PlainPen is operated by Yuchuan Cao (曹于川), an individual developer. Contact support@shangyingai.cn for support and privacy requests.
Documents, conversations, saved summaries, available reasoning text, imported files, version history and writing preferences are stored on your device. Local editing and export do not require an AI request. Your device or system backup settings may also retain local data.
Before sending a writing request, PlainPen shows a processing notice and asks for your agreement. Our service receives the current source text, selected passages, task instructions, selected source materials, relevant tone rules and any attached screenshots. For a partial rewrite, the model receives the selected passages and task-relevant context; the server also uses the original text to validate changes. Whole-text tasks send the submitted text. Photo selection uses the system picker, not access to your full photo library.
Cloudflare runs the PlainPen API and task queue. Neon stores server records in the configured US East (Ohio) database region. Cloudflare processing is distributed and is not restricted to that database region. DeepSeek processes the task content needed to generate suggestions. Apple provides sign-in and purchase services. Submitted data may be processed outside your country.
We have not obtained an API-specific guarantee of zero retention or no training from DeepSeek. Do not submit sensitive information or content you are not allowed to share. Requests concerning data already sent to a provider may require that provider’s cooperation; deleting PlainPen records is not a guarantee of immediate deletion from every provider system.
You can use a limited number of AI Chat replies as a guest without Apple sign-in. Our server creates a random guest account and hashes its session token; the app keeps the token in the system Keychain. Signing in with Apple links the guest account to your Apple account after pending replies finish, and current-month guest replies count toward that account's free allowance. Apple sign-in does not request your name or email. Apple refresh tokens are encrypted. We process transaction IDs, product IDs, account associations, expiry and revocation status to deliver subscriptions. Apple handles payment-card details. We do not use advertising or analytics SDKs, sell your content, or track you across other companies' apps or websites.
For a conversation request, we send the current message, relevant prior messages, the materials you select and writing preferences needed for that request. When older conversation content is compressed, a separate AI request may produce a summary with short source excerpts. The original conversation remains on your device. Our server may store generated summaries and temporary answer or reasoning progress to support continuation and recovery. These content records follow the same seven-day server retention window as results. Saved local content remains until you delete it. Summaries can omit details; review important facts against the original messages.
Voice input uses Apple speech recognition. On-device recognition is used when supported; otherwise Apple may process audio through its speech recognition service. PlainPen does not save audio recordings. Recognized text becomes editable text and is sent to the PlainPen AI service only when you choose to send it. You can use keyboard input instead and control microphone and speech recognition permissions in device settings.
Local content remains until you delete it. Queued requests remain until completed or failed; request payloads are cleared when the task ends. Server results and generated summaries are retained for seven days and removed by hourly cleanup, normally within one additional hour. Content-free task IDs, hashes and usage records support idempotency and accounting until account deletion. Apple sessions expire after 30 days. A guest session can be renewed with its existing secret token before expired-session cleanup; after the last guest session expires and unfinished tasks end, scheduled maintenance removes the guest account and its task and usage records. To limit repeated guest accounts, the service keeps a daily rotating keyed hash of the connecting IP address, with up to five new guest accounts and 50 new guest task requests per network per UTC day. The application business database does not store raw IP addresses; the daily counters are removed after the day by scheduled maintenance. Cloudflare may process network records under its own policies. Content-free provider cost and notification records currently have no automatic expiry. The Neon database’s configured recovery history may temporarily contain data deleted from the active database. We do not maintain manual database snapshots or a snapshot schedule. Our application does not log document bodies; infrastructure providers may keep operational records under their own policies.
My has a Delete Local Data action, while My → Privacy & Data has the separate online-account deletion action. Local deletion removes documents, conversations, imported files and preferences from the device while keeping the online session temporarily so you can separately delete the online account. Guest account deletion removes that guest account and its server content. Apple account deletion requires a recent Sign in with Apple confirmation, revokes the stored Apple authorization, and removes the account and linked guest tasks, sessions, transactions, summaries and usage records from the active database. The app reports failure if deletion does not complete and supports a safe retry after a partial failure. Content-free provider cost records, notification deduplication IDs and short-lived daily network rate counters may remain; the Neon recovery history can temporarily include earlier data. Deleting the app or account does not cancel an Apple subscription; manage it in App Store settings.
Contact support@shangyingai.cn to request access, correction or deletion of your personal data. We may need to verify the request and coordinate with service providers. We will handle requests under applicable law. The service is not directed to children. Do not submit children’s personal information.
We use HTTPS, server-side provider credentials and the system Keychain for device credentials. No system can guarantee absolute security. Material processing changes will be reflected in the policy and relevant in-app notice. Last updated: September 28, 2026.