HEARIN / INORRA
Privacy & data
Website privacy notice
Scope: the public Inorra website and Hearin metadata catalog. English source · Version 2026-10-28 · Publication date: 2026-10-28.
This website
This notice covers the public Inorra website and Hearin library catalog. The operator is Hui Wang, an individual developer using the Inorra brand, Råcksta Gårdsväg 21, 162 73 Stockholm, Sweden. Contact: foks.wang@gmail.com. App data processing is described separately below; the App policy draft is not an effective App privacy policy.
What the website processes
You can browse without creating an account or logging in. Public catalog pages display published titles, covers, collection descriptions and episode relationships. They do not expose your personal reading activity, iCloud data or purchase records. The website source has no advertising pixels, analytics integration, tracking cookies, local-storage tracking, contact form or file upload. Language selection follows a link to another static page.
Delivery and security
The website is configured for Cloudflare hosting and delivery. Your browser sends ordinary request information, including an IP address, requested URL, browser information and request time, to the hosting network. Cloudflare processes network and security information to deliver the pages and protect the service. We do not claim that visiting a static website transmits no personal data. The website does not request access to App verification, subscription or private content APIs.
Why information is processed
Necessary delivery and proportionate security processing serve our legitimate interests in operating a reliable public website and preventing abuse. If you contact us, we process the information you provide to answer your request and, where applicable, fulfil data-protection or other legal obligations. No marketing mailing list or advertising profile is created by this website.
Email contact and retention
Contact links open your email application. If you send a message to foks.wang@gmail.com, Gmail and your email provider process the correspondence under their applicable terms. We use the message and contact details to handle your request. Correspondence is kept for as long as necessary to resolve the request and meet applicable legal obligations; relevant circumstances include an unresolved request or dispute. This website does not operate an automatic mailbox deletion service. Please avoid sending passwords, purchase credentials or private article content.
Providers and international processing
Cloudflare operates a global network; this is not a promise of processing exclusively in Sweden or the EU. Its applicable customer agreement and Data Processing Addendum describe its processing and transfer safeguards, including applicable standard contractual clauses and Data Privacy Framework provisions. Hosting security information and recovery copies follow the applicable service configuration and provider terms; we do not promise a universal log-deletion deadline. Email provider processing is separate from website hosting.
Your rights
Where applicable, you can request access, correction, deletion, restriction or portability of personal data, and object to processing based on legitimate interests. Contact foks.wang@gmail.com. We may need information sufficient to identify the request without collecting unnecessary data. You can complain to Sweden’s privacy authority, IMY, or your competent supervisory authority. This website does not implement automated decisions with legal or similarly significant effects.
Scope and updates
This notice describes the public website. It does not approve an App release, describe future social or AI features as available, or promise deletion of App security records. We will update the website notice when its processing changes. The version and publication date are displayed with this notice.
Cloudflare customer terms · Cloudflare data processing addendum · Google privacy · IMY
About data in the Hearin App
Translation text and speech are processed on your iPhone. iCloud syncs personal state, not article bodies or offline files. Google ML Kit can send technical diagnostics and installation identifiers; on-device processing does not mean zero network data. See the detailed privacy draft.
Who is responsible
Hui Wang, an individual developer trading under the Inorra brand, Råcksta Gårdsväg 21, 162 73 Stockholm, Sweden. Privacy requests: foks.wang@gmail.com. Inorra is a brand, not a registered company. This review draft covers the Hearin iPhone app and the Inorra marketing website. It has no effective date until the release review is complete.
Reading, translation and speech
Reading content, local translations, downloaded stories and speech resources are stored or processed on your iPhone. The app uses Apple system speech and, for supported translation paths, Apple translation or Google ML Kit. Downloaded language and voice resources may be needed. On-device text processing does not mean every supporting service is offline or that no technical data is transmitted.
