灵析隐私协议Lingxi Privacy Policy

前言Introduction

上海途颜实业有限公司（以下简称"我们"）开发并运营"灵析"应用程序（包括"灵析"移动 App、灵析桌面端及灵析云端服务，以下统称"本服务"）及其相关配套服务。我们深知个人信息对您的重要性，并会尽全力保护您的个人信息安全可靠。

Shanghai Tuyan Industrial Co., Ltd. (hereinafter "we," "us," or "our") develops and operates the "Lingxi" application, including the Lingxi mobile app, the Lingxi desktop app, and the Lingxi cloud services (collectively, the "Service"). We understand the importance of your personal information and are committed to protecting its safety and security.

本服务主要功能：灵析是一款 AI 智能助手产品。您可以通过移动端登录账号，连接并远程操控您自己已登录同一账号的桌面端设备，进行 AI 对话、任务创建与跟踪、审批交互、文件传输等功能；也可以在不连接桌面端的情况下，直接使用云端 AI 对话能力。

Primary Function of the Service: Lingxi is an AI assistant product. You can log in with your account on the mobile app to connect to and remotely operate your own desktop devices that are signed in with the same account — to conduct AI conversations, create and track tasks, respond to approval requests, and transfer files. You can also use the cloud-based AI conversation feature directly, without connecting to a desktop device.

请您在使用本服务前，仔细阅读并充分了解本《隐私协议》（以下简称"本协议"）。您注册、登录、使用本服务的行为，即视为您已阅读并同意本协议的全部内容。 如果您不同意本协议的任何内容，请停止使用本服务；如果您已使用本服务，请您停止使用并删除本应用，或按照本协议第十二条与我们联系以注销账号。

Please read this Privacy Policy (the "Policy") carefully before using the Service. By registering for, logging in to, or using the Service, you are deemed to have read and agreed to the entire contents of this Policy. If you do not agree with any part of this Policy, please stop using the Service; if you have already been using it, please stop using and uninstall the app, or contact us in accordance with Section 12 below to request account deletion.

一、我们收集您个人信息的目的、方式和范围1. The Information We Collect, and Why

我们仅会出于本条款所述目的收集您的个人信息，并且只会收集实现产品功能所必需的最少信息。

We only collect personal information for the purposes described in this section, and we only collect the minimum information necessary to deliver the product's functionality.

1.1 账号注册与登录（必需）1.1 Account Registration and Login (Required)

当您注册或登录灵析账号时，我们会收集：

When you register for or log in to a Lingxi account, we collect:

1.2 设备配对与管理（使用本服务必需）1.2 Device Pairing and Management (Required to Use the Service)

当您使用移动端连接桌面端设备时，我们会收集：

When you connect your mobile device to a desktop device, we collect:

1.3 AI 对话与任务（核心功能）1.3 AI Conversations and Tasks (Core Functionality)

当您使用 AI 对话、创建/跟踪任务、进行审批交互时，我们会处理：

When you use AI conversations, create/track tasks, or respond to approval interactions, we process:

1.4 文件传输与文件管理1.4 File Transfer and File Management

当您使用手机与电脑之间互传文件、或向 AI 任务提供输入文件时，我们会处理：

When you transfer files between your phone and computer, or provide input files to an AI task, we process:

1.5 推送通知（可选）1.5 Push Notifications (Optional)

当您允许我们发送通知后，我们会收集：

If you allow us to send notifications, we collect:

1.6 大模型 API 密钥（仅在您使用"自定义模型"功能时）1.6 Large Model API Keys (Only When You Use the "Custom Model" Feature)

当您主动选择"自定义模型"并填写第三方大模型的 API Key 时：

When you choose "Custom Model" and enter a third-party large model's API key:

• 您的 API Key 通过加密信道（HTTPS/TLS）传输至灵析云端服务器，经 AES-256-GCM 算法加密后存储；
• 我们不会在移动端本地存储您的 API Key 明文；
• 我们不会将 API Key 明文写入任何日志，不会将其返回给任何客户端，不会将其用于提供服务本身之外的任何用途；
• 您可在应用内随时删除该自定义模型配置，删除后对应的加密密钥数据将被同步删除。

• Your API key is transmitted over an encrypted channel (HTTPS/TLS) to Lingxi's cloud servers and stored encrypted with the AES-256-GCM algorithm;
• We do not store your API key in plain text on the mobile device;
• We do not write the plain-text API key to any logs, do not return it to any client, and do not use it for any purpose other than providing the service itself;
• You can delete the custom model configuration in the app at any time; upon deletion, the corresponding encrypted key data is deleted as well.

