Privacy Policy

Optaxis · Last updated: June 3, 2026

Overview

Optaxis is the official app for medium format, large format, technical-camera, 135 flagship and film photographers. It offers professional calculators (Scheimpflug, DOF, FOV, hyperfocal, star trail, Milky Way, timelapse, print size, shift correction, focal-length conversion, ND, reciprocity), the AR composition viewfinder, lens database, equipment archive, gear comparison, global player map, gallery & collections, hashtag aggregation, photo challenges, full-featured chat (recall/edit, quote, reactions, read receipts, search, view-once, group announcement, file transfer, in-chat camera), TRTC voice/video calls (with in-call camera & live image annotation), shooting plans & logs (with cloud sync), the @Xiaoguang AI assistant, follows/friends, photo-spot sharing, brand verification, four-language tutorial articles, password recovery, and more — with a 4-language UI. We respect your privacy and this policy describes how we collect, use, and protect your information.

Information We Collect

• Location (optional): used for weather queries and the global player map (city-level only — no precise coordinates collected). Disable any time in system settings.
• Username & avatar (optional): stored locally on your device. When you join the global map, your username is uploaded.
• Email address: when you register or sign in with email, your address is stored by our authentication provider (Supabase Auth) to identify your account, secure sign-in, and enable password recovery. If you use Sign in with Apple, Apple may provide a private relay address instead.
• Equipment data: bodies, lenses, backs, filters, kits and film inventory you add are stored locally (SwiftData) for offline use, and synced to our server (Supabase tables user_equipment / user_kits / user_film_rolls) for cross-device consistency and reinstall recovery.
• Public map info (optional): if you join the global player map, your username, city, featured photo and chosen equipment are stored on Supabase and visible to other users.
• Posts & interactions (optional): photos, descriptions, shooting city, focal-length info, likes and comments are stored on the server and visible to others.
• Post edit history (optional): when you edit a published post, the change history (photos, captions, descriptions, city, gear) is stored for moderation and version tracking.
• EXIF metadata: when you upload photos (chat or posts), the App auto-extracts camera, focal length, aperture, shutter, ISO and other shooting parameters. Stored alongside the message/post and may be visible to others.
• Chat messages (optional): text, images, files (PDF/DOC/XLS/ZIP up to 5 MB), gear cards, shoot parameters, location, before/after — transmitted and stored via Tencent Cloud IM. Group chat and pinned-message state are additionally stored on Supabase for cross-device sync and search. DMs are visible only to participants; group messages to group members.
• Content filtering: chat messages are filtered locally for inappropriate or politically sensitive terms (replaced with “***” before sending). The original content is not transmitted.
• Group management: your role (member / admin / owner) and management state (muted / image-restricted) are stored on the server. Owners and admins can see members’ status.
• Friends (optional): friend requests sent and received, plus friendship state, are stored on the server.
• Follows (optional): following and follower lists are stored on the server. Other users can see counts and mutual-follow status. New posts from followed users may trigger push notifications.
• Read receipts: read/unread state is stored on the server so senders can see whether their messages have been read.
• View-once messages (optional): if enabled, messages auto-delete from the server after the chosen window (24 h, 7 days, or 90 days). Once expired, content cannot be recovered.
• Voice/video calls (optional): audio/video streams flow in real time via Tencent TRTC and are not stored on our servers. Call logs (caller, receiver, duration, type) are stored for history. Photos taken with the in-call camera, shared images, and live annotations (circles / drawings) are sent as ordinary chat messages and follow chat-storage rules.
• Multi-image posts (optional): each additional image’s URL, sort order, aspect ratio and per-image shooting parameters are stored on the server.
• AI assistant interaction (optional): if you use the Lumi AI assistant, your prompts and AI responses are stored on our servers (Aliyun, encrypted) and used to improve service quality: analyzing common questions to improve responses, building knowledge bases, and (with your explicit consent) training proprietary photography AI models. You can opt out of "service improvement" analytics or "model training" separately in Settings → Privacy → AI Data. If you enable model training, your raw conversations are retained for up to 4 years for that purpose; turning it off deletes the retained raw data within 30 days. We never sell your conversations or share them with third parties.
• Camera permission (optional): the in-chat camera and AR viewfinder require camera access — used only when you actively trigger them, never in the background.
• Precise location (optional): chat location sharing uses GPS via MapKit. Shared location is part of the message and visible to participants. Triggered only on demand — never in the background.
• Subscription credential: if you are a Pro subscriber, the App generates a QR code containing your user ID, plan, transaction ID and HMAC signature for presentation to dealers.
• Photo challenges (optional): submitted works and voting records are stored on the server.
• Galleries & portfolios (optional): portfolios you create, collected works and appreciation votes are stored on the server.
• Photo spots (optional): spot name, coordinates and description are stored on the server and visible to other users.
• Meetup status (optional): your status (e.g., “Shooting”, “Looking for meetup”) is visible to other users.
• Verification (optional): if you apply for brand verification (ALPA, Cinema Lens, Leica, Hasselblad, Fuji, Large-Format Film), submitted serial numbers/models and credential photos are stored and visible to admins only. Approved badges become public.
• Tutorial articles (optional): articles or reviews you submit are stored on the server and visible to others.
• Group events (optional): shoot events you create or join in groups are stored on the server, visible to group members.
• Shooting plans (cloud + local, optional): title, location, date, time of day, notes, priority, linked log, and reference cover are now cloud-synced across your devices, with local offline cache retained. Reference covers (≤1024 pt / ~150 KB) are stored on our OSS (path plan-covers/), visible only to you. (Supersedes the earlier local-only description.)
• Shooting logs (local + cloud, optional): gear, exposure, weather, notes are stored locally (SwiftData) and cloud-synced via our server. With Film Mode enabled, the log adds film-specific fields (stock, roll, holder, metering method, reciprocity comp, push-pull processing, developer). Attached photos are uploaded full-size to OSS (path shooting-logs/), visible only to you.
• Daily inspiration (read-only, optional): Daily Inspiration in the Discover tab is admin-curated and stored on Supabase. Inspiration items, source post links and push delivery records are public. Viewing inspiration uploads no personal data; opt-in push delivers new entries to your device.
• Device sensors (optional): the AR viewfinder uses compass and gyroscope data locally for azimuth overlays — not uploaded to the server.
• Language preference: the App supports a 4-language UI (Simplified Chinese, English, Traditional Chinese, Japanese). Your language preference is stored locally.
• Device identifier: we use IDFV (identifier for vendor) to identify users; we do not use IDFA (Apple advertising identifier).
• Usage analytics (anonymized): in-app activity — screens viewed, features used, sign-up / subscription milestones — is collected to understand how the app is used and improve it. Your account ID is hashed before sending; no email, name or content is included. Processed by PostHog (United States) — see Third-Party Services.
• Reports & blocks (optional): when you report content or users, reason and description plus the reported content identifier are stored on Supabase for moderation. Block relationships are stored so blocked users’ content stops appearing.