Your private iCloud state
Hearin has no separate product account. When iCloud is available, personal state such as followed sources, saved items, reading progress, preferences and limited playback state can synchronize through your Apple-managed private CloudKit database. Article bodies, translations, offline files and the full playback queue are not synchronized through this feature. Hearin does not receive your Apple ID email or password. Apple operates iCloud under its own terms and privacy policy.
Google translation services
Google states that ML Kit processes translation input and output on the device without sending that text to Google. Its SDK can connect for models and configuration and send device/app information, per-installation identifiers, configured languages, performance, usage and error diagnostics. Google processes this technical information under its own privacy terms. These disclosures are separate from local text processing and are not a claim of zero third-party collection.
Content delivery, security and purchases
Requests to retrieve Hearin content disclose network and request information to delivery providers. App authenticity and subscription checks use technical app-verification identifiers, session records and purchase-verification information; they do not require a Hearin login. The implementation stores hashed session tokens and transaction identifiers where used, rather than raw bearer tokens or raw signed purchase records in its state database. Security records are separate from a personal reading-history service. Apple handles App Store payments and may supply purchase entitlement information. We do not receive your payment-card details.
RSS sources and external destinations
Importing or refreshing RSS, loading publisher images, or opening an external article can contact that publisher or its hosting provider, which receives normal network request information, including your IP address. Feed content and availability depend on the source. Those operators have their own privacy policies. Do not import confidential feeds or URLs containing credentials unless you understand their handling.
This website
The website source adds no advertising pixels, analytics SDK, cookies, local-storage tracking or feedback form. Selecting a website language navigates to a static page; it does not create an account or a language cookie. Images, styles and scripts are served from the site. Once deployed, Cloudflare will process network/request information to deliver and protect the website. Hosting logs and optional account-level services must be verified against the actual release configuration; this draft does not assert that hosting processes no personal data.
When you contact us
If you email foks.wang@gmail.com, your email address, message and any attachments are processed to respond to your request. Email providers also process the correspondence. Do not send passwords, payment details or full private reading content. The website itself has no upload or support form.
Purposes and legal grounds — release review
The proposed GDPR basis for necessary content delivery and requested features is performance of the service contract; for minimal anti-abuse/security processing, legitimate interests in protecting the service, subject to a documented balancing assessment; and for mandatory legal records, legal obligation where applicable. Optional diagnostic/SDK processing needs a separate necessity, lawful-basis and consent assessment before release. An operating-system permission is not automatically GDPR consent. These proposed grounds must match the final app behavior before this policy becomes effective.
Retention, recipients and international transfers — release review
Local files remain subject to app/device storage controls and deletion. Private iCloud data follows Apple storage controls and must be managed separately from local files. The October 2026 deployment review found that expired session and app-verification challenge records remain in the database after they stop granting access. Eligible new diagnostic events attempt to remove diagnostic records older than seven days and limit their number, but this is not a scheduled or guaranteed deletion deadline. Other security, purchase-verification and recovery records need separate retention rules. Before release, the operator must establish the necessary retention and deletion criteria for security records, purchase verification, contact emails, hosting logs and recovery copies, and verify applicable provider roles and transfer safeguards. Cloudflare publishes a customer Data Processing Addendum, incorporated into its Self-Serve Subscription Agreement where applicable, including international-transfer provisions. This reference does not assert EU-only storage or establish the configuration and retention of every deployed service. No unverified blanket deletion deadline or EU-only storage promise is made.
Your choices and rights
Manage local downloads in the app and cloud storage using Apple’s available controls. Removing a local app copy does not itself prove deletion of iCloud records, external-provider records or purchase history. Where applicable, you may request access, correction, erasure, restriction, portability or object to processing; consent-based processing permits withdrawal without affecting earlier lawful processing. Contact foks.wang@gmail.com. You may complain to your local supervisory authority, including Sweden’s IMY. There is no automated decision-making with legal or similarly significant effects implemented in the reviewed marketing site.
Scope and changes
Planned on-device AI and social features are not covered as already available features. Any new processing must be assessed and this policy updated before those features are released. The eventual effective date, material changes and final app disclosure must be stated clearly. The review date records this draft, not a past launch.