Niobalan Network Technology (Shanghai) Co., Ltd. (“Neobalan”, “we”, “us”) is the developer and operator of PastEcho (the “App”), an AI-powered game in which you converse with historical figures of hidden identity, gather clues, and guess who they are. We act as the data controller for personal data processed through the App and the website pastecho.app, and we have prepared this Privacy Policy (the “Policy”) to explain, clearly and plainly, what we collect, why, and what you can control.
Scope. This Policy applies to your use of the PastEcho iOS app and the public website pastecho.app. PastEcho is operated as fully separate Chinese and international editions with completely separate accounts and data. This Policy covers the international edition only; it does not cover any China-edition product, and data is never merged between the two editions.
Consent. When you first launch the App, its key points are presented to you. Before you tap “Agree and Continue”, the App does not send any network requests and does not collect any personal data. By tapping “Agree and Continue”, or by otherwise using the App after being presented with this Policy, you acknowledge and agree to it. If you do not agree, please stop using the App; you may withdraw consent at any time as described in Section 10, without affecting the lawfulness of processing already carried out.
Reading guide. Provisions that significantly affect your rights are shown in bold. Please read them with particular care. If anything is unclear, contact us through the channels in Section 14.
We follow the principles of lawfulness, fairness, and data minimization: we collect only what is directly needed to provide the features you use. You can use the entire App as a guest, without any account — signing in is never a precondition for play. Information falls into three categories:
| Category | Examples | How obtained | Purpose | Required? |
|---|---|---|---|---|
| Account identifiers | Guest clientId; Apple user identifier | Generated locally or obtained via Apple authorization | Account recognition, anti-abuse | Required (guest identifier is generated automatically; you provide nothing) |
| Profile | Nickname, avatar; name and email only if you choose to share them via Apple | You provide / authorize | Profile display, account recovery | Optional |
| Account time zone | IANA time zone | From device at account creation | Daily benefit reset anchor | Required (UTC fallback) |
| User content | Chat messages, guesses, feedback | You type it | AI replies, guess judging, support | Needed for the corresponding feature |
| Device information | Brand, model, OS version, platform | Automatic | Compatibility, user-base analysis, anti-abuse | Required |
| Usage data | Feature events and associated identifiers | Automatic | Product analytics, error and abuse monitoring | Required (starts only after you agree to this Policy) |
| Ad interaction data | Rewarded-ad event metadata | Automatic, when you choose to watch ads | Reward issuance and auditing | Optional (only if you watch rewarded ads) |
We do not collect your phone number, contacts, messages, precise location, biometric data, health or fitness data, financial account information, browsing history, or official ID documents. We do not request the App Tracking Transparency permission or read the advertising identifier (IDFA) ourselves; the Google AdMob SDK may access the advertising identifier subject to your iOS tracking permission and Google's policies (see Section 8). Please do not enter sensitive personal data (such as ID numbers, bank card numbers, or health information) into AI conversations — chat content is not a place to store such data.
We use the information described above only for the following purposes:
Purpose limitation. If we need to use personal data for a new purpose not described in this Policy, we will seek your consent again. We do not use your personal data to send you marketing messages, and the App sends no push notifications or in-app marketing.
The App requests iOS permissions on a strict minimum-needed basis. Currently this covers:
The App does not request camera, microphone, location, contacts, Bluetooth, local network, health, or tracking permissions. If you decline the photo-library permission, only saving images is affected. You can change permissions at any time in iOS Settings, with immediate effect.
The App uses standard iOS local storage (such as UserDefaults and sandbox files) for: sign-in credentials (so you stay signed in until they expire), the clientId, and preferences (onboarding completion, remembered sign-in state). This data stays on your device and is not uploaded except as needed to call our services. You can clear sign-in credentials by signing out, and clear all local data (including the clientId) by uninstalling the App. The App does not use web cookies or comparable cross-site tracking technologies.
