Privacy Policy

Milo (package name: net.zrex.milo) respects your privacy. This policy explains how Z-Rex Network (“we,” “us”) collects, uses, stores, shares, and protects personal information when you use the Milo mobile app and related services, and what choices you have.

By using the Service, you agree to this policy. If you do not agree, do not use the Service. This policy works together with our Terms of Service.

1. Information We Collect

1.1 Information you provide

• Account data: Email address; if you use Google sign-in, your Google account identifier (Google ID), email, and display name from Google.
• Profile data: Nickname, avatar (chosen from in-app presets), bio, primary language, zodiac sign, birth decade range, and gender (you may keep gender private).
• User content: Letters, replies, conversation messages, and associated virtual identity nicknames and avatars.
• Social actions: Pen pal requests, accept/decline records, pen pal relationships, and visibility settings.

1.2 Information collected automatically

• Device and log data: To keep the Service secure and stable, our servers may log access times, API requests, and error logs. When sending email verification codes, we may log and rate-limit your IP address to prevent abuse.
• App activity: Check-in history, virtual stamp balance and changes, letter send/receive status, conversation and read status, and rewarded ad claim records—for core features and anti-abuse.
• Authentication tokens: After sign-in, your device may store access tokens (JWT) and refresh tokens locally to keep you signed in.

1.3 What we do not require

Unless you include it in your own messages, we do not require precise location, contacts, photo library, microphone, or camera access to use the Service. The current version is focused on text communication.

2. How We Use Information

We use collected information to:

1. Create and manage your account and verify identity (including email codes);
2. Deliver, store, and display letters and conversations, including drifting, delayed delivery, and pen pal features;
3. Run content safety reviews and handle violations;
4. Issue and manage virtual stamps, check-in rewards, and ad rewards;
5. Protect the Service from spam, abuse, and attacks;
6. Improve the product through aggregated or de-identified analytics;
7. Respond to your requests and support inquiries;
8. Comply with legal and regulatory obligations.

3. Content Moderation and Automated Decisions

When you send a letter or reply, we run local sensitive-word checks and may send the text to a third-party moderation service (currently the OpenAI Moderation API) for automated analysis. Results may affect whether content can be sent.

If you disagree with a moderation outcome, contact support@z-rex.net for a manual review. We will respond within reason but cannot guarantee reinstatement of rejected content.

4. Sharing and Third Parties

We do not sell your personal information. We may share data only as follows:

4.1 Service providers

• Google: Google account sign-in (OAuth) and Google AdMob rewarded ads. Google may process device advertising identifiers per its policies.
  See: Google Privacy Policy
• OpenAI: Text content moderation. We send text pending review; we do not intentionally send your email or account ID to OpenAI (but text may include information you write yourself).
  See: OpenAI Privacy Policy
• Email delivery: To send login verification codes—limited to your email and data needed to deliver mail.
• Cloud infrastructure: Databases, caches (e.g., MariaDB, Redis), and hosting providers that store or process data on our behalf.

4.2 Other users

• Before you become pen pals, others typically see only your virtual identity, not your registration email.
• After becoming pen pals, others may see profile fields you make visible.
• Recipients see content you choose to send in letters and replies.

4.3 Legal and safety

We may disclose information when required by law, valid legal process, or when necessary to protect users, the public, or our rights.

5. Storage and International Transfers

• Data is primarily stored on servers in regions we use for operations. Locations may change as our infrastructure evolves.
• Because we use providers in different countries (e.g., Google, OpenAI), some data may be processed outside your country, including outside mainland China. We take reasonable steps to protect transfers and limit them to what is needed for the purposes in this policy.
• We retain information only as long as needed for those purposes. After account deletion, we delete or anonymize personal data within a reasonable period, except where law requires retention.

6. Security

We use measures such as HTTPS, access controls, and hashed password storage where applicable. No method of transmission or storage is 100% secure. If an incident may affect your personal information, we will notify you and take remedial steps as required by law.

7. Your Rights

Depending on applicable law, you may have the right to:

• Access and correct profile data in the app (Profile → Edit);
• Delete content where the product supports it;
• Delete your account by emailing support@z-rex.net from your registered address with a deletion request. We will verify identity before processing;
• Withdraw consent by stopping use or deleting your account—without affecting processing that already occurred;
• Complain to us or to a competent data protection authority if you believe your rights were violated.

8. Children

The Service is intended for users aged 16 and older. We do not knowingly collect personal information from children under 16. If you are a parent or guardian and believe we collected a child’s data without consent, contact support@z-rex.net and we will delete it promptly.

9. Cookies and Local Storage

The Milo app mainly uses on-device storage (tokens, language preference) rather than browser cookies. This legal site is static HTML; we do not set tracking cookies here. Hosting platforms (GitHub Pages, Cloudflare Pages, etc.) may keep basic access logs—see their documentation.

10. Policy Updates

We may update this policy from time to time. The new version will be posted here with an updated “Last updated” date. For material changes, we may notify you in the app or by other reasonable means. Continued use means you accept the updated policy.

11. Contact