How we handle your data.

Last updated: August 17, 2026

01 Information we collect

You give us

• Account information — email address, display name, login provider, preferred account language, and account status.
• Wellness profile — your responses to the constitution assessment, including health-related questions about energy, sleep, and digestion.
• Daily check-ins — how you're feeling on any given day, what you ate, which recipes you tried.
• Conversations with the AI — messages you send to TiaoLi's AI companion and any image you deliberately upload for analysis.

We collect automatically

• Technical information — browser or client type, language, timezone, IP address, and security logs needed to operate and protect the service.
• Usage and quota data — feature requests, AI usage counts, timestamps, and errors needed to provide limits and improve reliability.
• Approximate location — country or region inferred from network information when needed for security, localization, or legal compliance. We do not request precise GPS location for the current web service.

What we never collect

• Precise GPS location through the current web service
• Your contacts or microphone
• Information about apps you use outside of TiaoLi
• Sensitive identifiers (Social Security, passport, etc.)

02 How we use it

We use your information to do three things:

1. Personalize your recommendations. Your constitution, recent check-ins, and the current solar term all inform what we suggest for meals, teas, and movement.
2. Improve TiaoLi. Aggregate, anonymized usage data helps us understand which features work and which don't. We never use your individual data to train AI models for other companies.
3. Communicate with you. Important account updates, occasional product news (you can unsubscribe anytime), and your direct conversations with our team.

03 AI and your data

TiaoLi uses DeepSeek large language models to generate personalized recipes, tea suggestions, and conversation responses.

When you interact with the AI:

• Your message and relevant context (constitution type, season, recent check-ins) are sent to the AI provider for processing.
• We don't include your name, email, or identifying information in these requests.
• The provider processes this information to return a response. Its handling and retention are also governed by its applicable service terms and privacy commitments.
• We do not intentionally submit your account identifiers or use your conversations to train models for other companies.

04 Sharing & third parties

We never sell your data. We share information only with these service providers, and only what they need:

• Cloud infrastructure (Cloudflare) — to host, deliver, secure, and monitor the service
• Authentication (Google, when you choose Google sign-in) — to verify your identity and provide your email and basic account details
• AI processing (DeepSeek) — to generate responses, as described above
• Email delivery (Resend) — to send account creation, deletion, security, and service emails
• Payment processing (PayPal) — Plus and Pro purchases are prepared to use PayPal, although new purchases remain unavailable until checkout is enabled. PayPal processes payment credentials and related payer information under its own privacy policy. TiaoLi receives and stores the subscription, transaction, status and limited account-linking records needed to provide access, prevent duplicate subscriptions, handle refunds and disputes, reconcile payments, and meet legal obligations. TiaoLi does not store full card or bank-account details.

We will only share your data with law enforcement when legally required to do so, and we will challenge requests we believe are overreaching.

05 Data retention

• Active accounts — we keep your data as long as your account is active.
• Deleted accounts — signed-in users first confirm deletion through their login email. Confirmation begins a 28-day grace period during which deletion can be cancelled. After cancellation, another deletion request cannot be started for 24 hours. At the end of the grace period, we remove the account and associated personal data and send a completion notice. The recipient address is retained only in encrypted form for delivery retries and is removed after delivery or within seven days. We may retain minimal records when required for security, fraud prevention, tax, payment, dispute, or other legal obligations.
• Inactive accounts — accounts inactive for 24+ months may be archived; we'll email you before doing this.
• Backups — residual copies may remain in protected backups until their normal rotation expires and are not restored except for disaster recovery or legal necessity.

06 Security

We protect your data using industry standard measures:

• Encryption in transit and infrastructure-level protections for stored data
• We use strong access controls and audit logs for our internal systems
• Regular security reviews and dependency updates
• Limited employee access on a need-to-know basis

No system is perfect. If we detect a security incident affecting your personal data, we will assess it and notify affected users and regulators when and within the time required by applicable law.

07 Your rights

You have control over your data:

• Access — request a copy of all data we have about you
• Correct — fix any incorrect information
• Delete — request full deletion of your account and associated data
• Export — request a portable copy of your data where applicable
• Restrict — limit how we use your data
• Object — opt out of any processing you disagree with

To exercise these rights, email us at hello@tiaoli.app. We will acknowledge your request and respond within the period required by applicable law after verifying your identity.

08 International users

TiaoLi is a product name used by its individual operator in mainland China. The service is operated personally under that operator's own legal identity, not under a separate company identity, and uses service providers that may process data in multiple countries or regions. Where personal information is transferred across borders, we use provider agreements and other safeguards appropriate to the service and applicable law.

Specifically:

• EU/UK users — where applicable, processing is based on performance of our service agreement, legitimate interests in security and improvement, consent where requested, and legal obligations. You can withdraw consent without affecting earlier lawful processing.
• California users (CCPA) — you have the right to know what's collected, the right to delete, and the right to opt out of any sale (we don't sell data).
• Chinese users — we process personal information in accordance with applicable requirements, including rules concerning sensitive personal information and cross-border processing where they apply.

09 Children's privacy

TiaoLi accounts are intended for people aged 16 or older, or the higher minimum age required where they live. Family profiles must be created and managed by an adult who is authorized to provide the relevant information. If you believe a child created an account without valid authorization, contact us so we can investigate and take appropriate action.

10 Changes to this policy

We may update this policy as our practices evolve. When changes materially affect your rights or how we use personal information, we will provide notice by email, in the service, or by another appropriate method before they take effect when required. The "Last updated" date reflects the most recent version.

11 Contact us

Questions, concerns, or requests? Reach us at:

• Privacy and general inquiries: hello@tiaoli.app

We read every email and aim to respond within 3 business days.