Initializing System

Privacy Policy

Last updated: July 2, 2026. This policy explains how GZTONGCHEN collects, uses, and protects your information across our website and mobile applications.

Effective: July 2, 2026 Version: 3.2 Contact: contact@gztongchen.com Region: Global

1. Overview & Commitment

GZTONGCHEN ("we," "our," or "us") is a US-based research and development team headquartered at the Rochester Innovation Center, Rochester, NY 14604, United States. We develop and publish mobile applications available on the Apple App Store, Google Play Store, and through our website at gztongchen.com.

Privacy is foundational to our work. Our applications are designed on a "data does not leave your device by default" principle. This Privacy Policy explains what limited information we do collect, how we use it, and the rights you have over your data.

Our current app portfolio includes: ContractCheck, FilmLab Studio, PracticeLog, SideHustle Tracker, VitalDay, and StockMate. Each of these applications is built with privacy as a core architectural constraint.

2. Information We Collect

We collect the minimum information necessary to provide and improve our services. The categories of information we may collect include:

2.1 Information You Provide Directly

  • Account Information: When you contact us via our website form, we collect your name, email address, company (optional), and the content of your message.
  • Support Communications: When you email our support team (support@gztongchen.com), we collect the content of your communications and any attachments you choose to send.
  • Newsletter Subscription: If you opt in to receive our newsletter, we collect your email address.

2.2 Information Collected Automatically

  • Device Information: Device type, operating system version, device identifiers (such as IDFA on iOS or GAID on Android, only with your explicit consent), locale, and time zone.
  • Usage Data: App features used, session duration, crash logs, and performance metrics.
  • Log Information: IP address (truncated/anonymized), browser type, referring/exit pages, and timestamps.

2.3 Information from App Store Platforms

When you download our apps from the Apple App Store or Google Play Store, those platforms may collect information about you subject to their own privacy policies (Apple's Privacy Policy and Google's Privacy Policy). We do not control these third-party data practices.

2.4 Local Application Data (NOT collected by us)

Our applications store your data locally on your device by default. This includes:

  • ContractCheck: Contract documents you analyze, verification results, and notes
  • FilmLab Studio: Photos and videos you edit, preset configurations, and edit history
  • PracticeLog: Practice session records, instrument settings, and progress data
  • SideHustle Tracker: Income and expense entries, categories, and reports
  • VitalDay: Health metrics, sleep data, mood logs, and habit tracking
  • StockMate: Inventory items, materials, and project data

This data remains on your device and is not transmitted to our servers. If you delete the app, this data is deleted with it.

3. How We Use Information

We use the limited information we collect for the following purposes:

  1. To Provide Our Services: Responding to your inquiries, delivering support, and fulfilling your requests.
  2. To Improve Our Applications: Analyzing crash reports and aggregated usage patterns to identify and fix bugs, optimize performance, and develop new features.
  3. To Communicate With You: Sending you important updates about our apps, services, and policies (where you have opted in to receive such communications).
  4. To Comply With Legal Obligations: Meeting applicable legal, regulatory, and tax requirements.
  5. To Protect Our Rights: Detecting and preventing fraud, abuse, security incidents, and other harmful activities.
  6. With Your Consent: For any other purpose disclosed at the time of collection, with your explicit consent.

For users in the European Economic Area (EEA), United Kingdom, and Switzerland, we process your personal data under the following legal bases as defined by the General Data Protection Regulation (GDPR):

  • Consent (Article 6(1)(a)): For optional features, marketing communications, and non-essential cookies. You may withdraw consent at any time.
  • Contract Performance (Article 6(1)(b)): To provide services you have requested or to fulfill a contract with you.
  • Legal Obligation (Article 6(1)(c)): To comply with applicable laws and regulations.
  • Legitimate Interests (Article 6(1)(f)): For analytics, security, fraud prevention, and product improvement, where our interests are not overridden by your fundamental rights and freedoms.

5. Data Storage & Localization

Local-First by Default: All application data is stored locally on your device. We do not maintain servers that store your personal content, contracts, photos, financial records, or health information.

