聊搭子（ReplyBuddy）隐私政策 / Privacy Policy

最后更新 / Last updated: 2026-07-28

中文版

聊搭子帮助你撰写和润色聊天回复。我们的设计原则是：你的数据属于你，尽可能留在你的设备上。

我们处理哪些数据

• 聊天截图：你手动导入的截图只在你的设备上用系统文字识别（Vision OCR）处理，图片本身不会上传。
• 聊天文本与联系人画像：识别或输入的聊天内容、你为联系人建立的画像，保存在你设备本地的数据库里。只有当你主动使用 AI 功能（生成回复、解读、润色、评估、追问、更新画像、跨联系人复盘）时，相关文本才会通过加密连接（HTTPS）发送给 AI 服务用于本次生成。
• 键盘扩展：键盘会读取你在主 App 中建立的联系人画像与聊天记录用于生成回复——这些数据只保存在你设备上的 App 共享容器内，仅在本 App 与其键盘之间共享。剪贴板内容仅在你点击「导入」按钮时读取（系统会显示粘贴提示）；平时只探测「剪贴板是否有文本」这一元数据，不读取内容。与主 App 相同：只有当你点击润色或生成按钮时，相关文本才会通过加密连接发送给 AI 服务用于本次生成；键盘不读取、不上传你在其他 App 里的任何其他内容。
• 聊天技巧笔记（可选）：你从文章 / 视频等外部来源自行收集并导入的聊天技巧，经 AI 提炼后保存在你设备本地 / App 共享容器内，仅在你使用生成功能时随请求发送用于本次生成。视频导入：若你导入技巧视频，其语音转文字与画面字幕文字识别全部在你的设备上完成（本机语音识别 + Vision OCR），视频与画面不会上传，只有识别出的文字（技巧笔记）才会在生成时随请求发送。
• 跨联系人复盘与复盘心得（可选）：当你使用教练的「复盘」功能时，你所选联系人的画像与近期聊天消息会一并通过加密连接发送给 AI 服务，用于生成本次复盘报告，同样不留存；复盘报告本身不保存在你设备之外。你选择「记住这次复盘的要点」时，AI 提炼出的、只关于你自己聊天风格与习惯的「复盘心得」会保存在你设备本地 / App 共享容器内，并在之后使用生成功能时随请求发送用于本次生成（与技巧笔记相同）。
• 设备标识与设备校验（额度与防滥用）：为统计免费/试用额度，App 会生成一个随机设备标识符随生成请求发送，仅用于按日或按周计数。该标识符不含你的任何身份信息，卸载重装后仍会保留，用于防止重复领取免费额度，也不用于跟踪或与身份关联。使用官方服务时，设备还会通过 Apple 的 App Attest 完成设备真实性校验，我们的服务器仅保存校验公钥与该随机标识的对应关系（用于防滥用，不含身份信息）。
• 订阅状态核验（订阅用户）：使用官方服务且已订阅时，App 会把 Apple 签发的订阅凭证（StoreKit 交易凭证）发送给我们的服务器，用于核验订阅是否有效。凭证包含匿名的原始交易编号、订阅产品与到期时间等信息，不包含你的姓名、Apple ID、邮箱或任何付款方式信息。核验通过后，服务器仅以该匿名交易编号为键统计你订阅内的月度用量（计数保留约一个月后自动过期删除），不与身份关联、不用于跟踪、不与任何第三方共享。

我们不做什么

• 不留存：官方服务的服务器是无状态转发，不存储、不记录你的聊天内容，也不用于训练任何模型。
• 无账号：App 不要求注册，我们没有你的身份信息；发送的内容不与任何身份关联。
• 无跟踪：不含广告 SDK、不含分析跟踪、不进行跨 App 跟踪（隐私清单 NSPrivacyTracking = false）。