1.7 本地存储1.7 Local Storage

为正常使用本服务，应用会在您的设备本地（应用沙箱内）存储：

To operate the Service, the app stores the following on your device (inside the app sandbox):

以上本地数据均存储于您设备的应用沙箱中，我们无法远程读取；您卸载本应用后，上述本地数据将一并删除。

All of the above local data resides in your device's app sandbox, which we cannot read remotely. When you uninstall the app, this local data is deleted with it.

1.8 我们不会收集的信息1.8 Information We Do NOT Collect

我们不会收集以下信息（当前版本）：

We do not collect the following (in the current version):

• 通讯录、短信、通话记录；
• 位置信息（精确或粗略）；
• 麦克风录音（当前版本未提供语音功能，麦克风权限未启用）；
• 相机/照片（当前版本未提供拍照功能，相机权限未启用）；
• 应用列表（未声明对应查询权限）；
• 任何广告标识符（如 GAID/IDFA）——本应用不包含任何广告 SDK 与统计分析 SDK。

• Contacts, SMS messages, or call history;
• Location information (precise or approximate);
• Microphone recordings (no voice feature is available in the current version; the microphone permission is not enabled);
• Camera/photos (no camera feature is available in the current version; the camera permission is not enabled);
• Installed app lists (no corresponding query permission is declared);
• Any advertising identifiers (e.g., GAID/IDFA) — the app contains no advertising SDKs and no analytics SDKs.

二、第三方服务与信息共享2. Third-Party Services and Information Sharing

2.1 我们共享信息的第三方2.1 Third Parties With Which We Share Information

为提供本服务，以下第三方服务供应商会处理您的部分信息：

To provide the Service, the following third-party service providers process some of your information:

2.2 重要提示（关于大模型服务商）2.2 Important Notice (About Large Model Providers)

当使用"云端 AI 对话"（含官方托管模型与您自定义配置的模型）时，您的对话内容将被传输至相应的大模型服务商服务器进行处理。请注意：

When using "cloud AI conversations" (including officially hosted models and models you configure yourself), your conversation content is transmitted to the servers of the corresponding large model provider for processing. Please note:

1. 不同服务商的数据处理政策各不相同，部分服务商可能位于境外；
2. 您的对话内容可能包含个人信息或敏感信息，请您自行评估并谨慎输入；
3. 我们不会访问、读取或使用您与第三方大模型服务商之间的交互内容用于任何目的（除完成推理所必需的技术处理外）。

1. Data-handling policies differ among providers, and some providers may be located outside your country/region;
2. Your conversation content may contain personal or sensitive information — please evaluate this yourself and type carefully;
3. We do not access, read, or use the interaction content between you and third-party large model providers for any purpose (except for the technical processing necessary to complete inference).

2.3 我们承诺2.3 Our Commitments

• 我们不会出售您的个人信息；
• 我们不会将您的个人信息用于广告投放或用户画像；
• 我们不会与上述列明的第三方以外的任何第三方共享您的个人信息，除非：
  1. 获得您的明确同意；
  2. 依据法律法规的要求或政府主管部门的强制性要求；
  3. 为保护我们、我们的用户或公众的人身、财产安全或知识产权免遭损害而有必要；
  4. 与学术研究机构共享，且信息已做匿名化处理。

• We will not sell your personal information;
• We will not use your personal information for advertising or user profiling;
• We will not share your personal information with any third party other than those listed above, except:
  1. With your explicit consent;
  2. As required by applicable laws/regulations or by a mandatory requirement of a governmental authority;
  3. Where necessary to protect the personal or property safety or intellectual property rights of us, our users, or the public;
  4. Where sharing with academic research institutions and the information has been anonymized.

三、我们使用 Cookie 与同类技术的情况3. Cookies and Similar Technologies

本服务在 Web 端或应用内页面中可能使用本地存储（如 SharedPreferences、WebView 本地存储）保存登录令牌与偏好设置，用于保持登录状态与服务连续。我们不使用第三方 Cookie，不部署任何第三方跟踪脚本或广告跟踪技术。

The Service may use local storage (e.g., SharedPreferences, WebView local storage) on the web or in-app pages to save login tokens and preferences, in order to maintain login state and service continuity. We do not use third-party cookies, and we do not deploy any third-party tracking scripts or ad-tracking technologies.

