Privacy Policy

Xuzhou Youfang Network Technology Co., Ltd. ("we" or "us") operates ScholarKey VPN (Chinese name: 知匙加速器; the "App") and its official website. We understand how important your personal information is to you, and we process it in accordance with the Personal Information Protection Law of the People's Republic of China and other applicable laws and regulations.

This Policy explains what information we collect, why we collect it, how we use and protect it, and how you can manage your own information. Please read this Policy carefully before using the App, especially the parts in bold. By tapping "Agree and Continue", you confirm that you have read and agree to this Policy. If you do not agree, you may choose not to use the App.

Our basic principles

• We collect only what is necessary. The App does not ask for your phone number and does not require real-name verification. You can also skip registration and use the App and buy a membership as a guest.
• No advertising and no tracking. The App has no ads and does not integrate any third-party advertising or analytics SDK. We do not access the advertising identifier (IDFA) and do not track your activity in other apps or on other websites.
• We do not look at what you access. Only traffic to websites on the academic resource whitelist passes through our connection servers, and our connection servers do not log the web addresses you visit or the content transmitted.
• We do not sell personal information.

1. Personal information we collect and use

1.1 Using the App as a guest (default)

When you open the App for the first time, we automatically create a guest identity for you; no registration is needed. To do this, we process:

• Device identifier: a random identifier that the App generates in your device's keychain. It is not an advertising identifier or a device serial number. It is used only to identify your guest identity, recover your guest data after you reinstall the App, and manage signed-in devices.
• Device information: device model (for example, "iPhone 16 Pro"), system version, App version and platform type. This is used to display your devices in the "Signed-in Devices" list and to troubleshoot compatibility issues.
• User ID: a number we assign to you (for example, v-10012345). It is shown on the "Me" tab so that you can identify yourself when you contact us.

1.2 Registering and signing in to an account (optional)

With an account, you can use your membership on multiple devices and keep it when you switch phones. You can choose:

• Email sign-in: we collect your email address and the password you set. Passwords are stored only as salted hashes, so no one (including us) can recover the original password. When you register, sign in with an email code or reset your password, we send a verification code to your email.
• Sign in with Apple: we receive the user identifier provided by Apple and the email address you choose to share (which may be an Apple "Hide My Email" address). We do not request your name. We also store the authorization token returned by Apple, which is used only to revoke the authorization with Apple when you delete your account.

When you sign in, the membership time, favorites, wishes and feedback you have as a guest on this device are merged into your account.

An account can be signed in on up to 3 devices at the same time. To enforce this rule, we record the device identifier, device information and last-used time of each signed-in device. If your account is already signed in on 3 devices and you sign in on a new device, we automatically sign out the device that has gone unused the longest.

1.3 Academic resource access (VPN connection)

The App establishes an encrypted connection using the iOS Network Extension (VPN) feature. The first time you connect, iOS asks you to allow the VPN configuration to be added.

• Connection credential: we generate a random connection credential for each device. It is used by the connection servers to authenticate connections and to enforce membership and device limits. The credential is invalidated when the device is removed, when you sign out, or when you delete your account.
• Network traffic: Only traffic to academic resource websites on the whitelist passes through the encrypted connection and our connection servers. Traffic to all other websites and apps connects directly and does not pass through our servers. Our connection servers only forward traffic. They do not log the web addresses you visit and do not view or store the content transmitted.
• IP address: when a network connection is established, the connection servers and our API servers necessarily receive your IP address.
• Domain name resolution: while connected, domain names of whitelisted websites are resolved through the connection servers. Domain names of other websites are sent by your device directly to Alibaba Cloud Public DNS (223.5.5.5) for resolution.

1.4 Buying a membership

• Memberships are paid for through Apple's In-App Purchase. We do not receive your bank card, payment account or other payment information.
• We receive and store the transaction ID, original transaction ID, product, purchase time, expiration time, auto-renewal status and refund status, as well as a purchase identifier attached at the time of purchase and linked to your user ID. This information is used to activate and renew memberships, restore purchases and process refunds.
• We receive notifications from Apple about subscription renewals, cancellations and refunds so that we can keep your membership status up to date.

1.5 Library, favorites and Wish Cards

• Favorites: resources you add to your favorites are stored on our servers so that they can be synced across your devices.
• Search: the keywords you enter are used only to return search results, and we do not store them in association with your identity. Your recent searches are stored only on your device, and you can clear them at any time.
• Wish Cards: the resource name, web address and contact information (optional) you enter are used to evaluate and add resources, and to show you the progress in "My Wishes".
• Visiting resource websites: resource websites open inside the App in the system's Safari view. These websites are operated by third parties, and their own privacy policies govern how they collect and use your information. We cannot access what you browse or your sign-in information on these websites.

1.6 Feedback

We collect the problem description and contact information (optional) that you submit. To help us troubleshoot, diagnostic information is attached when you submit: App version, system version, device model, VPN connection status and the current server number. Your contact information is used only to reply to you.

