Was sich geändert hat
- Clarify optional photo and file attachments in feedback, upload on submission, account association, access and deletion.
Scope and responsible person
Origo X is provided by Wangtao Xie, who is responsible for personal information processed by our first-party services. This policy covers Origo X apps, open.xxread.top, and our account, membership and download services.
Content websites, sign-in and payment platforms, and AI, WebDAV or other services you configure also handle data under their own privacy policies. Review those policies before connecting. This policy does not replace them.
Local reading and permissions
Basic local reading does not require an account. Imported books, reading progress, bookmarks, highlights, notes, reading statistics and preferences are stored on your device by default. Local reading alone does not upload this content to our account server. You choose where exported files are saved or shared.
Features such as file or photo selection, notifications and text-to-speech request permissions when needed for the feature and required by the platform. Local reading does not require access to contacts, precise location or recordings of your voice. Network use by system speech services, iCloud documents and system backups depends on your device settings and platform services.
Account reading statistics and leaderboards
While signed in, reading record IDs, account ownership, start and end times, durations and provenance are uploaded to our server for cross-device statistics, deduplication and personal summaries. This feature does not upload book text, titles, book lists or hardware identifiers. Guest records stay on the device until you choose an account to import them into, and imported records cannot be reassigned.
Public rankings are off by default. If you opt in, the leaderboard shows your display name, avatar and eligible reading time. Opting out hides your ranking while private cloud statistics remain. Deleting the account deletes its cloud reading records.
Accounts, sign-in and security
To detect abuse, we aggregate download, registration and redemption request rates and origin bytes by IP. Risk events and hourly aggregates are retained for 90 days, minute aggregates for 7 days, and action audits for 180 days. Authorized administrators may review evidence and restrict accounts or IPs; sharing an IP does not establish that users are the same person.
We record connection IP addresses when accounts are created or signed in, and the IP address, account and time of each successful card or promotional code redemption. These records help identify abuse such as multiple accounts claiming codes from the same IP and support account security controls. Only administrators with the relevant permissions can access them.
When you create or sign in to an account, we process the email address, username, display name and avatar you provide, together with your account ID, authentication status and membership status. Email is used for verification and account security. Password verification material, verification codes, multi-factor authentication and passkey information support the authentication methods you select. Never send support your password or verification codes.
When you choose Apple, Google, GitHub or Huawei sign-in, the platform handles authorization and may share an identifier, email address and basic profile information within the authorized scope. Available methods depend on the current service. We use this information to create or link your account; this does not give us access to all your content on that platform.
The app stores authentication tokens in system secure storage and a local summary for displaying your account. Signing out removes the local sign-in state, but does not automatically delete the server account or data on other devices.
Membership and purchase verification
Apple or your selected payment provider processes payments. We process product, order or transaction identifiers, purchase time, transaction status, verification evidence and membership entitlements, linking entitlements to your account where needed to verify purchases, restore access, handle refunds and prevent fraud.
For Apple payments, we do not receive your card number or complete payment account information. Deleting the app, signing out or requesting data deletion does not automatically request a refund or delete transaction records that the payment platform must retain.
Online features you choose
These features require you to configure or use them. A server receiving a request can see the connection IP address and information needed to provide its service.
- WebDAV: depending on your sync and backup choices, library information, progress, bookmarks, notes, reading sessions, settings and optionally book files and covers are sent to the server you specify. Sync also sends a randomly generated device identifier stored locally to distinguish devices and resolve conflicts; it is not an advertising identifier or hardware fingerprint. Server credentials are used to access that service. You and the provider manage remote retention and deletion.
- AI: your questions, selected text or page content, relevant book and chapter context, and conversation context are sent to your configured AI provider. Your API key authenticates with that provider. Do not submit private information you do not want it to receive. Its retention and model-training practices depend on its policy and your account settings.
- Cloud text-to-speech: when you switch to a configured cloud TTS service and use read-aloud, text to be spoken and settings such as voice and speed are sent to that provider, using your API key. Default system speech is handled by the device speech engine; cloud TTS does not record or upload your voice.
- Book sources, search and web content: queries and requests for catalogs or chapters go to your selected content service. Website login state and script requests depend on the sources you import or configure. Use only trusted services and content you are entitled to access.
- Remote covers, fonts and updates: loading online resources or checking for updates sends the resource address, version or platform information and network connection information to the relevant server.
Feedback and optional performance diagnostics
When you submit feedback while signed in, we receive the category, description you enter, app version and platform, associated with your account. Do not include passwords, verification codes, tokens, book text or unnecessary personal information. Feedback does not automatically attach screenshots, books or full logs.
Help improve performance is off by default on Android and iOS. Lightweight collection starts only when you enable it. Metrics include platform, OS and device model, app version, foreground duration, frame timing and slow-frame counts, process memory and CPU time, battery changes and thermal state. Availability varies by system; unavailable values are not treated as zero. This feature does not read book names or text, source URLs, keys or usage records of other apps.
Diagnostics are summarized locally. While signed in and after accepting the current agreement, summaries are uploaded in batches over HTTPS to our account service and associated with your account, not an advertising analytics service. Attaching a performance summary to feedback is a separate choice. Estimated battery drain measures whole-device battery change during continuous unplugged use and includes display, system and other background activity; it is not exact app-only energy use.