No Cloud Backup: Our applications do not perform automatic cloud backups. You are responsible for your own device backups (via iCloud, Google Drive, or your device's native backup system). We recommend enabling device-level backup for safety.

Server-Side Data (Minimal): For our website and customer support, we use secure cloud infrastructure providers including:

  • Email and communication: Google Workspace (United States)
  • Website hosting: Cloudflare (Global CDN)
  • Error tracking: Self-hosted or privacy-respecting alternatives

Data transmitted to these services is limited to what is necessary for the specific service being used.

6. Data Sharing & Third Parties

We do not sell your personal information. Period. We share information only in the following limited circumstances:

  1. Service Providers: With vendors who perform services on our behalf (e.g., email delivery, error monitoring), bound by confidentiality and data protection agreements.
  2. Advertising Partners: As described in detail in Sections 7-9 below, our free applications may display ads through third-party ad networks.
  3. Legal Requirements: When required by valid legal process, or to protect our rights, your safety, or the safety of others.
  4. Business Transfers: In the event of a merger, acquisition, or sale of assets, with appropriate confidentiality protections.
  5. With Your Consent: For any other purpose disclosed at the time of collection with your explicit consent.

7. Advertising & Ad Networks

To keep our applications free, certain of our apps display advertisements through third-party advertising networks. We want to be fully transparent about this practice. Our privacy-first principles apply to advertising as follows:

  • Advertising is not used to build personal profiles for cross-site tracking purposes.
  • Where required by law (EU/UK under GDPR, California under CCPA, etc.), we request your explicit consent before displaying personalized ads.
  • You can opt out of personalized advertising at any time through the app's settings or via your device's privacy controls (Limit Ad Tracking on iOS / Opt out of Ads Personalization on Android).
  • Children under the age limits specified in Section 10 are shown only contextual (non-personalized) ads or no ads at all.
  • We do not use advertising for sensitive data categories such as health, finance, or government identifiers.

7.1 Ad Network Integration & SDK Compliance

Our applications may integrate the following advertising Software Development Kits (SDKs). Each SDK is implemented in compliance with applicable platform policies (Apple App Store Guidelines, Google Play Developer Policy) and applicable privacy laws:

8. Ad Formats & User Controls

Our applications may display the following types of advertisements. Each format has been implemented with user experience and privacy in mind:

8.1 Banner Ads

Standard display banner advertisements shown at designated areas within the app interface (typically at the bottom of screens). These are non-intrusive and can be contextual or personalized based on your consent.

8.2 Interstitial Ads

Full-screen advertisements displayed at natural transition points in the app (e.g., between levels, after completing a task, when opening a new section). Interstitials include a clear "close" or "skip" button, and we ensure they are not shown more frequently than platform policies allow.

8.3 Rewarded Video Ads

Video advertisements that users can choose to watch in exchange for in-app rewards (such as unlocking premium features temporarily, gaining extra content, or removing watermarks). Watching rewarded ads is always optional—users never need to watch ads to use the app's core features.

8.4 Splash Ads

Advertisements displayed when the app is first launched. These typically appear briefly before the app's main content loads. Users can usually dismiss them after a few seconds.

8.5 Native Ads

Ads designed to match the look and feel of the app's content, clearly labeled as "Sponsored" or "Ad" to distinguish them from organic content.

8.6 Ad Controls & Opt-Out

You have multiple ways to control advertising in our apps:

  • In-App Settings: Most apps include an "Ad Preferences" section where you can opt out of personalized ads.
  • Device-Level Controls: iOS: Settings > Privacy & Security > Apple Advertising > toggle off "Personalized Ads". Android: Settings > Google > Ads > toggle on "Opt out of Ads Personalization".
  • Paid Versions: Where available, you can purchase ad-free premium versions of our apps.
  • Industry Opt-Out Tools: Visit YourAdChoices (US) or YourOnlineChoices (EU).

