create your profile | To show them on your profile, to create readings that are yours alone (see section 4), and to confirm from your date of birth that you are 18 or older | C001 identifying information, C011 personal description |
| Your photo | You pick one from your photo library or take one with the camera, then crop it yourself | To show it on your profile, to create readings that are yours alone, and to restore it when you switch phones or reinstall the app | C001 identifying information |
| Your quantum identity | Created at your first reading, and yours alone | Used for every later reading. It is created only once and never changes | C132 unclassified data |
| Your readings | Created as you use the app. This covers the kind of reading you request each time, when you requested it and when it finished, its place in the queue, and the result | To deliver your readings, show your place in the queue, count your allowance, and let each reading follow on from the last one | C036 lifestyle |
| Your plan, the language of your readings, and when you created your account and last signed in | Created as you use the app | To decide which features you can use and to produce readings in the language you chose | C036 lifestyle, C132 unclassified data |
| Consent records, meaning the policy version you agreed to, a hash of that version's text, the language shown, the app version, your phone's platform, and when you agreed | After you tap I have read and agree and sign in, the app sends them and the server adds a record. Records are only ever added, never changed | To show which version of this policy you agreed to, and to tell whether we need to ask you again after a major change | C132 unclassified data |
| Your phone's time zone setting | The app sends it with every request | To work out which day it is for you, so we can count your allowance. The server uses it for that request and does not store it | None |
| Connection data, meaning your IP address, the time of each request, the URL path requested, and the app's User-Agent string | Created by every request | The server program uses your IP address only in memory, to limit how often someone can try to sign in, and never writes it to the database. Our hosting provider's request logs are used to fix faults and keep the service secure | C001 identifying information |
We do not collect your phone number, postal address, location, contacts, or advertising ID. The app shows no ads and has no analytics or crash-reporting tools. Google ML Kit does send usage statistics to Google, as section 5 explains. We do not sell your data.
Under the PDPA, the specific purposes for which we collect this data are:
- 069 contracts, quasi-contracts, and other legal relationships
- 090 consumer and customer management and service
- 135 information and communication services
- 136 information, communication, and database management
We collect this data under Article 19, paragraph 1 of the PDPA, on two grounds: subparagraph 2 (our contract, or a relationship similar to a contract, with you) and subparagraph 5 (your consent). The service needs all of this data to produce your readings.
We use your data only for these purposes. Before we use it for any other purpose, we will ask for your consent separately. That consent is never bundled with your agreement to use the app.
4. How we use your photo, name, and date of birth
Your photo, name, and date of birth are used only for your profile and to create readings that are yours alone. Your date of birth is also used to confirm that you are 18 or older. Here is how we handle them.
- Your phone checks the photo first. The app uses Google ML Kit face detection and image labeling to confirm that you are the only person in the photo and that your face is clear. The check runs on your phone, and your photo is not uploaded for it.
- Once the photo passes, only the thumbnail you cropped is uploaded. The original photo is never uploaded, and the photo in your library is not changed or deleted. The temporary copies the app makes while processing are deleted as soon as the thumbnail is ready.
- Before anything reaches the quantum device, the server converts your data into a form that cannot be reversed. The quantum device never sees your name, date of birth, photo, or email address.
We do not use your photo for facial recognition and never compare it with anyone else's.
After your first reading, your photo, name, and date of birth are locked and can no longer be changed in the app. To correct them, email info@qtlives.biz. When you delete your account, they are deleted with it (see section 7).
5. Services provided by Google
Sign in with Google
After you choose an account on Google's screen, Google gives the app a sign-in token. The token contains basic information such as your Google account ID, email address, and name. The app asks for no other Google permissions, so it cannot reach your Drive, contacts, or calendar.
After the server confirms that Google issued the token, it keeps only your Google account ID and your email address if Google has verified it. We do not keep the Google account name or the profile picture link that come in the token. Google handles your sign-in on its side under its own privacy policy (https://policies.google.com/privacy).
