AmoraKey Privacy Policy

1. Who we are and what this Policy covers

AmoraKey is provided by Atomlight Limited, a company registered in the Hong Kong Special Administrative Region (“Hong Kong”) (“Atomlight,” “we,” “us,” or “our”).

This Privacy Policy (“Policy”) applies to the AmoraKey mobile applications, keyboard extensions, website, AI communication features, account services, and related support services (collectively, the “Services”). It describes how we collect, use, disclose, retain, and protect personal data when you use the Services.

By using AmoraKey, you acknowledge the practices described in this Policy. Where consent is required by applicable law, we will request it separately. If you do not provide data required for a particular feature, that feature may not work, but other features may remain available.

2. Personal data we collect

2.1 Account and identity data

When you use guest mode, we process an anonymous account or installation identifier. If you sign in, we may process your email address, authentication-provider identifier, sign-in provider, account ID, session tokens, and basic authentication metadata supplied by the sign-in method you choose. We do not receive the password for a third-party sign-in account.

2.2 Profile and preference data

We process the gender selection you provide during onboarding, your device or selected language/locale, platform, and keyboard preferences. Gender is used as a weak contextual reference for pronouns, forms of address, and explicitly stated relationship context. AmoraKey is designed not to infer personality, needs, or power dynamics from gender alone.

2.3 Content you actively submit

Depending on the feature you choose, we process text pasted into AmoraKey, selected conversation screenshots, text extracted from screenshots by OCR, your instructions or follow-up questions, and contextual information you provide. This may include communications written by another person.

We also process the AI-generated replies, openers, conversation analyses, safety flags, and follow-up answers returned to you. If conversation history is enabled, eligible submitted text, generated results, timestamps, gender context, and service conversation identifiers may be associated with your account.

2.4 Usage, entitlement, and transaction data

We process usage counters, request identifiers, the feature requested, success or failure status, account or guest status, platform, subscription status, product identifier, expiration status, and app-store transaction or purchase identifiers needed to verify benefits and prevent duplicate charging or quota use. The relevant app marketplace or payment provider processes your payment credentials; we do not receive your full card or bank details.

2.5 Technical and support data

Our systems may process IP address, request time, server logs, error details, app version, operating system, platform, network status, and security events for operation, troubleshooting, abuse prevention, and service protection. If you contact support or submit feedback, we process your email address, message, attachments you choose to send, and correspondence history.

3. Device permissions and keyboard access

AmoraKey requests or declares permissions only to support specific functions. System wording and availability vary by operating-system version.

Permissions AmoraKey does not request for its current product features: location, contacts, call logs, SMS, camera, microphone, display over other apps, or unrestricted access to device storage.

4. How we use personal data

We use personal data to:

• create and authenticate guest or registered accounts;
• provide OCR, Quick Reply, Conversation Openers, Conversation Analysis, and follow-up features;
• maintain eligible conversation history and synchronize necessary preferences;
• calculate free usage, verify subscriptions, restore purchases, and prevent duplicate or fraudulent requests;
• adapt output language and communication style to the conversation context;
• detect unsafe requests and apply safety restrictions;
• operate, secure, debug, maintain, and improve the Services;
• respond to support, feedback, account deletion, and privacy requests;
• comply with legal obligations and enforce the AmoraKey Terms of Service; and
• protect users, third parties, Atomlight, and the public from fraud, abuse, or security threats.

When an account is deleted, we retain a keyed, non-readable fingerprint of the normalized account email for 30 days to prevent immediate repeated registration and promotional-use abuse. We do not retain the email address in this block record. After the 30-day period, the registration block expires.

Where applicable, our legal bases may include performing our contract with you, your consent, compliance with legal obligations, protection of vital interests, and our legitimate interests in providing, securing, and improving the Services, balanced against your rights.

5. How screenshots and conversations are processed

When you choose a screenshot, the selected image is uploaded to the AmoraKey service and transmitted to an OCR service provider to extract text. AmoraKey is designed to process the image for the request and does not intentionally add the original uploaded image to conversation history. OCR service providers may process request data under their own contractual retention and security terms.

Extracted text and other text you submit may then be transmitted to AI service providers to generate the requested output. Submitted text and AI Output may be stored as part of conversation history when that feature is used. Request identifiers and service conversation or message identifiers may also be stored to support follow-up questions and reliability.

Before uploading a screenshot, crop or redact names, phone numbers, photographs, health information, financial information, intimate material, and other details that are not needed. You are responsible for having the right to submit content involving another person.