9. Ad Network Partners

Our applications may integrate the following advertising platforms and networks. Each partner is bound by its own privacy policy, and we have provided links to those policies for your review:

9.1 Google AdMob & Google Ad Manager

Google AdMob is one of the world's leading mobile ad platforms. We integrate AdMob SDK in our applications to display banner, interstitial, rewarded video, and native ads. Google's advertising compliance includes support for GDPR, CCPA, COPPA, and other regional regulations.

9.2 Meta Audience Network (Facebook)

Meta Audience Network extends Facebook's advertising to mobile apps. We may integrate this SDK to display various ad formats in compliance with Meta's platform policies.

9.3 Unity Ads

Unity Ads is a major mobile game and app monetization platform. We may integrate Unity Ads SDK to display ads in our applications.

9.4 AppLovin

AppLovin is a global mobile marketing platform. We may integrate AppLovin SDK to display various ad formats.

9.5 ironSource (now Unity)

ironSource provides monetization solutions for app developers. The ironSource SDK may be integrated for ad serving.

9.6 Vungle (now part of Liftoff)

Vungle is a mobile ad network specializing in video advertising, including rewarded video ads.

9.7 Chartboost (now part of Zynga)

Chartboost provides in-app advertising solutions for mobile games and apps.

9.8 InMobi

InMobi is a global mobile advertising platform that may serve ads in our applications.

9.9 TikTok (Pangle / Audience Network)

TikTok's Pangle platform may serve ads in some regions.

9.10 Snap (Snapchat Ads)

Snap's advertising platform may serve ads through Snap Kit integration.

9.11 Twitter (X) MoPub

Twitter's MoPub SDK may be integrated in some of our applications for ad serving.

9.12 Pinterest

Pinterest's advertising platform may be integrated for ad serving.

9.13 Amazon Publisher Services (APS)

Amazon's ad network may serve ads in some of our applications.

9.14 Criteo

Criteo is a retargeting ad network that may serve personalized ads in our applications.

9.15 Taboola

Taboola is a content discovery and native advertising platform.

9.16 Outbrain

Outbrain is a content discovery platform that may serve native ads.

9.17 StartApp

StartApp is a mobile ad network and mediation platform.

9.18 Tapjoy

Tapjoy provides rewarded advertising and offerwall solutions.

9.19 AdColony (now part of Digital Turbine)

AdColony is a mobile ad network specializing in video advertising.

9.20 Smaato

Smaato is a global real-time advertising platform for mobile apps.

9.21 Fyber (now part of Digital Turbine)

Fyber provides ad mediation and programmatic advertising solutions.

9.22 Mintegral

Mintegral is a mobile ad platform providing programmatic advertising solutions.

9.23 Huawei Ads (Petal Ads)

Huawei's advertising platform may serve ads on Huawei devices.

9.24 Yandex Ads

Yandex advertising services for users in Russia and CIS regions.

9.25 MyTarget (VK/Mail.ru Group)

MyTarget is an advertising platform for the Russian-speaking market.

9.26 Ad Network Mediation Platforms

To optimize ad serving and fill rates, we may use ad mediation platforms that automatically select which ad network to serve from. These platforms include:

  • Google AdMob Mediation
  • AppLovin MAX
  • Unity LevelPlay Mediation
  • ironSource Mediation (now part of Unity)

These mediation platforms may collect device-level information to optimize ad delivery, subject to their own privacy policies.

10. Age Restrictions (COPPA, GDPR-K, etc.)

We are committed to protecting children's privacy. Our applications and services are not directed to children under the age limits defined below, and we do not knowingly collect personal information from them without verifiable parental consent.

10.1 United States - COPPA (Children's Online Privacy Protection Act)

  • Children under 13 years of age in the United States are not permitted to use our ad-supported features.
  • Our apps that may appeal to children have ad networks configured in "child-directed" or "tag for child-directed treatment" mode where required.
  • We do not permit behavioral advertising, retargeting, or interest-based advertising for users under 13.
  • Where our apps may attract users under 13, we use only contextual advertising (not based on user behavior) and disable IDFA/GAID collection for such users.
  • Parents who believe their child has provided information to us may contact us at contact@gztongchen.com to request deletion.

