Scope
M-Jot (晓账) is operated by XIAOWEN YUAN, an individual developer using the Google Play developer name Xiaowen Studio, with China as the registered developer country. The official website is https://m-jot.com.
This policy covers the M-Jot app, account services and website. Reading these policies requires no login; accounting and cloud account features require the relevant account. See the contact information on this page for privacy inquiries.
Accounts and identity
For email registration, verification-code login, password setup and password reset, we process your email, verification results, account identifiers and password verification information to create accounts, verify identity and protect sessions. Password login requires your credentials. SMS registration and login are not currently available.
If you choose Google sign-in or linking, we receive and verify Google credentials and process the Google identifier, email, name and profile image returned with authorization. First sign-in may create a M-Jot account. Linking or unlinking changes your sign-in methods; it does not delete your Google account or M-Jot records.
You can update your nickname and profile image. Profile and ledger cover images are optional. Account relationships, sessions, language, time zone and default currency support sign-in and accurate display.
Entries, ledgers, budgets and recurring entries
Amounts, income/expense types, currencies, dates, categories, notes, ledgers and membership relationships that you create or import support saving, synchronization, statistics and collaboration. Budget amounts, ledgers, categories, periods and alerts support budget calculations. Recurring templates and execution results support scheduled entry creation.
This information is needed for the accounting features you choose. Notes, photos and locations are optional. Recurring entries create accounting records; they do not charge a bank or payment account.
Files you select for WeChat or Alipay statement import are uploaded to our backend for parsing and preview. This does not give us access to your accounts on those platforms. Import preview sessions expire after 30 minutes; cancelling clears the session. Confirmed entries are retained as business records. Export creates files; you and your recipients manage copies saved or shared outside the app.
Optional images and location
When adding entry photos, profile images or ledger covers, the app reads the images you select or take and uploads them. The server saves images and generates thumbnails or size variants. Images may contain metadata such as capture time or location; check and remove information you do not wish to provide before uploading.
Entry photos and location are VIP features. The app requests system location access as needed only when you actively add an entry location or use the current-location feature. Viewing a saved location does not request new location permission. Locations saved with an entry are uploaded with that entry, including manually selected points. The device caches recently selected locations and location history.
Refusing camera, photo or location access does not prevent entries without this content. Map services also process network requests and SDK data as described separately.
In-app feedback and support
In versions that support in-app feedback, signing in and selecting Submit sends your feedback category, text, optional contact details and selected photo or video attachments to M-Jot. The submission is linked to your account and includes the entry point, app version and build number, platform, operating-system version, device model and interface language for troubleshooting, handling your request and replying where possible. Contact details and attachments are optional; choosing not to send feedback does not prevent ordinary accounting.
Feedback accepts up to three selected photos or videos through the system picker. This feature does not record video or audio. Selected files may contain faces, voices, account details or location metadata. Review them before submitting and remove information you do not intend to provide, including other people’s private information. Do not include passwords, verification codes or full purchase tokens.
Selecting attachments alone does not upload them. After you select Submit, text, contact details and diagnostics may reach the server before the attachments finish uploading. Cancelling an upload or closing the app does not immediately erase data already received. Incomplete submissions are cleared by background cleanup after their validity period expires; failures can delay cleanup. The device also keeps temporary attachment copies and a minimal account-linked submission identifier to check uncertain results.
Only authorised support staff can access feedback under the applicable permissions; attachments do not have public download links. When support marks feedback as handled, access to its attachments is revoked and the files are deleted, with retries if cleanup fails. The submitted text, contact details, diagnostics and handling records are not automatically erased by this action and have no fixed automatic expiry. They remain available for follow-up and troubleshooting until separately cleared.
On permanent account deletion, feedback is detached from the account, contact details and diagnostics are cleared, and attachments are deleted through the cleanup process. Submitted text and necessary handling records remain and have no fixed automatic expiry. Text may still identify you if you included personal information, so this is not a promise of complete anonymisation. Use the privacy email to request further deletion and identify the feedback number where available; we will explain any necessary retention in the response.
The website and sign-in help provide an email contact route. You choose what to send through your email app; opening a mail link does not send a message or complete a deletion request. If your installed version does not provide in-app feedback or the service is unavailable, use this email route.
