QiFlux · SDK disclosure

SDK · 01 of 05

RevenueCat

Validates Apple StoreKit / Google Play Billing receipts so we know which features to unlock.

always-on · purchase only

Field	Value
What it sends	Anonymous UUID (per device) · purchase receipt · subscription status
What it never sees	Cycle data · 體質 tag · symptoms · name · email · IP (proxied via Apple/Google)
When	On purchase · on app launch (subscription status refresh)
Region	US-East · processed under SOC 2 Type II
Switch	None — required for billing. The data sent is functionally what Apple/Google already see.

SDK · 02 of 05

Google Mobile Ads (rewarded only)

Loads the optional rewarded video ad for free-tier users who choose "看廣告兌換 1 點" instead of waiting for the daily refresh.

opt-in · free tier only

Field	Value
What it sends	Standard ad-request payload (advertising ID, locale, app bundle, OS version)
What it never sees	Cycle data · 體質 tag · symptoms · purchase history · in-app behavior beyond "ad button tapped"
When	Only when the user actively taps "看廣告兌換 1 點"
Frequency cap	5 per day per device
Switch	Removed entirely from the build for Premium users · ATT prompt on iOS, "Limit ad tracking" honored

SDK · 03 of 05

Sentry

Crash reporter. Off by default; user must explicitly enable it in Settings → Help us improve.

opt-in · default OFF

Field	Value
What it sends	Stack trace · device model · OS version · app version · breadcrumb of last 20 nav events (screen names only, no data)
What it never sees	Cycle data · symptoms · 體質 · UI text content · screenshots
When	Only on crash · only if user opted in
Region	Self-hosted on EU-Central (Frankfurt) · GDPR DPA in place
Switch	Settings → Help us improve → toggle. Off by default for every install.

SDK · 04 of 05

Sign-in-with-Apple

Used only if you opt in to iCloud backup, to bind the encrypted blob to your Apple ID. We never see your email.

opt-in · backup only

Field	Value
What it sends	Apple-issued opaque user identifier (private relay email if you choose)
What it never sees	Real email (relay'd by Apple) · cycle data · device identifiers
When	One-time, when you tap "Backup to iCloud" in Settings
Switch	Sign out from Settings → Backup → Disconnect, anytime

SDK · 05 of 05

google_sign_in (Android only)

Mirrors Sign-in-with-Apple on Android: only if you opt in to Google Drive backup.

opt-in · backup only

Field	Value
What it sends	Google-issued opaque user identifier · OAuth scope: drive.appdata only
What it never sees	Drive contents outside our app sandbox · contacts · calendar · email contents
When	One-time, when you tap "Backup to Google Drive"
Switch	Settings → Backup → Disconnect, anytime · revoke at myaccount.google.com

Cap policy

5 SDKs is the ceiling, not the goal.

If we want to add a sixth, one of the existing five must come out first. The cap is enforced in CI: scripts/check-sdk-count.sh fails the build if the network-SDK count exceeds 5.