WhaleLink Privacy Policy

Last updated: 2026-10-04

Introduction

WhaleLink (the "App") is a secure remote-access client that helps you securely access and manage your own DeepSeek Harness (DSH) host from your phone, and communicate with your agent by voice. We understand the importance of your privacy. This policy explains how we collect, use, store, and protect your information.

1. Information We Collect

1.1 Account Information (provided by you)

When you register or sign in, we collect:

• Your phone number (mainland China +86 only) or email address, used as your account identifier;
• The password you set. Passwords are stored as cryptographic hashes, and we cannot read your plaintext password.
• If you use "Sign in with Apple" (iOS only), we collect: a unique identifier (sub) generated by Apple, used to identify your account; if you choose to share it at first authorization, Apple may provide us with your email address (which may be Apple's private relay email) and name. We do not automatically merge accounts based on this email or name alone.

1.2 Device and Network Information (collected automatically)

• IP address, User-Agent, device type, and similar information, used for account security (e.g. human verification, rate limiting, anomaly detection);
• Network connectivity status, used to determine whether direct local-network access is available;
• Usage metadata (relayed/direct traffic byte counts, speech recognition duration, session count), used for usage statistics display and operations, and containing no voice or web content.

1.3 Information Stored Locally

• Host addresses you manually enter (LAN IP or cloud address);
• Login session credentials (stored encrypted on your device);
• Preferences such as language and theme.

2. How We Use Information

• To provide account registration, sign-in, and session persistence;
• To display the list of cloud hosts under your account;
• To provide voice-to-text and agent communication;
• To protect account security (human verification, rate limiting, anomaly detection);
• To improve the product experience;
• Usage statistics and operations (displaying your usage, cost accounting and pricing analysis).

3. Information Transmission

3.1 Voice Data

When you use voice input or read-aloud, voice data is handled according to the mode you choose; the App does not collect or store your voice audio or conversation content:

• Offline mode: recognition and read-aloud run locally on your device, so voice data never leaves it;
• System recognition: provided by your device's operating system and device manufacturer (Apple Speech Recognition on iOS; on Android, provided by the respective device manufacturer), and voice data is handled under each platform's own privacy policy;
• Cloud mode (optional): if you choose to use "cloud recognition" or "cloud read-aloud" and enter your own Volcengine (a ByteDance company) API Key, the relevant voice audio (recognition) or text (read-aloud) is sent directly to Volcengine for processing, without passing through or being stored on our servers; whether to use it is entirely your choice;
• The text converted from speech is sent to the DSH host that you designate for interaction with the host.

3.2 Scope of This App

The App is mainly responsible for accessing and interacting with web content, and does not touch the memory, files, or other underlying data on your host.

4. How We Store Information

• Local storage: session credentials are stored encrypted on your device; host addresses and preferences are stored locally;
• Server storage: your account identifier (email or phone number) is stored on our server (rdsh.cn) for authentication and host-list services.

5. Companion Software Tools

To access an agent on your intranet, you need to install one of the following companion software on your host (choose one):

• WhaleLink Agent Access Gateway: mainly for servers;
• WhaleLink Agent Remote Access Plugin: mainly for desktop systems.

Both must be used together with DeepSeek Harness (DSH), and are responsible for securely wrapping and forwarding the agent's input and output. The App is a mobile access entry independent of them.

5.1 Security Measures

The following security mechanisms are mainly provided by the above companion software and the overall system:

• Transport encryption: communication between the client and the platform is encrypted via HTTPS / WSS;
• End-to-end encryption: business data between you and your host is end-to-end encrypted, and the relay platform only forwards ciphertext and cannot read the content (even we cannot see your operations or data);
• Outbound tunnel: the host proactively establishes an outbound encrypted tunnel, requiring no public IP, no open inbound ports, and no port forwarding;
• Host fingerprint trust: the first time you connect to a host, its security fingerprint is shown and the encrypted channel is established only after you confirm trust;
• Two-factor authentication (TOTP): when signing in, in addition to your username and password, you can enable two-factor authentication to strengthen sign-in security;
• Host access password: you can set a separate access password for your own host, which is verified when accessing it, further strengthening security.

