隐私政策
你的图片永远不离开你的设备。文字识别、隐私风险检测、打码等所有图像处理都在本机完成，我们没有任何接收图片的服务器。
应用只在两种情况下联网：Apple 的 App 内购买（StoreKit），以及崩溃诊断（Firebase Crashlytics）—— 每次打开应用时发送一条会话记录，崩溃后发送崩溃报告。两者都不含图片、不含识别出的文字，也不含你的任何个人内容。
1. 我们收集什么
我们只收集崩溃诊断数据，用于找到并修复导致应用闪退的问题。它分两部分：
会话记录。每次打开应用时，会发送一条简短记录：随机生成的会话 ID、安装标识符、设备型号、系统版本和应用版本。它不含任何使用行为，只用来计算「多大比例的使用没有发生崩溃」，以判断问题有多严重。同时，应用会向 Crashlytics 获取一次上报设置。
崩溃报告。应用意外崩溃后，下次打开时会发送一份报告，内容包括：
- 崩溃时的程序调用栈，即出错的是哪一段代码
- 设备型号、系统版本、应用版本、崩溃时间
- 崩溃时的内存、可用存储空间、屏幕方向等运行状态
- 一个随机生成的安装标识符（Firebase 安装 ID），用来统计同一个问题影响了多少台设备。它与你的 Apple 账户、姓名、手机号都没有关系，删除应用后重新安装会生成一个新的
你可以随时在应用的「设置 → 通用设置 → 发送崩溃报告」中关闭它。关闭后，会话记录与崩溃报告都不再发送，尚未发出的报告也会被删除。
我们不收集：
- 图片，以及从图片中识别出的任何文字或敏感信息
- 姓名、邮箱、手机号等个人身份信息
- 使用行为与统计分析数据
- 广告标识符（IDFA）；我们也不做任何跨应用追踪
- 位置信息
应用没有账号系统，无需注册或登录。应用在 App Store 上的隐私标签声明了「崩溃数据」与「设备 ID」两项，均不与你的身份关联、不用于追踪，与上述内容一致。
2. 你的图片
所有图像处理 —— 文字识别、隐私风险检测、打码、标注、拼接、保存 —— 全部在你的设备本机完成。
图片不会被上传，不会被写入应用沙盒之外的位置，也不会出现在任何日志或崩溃报告中。
识别出的敏感内容（手机号、身份证号等）只存在于内存与你设备上的编辑记录里，同样不进日志、不进导出文件、不进崩溃报告。
你在应用内建立的隐私词库属于最高敏感数据，只存于本机，处理方式同上。
3. 权限说明
| 权限 | 用途 |
|---|---|
| 照片 | 展示你的相册、读取你选择的图片进行编辑、把结果存回相册。仅在你主动操作时读取，不做后台批量扫描。 |
| 相机 | 仅在你选择「拍照」时使用，用于拍摄后立即在本机编辑。 |
| Face ID | 可选的应用锁。它只是界面上的一道门禁，不加密任何数据。 |
你可以选择「有限访问」，此时应用只能看到你明确授权的那些照片。
4. 第三方
应用集成了一个第三方 SDK：Google 的 Firebase Crashlytics，只用于第 1 节所说的崩溃诊断。应用中没有分析、广告、远程配置或 A/B 测试 SDK。
崩溃诊断数据由 Google 作为数据处理方代为接收和存储，服务器可能位于你所在的国家或地区之外。Google 保留崩溃报告 90 天，之后自动删除。发送数据时，和任何网络连接一样，Google 的服务器会看到你的 IP 地址。Google 对这部分数据的处理适用 Firebase 隐私与安全说明。
另一个外部组件是 Apple 的 StoreKit，用于处理购买。这部分由 Apple 直接处理，我们收不到你的支付信息，也收不到你的 Apple 账户信息 —— 应用只能知道「当前这台设备上的这个 Apple 账户是否持有有效权益」这一个结果，且该判断在设备本地完成。Apple 对 App Store 交易的处理适用 Apple 隐私政策。
5. 数据存储与保留
应用的项目文件与缓存保存在你设备的应用沙盒内，启用了系统的完整文件保护。你删除应用时，这些数据随之删除。
「临时编辑」模式下的内容在你退出时即被删除。
iCloud 备份默认关闭；你可以在设置中自行开启。
崩溃报告在 Google 的服务器上保留 90 天后自动删除。
6. 儿童
本应用不面向 13 岁以下儿童，也不会有意收集儿童的个人信息。
7. 你的权利（GDPR / CCPA 等）
你可以在设置中关闭崩溃报告，随时撤回对这项收集的同意。崩溃诊断数据里没有你的姓名、账户或联系方式，我们无法据此认出你是谁，也无法按人查找某一份报告。报告会在 90 天后自动删除；删除应用会使安装标识符失效，重新安装后生成的是新的标识符。
你设备上的其他数据完全由你控制：删除应用即全部清除。行使权利或有任何疑问，请通过第 9 节的邮箱联系我们。
我们不出售、不交易任何个人信息，也不把数据用于广告。
8. 政策变更
本政策可能随应用更新而调整，变更会通过更新本页的生效日期体现。如果将来新增本政策未列出的数据收集，我们会先更新本政策并在应用内告知。
9. 联系方式
关于隐私的任何问题，请发邮件至 peimao918@gmail.com。
Privacy Policy
Your images never leave your device. Text recognition, privacy risk detection, redaction and all other image work happen on the device. We have no server that receives images.
