Third-party SDK and Service List

English version of V1.2-2026-09-24. Published and effective: September 24, 2026.

Operator: Guangzhou Zhigezhao Technology Co., Ltd. (广州支个招科技有限公司). Address: B660, Room 207, Building 7, Lingnan V Valley Industrial Design Creative Park, 6 Jinyi Street, Baiyun District, Guangzhou. Privacy contact: zigora@163.com.

Necessary third-party SDKs and system-platform services support login, push and subscriptions. This list reflects the current client source, Android release dependencies and iOS Pods. Processing varies with OS, device, SDK version and functions used. Google login and Google Play purchases are not currently offered to mainland users; any future introduction requires updated disclosure and necessary consent first. Collecting SDKs are enabled only after privacy consent and your active use of the relevant function, within the necessary scope. Manufacturer push SDKs apply only to their devices and push scenarios. We continue checking final releases, platforms and actual enabled functions. This list describes names, providers, purposes, methods, categories, scenarios, frequency and privacy rules under applicable mainland personal-information, network-data and app-collection rules.

1. Embedded SDKs

1.1 Umeng+ U-Push and base components

Providers: Umeng Tongxin (Beijing) Technology Co., Ltd. and Beijing Ruixun Lingtong Technology Co., Ltd. Components include U-Push, UMCommon, UMDevice, agoo/accs, HTTPDNS and UMID. Versions: Android U-Push 6.7.6, UMCommon 9.9.9, ASMS 1.8.7.2; iOS UMPush 4.1.4, UMCommon 7.5.11, UMDevice 3.6.0; Flutter umeng_push_sdk 2.4.0 and umeng_common_sdk 1.3.0.

Purpose: generate/manage push IDs and channels, deliver/display service notices, process clicks/deep links, measure delivery/opening and troubleshoot. After privacy consent and notification permission, invocation occurs at app start, login/logout, token creation/change and sending/clicks. iOS requests permission after login; initial refusal prevents initialization, with later checks when permission is granted. Device information is read and encrypted to Umeng; our server submits tasks and may use your zigora user ID as an alias.

Categories: brand/manufacturer/model, OS/version, system language, timezone, screen/basic hardware; permitted Android ID, OAID/GAID, IDFV, Umeng IDs, Device Token/Registration ID and APNs token; IP, network/Wi-Fi state and carrier; package/Bundle ID, app/channel/SDK versions and runtime status; aliases, permissions/switches, notice content/ID, sending/receiving/display/click times, delivery/open results, destination/deep link and error logs. Invocation is reasonably needed for token registration/refresh, channel maintenance, notices and troubleshooting; system/manufacturer channels may operate outside the foreground. Capabilities include network/Wi-Fi state, notifications and necessary signature/manufacturer permissions. zigora uses this for service messages, not ad profiling or cross-app advertising. Disable in app/system settings; logout/closure unbinds the alias.

1.2 Huawei Push Kit

Provider: Huawei Software Technologies Co., Ltd. Android com.huawei.hms:push 6.13.0.301; Umeng adapter 2.3.0. After consent and notifications, Huawei-device registration, receipt and clicks use the system channel. Necessary SDK information reaches Huawei servers. Categories include App ID/package/app/SDK versions, model/hardware/OS/settings, AAID, push tokens, network information, content and sending/receiving/click states, calls and failure logs. Calls occur on initial enablement, token changes and as needed for sending, processing and maintaining the channel, including background receipt. Permissions: network/Wi-Fi state, notifications and Huawei badge/push capabilities.

1.3 OPPO OPUSH

Provider: Guangdong Huantai Technology Co., Ltd. and affiliates. Android OPUSH 3.7.1; Umeng adapter 2.3.0. Consented notifications on supported OPPO, OnePlus and realme devices use the system service to authenticate developers, obtain Registration ID and deliver notices. Data includes Registration ID, App Key/Secret, MCS package, app package/version, SDK version and content/sending/receipt/click state. Reading occurs at initialization/registration; Registration ID is used until deregistration or deletion, with per-notice calls as needed. Permissions: network, notifications and OPPO/Huantai message capabilities.