We do not sell your personal data. We share it only with the service providers listed below, under contracts that bind each of them to process data solely on our instructions, with security obligations no weaker than those in this Policy.
| Provider | Role | Data processed |
|---|---|---|
| Vercel Inc. (privacy policy) |
Hosting of the website, REST API, and SSE chat streaming; routing of AI requests via Vercel AI Gateway; website analytics (Vercel Analytics / Speed Insights, website only) | HTTP request metadata (such as IP address and timestamps) in server logs; AI requests routed as described in Section 7; website visit metrics not linked to your account |
| Neon (privacy policy) |
Hosted PostgreSQL database (Oregon, United States) | The application database: account, conversation, guess, score, achievement, and related records |
| Upstash Inc. (privacy policy) |
Managed Redis for caching and rate limiting | Transient operational data (counters, locks, short-lived cache entries); not used for durable personal records |
| Cloudflare, Inc. (privacy policy) |
Object storage (R2) and CDN delivery of images via pastecho.tcodeapp.com | Avatar images and public image assets; conversations, authentication, and personal data are not placed in public caches |
| AI model providers (currently DeepSeek; other providers such as OpenAI as fallback models) |
Generating AI character replies and assisting guess evaluation | The conversation context of the current exchange (your message and recent turns), transmitted by our servers; see Section 7 |
| Google LLC (AdMob) (see Section 8) |
Rewarded video ads | Advertising identifier, device and ad interaction data, per Google's policies |
| CLS (operated by us) | Product event analytics | Usage events described in Section 3.3, reported under a PastEcho-international app identity |
Beyond the list above, we will disclose personal data only:
Public disclosure: we do not publicly display your personal data. Your nickname and avatar are visible only to you (and to trained reviewers for moderation where necessary); there is no public leaderboard or user community in the App.
The core experience of PastEcho is conversing with AI-portrayed historical figures. When you send a message, our servers transmit the conversation context (your message and recent turns, together with the character's instructions) to a third-party AI model provider to generate the reply; the reply is returned to the App, streamed to you, and stored in your conversation history as described in Section 3. The same applies, in a separate judging step, to evaluating whether a guess matches the hidden identity. Requests are routed through Vercel AI Gateway where applicable, and for guess-evaluation requests we ask the gateway and provider to operate in a zero-data-retention mode, so that message content is not retained beyond serving the request; gateway logs for such calls are limited to metadata (status, timing, token usage, cost).
We require providers to process such content only as needed to deliver the generation service to us, under their respective privacy terms linked in Section 6.4. Model providers and configurations may change as we improve quality; the current configuration is stated in this Section, and material changes to who processes your conversation content will be treated as changes to this Policy (Section 13).
To keep the community safe, we apply content-safety rules within the AI pipeline and review user-facing inputs such as nicknames, avatars, and feedback. Review exists solely to identify and handle unlawful or inappropriate content, not for any other purpose.
The App shows rewarded video ads provided by Google AdMob. When your daily message quota or new-figure slots run out — and for some relic hints — you may choose to watch a full ad to receive a bonus such as extra messages or an additional slot. Ads play only when you actively choose to watch them; not watching never blocks free use of the core game, and the App contains no paid purchases.
Rewards are verified on our servers: before an ad shows, our server issues a random reward token; the AdMob SDK carries only that random token as verification data, and after you finish watching, Google's servers call back our server to confirm it. We do not send your user ID, device identifiers, or any other personal data to the ad network for reward verification, and we do not store advertising identifiers on our servers. Our own ad logs contain event metadata only (ad unit, event type, result).
Like other ad providers, the AdMob SDK processes data to deliver, measure, and protect its ads, as described in Google's privacy terms linked in Section 6.4. This can include device and system information, the advertising identifier (on iOS, IDFA — accessed only if you have granted the app tracking permission in iOS), IP address, approximate location inferred from network signals (coarse, such as country or city level; the App never requests GPS permission), and ad interaction data. Data may be shared within Google's ad ecosystem for measurement and fraud prevention, per Google's terms.