How We Use Information

• Provide weather queries (location data).
• Show player distribution on the global map (city-level only).
• Display equipment users choose to make public.
• Provide post publishing, browsing, liking and commenting.
• Provide DMs and group chat.
• Apply local sensitive-word filtering for community health.
• Provide group management (roles, mute, image restriction).
• Provide friend management.
• Provide follow/follower social graph and mutual-follow indicators.
• Display read receipts.
• Auto-delete view-once messages on schedule.
• Process @Xiaoguang prompts and generate replies.
• Provide AI photo critique, article summary, bio generation, and voice-to-text.
• Provide in-chat camera (camera permission required).
• Display shooting parameters and shared location in chat.
• Auto-extract and display photo EXIF parameters.
• Generate subscription credential QR for dealer presentation.
• Provide photo challenge submission and voting.
• Provide gallery appreciation and portfolio management.
• Provide photo-spot sharing and meetup status.
• Provide brand verification review (ALPA, Cinema Lens, Leica, Hasselblad, Fuji, Large-Format Film).
• Provide tutorial article publishing and reviews.
• Provide event organization and shooting plans.
• Compute astronomical azimuth in the AR viewfinder (local processing).
• Process reports, review violations, maintain community safety.
• Maintain user block lists and filter blocked users’ content.
• Accelerate image delivery via CDN.
• Display the UI in your preferred language.
• Sync equipment across signed-in devices via our server (Supabase).