四、权限使用说明（Android）4. Permission Usage (Android)

我们仅在功能所必需的范围内申请 Android 权限，遵循最小必要与按需申请原则：

We request Android permissions only to the extent strictly required by functionality, following the principles of data minimization and on-demand requests:

您可以在 Android 系统"设置 → 应用 → 灵析 → 权限"中随时查看、撤回已授予的权限。

You can review and revoke granted permissions at any time in Android's "Settings → Apps → Lingxi → Permissions".

五、信息的存储地点与期限5. Where and How Long Your Information Is Stored

1. 存储地点：您的个人信息主要存储于我们位于中华人民共和国境内的服务器。当您使用境外大模型服务商（如适用）时，您的对话内容将传输至该服务商所在地进行处理，详见第 2.2 条。
2. 存储期限：
   • 账号信息、设备信息、会话/任务记录：存储期限与您的账号存续期限一致；您注销账号后，我们将依法删除或匿名化处理；
   • 云端中转文件：自传输完成起 24 小时后自动删除；
   • 登录访问令牌（Access Token）：有效期 15 分钟；刷新令牌（Refresh Token）：有效期 7 天，到期自动失效；
   • 日志信息（注册/登录打点）：用于安全审计，最长保存不超过法律法规要求的期限；
   • 推送令牌：自您删除设备绑定或注销账号起停止使用并删除。
3. 超出上述期限后，我们将对您的个人信息进行删除或匿名化处理，但法律法规另有规定的除外。

1. Location of storage: Your personal information is stored primarily on our servers located in the People's Republic of China. When you use overseas large model providers (where applicable), your conversation content is transmitted to the provider's location for processing — see Section 2.2.
2. Retention periods:
   • Account info, device info, session/task records: retained for as long as your account exists; after you delete your account, we delete or anonymize this data as required by law;
   • Cloud-relayed files: automatically deleted 24 hours after transfer completes;
   • Login access tokens: valid for 15 minutes; refresh tokens: valid for 7 days, expiring automatically;
   • Log data (registration/login events): used for security auditing, retained no longer than legally required;
   • Push tokens: cease to be used and are deleted when you unbind a device or delete your account.
3. Beyond the periods above, we will delete or anonymize your personal information, except as otherwise required by law.

六、信息的安全保护6. Security Measures

我们采取符合业界标准的安全防护措施保护您的个人信息，防止数据遭到未经授权的访问、公开披露、使用、修改、损坏或丢失：

We implement industry-standard security measures to protect your personal information against unauthorized access, public disclosure, use, modification, corruption, or loss:

1. 传输安全：所有客户端与云端之间的通信均采用 HTTPS / WSS（TLS） 加密传输；移动端与桌面端之间的 P2P 通道采用 WebRTC（DTLS-SRTP） 端到端加密。
2. 存储安全：
   • 登录密码采用 Argon2id 加盐哈希存储，不可逆；
   • 您自定义的大模型 API Key 采用 AES-256-GCM 加密存储，解密密钥与业务数据隔离管理，仅 AI 网关在内存中短暂解密使用，永不落盘、永不进日志、永不返回客户端；
   • 数据库访问实行最小权限控制，敏感数据加密落盘。
3. 访问控制：采用基于 JWT 的认证与基于账号归属的鉴权机制，接口按账号隔离；内部系统实行分级权限管理与操作审计。
4. 安全机制：异常登录检测、设备信任分级（pending/verified/trusted）、敏感操作审批（文件读写、命令执行等默认需用户确认）、频率与配额限制。
5. 应急响应：我们已建立数据安全技术事件应急预案；一旦发生个人信息安全事件，我们将按照法律法规要求，及时向您告知事件情况、影响、补救措施及我们所能采取的补救措施，并向有关主管部门报告。

1. Transport security: All communication between clients and the cloud is encrypted with HTTPS / WSS (TLS); the P2P channel between mobile and desktop devices uses end-to-end WebRTC (DTLS-SRTP) encryption.
2. Storage security:
   • Login passwords are stored as irreversible salted Argon2id hashes;
   • Large model API keys you configure are stored encrypted with AES-256-GCM; the decryption key is managed in isolation from business data and is decrypted only briefly in the AI gateway's memory — it is never written to disk, never logged, and never returned to any client;
   • Database access is controlled with least-privilege permissions; sensitive data is encrypted at rest.
3. Access control: JWT-based authentication and account-ownership-based authorization; APIs are isolated per account; internal systems use tiered permission management and operation auditing.
4. Security mechanisms: anomalous login detection, device trust tiering (pending/verified/trusted), approval for sensitive operations (file read/write, command execution, etc. require user confirmation by default), rate and quota limits.
5. Incident response: We have established an emergency response plan for data security incidents. In the event of a personal information security incident, we will promptly notify you of the incident, its impact, and remedial measures, as required by law, and report to the relevant authorities.