6. When we disclose personal data

We do not sell personal data. We may disclose limited data to the following categories of recipients when necessary:

• Authentication and data-service providers for anonymous access, email authentication, federated sign-in, session management, and account data;
• OCR service providers for extracting text from screenshots you select;
• AI service providers for generating replies, openers, analyses, and follow-up answers;
• Operating-system and app-marketplace providers for sign-in, application distribution, purchases, subscription verification, refunds, and account management;
• Infrastructure and security providers that host, transmit, protect, monitor, or support the Services;
• Professional advisers and transaction parties where reasonably necessary for legal advice, audits, financing, merger, acquisition, restructuring, or sale, subject to appropriate safeguards; and
• Authorities or other parties when required by law or reasonably necessary to protect rights, safety, and security.

Service providers may use personal data only to provide contracted services or as otherwise permitted by applicable law. Their independent products may also be governed by their own privacy policies.

7. International data transfers

Atomlight is registered in Hong Kong, and our service providers may process data in Hong Kong or other countries and regions where they or their infrastructure operate. These locations may have data-protection laws different from those in your country.

Where required, we use contractual, organizational, and technical measures intended to provide an appropriate level of protection for cross-border transfers. The exact processing location may depend on the region and configuration of our authentication, hosting, OCR, and AI providers.

8. Data retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Policy, including providing the Services, maintaining account and conversation history, verifying transactions, preventing abuse, resolving disputes, and meeting legal obligations.

• Account and profile data is generally retained while your account remains active and for a limited period afterward as required for deletion, security, backup, or legal purposes.
• Conversation text and AI Output stored in history remains until you delete the applicable data, delete your account, or it is removed under our retention practices.
• Original uploaded screenshots are intended for request processing and are not intentionally retained by the AmoraKey application server as conversation-history records.
• Usage, transaction, fraud-prevention, and security records may be retained for longer where reasonably necessary or legally required.
• Backup copies may remain for a limited period until overwritten or securely deleted.

Retention by authentication, OCR, AI, infrastructure, and app-marketplace providers is also subject to their respective contracts and policies.

9. Data security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal data, including authenticated requests, access controls, platform-protected credential storage, transport encryption in production, request validation, and separation of client applications from server-side provider credentials.

No method of transmission or storage is completely secure. You should protect access to your device and account and avoid submitting information that is not necessary for the requested feature. If we become aware of a data incident requiring notification, we will notify affected users and authorities as required by applicable law.

10. Your choices and privacy rights

Depending on your location and applicable law, you may have rights to request access to, correction of, deletion of, or a copy of personal data; object to or restrict certain processing; withdraw consent; and complain to a data-protection authority.

You can also:

• decline to upload screenshots or paste conversation text;
• disable AmoraKey Keyboard or “Allow Full Access” in system settings;
• change or revoke photo access through system settings;
• sign out or delete your AmoraKey account where available;
• manage or cancel subscriptions through the app marketplace where you purchased them; and
• contact us to make a privacy request.

We may need to verify your identity before completing a request. Certain data may be retained where required by law, necessary to protect security, or permitted for legal claims and other legitimate purposes. Withdrawing permission may prevent the corresponding feature from working but does not affect processing already lawfully completed.

11. Account deletion

You may request deletion through an available in-app account-deletion control or by emailing us. Deletion generally removes or de-identifies account-linked profile data, eligible conversation history, usage records that are not legally required, and account mappings. Deletion is irreversible.

Deleting your AmoraKey account does not automatically cancel an app-store subscription. You must cancel through the marketplace that processed the purchase. Some transaction, security, legal, and backup records may remain for the periods described above.

12. Children’s privacy

AmoraKey is intended only for people aged 18 or older. We do not knowingly collect personal data from children. If you believe a child has provided personal data to AmoraKey, contact us so we can investigate and take appropriate action.

13. Website cookies and analytics

The current AmoraKey informational website does not intentionally use advertising cookies or third-party behavioral advertising trackers. A hosting provider may process basic request logs, such as IP address, browser type, requested page, and time, for delivery, reliability, and security.

If we later introduce non-essential analytics, advertising, or cookie-based features, we will update this Policy and provide any notice or choice required by applicable law.

14. Changes to this Policy

We may update this Policy to reflect changes in the Services, technology, providers, law, or our data practices. We will post the revised Policy and update the effective date. Where required, we will provide additional notice or request renewed consent before a material change takes effect.

15. Contact us

For privacy questions, requests, complaints, or concerns, contact:

If you are not satisfied with our response, you may have the right to contact the data-protection authority in your place of residence or another competent authority under applicable law.