Device information, logs and website visits
The app processes device model or name, platform, app version, language, time zone, and request IP addresses, sessions and operation results for sign-in security, compatibility and troubleshooting.
Runtime logs stored on your device may contain entries, profile information, locations and errors. They rotate by size; you can view, clear or export them from the log page. Check their contents before sharing. Server application-log archives are cleaned using a maximum of 7 days together with size limits; active logs remain until rotation. Other runtime logs rotate by size. These rules do not apply to entries, images or transaction records.
There is no separate advertising, general behavioural analytics or automatic crash-reporting SDK. See Third-party Services for Mapbox telemetry and metrics processed by the Google ML Kit scanning component.
When you visit the website, hosting and network services process requests, IP addresses and browser information to deliver pages and protect the service. The website feedback page provides an email contact route; content is sent only when you send the message from your email app. The website saves your language choice in a cookie valid for one year only when you manually select a language. Without a saved choice, it reads your browser’s preferred languages to choose the page language.
Subscriptions and transaction information
For Google Play VIP purchases, Google handles payment account and payment-method information. M-Jot receives product/base-plan identifiers, purchase tokens, order identifiers, subscription status and periods, amounts, currencies and refund results. An obfuscated identifier linked to your M-Jot account supports ownership verification, restoration, entitlements, reconciliation and duplicate prevention. M-Jot does not receive your full card number.
Purchase tokens and pending states may be stored in device secure storage to recover interrupted purchases. Your Google sign-in, M-Jot account and Google Play payment account may differ. Restore using the original corresponding accounts.
Storage, protection and retention
Cloud data is stored in the United States. Devices also hold local entries, images, settings and logs. Providers of sign-in, payments, maps and email may process necessary data in other countries or regions.
No scheduled off-server business-data backups are currently configured. Server or storage failures may cause data loss; keep your own copies of important records.
We use HTTPS for transmission and device secure storage for sign-in credentials. Entry images are accessed according to ledger permissions. Other signed-in users with a profile or cover-image address may access that image; do not upload private identity documents. These measures do not mean that all local data is encrypted or that end-to-end encryption is provided.
Cloud data needed to provide the service is retained while the account is in use. Deleting an individual entry does not immediately erase every stored copy. Permanent account deletion has no cooling-off or recovery window and removes identity, login and personal accounting data. Other members’ records and necessary transaction records follow the Account and Data Deletion rules.
After deletion, orders, refunds, purchase tokens, payment notifications and necessary associations are retained separately from the login account for refunds, reconciliation, late notifications and preventing incorrect reassignment of old purchases. They are not automatically deleted with the account and have no fixed automatic expiry; they remain until manual cleanup. They are not used to restore a deleted identity or grant old membership to a new account. Server logs follow the rules above; exports and copies held by third parties are managed separately.
Service regions and international processing
The initial Google Play launch is planned for Singapore, Australia, New Zealand and the United States. Actual download and subscription availability is shown on the relevant store page. You do not need to be in these countries to read this policy.
Google, Mapbox, email and network providers may process information needed for their services outside your country or region. You may choose not to use optional Google sign-in or maps; email verification, cloud accounting and existing transactions still require their respective services. See Third-party Services for providers, purposes and privacy policies.
Access, correction, export and deletion
You can view and correct profile or entry information, delete records within your permissions, use entry export where your account has that entitlement and revoke optional permissions in system settings. Revoking a permission does not automatically erase information already uploaded.
Use the contact channel on this page for privacy requests. Statutory personal-data rights do not require a VIP purchase. Provide only what is needed to identify the account and describe the request; do not email passwords, verification codes, full purchase tokens or unrelated entries. Reading these instructions, signing out or uninstalling does not complete deletion.
Minors
M-Jot is intended for personal and household accounting by users aged 18 and over and is not directed at children. This does not mean that every user’s age has been verified. A store content rating is not the age requirement for registration, contracts or personal-data processing.
If you or a guardian believe we process a minor’s personal information, contact the privacy email on this page to request access, correction or deletion. Verification and handling follow applicable age, guardianship and data-protection requirements. Do not upload children’s information to shared ledgers or images without authority to do so.
Policy changes
When features, providers or processing rules change, we update this page and its revision date. Changes requiring notice or consent should also be explained in the relevant feature, with consent obtained where required. A revision date does not establish your consent to new processing.