Privacy Policy
Last updated 7 August 2026
The files you check never leave your device. Every check runs on your phone. Nothing you scan — no image, video, document, or text — is ever uploaded, and there is no server that holds your content. There is no account, no advertising, and no tracking.
The app does collect anonymous usage statistics — which screens you open, which button started a check, and what kind of result it produced. Never the file, its name, or anything inside it. Details below.
What the app stores, and where
Everything below stays in the app's own storage on your device. It is included in your device backups if you have those enabled, and it is deleted when you delete the app.
| Data | Why | Your control |
|---|---|---|
| Scan history — the verdict, the evidence list, a small thumbnail, and the time of the check | So you can look back at a previous result | Settings ▸ Keep history. Turning it off deletes what was stored, including thumbnails. History ▸ Clear removes it at any time. |
| Two preferences — whether onboarding was completed, and the keep-history setting | So the app behaves the way you left it | Removed with the app |
| Temporary copies of a file being checked | Some formats must be read from disk (video hashing, documents) | Replaced on the next scan and cleared by the system; cancelling a scan deletes the copy immediately |
What the app accesses while you use it
- Photos you pick. Selection uses Apple's system photo picker, which runs outside the app. Citizenship receives only the item you chose and never gets access to your photo library — which is why it never asks for photo permission.
- Files you choose or share. Only the specific file you select, or the one you send in via the share sheet.
- The clipboard, only when you tap Paste. The app checks whether the clipboard holds an image or text so it can enable or grey out the Paste row; it reads the contents only when you explicitly tap it.
The share extension behaves the same way, and writes no history at all.
Usage analytics
To understand which parts of the app are actually used, Citizenship sends anonymous product-usage events to Amplitude, an analytics provider based in the United States. This is the only network request the app makes.
What is sent:
- When the app is launched, and which screens you open.
- Which control started a check — the Photos tile, the Files tile, Browse, or Paste.
- For a completed check: the kind of file (image, video, audio, document or text), the result band, and roughly how long it took, rounded to a range such as "1–3s".
- A random identifier created the first time you open the app, so that repeat use is counted as one person rather than many. It is not your device's identifier, it is shared with no one, and deleting the app discards it.
- Your device model, system version, app version, and language.
What is never sent: the file itself, its name, its size, its dimensions, its contents, any thumbnail, any text you paste, or any of your history. Your IP address, city and region are switched off in our configuration, as are your mobile carrier and Apple's vendor identifier.
These events describe how the app is used. Because a completed check reports its result band, they do reveal that someone checked a file of a certain kind and what the app concluded — never which file, and never anything inside it.
Analytics is on by default, and the app does not currently offer a switch to turn it off. If you would like your data excluded or deleted, write to the address below.
What is never collected
No personal information, no contact details, no location, no advertising identifier, no crash or diagnostic reports, and no content from any file you check. Nothing is sold, and nothing is shared with data brokers. The app performs no cross-app or cross-site tracking, and its App Store privacy manifest declares no tracking.
Children
The app is not directed at children. It collects no personal information from anyone, regardless of age; the usage statistics described above are anonymous.
Changes
If a future version ever transmits the contents of a file you check — for example an optional cloud check — this policy will be updated before that version ships, and the app will ask for your explicit consent each time, on a per-scan basis. No such feature exists today.
Contact
Questions about this policy: [email protected]
隐私政策
最后更新：2026 年 8 月 7 日
你检测的文件不会离开设备。所有检测都在你的手机上完成， 你扫描的任何内容——图片、视频、文档或文本——都不会被上传，也没有任何服务器保存你的内容。 没有账号、没有广告，也没有追踪。
应用会收集匿名的使用统计——你打开了哪些界面、 通过哪个按钮发起检测，以及得到了哪一类结论。绝不包含文件本身、文件名或其中的任何内容。 详见下文。
应用存储什么，存在哪里
以下内容全部保存在设备上应用自己的存储空间中。若你启用了设备备份，它们会包含在备份内； 删除应用时会一并删除。
| 数据 | 用途 | 你的控制方式 |
|---|---|---|
| 检测历史——结论、证据列表、一张小缩略图与检测时间 | 方便你回看此前的结果 | 设置 ▸ 保留历史记录。关闭即删除已存储内容（含缩略图）。历史记录 ▸ 清除可随时清空。 |
| 两项偏好设置——是否已完成引导，以及是否保留历史记录 | 让应用保持你上次的使用状态 | 随应用一并删除 |
| 被检测文件的临时副本 | 部分格式必须从磁盘读取（视频哈希、文档） | 下次扫描时替换，并由系统清理；取消扫描会立即删除该副本 |
使用期间应用会访问什么
- 你选择的照片。选择过程使用 Apple 的系统照片选择器，它在应用之外运行。 Citizenship 只会收到你选中的那一项，永远无法访问你的照片图库——这也是它从不索取照片权限的原因。
- 你选择或分享的文件。仅限你选中的那个文件，或你通过分享面板发送进来的文件。
- 剪贴板，且仅在你点按「粘贴」时。应用会检查剪贴板中是否有图片或文本， 以便决定「粘贴」一行是可用还是置灰；只有在你明确点按时才会读取其内容。
分享扩展的行为完全相同，并且不写入任何历史记录。
使用统计
为了解应用的哪些部分真正被使用，Citizenship 会向 Amplitude（一家位于美国的分析服务商） 发送匿名的产品使用事件。这是应用发起的唯一网络请求。
会发送的内容：
- 应用何时启动，以及你打开了哪些界面。
- 通过哪个控件发起检测——照片磁贴、文件磁贴、浏览或粘贴。
- 检测完成时：文件的类别（图片、视频、音频、文档或文本）、结论分级， 以及大致耗时区间（例如「1–3 秒」）。
- 首次打开应用时生成的一个随机标识符，用于把重复使用计为同一个人而非多人。 它不是你的设备标识符，不与任何人共享，删除应用即失效。
- 设备型号、系统版本、应用版本与语言。
绝不会发送的内容：文件本身、文件名、大小、尺寸、内容、任何缩略图、 你粘贴的任何文本，以及你的任何历史记录。我们在配置中关闭了 IP 地址、城市与地区， 同时也关闭了运营商信息与 Apple 的供应商标识符（IDFV）。
这些事件描述的是应用如何被使用。由于检测完成时会上报结论分级，它们确实会显示 「有人检测了某一类文件」以及应用得出的结论——但绝不包含是哪个文件，也绝不包含其中的任何内容。
使用统计默认开启，应用目前未提供关闭开关。若你希望排除或删除自己的数据， 请通过下方邮箱联系我们。
绝不收集的内容
不收集个人信息、联系方式、位置、广告标识符、崩溃或诊断报告，也不收集你所检测文件的任何内容。 不出售任何数据，不与数据经纪商共享。应用不进行跨应用或跨网站追踪，其 App Store 隐私清单声明无追踪。
儿童
本应用并非面向儿童。无论年龄，应用都不收集任何人的个人信息；上述使用统计为匿名数据。
政策变更
如果未来版本会传输你所检测文件的内容——例如可选的云端检测——本政策会在该版本发布前更新， 并且应用会在每次扫描时单独征求你的明确同意。目前不存在此类功能。
联系方式
关于本政策的问题：[email protected]