You may disable diagnostics from the feedback page at any time to stop future collection and uploads and clear local pending summaries. Signing out or switching accounts clears the old account’s pending summaries. Disabling or signing out does not retract records already sent. Feedback and its attachments expire after 90 days; automatically uploaded summaries expire after 30 days and are cleaned periodically. Account deletion removes associated records. Backup copies may remain until backup rotation.
You may voluntarily select photos or files for feedback. Attachments and filenames are uploaded over HTTPS only when you send, linked to that feedback and your current account for investigation. You can remove them before sending; check and redact sensitive information, and do not attach passwords, tokens, keys or unrelated content. Only staff with feedback access permission can view or download attachments; there are no public links. Attachments are retained with feedback for 90 days and deleted when the account is deleted.
Website, operational records and storage
When you visit the website, use online APIs or download software, service infrastructure processes IP addresses, request times, paths, response status and browser or client information to deliver the service, troubleshoot and protect it. The download service also records the selected version, platform and download event, and infers an approximate region from the IP address for download statistics. This is not GPS location.
The website uses Cloudflare for network proxy and security services. Download-region statistics may send a public IP address to IP.SB, ipwho.is or PConline’s IP lookup service to obtain an approximate country, province or city. These lookup services handle requests under their own policies; this lookup does not send them your reading text or account password.
The website uses necessary session or authentication storage and saves preferences such as language and appearance in cookies or browser storage. Clearing this storage may sign you out or reset preferences. We do not use it for cross-site advertising tracking.
Purposes and recipients
We process data to provide requested features, maintain accounts and purchase entitlements, protect the service, respond to support requests and improve download services. You decide whether to enable optional features requiring your authorization. We seek additional authorization where applicable law requires it.
We do not sell personal information, use reading content to build advertising profiles, or provide data to brokers or for cross-company advertising tracking. Necessary information is processed by our cloud infrastructure, your chosen identity or payment platforms and external services you connect. We may retain or disclose relevant records where necessary for legal obligations, security incidents or disputes.
The app does not integrate advertising or general analytics SDKs that automatically upload reading activity. Full local debug records are not automatically sent to us; optional performance diagnostics upload only the summaries described above. Other support material you choose to share may contain book names, paths or screenshots; review and redact it first. Platform diagnostics are governed by operating-system settings and policies.
Retention and security
Local content generally remains until you delete it, clear app data or uninstall. System backups, exports and WebDAV copies must be managed separately. Account information is retained while we provide account services. Purchase and security records are retained as necessary for transactions, disputes, fraud prevention and applicable legal requirements. Signing out is not account deletion.
IP addresses, IP hashes, browser information and region data in download event details are periodically cleared under a 180-day retention period; cumulative download counts may remain. Website access logs rotate by size and are kept for up to 30 days. Email verification records are cleared two days after the request; expired sessions and temporary sign-in challenges have separate short-term cleanup rules. Core account, transaction and security audit records currently have no single automatic deletion period.
Deletion requests are handled by data category. Any records that must remain are restricted to the necessary purposes. Backup copies may remain until backup rotation. Retention periods differ; we do not promise that all records are automatically erased after a fixed number of days.
When you delete your account yourself in the app or on the website, the account record, sign-in methods, sessions, two-factor setup, membership access, referral links, cloud reading statistics, feedback and performance diagnostics are deleted. Redeemed codes remain spent. Account-bound Reader and Explorer purchases become terminal records that cannot be claimed again, while immutable original account ownership remains to prevent moving the same transaction to another account. A minimal deletion record remains without the plaintext email address.
We use HTTPS, authentication controls and access restrictions to protect online data. The security of third-party addresses and shared files depends on the service and your configuration. No network or storage measure can guarantee absolute security.
WebDAV sync currently has no app-level end-to-end encryption. Synced data is stored as readable data or files on your selected service. HTTPS protects data in transit; it does not prevent the service from reading it.
Service locations and international access
Our website, account, purchase-verification and reading-statistics production services currently operate in mainland China. Infrastructure and the specific facility may change, so this policy does not promise a permanent cloud provider or city. Sign-in, payment, AI, WebDAV, content and resource services you choose may operate in other countries or regions, and using them may involve cross-region transfers. Review the provider and its location before connecting and avoid sending personal information to untrusted services.
Where applicable law imposes additional requirements on a transfer, those requirements apply. This policy does not replace any separate notice, consent or other measures required by law.
Your rights and contact
Subject to applicable law, you can request information about, access to, correction, a copy or deletion of your personal information, withdraw relevant authorization or object to processing. See Privacy Notice & Choices for available controls and instructions for different copies of your data. We may verify your identity to protect your account, but will never ask for your password or one-time verification code.
Our current public support channel is the project GitHub Issues page. For account, order or deletion matters, initially ask only for a private privacy-support channel. Share the minimum verification information after a private channel is arranged. Do not post email addresses, purchase evidence, book content, API keys or other personal information in a public issue.
Minors and policy changes
Minors should use online services with guidance from a parent or guardian. Where the law requires parental consent for processing a child’s information, that consent must be obtained first. A guardian who believes a child provided information without required consent can contact us through the channel above.
We update this page, its version, effective date and change summary when features or processing practices change. Material changes to purposes, data categories, recipients or user rights receive prominent notice and, before the changed processing continues where consent is required, a new “Agree and continue” or equivalent affirmative choice. Silence or continued browsing of public pages is not treated as consent.