Google ML Kit usage statistics
The ML Kit code that checks your photo runs on your phone. Under the ML Kit terms of service, neither the photo nor the result of the check is sent to Google.
ML Kit does send usage statistics to Google. According to Google's published description, they include:
- Device information, such as the manufacturer, model, operating system version, and the machine learning hardware accelerators available on the phone
- The app's package name and version
- An identifier created for each installation, which Google says is not intended to identify a user or a physical device
- Performance data, such as how long processing took
- Configuration, such as image format and resolution
- Input and output sizes, the feature version, event types (such as start-up, detection, and releasing resources), and error codes
Google says it uses this data to measure performance, to debug, maintain, and improve ML Kit, and to detect misuse. Google collects these statistics for its own purposes, not on our behalf, and stores and processes them wherever Google decides. The data travels over HTTPS, and Google does not pass it on to third parties. Google collects it directly, so we never receive it and cannot delete it for you. You cannot turn these statistics off in the app.
Google describes this on its ML Kit data disclosure page (https://developers.google.com/ml-kit/android-data-disclosure) and in the ML Kit terms of service (https://developers.google.com/ml-kit/terms).
6. Where your data is stored, international transfers, and who receives it
Locations and international transfers
Your data is stored outside Taiwan, which the PDPA treats as an international transfer.
- Our server and database are in Singapore, in Railway's Southeast Asia data center. Railway Corporation is a US company.
- Continuous database backups are kept in Railway storage in Singapore (the same region as the database).
- The quantum devices that produce readings are in Taiwan.
- Data that Google receives is stored wherever Google processes it.
Recipients
- Us, to run the service. The quantum devices that produce readings are our own computers. A program runs them automatically, no person operates them, and they receive only the data listed in section 4.
- Railway Corporation, which provides our hosting, database, and backups on our behalf and may process the data only as we instruct.
- Google, as described in section 5.
- Government agencies or courts, only when the law requires it.
We give your data to no one else, and we never use it to target ads.
How it is processed
The server processes your data automatically. We look at your data only to handle a support request from you, to fix a system fault, or when the law requires it.
7. How long we keep your data
| Data | How long we keep it |
|---|---|
| Your account, your profile (photo, name, and date of birth), your quantum identity, and all your readings | Until you delete your account. Whatever your plan, the server currently keeps all of your readings |
| Consent records | For as long as your account exists, and for 5 years after you delete it, to show which version of this policy you agreed to. We then delete them. A consent record holds only an internal account number and the items listed in section 3. It contains no name, date of birth, photo, or email address |
| Sign-in tokens | The server keeps only a hash of each token. A token stops working after 90 days without use |
| Our hosting provider's request logs | Deleted automatically after 30 days |
| Database backups | Deleted automatically after about 4 weeks. After you delete your account, your data may remain in backups for that long. We use backups only to restore the service after a system failure |
| Results waiting on a device | Deleted once the server confirms it has received them, and kept for 7 days at most. They contain no name, date of birth, photo, or email address |
| Support emails | 1 year after the request is resolved |
| Data on your phone | Until you sign out, delete your account, or uninstall the app |
If we later start deleting older readings automatically according to your plan, we will update this policy first and tell you in the app.
For the steps and details of deleting your account, see "How to delete your InnerVibe 369 account" (https://innervibe.qtlives.com/account-deletion?lang=en).
8. Your rights and how to use them
Under Article 3 of the PDPA, you have the right to:
- Ask what personal data we hold about you, and look at it
- Ask for a copy of it
- Ask us to complete or correct it
- Ask us to stop collecting, processing, or using it
- Ask us to delete it
You can do most of this in the app:
- See your profile and email address under Settings.
- Before your first reading, change your photo, name, or date of birth under Settings > Edit profile. Once they are locked, email support to correct them.
- Delete your account and all your data under Settings > Delete account.