七、您的权利7. Your Rights

您对自己的个人信息享有以下权利，我们将按法律法规要求保障您查询、访问、更正、删除您的个人信息以及注销账号、撤回同意的权利：

You have the following rights regarding your personal information, and we will protect them as required by applicable laws:

1. 查阅与复制：您可在应用内"设置 / 我的"中查看账号信息、设备列表、会话与任务记录；如需导出，请通过第十二条联系方式申请。
2. 更正与补充：您可在应用内更新昵称、头像等账号信息；如发现信息有误，可联系我们更正。
3. 删除：您可删除会话、任务、自定义模型配置等；删除后相关数据将在技术上可行的范围内从系统中清除（法律法规要求留存的情况除外）。
4. 撤回同意：您可随时通过系统设置撤回通知等权限授权；撤回授权后，我们将停止处理相应信息，但不影响此前基于授权进行的处理。
5. 注销账号：您可通过第十二条联系方式提交注销申请，我们核验身份后将在 15 个工作日内完成处理。注销后：
   • 我们将停止为您提供本服务；
   • 删除您的账号信息、设备绑定、会话/任务/文件/人物设定等全部个人数据，或进行匿名化处理（法律法规要求留存的除外）；
   • 注销账号为不可逆操作，注销前请确认已妥善保存您需要的文件与记录。
6. 响应期限：我们将在收到您的请求并验证身份后的 15 个工作日内予以答复；对于无充分理由的重复请求、需要过多技术手段、需损害他人合法权益或商业上不切实际的请求，我们将说明不予处理的原因。

1. Access and copy: You can view your account info, device list, session and task records in the app under "Settings / Profile"; to request an export, please contact us via the channels in Section 12.
2. Correct and supplement: You can update your nickname, avatar, and other account info in the app; if you find any inaccuracy, contact us to correct it.
3. Delete: You can delete sessions, tasks, custom model configurations, etc.; after deletion, the related data will be removed from our systems to the extent technically feasible (except where retention is required by law).
4. Withdraw consent: You can revoke permission grants (such as notifications) in system settings at any time; after revocation, we will stop processing the corresponding information, which does not affect processing that occurred under the prior grant.
5. Delete your account: You can submit a deletion request via the channels in Section 12. After verifying your identity, we will complete processing within 15 business days. Upon deletion:
   • We will stop providing you the Service;
   • We will delete all your personal data — account info, device bindings, sessions/tasks/files/persona, etc. — or anonymize it (except where retention is required by law);
   • Account deletion is irreversible; before deleting, please make sure you have saved any files or records you need.
6. Response timeline: We will respond within 15 business days of receiving your request and verifying your identity. For repetitive requests without sufficient reason, requests requiring excessive technical effort, requests that would harm the legitimate rights of others, or commercially unreasonable requests, we will explain the reason for not processing them.

八、跨边境数据传输8. Cross-Border Data Transfers

您的个人信息主要存储于中华人民共和国境内。在以下场景中，您的信息可能发生跨境传输：

Your personal information is stored primarily in the People's Republic of China. In the following scenarios, your information may be transferred across borders:

• 您使用境外第三方大模型服务商进行 AI 对话时，对话内容将传输至该服务商所在地；
• 您使用 Google Firebase（Android 推送）服务时，推送令牌及通知内容可能经 Google 服务处理。

• When you use overseas third-party large model providers for AI conversations, your conversation content is transmitted to the provider's location;
• When you use Google Firebase (Android push), your push token and notification content may be processed via Google's services.

发生跨境传输时，我们将依照相关法律法规要求，采取标准合同、安全评估等合规措施，确保您的个人信息得到与本协议相同水平的保护。

Where cross-border transfers occur, we will take compliance measures as required by applicable laws — such as standard contractual clauses and security assessments — to ensure your personal information receives a level of protection no less than that provided under this Policy.

