YeeDot1. Information processing list
Items marked optional are processed only after you use or enable them and complete the required authorization. Disabling them does not affect local bookkeeping or forecasting.
| Scenario | Information or permission | Purpose | Method | Required? | Trigger | Location and retention | Control |
|---|---|---|---|---|---|---|---|
| Local ledger and forecasts | Account names, balances, transactions, categories, notes, plans, forecasts | Bookkeeping, cash-flow calculation, and risk notices | On-device only | Core data required; notes optional | You enter or import data | On-device until deleted or cleared | Delete records, clear data, or uninstall |
| Screenshot and payment-result recognition | Bill screenshots and image text you provide; WeChat or Alipay payment notifications after opt-in; the direct build can read visible payment-result content | Create an on-device draft for your confirmation | On-device OCR with iOS Vision or bundled Android ML Kit; notification and accessibility recognition run only after the matching opt-in | No | You share a screenshot, run the Shortcut, or separately enable notification/accessibility recognition | Source image deleted after processing; on-device draft kept until confirmed, cancelled, or cleared | Do not share screenshots, or disable the relevant recognition setting in the app/system |
| Reminders and privacy | Reminder time, plan dates, biometric result, privacy settings | Notifications, app lock, hidden amounts | System and local database | Optional | You enable it | On-device until disabled or cleared | App or system settings |
| Import, export, and share | Files or exports you select | Migration, backup, or sharing | System picker or share sheet | Optional | You select | Your chosen destination determines it | Cancel or delete exported files |
| Website visit | IP, time, path, User-Agent, response status | Delivery, security, troubleshooting | EdgeOne logs | Required for website delivery | Visit website | Shortest period required by settings and law | Stop visiting; no website cookie |
| Direct updates | IP, time, app version, channel, download request | Check, download, and verify updates | HTTPS manifest and APK | Check optional; download user-triggered | Check or confirm download | Minimum necessary delivery-log period | Do not check or download |
| Account and cloud backup — optional | Email, Apple identifier, session, device metadata, per-ledger snapshots, workspace manifest | Authentication, device management, backup and restore | Encrypted transport; not end-to-end encrypted | Only for online feature | You register or sign in and enable cloud backup | For the account lifetime; active data deleted after account deletion and infrastructure backups expire by rotation | Disable backup or delete cloud account |
| Anonymous analytics — optional | Separate random ID, allow-listed event, version, time | Understand feature operation | Separated from account and ledger | No | You enable it | Sending stops when disabled; historical events for the installation ID can be deleted on request | Disable and request deletion |
| Feedback — optional | Category, message, optional contact | Investigate and respond | Submitted by you | No | You submit | Minimum needed to resolve and meet duties | Do not submit or request deletion |
| YeeDot AI — optional | Prompt, 12 recent turns, minimal cash-flow context | Draft cash-flow explanations | Via YeeDot to a disclosed provider | No | You sign in, enable AI, and complete provider-specific consent | On-device history: up to 50 messages and 30 days; short-lived server run metadata: up to 24 hours | Decline or withdraw AI consent |
2. Android permissions and system capabilities
| Scenario | Information or permission | Purpose | Method | Required? | Trigger | Location and retention | Control |
|---|---|---|---|---|---|---|---|
| Network | INTERNET | Updates and online features you choose | HTTPS | Not for local core | Update check or online feature | Permission itself is not stored | Do not use online features or restrict network |
| Reminders | POST_NOTIFICATIONS | Show local reminders | Android notifications | Optional | You enable and allow | Settings remain on-device | App or system settings |
| App lock | USE_BIOMETRIC | System biometric unlock | System returns success or failure only | Optional | You enable and verify | No fingerprint or face template is read or stored | Disable app lock or system biometrics |
| Restore reminders | RECEIVE_BOOT_COMPLETED | Restore local reminders after restart/update | Receive system event | Only for reminders | Restart or app update | No device content collected | Disable reminders or background access |
| Install direct update | REQUEST_INSTALL_PACKAGES | Let Android install a confirmed official APK | Android confirmation UI | Only for direct updates | You confirm install | No installed-app list is collected | Decline or disable source permission |
| File import/export | System file picker | Read selected file or save export | Per-file system grant | Optional | You select | No broad storage permission | Cancel or delete export |
| Share | System share sheet | Send selected export to chosen app | System and user choice | Optional | You share | Chosen app's policy applies | Cancel sharing |
| Payment notification recognition | Android notification access; WeChat or Alipay payment-result notifications | Create an on-device draft for confirmation | Matches allow-listed sources and payment fields only; source content is excluded from logs, analytics, and cloud backup | Optional | You enable it in both the app and system settings | Source notification not retained; local draft kept until confirmed, cancelled, or cleared | Disable it in the app or Android notification-access settings |
| Payment-result accessibility enhancement | Android accessibility service in the direct build; visible WeChat or Alipay payment-result content | Supplement an on-device draft for confirmation | Read-only matching of visible payment results in allow-listed apps; the Play build does not include this service | Optional | You install the direct build and separately enable it in system settings | Source screen content not retained; local draft kept until confirmed, cancelled, or cleared | Disable it in the app or Android accessibility settings |
3. Scope and updates
A declared permission is not the same as collecting personal information. System biometrics, for example, return only an authentication result.
Before every release, compare this list with platform manifests, store privacy labels, and real network traffic. New permissions, SDKs, recipients, or purposes require an updated list and version first.