Where Data Lives

• On-device: preferences, language, cache; equipment archive (SwiftData) for offline use, also synced to our server (see below).
• Equipment sync: bodies, lenses, backs, filters, kits and film inventory sync to Supabase (Singapore region — tables user_equipment / user_kits / user_film_rolls) for cross-device consistency and reinstall recovery. We do not use Apple iCloud / CloudKit for equipment sync.
• Server: structured data (map, posts, likes, comments, group messages, friends, EXIF, shared locations, shooting logs with photos, pinned message state) lives on Supabase (Singapore). Photos, chat files and originals live on Alibaba Cloud OSS (Singapore, bucket alpa-photos-sg). DM contents are stored and delivered by Tencent Cloud IM.

User-Generated Content

Posts and comments you publish are public. Chat messages are semi-public — visible only to participants. Please note:

• Do not include sensitive personal info in posts, comments or chat.
• You can delete your posts and comments at any time.
• Post authors can delete any comment under their work.
• DMs are visible only to participants; group messages only to group members.
• Locations, photos and EXIF shared in chat are visible to participants.
• We reserve the right to remove violating content.

Information Sharing

We do not sell or rent your personal information. Apart from the service providers listed in the Third-Party Services section below (who process data on our behalf under our instructions), we share information only in these cases:

• Map information you actively choose to make public (username, city, equipment, featured work).
• Posts and interaction content (comments, likes) you publish.
• Messages you send in chat (visible only to participants).
• Subscription credentials you voluntarily present (QR contains user ID, plan, etc.).
• As required by laws and regulations.

Third-Party Services

• Apple WeatherKit: real-time and 10-day forecast for map weather, spot details and shoot-plan weather cards. WeatherKit attribution follows Apple’s requirements (legal-attribution).
• Apple MapKit: map services (uses AutoNavi/Amap data in mainland China).
• Apple Push Notification service (APNs) + PushKit: system pushes (likes, comments, follows, DMs, events, daily inspiration) and VoIP pushes (incoming calls). Only device tokens and notification payloads are sent — no private data.
• Supabase (Singapore): structured data — global map, posts, likes, comments, group messages, friends, shooting logs/plans, pinned message state. Provides Auth and PostgREST.
• Cloudflare CDN: image delivery acceleration (cdn.dakaolaapp.com). Collects no additional user data.
• Alibaba Cloud OSS (Singapore, bucket alpa-photos-sg): photo and file storage for posts, chat photos and files, avatars, log/plan attachments.
• Tencent Cloud IM (ImSDK): DMs (text, images, files, view-once) transmission and storage; call signaling and in-chat call records also flow through IM. We trigger notification events server-side via IM to deliver offline APNs pushes.
• Tencent Cloud TRTC: real-time 1-on-1 voice/video. Audio/video streams are not stored on our or Tencent’s servers.
• Tencent Cloud TPNS: relays offline pushes from IM backend to APNs. Only tokens and payloads transmitted.
• Tencent Cloud Translation (TMT): auto-translates post titles, descriptions, Tips/News articles for multilingual display. Not used for other purposes.
• AI services (Alibaba Cloud DashScope Qwen): @Xiaoguang assistant, photo critique, article summary, bio generation, voice-to-text — proxied via our Vercel Functions and IP-routed: China users via DashScope-CN (Beijing), overseas via DashScope-INTL. Submitted images and text are used solely to generate the immediate result and not for model training.
• Alibaba Cloud Content Moderation: publishing posts, comments and chat text/images are screened for violations (NSFW, violence, political, ads). Only the content under review is transmitted; Alibaba Cloud does not persist it after moderation.
• Sentry (crash & error monitoring): stack traces, device model, iOS version, App version, and a pseudonymous account identifier (your account UUID). No IP addresses, screenshots, or view hierarchies. Email support@optaxis.app to request deletion of related Sentry events.
• PostHog (product analytics, United States): receives anonymized in-app usage events (screens viewed, features used, sign-up / subscription milestones) so we can understand product usage and improve the app. Your account ID is hashed before it is sent; we never send your email, name, or content. Data is hosted in the United States.
• Apple StoreKit 2 / Apple Server Notifications V2: subscription purchases, renewals and refunds are handled by StoreKit 2 and asynchronously relayed to our servers. We store only the fields required (plan type, original transaction ID, expiry, status); we never access Apple payment credentials or card details.