1.7 Security and service operation

To keep accounts and the service secure and to troubleshoot faults, our API servers record operational logs, including IP address, request time, the feature requested and the result. As required by the Cybersecurity Law of the People's Republic of China, we retain network logs for no less than six months.

1.8 Information stored on your device

Your sign-in credential and device identifier are stored in your device's keychain. Whether you have agreed to the Privacy Policy, your appearance settings and your recent searches are stored in the App's local storage. This information is not uploaded, and the information in local storage is erased when you delete the App.

1.9 Information we do not collect

We do not collect your phone number, contacts, precise or approximate location, photos, microphone or camera data, or advertising identifier, and we do not read the contents of your clipboard.

2. Device permissions used by the App

The App does not request permission for notifications, location, camera, photos, contacts, microphone, Bluetooth or local network. You can delete the App's VPN configuration at any time in iPhone "Settings → General → VPN & Device Management". After deleting it, you will not be able to use the academic resource access feature, but other features are not affected.

3. Cookies and similar technologies

The App does not use cookies or similar technologies to track you. Our official website does not use cookies either and does not include any analytics tools. Third-party resource websites you open in the App may use cookies, which are governed by their own policies.

4. How we share, transfer and publicly disclose information

We do not sell your personal information or use it for personalized advertising. We will share or disclose your personal information only in the following cases:

• With your separate consent obtained in advance;
• As required by laws and regulations, litigation, or lawful requests from administrative or judicial authorities;
• Where personal information needs to be transferred because of a merger, division, dissolution, declaration of bankruptcy or similar event. In that case, we will tell you the name and contact details of the recipient and require the recipient to continue to fulfill the obligations in this Policy. If the recipient changes the purpose or method of processing, it will obtain your consent again.

5. Where and how long we store information

• Storage location: your account and service data are stored on servers within the People's Republic of China.
• Location of connection servers: connection servers may be located inside or outside mainland China (for example, in Hong Kong, China), depending on the servers offered in the App. When you connect to a server, your IP address, connection credential and encrypted traffic to whitelisted websites pass through that server. If a server is located outside mainland China, we will fulfill our legal obligations regarding cross-border transfers of personal information and obtain your separate consent.
• Retention period: we keep your personal information only for the shortest period needed to achieve the purposes described in this Policy:
  • Account and service data: kept for as long as your account exists;
  • Transaction records: kept for the period required by accounting, tax and other laws and regulations, and no longer linked to your identity after your account is deleted;
  • Operational logs: kept for no less than six months and deleted afterwards;
  • After these periods expire, we delete or anonymize your personal information.
• Discontinuation of the service: if the App stops operating, we will notify you at least 30 days in advance and delete or anonymize your personal information after operations end.

6. How we protect your personal information

• All communication between the App and our servers is encrypted with HTTPS, and service data is additionally encrypted in transit with AES-256-GCM;
• Passwords are stored as salted hashes;
• VPN connections are encrypted with TLS, and the server certificate fingerprint is verified to prevent impersonation;
• We apply access controls to our servers and databases, and only authorized personnel can access personal information, to the extent required by their work;
• In the unfortunate event of a personal information security incident, we will take remedial measures immediately and notify you and the relevant authorities promptly as required by law.

No internet environment is completely secure. Please keep your account password safe and do not lend your account to others.

7. Your rights

You can manage your personal information directly in the App:

About deleting your account:

• To delete your account, you must verify your identity again with an email verification code or with Apple. Deletion takes effect immediately after verification;
• After deletion, your email address, password, Apple authorization, favorites and all signed-in devices are deleted or invalidated, and we revoke the "Sign in with Apple" authorization with Apple. Any membership benefits remaining on the account are removed and cannot be restored;
• Deleting your account does not automatically cancel an Apple auto-renewing subscription. If you subscribed to Monthly Auto-Renew, first cancel it in iPhone "Settings → Apple Account → Subscriptions" to avoid further charges;
• A guest identity has no account to delete. To have your guest data deleted, contact us using the details at the end of this Policy.

For requests that cannot be completed in the App, such as obtaining a copy of your personal information, transferring your personal information, correcting information, or withdrawing a consent you have previously given, contact us using the details at the end of this Policy. We will respond within 15 working days after verifying your identity. Withdrawing consent does not affect processing carried out on the basis of that consent before it was withdrawn.

8. Personal information of minors

The App is intended mainly for students and researchers. If you are a minor under the age of 18, please read this Policy together with your parent or guardian and use the App only with their consent. We do not knowingly collect personal information from children under the age of 14. If a parent or guardian discovers that a child has provided us with personal information without consent, please contact us and we will delete it as soon as possible.

9. Updates to this Policy

We may update this Policy from time to time. When we do, we will publish the new version on this page and update the date. For material changes (for example, changes to the purposes or methods of processing or to the types of personal information processed), we will notify you prominently in the App, such as with a pop-up, and obtain your consent again where required.

10. How to contact us

If you have any questions, comments or complaints about this Policy or your personal information, you can contact us at:

• Operator: Xuzhou Youfang Network Technology Co., Ltd.
• Contact email: support@scholarkey.com
• In the App: "Me → Feedback"