九、未成年人保护9. Children's Privacy

1. 本服务面向 13 周岁及以上用户设计，不属于"专为儿童设计"的应用。
2. 我们不故意收集 13 周岁以下未成年人的个人信息。若您是未满 13 周岁的未成年人，请勿注册或使用本服务。
3. 若您意识到我们可能在未事先获得可证实的家长同意的情况下收集了未成年人的个人信息，请通过第十二条联系方式与我们联系，我们将在核实后尽快删除。

1. The Service is designed for users aged 13 and older and is not a "Made for Kids" application.
2. We do not knowingly collect personal information from children under 13. If you are under 13, please do not register for or use the Service.
3. If you believe we may have collected a child's personal information without verifiable parental consent, please contact us via the channels in Section 12, and we will delete it promptly after verification.

十、本政策的更新10. Changes to This Policy

我们可能适时修订本政策的条款。该等修订将会以更新版本的形式发布，并在发布时注明修订日期。修订后的协议自公布之日起生效。 对于重大变更（如处理目的、方式的重大变化），我们将在应用内以弹窗等显著方式重新征得您的同意。

We may revise this Policy from time to time. Revisions will be published as an updated version with the revision date. The revised Policy takes effect on the date of publication. For material changes (e.g., significant changes to the purposes or methods of processing), we will prominently re-request your consent in the app (e.g., via a dialog).

"重大变更"包括但不限于：

"Material changes" include, but are not limited to:

• 我们的服务模式发生重大变化（如业务转型）；
• 个人信息所有权发生变更（如并购重组）；
• 个人信息共享、转让或公开披露的主要对象发生变化；
• 您参与个人信息处理方面的权利及行使方式发生重大变化；
• 我们负责处理个人信息安全的联络部门、联络方式及投诉渠道、处理时限发生变化。

• A material change in our service model (e.g., a business pivot);
• A change in ownership of the personal information (e.g., mergers and reorganizations);
• A change in the primary recipients of shared, transferred, or publicly disclosed personal information;
• A material change in your rights regarding personal information processing or the ways to exercise them;
• A change in our contact department, contact channels, complaint channels, or response timelines for personal information security.

十一、适用法律11. Governing Law

本政策的执行、解释和争议解决均适用中华人民共和国法律。如我们与您就本政策产生任何争议，双方应友好协商解决；协商不成的，您有权向有管辖权的人民法院提起诉讼。

This Policy is governed by, and construed in accordance with, the laws of the People's Republic of China. Any dispute between us and you arising from this Policy should first be resolved through friendly negotiation; if negotiation fails, you have the right to file a lawsuit with a competent people's court.

十二、联系我们12. Contact Us

如果您对本协议内容、您的个人信息处理有任何疑问、意见或建议，或希望行使第七条所述的权利，请通过以下方式与我们联系：

If you have any questions, comments, or suggestions about this Policy or how we handle your personal information, or if you wish to exercise the rights described in Section 7, please contact us:

如果您对我们的回复不满意，您还可以向相关行政监管部门投诉，或依法向有管辖权的人民法院提起诉讼。

If you are not satisfied with our response, you may also file a complaint with the relevant administrative authority or initiate litigation with a competent court as provided by law.

附录：Google Play「数据安全」表单填写参考Appendix: Reference for the Google Play "Data Safety" Form

共享对象（Data shared with third parties）：

Shared with third parties:

1. Google Firebase Cloud Messaging — 推送令牌、通知内容（App functionality）
2. 第三方大模型服务商（OpenAI / Anthropic / Google / Ollama 等，取决于用户选择）— 对话内容（App functionality）
3. 云基础设施托管服务商 — 全部用户数据（App functionality，仅基础运维）

1. Google Firebase Cloud Messaging — push tokens, notification content (app functionality)
2. Third-party large model providers (OpenAI / Anthropic / Google / Ollama, etc., depending on user choice) — conversation content (app functionality)
3. Cloud infrastructure hosting provider — all user data (app functionality, basic operations only)

使用方式声明：

Usage statements:

• 数据不用于广告目的；
• 不用于行为分析与再营销；
• 用户数据可删除（用户行使删除权）；
• 不要求用户必须提供所有列出的数据才能使用核心功能之外的可选功能（推送可拒绝）。

• Data is not used for advertising purposes;
• Data is not used for behavioral analytics or remarketing;
• User data is deletable (users can exercise deletion rights);
• Users are not required to provide all listed data to use the core features (push is optional and can be refused).