5.2 Your Private Data

The above companion software only provides secure wrapping and forwarding of input and output, and does not touch your private data, documents, or agent-related credentials on your host; the App is remote and cannot reach this data at all.

• Your private data and documents stored on your own host are not read, collected, or stored by us;
• If you use an agent, we do not interfere with the agent's own operations;
• Data exchange between the agent and its model service provider takes place directly between them, without passing through our servers;
• Credentials such as API Keys you configure for your agent are not touched by us.

6. Third-Party SDKs and Partners

We perform security reviews on third-party SDKs we integrate. As our services and features evolve, we may adjust the third-party SDKs we use and update this policy accordingly. The SDKs and services currently integrated are as follows:

WeChat Open SDK

• Company: Shenzhen Tencent Computer Systems Co., Ltd.;
• Information collected: WeChat app installation status, WeChat sign-in credential, WeChat Pay order identifier, payment status;
• Purpose: security and risk control during WeChat sign-in and WeChat Pay;
• Scenario: WeChat sign-in and WeChat Pay;
• Third-party rules: https://support.weixin.qq.com/cgi-bin/mmsupportacctnodeweb-bin/pages/RYiYJkLOrQwu0nb8

Apple In-App Purchase (StoreKit)

• Company: Apple Inc.;
• Information collected: payment order, transaction receipt;
• Scenario: iOS in-app purchase (subscription);
• Privacy policy: https://www.apple.com/legal/privacy/

Sign in with Apple (iOS only)

• Company: Apple Inc.;
• Information collected: unique Apple identifier (sub); email address and name if you choose to share them at first authorization;
• Purpose: account sign-in and identity authentication;
• Scenario: using "Sign in with Apple";
• Privacy policy: https://www.apple.com/legal/privacy/

Google Play Billing

• Company: Google LLC;
• Information collected: payment order, transaction receipt;
• Scenario: Android in-app purchase (subscription);
• Privacy policy: https://policies.google.com/privacy

System Speech Recognition

• Provided by your device's operating system and device manufacturer (Apple Speech Recognition on iOS; on Android, provided by the respective device manufacturer);
• Information collected: voice audio (for transcription);
• Scenario: voice-to-text input;
• Privacy policy: see Apple and Google respective privacy policies.

Volcengine (optional)

• Company: Beijing Volcano Engine Technology Co., Ltd. (a ByteDance company);
• Information collected: voice audio (cloud recognition), text (cloud read-aloud);
• Purpose: speech recognition and read-aloud driven by the API Key you apply for and enter yourself;
• Scenario: only after you actively enable "cloud recognition" / "cloud read-aloud" and enter an API Key;
• Data flow: content is sent directly to Volcengine for processing, without passing through or being stored on our servers; whether to use it is entirely your choice;
• Privacy policy: https://www.volcengine.com/docs/6256/64902

Flutter Framework

• Developer: Google Inc.;
• Purpose: provides the framework runtime and does not proactively collect user privacy;
• Privacy policy: https://flutter.dev/privacy

In addition, the Alibaba Cloud CAPTCHA service is used for human verification during registration or password reset; this service processes your IP address and device information.

7. Your Rights

• Access and correction: you can view and update your account information within the App;
• Deletion: you can delete your account, after which we will remove your account data stored on our server;
• Withdraw consent: you can disable microphone access in system settings, after which voice features will be unavailable;
• Contact us: if you have any questions about this policy, please contact us via the details below.

8. Protection of Minors

The App is not intended for minors. If you are a minor, please use the App under the guidance of a guardian.

9. Updates to This Policy

This policy may be updated from time to time. In the event of material changes, we will notify you prominently within the App.

10. Contact Us

If you have any questions, comments, or suggestions about this Privacy Policy, please contact us at:

Chengdu Unicgames Co., Ltd. / service@unicgames.com