ReturnGuard Privacy Policy

Effective date: August 19, 2026

Information stored on your device

Order references, optional item details, recipient names, phone numbers, addresses, marketplace accounts, shipment and return videos, and private transaction risk reminders are stored in ReturnGuard’s private app container on your device. Reminders support manual review and stronger capture. An account is optional: recording, saving, viewing, comparison, and export work without signing in. ReturnGuard provides no cloud media storage or shared blacklist.

You can also select a CSV/TSV product table exported from Excel, Numbers, or WPS to build an on-device Product Library. ReturnGuard reads only the file you choose, stores imported products in its private app container, and does not upload the table to a server. You can delete the Product Library inside the app.

“No cloud media storage” means that the ReturnGuard developer does not operate or receive a cloud copy of your cases or media. If you enable iPhone backup, Apple may include the app container in your encrypted iCloud or computer backup according to your device settings. We cannot access, inspect, or restore that Apple-managed backup.

Data we collect

ReturnGuard does not upload or collect order references, customer or product details, videos, photos, notes, exports, identifiers, advertising data, analytics, or location. The app contains no advertising or third-party analytics SDK.

If you choose account sign-in, you may register worldwide with an email address. When China mainland SMS is available, the app also offers +86 mobile registration; the phone option stays hidden when unavailable. ReturnGuard sends only the selected contact method to our account service to deliver and verify a six-digit code using Alibaba Cloud DirectMail or Alibaba Cloud SMS. After verification, our service retains the verified email address or phone number and an internal user identifier. You may create a password; only a one-way password hash is retained, never the plaintext password. Only when you manually back up store profiles does the service also retain profile name, marketplace, and optional seller/store ID. Account backup never includes orders, labels, buyer details, product templates, the Product Library, photos, videos, notes, or exports, and is not used for tracking or advertising.

Codes are stored only as one-way HMAC values and expire after 10 minutes; the session token is kept in the iOS Keychain. You can create or change a password in My Account, or reset it after verifying the registered email address or phone number again. Deleting the server account removes the verified email address or phone number, password hash, account record, and backed-up store metadata while local evidence remains on the iPhone. Account, email, or SMS outages do not affect local recording, saving, viewing, comparison, or export.

Server-signed time receipts are disabled by default. After you opt in or manually request one, ReturnGuard sends only the file’s SHA-256 fingerprint, media type, and capture time over HTTPS to api-returnguard.xunfangbbs.com. The server creates and immediately returns an Ed25519 signature. It receives no original file, order number, customer details, or product name and does not retain request fields or issued receipts in an account, database, or access log. You may turn automatic requests off at any time; local recording, comparison, and export continue if the server is unavailable.

Permissions and sharing

Camera access is used to scan codes, recognize shipping-label text and a broad item category on device, and capture shipment or return records. Recognition creates only editable reference fields; it does not establish authenticity, an exact model, or a unique product identity. Microphone access is used only for video with audio. A file leaves the device only when you choose a destination through the iOS share sheet.

Retention and deletion

Cases, transaction risk reminders, and returned signing receipts remain on your device until you delete them or uninstall the app. Reminders can be paused, corrected, or deleted separately. Uninstalling removes records not exported or preserved through an Apple-managed device backup. We cannot recover deleted local data because we possess no case or media server copy. Time-receipt request fields are discarded as soon as signing is complete. Optional account and store-profile metadata remain until you delete the account in the app; uninstalling alone does not delete the server account.

Children, changes, and contact

ReturnGuard is a business utility and is not directed to children. We will update this policy and App Store disclosures before changed data practices are released when required. Contact support@xunfangbbs.com without sensitive case media unless necessary and authorized.