The app goes online in only two cases: Apple’s in-app purchases (StoreKit), and crash diagnostics (Firebase Crashlytics) — a session record each time the app opens, and a crash report after a crash. Neither contains images, recognized text, or any of your personal content.
1. What we collect
We collect only crash diagnostics, used to find and fix whatever made the app quit. They come in two parts:
Session records. Each time the app opens, it sends a short record: a random session ID, the installation identifier, device model, OS version, and app version. It contains no usage behavior; it only lets us calculate what share of sessions ended without a crash, so we can judge how serious a problem is. The app also fetches its reporting settings from Crashlytics at the same time.
Crash reports. After an unexpected crash, the app sends a report the next time it opens. The report contains:
- the stack trace at the time of the crash, i.e. which code failed
- device model, OS version, app version, and time of the crash
- runtime state such as memory, free storage, and screen orientation
- a randomly generated installation identifier (Firebase installation ID), used to count how many devices one problem affects. It is unrelated to your Apple Account, name, or phone number, and reinstalling the app generates a new one
You can turn this off at any time in the app under Settings → General → Send Crash Reports. Once off, neither session records nor crash reports are sent, and any unsent reports are deleted.
We do not collect:
- images, or any text or sensitive details recognized in them
- personal information such as name, email, or phone number
- usage data or analytics
- the advertising identifier (IDFA); we do no cross-app tracking
- location
There is no account system; nothing to register or sign in to. The App Store privacy label lists Crash Data and Device ID, both not linked to your identity and not used for tracking, consistent with the above.
2. Your images
All image work — text recognition, privacy risk detection, redaction, annotation, stitching, saving — happens on your device.
Images are never uploaded, never written outside the app’s own container, and never appear in any log or crash report.
Sensitive values found during a scan (phone numbers, ID numbers, and so on) exist only in memory and in the edit record on your device. They are likewise kept out of logs, out of exported files, and out of crash reports.
The privacy term list you build inside the app is treated as the most sensitive data of all: stored locally only, handled the same way.
3. Permissions
| Permission | Why |
|---|---|
| Photos | To show your albums, read the image you pick for editing, and save the result back. Read only when you act; there is no background scan of your library. |
| Camera | Only when you choose to take a photo, so it can be edited on-device straight away. |
| Face ID | An optional app lock. It is a gate in the interface and does not encrypt anything. |
You may grant limited photo access, in which case the app sees only the photos you explicitly select.
4. Third parties
The app includes one third-party SDK: Google’s Firebase Crashlytics, used only for the crash diagnostics described in section 1. There is no analytics, advertising, remote config, or A/B testing SDK.
Google receives and stores crash diagnostics as our data processor, and its servers may be outside your country or region. Google keeps crash reports for 90 days and then deletes them automatically. As with any network connection, Google’s servers see your IP address when data is sent. Google’s handling of this data is covered by Firebase Privacy and Security.
The other external component is Apple’s StoreKit, for purchases. Apple handles that directly. We never receive your payment details or your Apple Account information — the app learns exactly one thing, decided locally on the device: whether an active entitlement exists. Apple’s handling of App Store transactions is covered by the Apple Privacy Policy.
5. Storage and retention
Project files and caches live in the app’s container on your device with the system’s complete file protection enabled. Deleting the app deletes them.
Content in temporary editing mode is deleted when you leave it.
iCloud backup is off by default; you can turn it on in Settings.
Crash reports are kept on Google’s servers for 90 days and then deleted automatically.
6. Children
The app is not directed at children under 13 and does not knowingly collect personal information from them.
7. Your rights (GDPR, CCPA, and similar)
You can turn crash reports off in Settings, withdrawing consent to this collection at any time. Crash diagnostics contain no name, account, or contact details, so we cannot tell who you are from them or look up a report by person. Reports are deleted automatically after 90 days; deleting the app retires its installation identifier, and a reinstall gets a new one.
All other data on your device is entirely under your control: removing the app removes all of it. To exercise your rights or ask a question, contact us at the address in section 9.
We do not sell or trade personal information, and we do not use data for advertising.
8. Changes
This policy may change as the app is updated; changes are reflected in the effective date above. If we ever add data collection not listed here, we will update this policy first and tell you inside the app.
9. Contact
Privacy questions: peimao918@gmail.com.