1.4 vivo Push

Provider: Vivo Mobile Communication Co., Ltd. Android vivo Push 4.1.3.0; Umeng adapter 2.3.0. Consented vivo/iQOO notifications register, deliver/display and record interface success through vivo servers and system channels. Data includes App ID/Key/package/app/SDK versions, vpush Reg ID, device type/basic hardware, OS/version, network, notification settings and sending/receipt/click status. Calls occur on enablement, token changes, notices and channel maintenance; background receipt may occur. Permissions: network, notifications and vivo badge/push capabilities.

1.5 HONOR Push

Provider: Shenzhen Honor Software Technology Co., Ltd. or affiliates. Android HONOR Push 10.0.13.305; Umeng adapter 2.3.0. After consent and notification permission, HONOR devices send/display notifications through the SDK, servers and system channel. Data includes device/system and app information, AAID, tokens, network, notice content and send/receive/click states, runtime and failure logs. Calls occur on enablement, token changes, notices and channel maintenance, potentially in the background. Permissions: network, notifications and HONOR push/notification-reading capabilities.

1.6 Xiaomi Mi Push

Provider: Beijing Xiaomi Mobile Software Co., Ltd. and affiliates. Android Mi Push 7.9.2; Umeng adapter 2.3.0. On supported Xiaomi/Redmi devices, consented notifications use encrypted communication with Xiaomi servers and may communicate with or launch the system push service for registration, delivery and display. Data includes package/app/SDK versions and runtime state; manufacturer/model/memory/OS, country/region and unique device or push registration ID; network/Wi-Fi state and SIM carrier; content and creation/delivery/click times, notification-bar/lock-screen settings, interface results, erroneous requests and crashes. Some network/carrier information may be read only locally, depending on Xiaomi rules and the final implementation. Calls occur on enablement, token changes, notices and channel maintenance, including background receipt. Permissions: network/Wi-Fi state, notifications and Xiaomi push capabilities. We use service notifications rather than marketing or ad-effect measurement. Xiaomi's published rules say third-party pushed message content is deleted after 30 days; other data follows necessary or legal periods. Disable in app/system settings.

1.7 WeChat Open SDK

Provider: Shenzhen Tencent Computer Systems Co., Ltd. Integrated through fluwx_no_pay for account linking and invitation sharing. Versions: Android WeChat Open SDK 6.8.34; iOS OpenWeChatSDKNoPay 2.0.5; Flutter fluwx_no_pay 6.0.2. It checks WeChat availability only when you actively link from account management or share a profile/MBTI invitation. This version does not display a WeChat login button or query installation merely on entering login.

For linking, the SDK communicates with WeChat, obtains a temporary authorized code and our server exchanges it to link your current account. For sharing, the chosen link/title/description is passed to WeChat; you choose recipients and confirm. We do not read contacts or chats. Data includes installation availability, App ID/package/Bundle ID, requested scope/random state, temporary code and authorization state; authorized OpenID/UnionID, nickname/avatar; invitation link and access identifier, title/description and action/result states. On iOS, temporary Open SDK protocol clipboard reads/writes may support cross-app communication. Calls happen only when you choose linking/sharing, not routine start, browsing or other login methods. Capabilities include network, installation queries, URL Scheme/Universal Link and cross-app navigation, with possible iOS protocol clipboard use. Avoiding/canceling the action stops it; copying links is an alternative. Unlink through app or WeChat authorization settings. Revoking WeChat does not close zigora.

2. iOS platform services

These Apple/system functions are disclosed for completeness and are not embedded SDKs in the Android sense.

2.1 Sign in with Apple

Provider: Apple Inc. and applicable affiliates. Local component sign_in_with_apple 8.1.0. Your active selection authenticates and creates/links an account. Data includes the app-specific user ID, identity token/code, chosen name/email or relay address and Apple's security/fraud account/device usage summaries and risk scores. System authentication happens per selection; the app forwards its result to our server for verification.