For anything else, email info@qtlives.biz from the Google account email address you use to sign in to the app, and say which right you want to use. We ask you to write from that address so that we know the request comes from you.
We answer requests to see your data or get a copy within 15 days. We answer requests to complete, correct, stop using, or delete your data within 30 days. If we need more time, we will email you the reason first, and the extension will be no longer than the original period. Article 14 of the PDPA allows us to charge the necessary cost for looking up, viewing, or copying your data. We currently do not charge for this.
Correcting your name or date of birth does not give you a new quantum identity.
The service cannot work without this data, so withdrawing your consent means ending the service. To withdraw, go to Settings > Delete account. We then delete your account and all your data, except the data that section 7 says we keep for a limited time. If you have not finished setting up your profile, you can delete your account from the bottom of the profile setup screen. Withdrawing does not affect anything we did with your data before you withdrew. Deleting your account does not cancel a paid Google Play subscription, so cancel it in Google Play as well.
9. Your consent, and what happens if you do not provide data
Every time you are about to sign in (including the first time you open the app, and when you switch to another Google account on the same phone), the app shows you the key points of this policy first, before you sign in. Only after you tap I have read and agree does the app take you to Google sign-in and then to setting up your profile.
Whether to provide data is your choice. This is what happens if you do not:
- If you do not agree to this policy, you cannot use the app. We then create no account and keep none of your data.
- If you do not sign in with a Google account, you cannot use the app.
- If you do not provide your name, date of birth, or photo, you cannot create a profile, so you cannot get readings.
- If you do not let the app use the camera, you can still pick a photo from your library.
- You cannot turn off ML Kit's usage statistics in the app.
10. How we protect your data
- Every connection between the app and the server is encrypted in transit with HTTPS. Release builds refuse unencrypted connections.
- Each account can read and change only its own data. On every request, the server checks that the account still exists and that the data belongs to it.
- Your name, date of birth, photo, and email address are never sent to the quantum devices that produce readings (see section 4).
- The server program never writes your name, date of birth, photo, or email address to its logs.
- On your phone, sign-in tokens are kept in Android's secure storage. The server keeps only a hash of each token.
- When an account is deleted, every sign-in token it had stops working at once.
- If we learn of a data breach, we will email you within 72 hours to tell you what happened, which data it affected, what we have done about it, and how to reach us. We will also report it to the authorities as the law requires.
11. Data on your phone
The app keeps the following on your phone: your photo thumbnail, a copy of your profile and account data, your readings, your sign-in tokens, and your display language and Material effects settings. The thumbnail is stored in the app's own folder, which other apps cannot read.
When you sign out or delete your account, all of this is deleted except your display language and Material effects settings. When you uninstall the app, Android deletes it.
12. Age limit
The app is only for people aged 18 and over. When you create your profile, we use your date of birth to check your age. If you are under 18, you cannot create a profile, and we delete the account that was created when you signed in. If you know of someone under 18 using the app, email info@qtlives.biz and we will delete their data.
13. Changes to this policy
When we change this policy, we update the policy version and the "Last updated" date at the top. If a change affects your rights or uses your data for a new purpose, the app shows you the new version the next time you open it, and you need to agree to it before you can keep using the app. If you do not agree to the new version, you can delete your account.
14. Contact us
Chen Peng-Cheng
Email: info@qtlives.biz
Where this policy covers each notice item in Article 8 of the PDPA
| Article 8, paragraph 1 of the PDPA and related rules | Where this policy covers it |
|---|---|
| 1. Name of the collector | Section 1 |
| 2. Purpose of collection | Section 3 |
| 3. Categories of personal data | Section 3 |
| 4. Period, locations, recipients, and methods of use | Sections 6 and 7 |
| 5. Your rights under Article 3 and how to use them | Section 8 |
| 6. What happens if you choose not to provide data | Section 9 |
| Locations of international transfers | Section 6 |
| Consent and withdrawing it | Sections 8 and 9 |