Effective date: July 7, 2026
Kaxiu is a virtual card collecting, gacha-draw entertainment, creator card-pack publishing, community showcase, and in-app marketplace/auction product, operated by Yu Zhao, an individual developer ("we", "us", or "the app"). This Policy explains how we collect, use, retain, share, and protect your personal information when you use Kaxiu, and the rights you have.
Please read this Policy carefully before using Kaxiu, especially the bold parts. By using Kaxiu you acknowledge and agree to this Policy.
Note: This English Policy governs the international ("Global") edition of Kaxiu. The China edition is operated separately under a separate policy.
When you register, sign in, contact support, or submit an account-deletion request, we may collect:
To provide pack draws, collection, showcase, marketplace, and auction features, we process:
When you use the creator tools, community, reporting, or support features, we may collect:
To support features, handle support, and perform basic operational analytics, we may process notification read-state, message targets, view state, filter preferences, notification preferences, odds reminders, and public-display settings.
We use the above information to: register and identify accounts and sync profiles; display packs, odds, collections, showcases, messages, community, marketplace, and auctions; execute server-side transactions such as draws, coin deductions, top-up crediting, trades, auction holds, and settlement; handle content moderation, reports, support tickets, and account-deletion requests; provide odds disclosure and security/risk controls; and generate necessary operational metrics, audit logs, and stability diagnostics.
We do not use your personal information for third-party advertising or tracking. The app's Privacy Manifest declares NSPrivacyTracking=false.
Coin top-ups on iOS are processed only through Apple In-App Purchase. Kaxiu does not directly collect or store your card number, Apple ID password, or full payment credentials.
To credit purchases and handle support, we process the Apple product ID, Apple transaction id, the Apple transaction JWS (or its server-side verification result), and top-up order/crediting/recovery records.
To provide the service, we share or entrust specific information to the following providers, within the necessary scope and subject to this Policy and applicable law:
Except as described above, as separately consented by you, or as required by law, we do not share your personal information with other third parties.
International data transfer: Our servers and the above providers are located in the United States. If you access Kaxiu from the European Economic Area, the United Kingdom, or elsewhere, your information will be transferred to and processed in the United States. Apple services are processed by Apple under its own privacy policy.
We retain information for as long as needed to provide the service. Certain order, payment, audit, dispute, support, and compliance records may be retained for a period as required by law or platform security.
You can request account deletion from the account page. Before deletion, the server checks for unfinished top-ups, draws, listings, trades, auctions, disputes, support tickets, or review tasks. Once blocking items are resolved, we delete or anonymize personal information as required by law and retain only necessary order, audit, and compliance records.
Kaxiu is not directed to children under 13 (or the minimum age required in your jurisdiction, such as 16 in parts of the EEA). We do not knowingly collect personal information from children under that age. If you believe a child has provided us personal information, contact us (Section 9) and we will delete it.
Depending on your location, you may have rights to access, correct, delete, port, or restrict processing of your personal information, to object to processing, and to withdraw consent.
To exercise your rights, use the in-app account page, a support ticket, or the contact in Section 9.
We use reasonable security measures, including HTTPS/TLS in transit, storing login tokens in the iOS Keychain, handling sensitive operations (balance, draws, payments, trades, auctions, moderation) through server-side transactions, and requiring permission checks with audit logging for administrative actions.
If you have any questions, comments, or complaints about this Policy or our handling of personal information, contact us at the email above or via an in-app support ticket.
When product features, data practices, third-party services, or legal requirements change, we will update this Policy and, where appropriate, notify you via in-app message, prompt, or our website.