10.2 European Union - GDPR & GDPR-K

  • Children under 16 years of age (or younger in some EU member states) require parental consent to process their personal data.
  • Our ad-supported apps are not intended for children under 16 without parental consent.
  • For users in the EU under 16, we do not engage in interest-based advertising without verified parental consent.

10.3 United Kingdom - Age Appropriate Design Code (AADC)

  • We comply with the UK's Age Appropriate Design Code for services likely to be accessed by children.
  • High privacy settings are enabled by default for all users, with no use of personal data beyond what is strictly necessary.
  • Profiling that could result in detrimental treatment of children is disabled.
  • Geolocation tracking is set to high-privacy by default.

10.4 Other Jurisdictions

  • California (CCPA/CPRA): Specific protections for users under 16 in California are respected, including opt-in requirements for sale of personal information.
  • China (PIPL): Special protections for minors under 14 are observed.
  • India (DPDP): Verifiable parental consent for children under 18 is implemented where required.
  • Brazil (LGPD): Specific protections for users under 18 are respected.

10.5 Age Verification

For our apps that include user accounts or ad-supported features, we implement age-screening measures including age gates, default privacy settings, and where appropriate, neutral age screens (as recommended by the UK ICO and FTC). For users verified to be under the applicable age threshold, we disable interest-based advertising and limit data collection to what is strictly necessary for app functionality.

11. International Data Transfers

GZTONGCHEN is based in the United States, and information we collect may be transferred to, stored, and processed in the United States or other countries where our service providers operate.

For users in the European Economic Area (EEA), United Kingdom, or Switzerland, we ensure that any transfer of personal data complies with applicable data protection laws, including:

  • Standard Contractual Clauses (SCCs): Approved by the European Commission for transfers from the EEA to third countries.
  • UK International Data Transfer Agreement (IDTA): For transfers from the UK.
  • Adequacy Decisions: Where applicable, transfers to countries with adequacy decisions from relevant authorities.
  • Data Privacy Framework (DPF): For transfers from the EU/UK/Switzerland to certified US organizations.

By using our services, you understand that your information may be transferred to, stored, and processed in the United States and other countries where our partners operate.

12. Your Rights & Choices

You have the following rights regarding your personal information, subject to applicable law:

  1. Right of Access: Request a copy of the personal information we hold about you.
  2. Right of Rectification: Request correction of inaccurate or incomplete information.
  3. Right of Erasure (Right to be Forgotten): Request deletion of your personal information.
  4. Right of Restriction: Request that we limit the processing of your information.
  5. Right of Portability: Receive your information in a structured, commonly used, machine-readable format.
  6. Right to Object: Object to processing based on legitimate interests or for direct marketing purposes.
  7. Right to Withdraw Consent: Where processing is based on consent, withdraw it at any time without affecting prior processing.
  8. Right to Non-Discrimination: Not be discriminated against for exercising your privacy rights.
  9. Right to Lodge a Complaint: File a complaint with a supervisory authority in your jurisdiction.

To exercise any of these rights, please contact us at contact@gztongchen.com. We will respond within 30 days (or sooner as required by applicable law).

13. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

  • Right to Know: Request information about the categories and specific pieces of personal information collected, the sources, the business purposes, and the categories of third parties with whom information is shared.
  • Right to Delete: Request deletion of your personal information, subject to certain exceptions.
  • Right to Correct: Request correction of inaccurate personal information.
  • Right to Opt Out of Sale or Sharing: We do not sell personal information. We may share information with advertising partners as described in Sections 7-9; you can opt out via your device settings (Limit Ad Tracking on iOS / Opt out of Ads Personalization on Android) or through in-app controls.
  • Right to Limit Use of Sensitive Personal Information: We do not collect sensitive personal information as defined under CPRA.
  • Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA/CPRA rights.

