Privacy policy

Hibi no Mori: World Tree · Effective September 25, 2026

Who operates the app

Hibi no Mori: World Tree is operated by Ziyu Guo. Address: 3-18-4 Nakazato, Kita-ku, Tokyo 114-0015, Japan. For privacy questions, access, correction, or deletion requests, contact zyguo415@gmail.com. We may need to verify that a request concerns your own account. Please do not send passwords, verification codes, full payment card details, or your complete journal.

Your journal and storage choices

You can use the local journal without creating an app account or allowing AI processing. The app stores your journal text, plans, drawings, selected photos, materials, and saved growth records on your device. You choose whether to enable iCloud synchronization. If enabled, Apple iCloud receives journal content, selected photos, and growth records for synchronization with your devices. Turning synchronization off stops subsequent app synchronization; it does not erase copies already in iCloud.

Device backups are controlled by your Apple and device settings. Choosing local storage in the app does not disable a system backup. The Apple account used for iCloud and the Apple account used to sign in to the app can differ.

Optional AI processing

Before a new AI generation, the app asks for your permission. Selected journal excerpts, summaries, category names and goals, background information, and on-device handwriting transcripts are sent through our Google Cloud servers to Google Cloud Vertex AI. They are used to generate your World Tree, possible future branches, skills and titles, weekly reviews, weekly letters, seeds, cloud replies, comics, and picture books. Generated comic and picture-book artwork and its supporting text are also checked using Google AI.

The app limits the selected evidence sent for a generation. It does not send your photo-library originals or original drawing files to the AI service. Handwriting recognition runs on your device; the resulting text can be included when you authorize AI processing. Recognition and generated content can be inaccurate. You can decline AI processing and continue using the local journal.

AI permission can be withdrawn in Settings. This prevents new generations and manual generation retries. A job already submitted may finish, and withdrawing permission does not itself delete earlier uploads or saved results. Photos added to the journal may still be synchronized by iCloud if you separately enabled it.

Weekly letters, seeds, the tree's replies, and picture books

• Weekly letter. When you receive a letter, up to 60 text excerpts from that week's pages across your folders (for your first letter, which comes without waiting for Sunday, the last seven days) (photos and drawings are only counted, not sent), your language, your negative-title choice, and the identifiers of your existing skills and titles are sent through our servers to Vertex AI. The letter, the skills and titles it gives, and the excerpts it was written from are saved on your device, and in iCloud if you enabled it. Opening a letter and the answer you write back are saved the same way; your answer is not sent to our servers or to AI.
• The tree's reply to a leaf. You choose how the tree replies in Settings. On this iPhone: Apple Intelligence runs on your device and the line is not sent to us. Cloud: only after you choose it and allow AI processing, the line you just hung and up to five related earlier lines found on your device are sent through our servers to Vertex AI. Off: nothing is sent. A reply is saved with its leaf on your device, and in iCloud if enabled.
• Seed. When you plant a seed, the wish you wrote (up to 60 characters), your language, and up to twelve lines from the past year found on your device that share words with the wish, with their dates and folder names (handwriting and photos are not read), are sent through our servers to Vertex AI to suggest three paths. The seed and what happens to it afterwards are saved on your device, and in iCloud if you enabled it.
• Picture book. When you ask to paint a letter's week, the excerpts that letter was written from are sent again to plan up to four panels; one image is generated and then checked by Google AI. The panels are saved with the letter on your device (and iCloud if enabled). The image is stored in our account storage like other generated comic artwork, removable from the letter, and deleted with your account.

Device checks against misuse

Letters, cloud replies and forest dew are free, so to stop misuse each such request is checked, and letters and replies are also limited per iPhone. The app uses Apple's App Attest: your iPhone creates a key in its secure hardware, Apple certifies that the key belongs to the genuine app, and our server keeps the key's public part, a use counter, and the environment it was made in. That record is not linked to your account or your journal. Each free request carries a signature from this key over the request itself. Per-iPhone usage counts (such as letters this week and replies today) are stored under a hashed key identifier and become eligible for automatic deletion after about seven days. A key record that has not been used for about 13 months is deleted; the app registers a new key when needed.

When you sign in, the app also sends a one-time Apple DeviceCheck token. Our server uses it to ask Apple for the two bits Apple keeps for our app on this iPhone, and sets one of them after the one-time welcome drops are given, so that deleting and re-creating accounts on the same iPhone does not grant them again. Apple does not give us a device identifier, and the bits hold no other information. Apple keeps them for our app until we change them; they are not part of your account data.

Accounts, purchases, and technical records

Sign in with Apple is used for account authentication. Our server verifies the Apple identity token and derives an account identifier from the Apple user identifier. A session credential is stored in the device Keychain. It expires after 30 days without use and is renewed while you keep using the app. We do not request your Apple password.