These services have their own privacy policies — please review them.

Data Security

We take reasonable technical measures including HTTPS encryption and Supabase Row Level Security (RLS). However, no method of internet transmission is 100% secure.

Children’s Privacy

The App is not intended for children under 13. We do not knowingly collect personal information from children.

Your Rights

• Disable location permissions in system settings any time.
• Delete local equipment data any time.
• Leave the global player map and delete your public info any time.
• Delete posts and comments any time.
• Delete chat messages any time.
• Remove friends any time.
• Unfollow other users any time.
• Disable camera permissions in system settings any time.
• Switch UI language any time.
• Contact us to request deletion of all data related to you.

Data Retention & Account Deletion

We retain personal data only as long as needed to provide the service or as required by law. Content you create (posts, comments, logs, equipment) is kept until you delete it or delete your account. Chat messages are retained on Tencent Cloud IM for offline delivery (group messages mirrored on Supabase for sync); view-once messages auto-delete on your chosen schedule. When you delete your account (in-app or by emailing support@optaxis.app), we permanently delete or anonymize your personal data within 30 days, except where longer retention is legally required (e.g., transaction records for tax/audit); residual copies in encrypted backups are purged within 90 days. De-identified, aggregated data that can no longer identify you may be retained.

EEA / UK Users (GDPR)

If you are in the European Economic Area or the United Kingdom, the GDPR applies. The data controller is Optaxis (see Contact below). We process your data on these legal bases: performance of our contract with you (providing the app and account), your consent (optional features such as location, AI training, and push notifications — withdrawable any time), our legitimate interests (security, abuse prevention, and service improvement), and legal obligations. You have the right to access, rectify, erase, restrict, or object to processing, to data portability, and to withdraw consent. You may also lodge a complaint with your local supervisory authority. To exercise these rights, email support@optaxis.app. Some data is processed on servers in Singapore and other regions; such international transfers rely on appropriate safeguards (e.g., Standard Contractual Clauses).

California Users (CCPA/CPRA)

If you are a California resident, the CCPA/CPRA gives you the right to know what personal information we collect and how it is used, to request access to or deletion of that information, to correct inaccurate information, and to be free from discrimination for exercising these rights. We do not sell or share your personal information for cross-context behavioral advertising, and we do not use sensitive personal information for purposes beyond providing the service. To exercise your rights, email support@optaxis.app; we will verify your request via your account email.

Mainland China Users (PIPL)

If you are in mainland China, the Personal Information Protection Law (PIPL) applies. We process your personal information based on your consent and the necessity of providing the service; for optional features (location, AI training, push) we obtain separate consent, which you can withdraw at any time in Settings. You have the right to access, copy, correct, and delete your personal information, to request an explanation of our processing rules, and to deactivate your account. Some data is stored or processed outside mainland China (e.g., Supabase and OSS in Singapore); where cross-border transfer of personal information is involved, we will provide the required notice and obtain your separate consent, and adopt measures consistent with PIPL. To exercise your rights, email support@optaxis.app.

Policy Changes

We may update this Privacy Policy from time to time. Updates will be posted on this page with a revised “Last updated” date. Please review periodically.

Contact Us

Questions about this policy:

Email: support@optaxis.app

Operating entity: this app is currently operated by XIAO MIN NI as an individual developer; it will be updated to the registered company name and address once company registration is complete.