Categories of Personal Information Collected (California): Identifiers (name, email), Commercial information (purchase history if any), Internet activity (usage data), Geolocation data (general location only with consent), Professional information (employer), and Inferences drawn from the above.

"Do Not Sell or Share My Personal Information": To opt out of any potential sharing of personal information for cross-context behavioral advertising, please enable the device-level opt-outs mentioned above or contact us at contact@gztongchen.com.

Shine the Light Law (California Civil Code § 1798.83): California residents may request information about categories of personal information disclosed to third parties for those third parties' direct marketing purposes.

14. European Privacy Rights (GDPR)

If you are in the European Economic Area (EEA), United Kingdom, or Switzerland, you have rights under the General Data Protection Regulation (GDPR) and equivalent national laws.

14.1 Data Controller

GZTONGCHEN is the data controller for personal data collected through our website and customer support channels. For data processed by third-party ad networks through our applications, those networks may act as joint controllers or independent controllers under their own privacy policies.

14.2 Data Protection Officer

For GDPR-related inquiries, you can contact our Data Protection Officer at contact@gztongchen.com.

14.3 Supervisory Authority

You have the right to lodge a complaint with your local data protection supervisory authority. A list of national supervisory authorities is available at https://edpb.europa.eu/about-edpb/about-edpb/members_en.

14.4 International Transfers

As described in Section 11, transfers from the EEA/UK/Switzerland to the US are protected by Standard Contractual Clauses.

15. Data Security

We implement industry-standard technical and organizational measures to protect your information, including:

  • Encryption in transit (TLS 1.3) and at rest where applicable
  • Access controls and authentication
  • Regular security assessments and vulnerability testing
  • Employee training on data protection
  • Incident response procedures
  • Regular backups and disaster recovery planning

However, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security of your data.

In the event of a data breach affecting your personal information, we will notify you and applicable authorities in accordance with applicable law.

16. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements.

  • Contact Form Submissions: Retained for up to 2 years for business purposes, unless you request earlier deletion.
  • Support Emails: Retained for up to 3 years for quality and training purposes, then anonymized or deleted.
  • Server Logs: Retained for up to 90 days, then anonymized.
  • Aggregated Analytics: Retained indefinitely, but in anonymized form that cannot identify individuals.
  • Local Application Data: Retained on your device until you delete the app or clear app data.

17. Children's Privacy

Our applications and services are not directed at children under the age thresholds defined in Section 10. We do not knowingly collect personal information from children without verifiable parental consent.

If we learn that we have inadvertently collected personal information from a child without proper consent, we will delete that information as soon as possible. Parents who believe this has occurred may contact us at contact@gztongchen.com.

18. Third-Party Links & Services

Our website and applications may contain links to third-party websites, services, or resources. We are not responsible for the privacy practices of those third parties. We encourage you to read the privacy policies of every website and service that collects your personal information.

Our applications may use the following third-party services (in addition to ad networks listed in Section 9):

  • Apple App Store / iCloud: Subject to Apple's Privacy Policy
  • Google Play Store: Subject to Google's Privacy Policy
  • Analytics (if used): Self-hosted or privacy-respecting alternatives only
  • Crash Reporting: Self-hosted or privacy-respecting alternatives only

19. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will:

  • Update the "Last updated" date at the top of this policy
  • For material changes, provide prominent notice (e.g., via email, in-app notification, or banner on our website)
  • Where required by law, request your consent for the new practices

We encourage you to review this Privacy Policy periodically to stay informed about our information practices.

20. Contact Us

If you have any questions about this Privacy Policy, our data practices, or wish to exercise your rights, please contact us:

GZTONGCHEN
Rochester Innovation Center
Rochester, NY 14604
United States

Email: contact@gztongchen.com
Support: support@gztongchen.com
Privacy Inquiries: contact@gztongchen.com (Subject: Privacy)

For users in the European Economic Area, you may also contact our Data Protection Officer at the same email address.

This Privacy Policy is effective as of July 2, 2026, and was last updated on July 2, 2026.
Version 3.2 · Previous versions are available upon request.
Title
Message