Apple processes purchases. RevenueCat receives the app account identifier, transaction and purchase information, and technical information needed to validate purchases and provide purchase analytics. Our server uses verified transactions to calculate your Magic Drops balance and purchased capacity. We do not receive your full payment card number. The current app does not include third-party advertising or advertising tracking.

Forest dew. On a day you write in the journal while signed in, the app tells our server only that you wrote today, and your account receives one drop of forest dew (up to five held). It sends your phone's offset from UTC and the App Attest signature described above, never your journal text or a list of dates. The server keeps the dew count and the date of the last dew with your balance, and deletes them with your account. Dew is used before drops you bought.

Cloud infrastructure processes connection and request information, such as IP addresses, request times, response status, and service usage. Application logs are designed to record failure categories, timing, and model usage rather than journal excerpts. Information you choose to send by email is used to answer your request.

Storage duration

• Temporary AI request, result, and working-memory objects in our AI-state storage become eligible for automatic deletion after about seven days. Cleanup is asynchronous; an updated object can start a new storage period. This is not a promise that every copy held by every service disappears after seven days.
• Per-iPhone usage counts for free features become eligible for automatic deletion after about seven days. App Attest key records are deleted after about 13 months without use. Neither contains your account or journal.
• Account records, purchase records, permanent capacity, private skill and title definitions, and generated comic and picture-book assets are stored separately without the seven-day automatic cleanup rule. They support account recovery, purchase verification, and your saved personal library. They are removed when your account deletion request is processed, except for minimal hashed deletion and transaction-claim identifiers retained to prevent old credentials or purchases from recreating a deleted account or being credited twice, together with a record that the Apple account has already received the one-time welcome drops.
• When an object is deleted from the account/library storage, its recoverable infrastructure copy can remain for seven additional days under the current storage recovery policy. Legal retention requirements, where applicable, must be distinguished from ordinary personal content.
• Content on your device or in your iCloud account follows your app deletion choices and Apple backup settings. Signing out does not delete this content. Generated reports and saved journal excerpts can remain in saved snapshots even if you later edit their source journal entry.

Service providers and international processing

The app uses Apple for sign-in, payments, and optional iCloud; Google Cloud for hosting, storage, and optional AI; and RevenueCat for purchase validation and purchase analytics. Our current application storage region is Japan, while the Vertex AI global endpoint and other providers may process information outside your country, including the United States. We do not promise that AI processing stays in Japan.

Google states that Vertex AI customer data is not used to train or fine-tune its models without customer permission or instruction. Its service-specific caching and safety or abuse-monitoring rules are separate from our application's cache policy. We do not represent this integration as zero-retention. See Google's data governance documentation.

See also Apple's privacy policy and RevenueCat's privacy policy. We use restricted service accounts, encrypted connections, access-controlled cloud storage, and server-side transaction verification to protect data.

Your choices and requests

You can change the iCloud choice, withdraw AI permission, manage reminders, and remove content using the app's available controls. Deleting a folder removes its journal pages; it does not necessarily remove excerpts in previously saved World Trees or reports. Those saved records and cloud account data require separate handling.

Contact the privacy address above to request information about data associated with your account, correction, deletion, or restrictions where applicable. The available rights and any required exceptions depend on applicable law. For Japanese users, this contact also handles questions about the operator's details, purposes of use, disclosure, correction, cessation of use, and security measures. We verify account ownership before disclosing or changing account data. We will explain any information needed to process the request and any applicable exception. We do not charge a request fee without first explaining it.

Delete your account

In Settings, choose Delete account and confirm. The account is disabled immediately, and a background task removes its private cloud library, generated artwork, balance and capacity, session credentials, and indexed AI data. Cleanup starts after a short waiting period of about 20 minutes so an older in-flight request cannot restore data. Failed cleanup steps are retried; use Check deletion status to see progress. Unindexed temporary caches created by older app versions remain inaccessible and become eligible for automatic deletion within about seven days. Recovery copies in account storage may remain for seven additional days.

The app also removes that account’s saved World Trees, reviews, comics, and picture-book images from the current device and synchronizes their deletion when iCloud is enabled. Your independent local journal is separate from the app account; manage journal folders, other devices’ offline copies, and device backups separately. Signing out alone does not perform deletion.

We request deletion of the associated RevenueCat customer and revoke Apple authorization when a token is available. For an older account without a stored token, the app links to Apple’s instructions for manually stopping Sign in with Apple after the deletion request. Minimal hashed account-deletion and transaction-claim markers, including a record that the one-time welcome drops were already granted, are retained to prevent replay, repeated welcome drops and double credit; they do not contain your journal, generated text, pictures, email, or payment card details. Apple retains its own payment records. Deleting an account does not request a purchase refund; refunds are handled by Apple.

Updates

Material changes to optional data processing will be explained in the app, and additional permission will be requested when needed. This policy does not replace the separate AI consent screen.