2.2 App Store and StoreKit

Provider: Apple Inc. and applicable affiliates. Components: StoreKit, in_app_purchase 3.3.0 and in_app_purchase_storekit 0.4.11+2. Product queries, subscriptions, restoration and refunds complete purchases, verify transactions and issue benefits. Apple independently handles accounts and payment methods; zigora receives product IDs/prices, order/transaction/original IDs, times, payment/subscription status, receipt or signed-verification data, App Account Token and refund/restoration results, not bank-card numbers or payment passwords. Calls are limited to product queries, purchase/restoration, status synchronization and transaction completion; purchase listeners run on iOS only.

2.3 APNs

Provider: Apple Inc. and applicable affiliates. Enabled notifications send/display through Apple Push Notification service. Data: APNs token, Bundle ID/topic, content, sending/delivery information and permission status. Registration occurs on permission/token changes; per-notice processing may occur outside the foreground.

3. Local components

Current local-only components do not independently transmit information to their open-source maintainers, so are not independent recipients in section 1. flutter_secure_storage uses Android Keystore/Apple Keychain for encrypted tokens/settings; package_info_plus reads package/version/build locally; url_launcher opens system settings, webpages or email on your action. Our camera/voice plugins invoke permissions only after active use and authorization. Voice passes through our server to Bailian, an API rather than a Bailian client SDK; new image-upload processing requires separate disclosure.

4. Server processors

These are server API services, not embedded client SDKs; processing is also described in Privacy Policy section 6.

Alibaba Cloud Computing Co., Ltd.: East China 1, Hangzhou cloud computing, databases and storage.
Shanghai Puzhikun Information Technology Co., Ltd.: server API sending phone verification SMS.
Tongyi Yunqi (Hangzhou) Information Technology Co., Ltd., Bailian AI: necessary questions/context/linked profiles/goals and outputs for replies/readings, including Qwen. Published agreement 6.2.4–6.2.7 limits dialogue data to the shortest necessary delivery period; deletion follows customer instructions; legal/backup restrictions first limit further processing; termination buffers depend on purchase rules. No universal fixed period or promise of instant deletion/zero retention.
Beijing Volcano Engine Technology Co., Ltd., Volcano Ark: routed necessary prompts/context/linked information/output, including Doubao Seed 2.0 Pro. Special terms 3.7.7 and 3.7.11 allow reasonable troubleshooting-data retention, stop further storage/review after an abnormal alert resolves and identify storage created by enabled caching/logging/monitoring. No universal period or all-scenario zero-retention promise; purpose, alert state and enabled functions determine retention.
Tongyi Yunqi (Hangzhou), Bailian voice recognition: after your confirmation, up to 60 seconds of recording passes via the server to qwen-audio-3.0-asr-flash and returns editable text. Normal completion/cancel/disposal deletes client temporary recordings; audio is not a conversation attachment. Provider audio/text retention and deletion follow Bailian agreement 6.2.4–6.2.7 as above, without a universal period or instant/zero-retention promise.

AI and voice are separate activities with separate purposes and retention disclosure. zigora history, audits and backups follow Privacy Policy section 8. Device audio deletion does not mean all providers have deleted their copies.

5. Activation, withdrawal and rights

Before privacy consent, collecting/transmitting SDKs are not initialized or called. Refusal does not prevent policy reading but may prevent account/network features. Notifications are optional; disabling them stops active sends to that device while manufacturer channels may briefly deliver in-flight messages. WeChat linking/sharing, Apple login and purchases are initiated by you; not selecting them leaves other available login/free functions usable. Request access, copies, corrections, deletion, consent withdrawal or closure through app privacy controls or email. We lawfully help coordinate requests concerning third-party processing.

6. Updates

Changes to SDK names, providers, purposes, methods or categories receive timely updates and any required renewed/separate consent before the changed SDK is enabled. Access and save the current list under Me → Privacy Management.