Privacy Policy

Last updated: October 29, 2026 · Version 4

Mingzhu Fang operates OONA ManiDeck (OONA). Contact belina.xu@gmail.com for privacy requests or account help.

Using OONA without an account

You can browse colors and create designs without signing in. Designs and drafts you make without signing in are stored only on your device; they are not uploaded and are not automatically moved into an account if you sign in later. Usage analytics described below still run, identified only by a random device ID. Sign in when you want to save designs to your account and open them on another device.

Information we use

• Apple sign-in (iOS): Apple's account identifier and, if provided, your email or private relay address. The identifier recognizes the same account across devices. We do not receive your Apple password.
• Google sign-in (Android): Google's account identifier and, if Google verifies it, your email address. We verify a Google-issued ID token; we do not receive your Google password and we do not request access to your Google data such as contacts or Drive. The identifier recognizes the same account across devices.
• Profile: your chosen username and optional avatar. With Apple sign-in, the initial username uses the Apple-provided email if available; with Google sign-in it starts empty until you set one.
• Creations: editable drafts and saved designs, including nail settings, material references, layers, decorations and drawing data. When you are signed in, selecting Save uploads that version to your account.
• Photos you choose: we only read a photo you pick with the system photo picker. This includes your avatar, custom sticker images you create from a photo, and photos placed inside a design. When you are signed in, these images are uploaded to our server with your profile or the design that uses them. We do not scan your photo library and the app does not use the camera.
• Usage analytics (our own, no third-party SDK): the app records events such as opening the app, starting a session, entering the editor, saving, exporting, sharing and signing in, together with a random device ID generated by the app, a session ID, platform, app version, sign-in method and, once you sign in, your OONA account ID. Failure events may include an error code. The device ID is created by OONA and is not your advertising identifier, IDFA, IDFV or Android ID. Events are sent only to our own server.
• Region setting: the country or region code from your device's language and region settings (for example US). It is stored with analytics events and, when you are signed in, on your account. It is not your location: we do not request location permission, use GPS or look up location from your IP address.
• Session and security data: session credentials, authorization challenges, request limits and information needed to protect and run the service. Requests expose your IP address to the hosting infrastructure.
• Linked email (optional): if you choose to link an email address in Settings, we collect and verify the email you provide, and use it only to migrate your beta data to the official version. We send the verification code by email.

Purposes and permissions

We process account, creation and photo data to provide the account and cloud-save service you request; analytics and region data to understand how OONA is used, measure reliability and improve the app; and security information to protect the service. We access a photo only when you choose one. We do not collect your contacts or precise or approximate location. OONA has no advertising, does not use analytics for advertising, and does not track you across other companies' apps or websites.

Storage and cloud saves

Account data, saved works, uploaded images and analytics are hosted on cloud infrastructure operated for OONA. If the hosting provider or region changes, we will update this policy and, where required, notify you in the app. Service requests use HTTPS. Apple refresh credentials are encrypted on the server. Authorized operators may access data for maintenance or support.

How your sign-in session is kept on the device depends on the platform. iOS: the session is stored in the device Keychain. Android: the session is stored in the app's private storage (SharedPreferences), which other apps cannot read; we have disabled system backup and device-to-device transfer of app data so the session is not copied off the device, and we plan to move it to encrypted storage.

Unsaved recovery work stays on your device under the account that created it, or under no account if you were not signed in. It is not a cloud backup and is not automatically moved to a different account. A cloud save is confirmed only after the database accepts it. Keep independent exports of important works.

Sharing and service providers

Apple and Google process sign-in under their own privacy terms. Our hosting provider processes information needed to host and secure the service on our behalf. Verification-code emails are sent through an email delivery provider configured by our operators; it receives the recipient address and the message. The sending domain is moving from mail.keyman.top to decorbeauty.ai. Designs are private to your account. Sharing through your device sends the selected output to the destination you choose. We do not sell personal information, share analytics with third parties, or share works for advertising. We may disclose information where legally required or necessary to protect lawful rights.

Retention and deletion

We keep profiles, saved works and uploaded images while your account exists. Analytics events linked to your account are kept while the account exists and are deleted with it. Session credentials expire after 30 days unless revoked earlier. Login challenges expire after five minutes. Email verification codes expire after 10 minutes, and email send-limit records are removed after 24 hours. Rate-limit records are removed after their short security window. Save-retry records are kept for up to 30 days to prevent duplicate writes.

Routine account request logging is disabled. Gateway diagnostic error logs may include an IP address or request path; they use daily rotation with up to 14 archived files. Operational service errors are used to maintain the service. We do not intentionally log Apple authorization codes, identity tokens, session tokens or design contents.

To delete your account, open Me → Settings → Delete account. After confirmation and a successful request, we revoke the Apple connection (for Apple accounts), delete the active profile, cloud drafts, saved designs, uploaded images, linked email, analytics events linked to the account and its region setting, invalidate sessions, and remove recovery data on the current device. Deletion cannot be undone. If you cannot open the app, see How to delete your OONA account.

What may remain after deletion: encrypted operational backups expire within seven days, and deletion records must be applied before a restored database is put into service; those deletion records contain only a one-way hash of the sign-in identifier. If you used beta-data recovery, a small record with internal account IDs and a one-way hash of the email is kept to prevent the same beta data from being claimed twice. Analytics events recorded before you signed in carry only the random device ID and no account ID, so they are not deleted with the account. Recovery data on other devices may remain until you remove it or delete the app. Exports shared outside OONA are controlled by you and their recipients.

Signing out does not delete cloud works. Revoking OONA in your Apple or Google account settings stops access through that sign-in method but does not itself request deletion of the OONA database account.

Your choices and rights

You can use OONA without signing in, edit your profile, delete individual works, export saved designs, sign out, or delete your account. Contact belina.xu@gmail.com to request access, correction, deletion or a copy of your information, or to raise a privacy concern. We verify account ownership before fulfilling requests. Rights and response requirements depend on the laws that apply to you.

Children and changes

OONA is not designed specifically for children. Contact us if you believe a child provided information without required parental permission. We will review and remove it where appropriate. Policy updates appear here with a new effective date; material changes receive notice and any consent required by applicable law.