Google may use the data above to select ads more relevant to you. You can control this:
If you limit tracking or personalization, you will still see ads, possibly less relevant ones; this never affects the rewards you earn from fully watching a rewarded video.
The international edition is hosted in the United States: the application database runs on Neon (Oregon, US), the application and AI routing run on Vercel, and images are stored in Cloudflare R2. By using the App you understand that your personal data will be transferred to and stored in the United States. See also Section 12.
We keep personal data only as long as necessary for the purposes described in this Policy, unless a longer period is required by law:
We apply industry-standard technical and organizational measures: HTTPS encryption in transit; signed, expiring session tokens (JWT); least-privilege access with audit logging; and periodic review of internal data handling. If a personal data breach occurs, we will activate our incident response plan, take remedial measures, and notify you and the relevant authorities as required by applicable law, describing what happened, the likely impact, and what we have done.
Depending on where you live, you may have statutory rights over your personal data, which we honor for all users as follows:
| Right | What it covers | How to exercise | Response time |
|---|---|---|---|
| Access and copy | View your profile, conversations, score, and achievements | In-app profile pages; ask us for an export via Section 14 | Within 30 days |
| Correction | Fix your nickname, avatar, and other profile data | Edit in-app; contact us for anything else | Within 30 days |
| Deletion | Delete specific conversations, or delete your account | Delete conversations in-app; account deletion per Section 10.2 | Immediate (see Section 10.3) |
| Withdraw consent | Stop processing based on consent | Uninstall the App, or delete your account | Immediate |
| Explanation | Ask us to explain this Policy or our practices | Contact us via Section 14 | Within 30 days |
We respond to all requests free of charge within the stated period; if a request cannot be fulfilled in full (for example, because data has been anonymized and can no longer be traced to you), we will explain why and offer a feasible alternative. Withdrawing consent or deleting your account does not affect processing already carried out on the basis of consent before withdrawal.
You can delete your account yourself from within the App (guest identities can be deleted the same way; uninstalling the App alone removes the local guest identity but does not delete any signed-in account). After deletion takes effect:
Please decide carefully. Deletion is permanent. If you use the App again afterwards, you start as a brand-new identity and prior data cannot be restored.
If you have a complaint about our handling of personal data, contact us via Section 14. If you are unsatisfied with the outcome and local law gives you that right, you may also lodge a complaint with your local data protection authority.
PastEcho is built around history education and entertainment for general audiences, but it is not directed at children under the age of 13 (or the minimum age of digital consent in your jurisdiction), and we do not knowingly collect personal data from children. If you are under that age, please do not use the App unless your parent or guardian has read this Policy, agreed to it on your behalf, and supervises your use.
If we learn that we have collected personal data from a child without valid parental consent, or once we receive a verified request from a parent or guardian, we will promptly delete that data. Contact us via Section 14.
We are a company based in Shanghai, China, and the international edition's service infrastructure is located in the United States (Section 9.1). When you use the App from outside the United States, your personal data will be transferred to, stored, and processed in the United States and possibly other countries where our service providers operate. Laws in those countries may differ from those of your home country. We rely on each provider's security and compliance program (such as the certifications and data protection commitments described in their privacy terms, linked in Section 6.4) to protect your data in transit and at rest. Where your local law requires a specific transfer mechanism for such transfers, contact us via Section 14 and we will provide the available information.
We may update this Policy from time to time. For material changes — for example, new categories of data collected, new purposes, new categories of service providers, changes to your rights, or a change of controller — we will notify you prominently (such as an in-app notice) and, where required, ask for your consent again. The version shown at the top of this page (“Last updated” and “Version”) identifies the current text. If you do not agree to an updated Policy, you may stop using the App and delete your account.
We aim to reply within fifteen (15) business days, and in any event within thirty (30) days, of receiving a request.