AI 服务提供方

• 官方服务（默认）：生成请求经我们的代理服务器转发给 Anthropic（Claude 模型）处理。Anthropic 的商用 API 默认不使用客户数据训练模型（见其商业条款）。
• 自定义 AI 线路（Pro 订阅者的可选项）：Pro 订阅者可在设置中改用自己的服务商（Anthropic / OpenAI / DeepSeek / Kimi / Gemini / 本地服务）。启用后，你的生成请求（含相关聊天文本）由设备直接发送给你选择的服务商、不经我们的服务器，适用该服务商的隐私条款；API Key 只保存在你设备的系统钥匙串中，我们无法读取。未启用该选项时，本 App 只通过上述官方服务生成。
• 本地模型：若你连接局域网内自己的模型服务（如 Ollama），内容只在你的局域网内传输，不出网。

数据保留与删除

所有聊天记录与画像仅存于你的设备。你可以随时在 App 内删除任意联系人、消息或整个档案；删除 App 即清除全部本地数据。我们的服务器上没有你聊天内容的副本——因为从未保存；服务端仅有的记录是上文所述的匿名额度计数、设备校验与订阅核验信息，以及一条不含聊天内容的用量记录——每次生成会记下随机设备标识（或匿名订阅编号）、调用的功能、所用模型档位与消耗的 token 数量，用于统计成本、排查异常与防止滥用；它不含你输入或生成的任何文字，也不与广告或第三方分析服务共享。以上记录均按期自动过期删除。
需要说明的是：为防止反复卸载重装刷取免费额度，那个随机设备标识保存在系统钥匙串中，删除 App 后仍会保留（它只是一串随机字符，不含任何身份信息）；其余本地数据（聊天记录、画像、笔记）删除 App 即全部清除。

儿童

本 App 面向 17 岁及以上用户，不面向儿童。

政策变更

政策更新会在本页发布，重大变更会在 App 内提示。

联系我们

隐私相关问题请联系：support@zihuahuang.com

English Version

ReplyBuddy helps you compose and polish chat replies. Our principle: your data belongs to you and stays on your device whenever possible.

What we process

• Chat screenshots: Screenshots you import are processed on your device using the system text recognizer (Vision OCR). Images are never uploaded.
• Chat text & contact profiles: Recognized or manually entered chat content and the profiles you create are stored in a database locally on your device. Only when you actively use an AI feature (reply suggestions, analysis, polishing, draft evaluation, follow-up chat, profile update, cross-contact review) is the relevant text sent over an encrypted connection (HTTPS) to the AI service for that single generation.
• Keyboard extension: The keyboard reads the contact profiles and chat history you created in the main app to generate replies — this data is stored only on your device, in the app's shared container, and is shared solely between the app and its keyboard. Clipboard content is read only when you tap the Import button (iOS shows a paste notice); otherwise the keyboard only checks the metadata "whether the clipboard contains text", never the content. As with the main app, the relevant text is sent to the AI service over an encrypted connection only when you tap a polish or generate button, and only for that request. The keyboard does not read or upload anything else you type in other apps.
• Chat technique notes (optional): Chat techniques you collect and import from external sources (articles, videos, etc.) are distilled by AI and stored locally on your device / in the app's shared container; they are sent with requests only when you use a generation feature, for that generation. Video import: If you import a technique video, both its speech-to-text transcription and on-screen subtitle text recognition happen entirely on your device (on-device speech recognition + Vision OCR); the video and its frames are never uploaded — only the recognized text (the technique notes) is sent with requests during generation.
• Cross-contact review & review insights (optional): When you use the coach's "review" feature, the profiles and recent chat messages of the contacts you select are sent together over an encrypted connection to the AI service to generate that review report, and are likewise not retained; the review report itself is not stored anywhere off your device. If you choose "remember the key points", the AI-distilled "review insights" — which are only about your own chatting style and habits — are stored locally on your device / in the app's shared container, and are sent with requests when you later use a generation feature, for that generation (same as technique notes).
• Device identifier & device check (quotas and anti-abuse): To meter the free/trial tier, the app generates a random device identifier that is sent with generation requests solely for per-day or per-week counting. This identifier contains none of your identity information, persists across app reinstalls to prevent repeated use of the free tier, and is not used for tracking or linked to any identity. When using the official service, your device also completes Apple's App Attest device integrity check; our server stores only the verification public key mapped to that random identifier (for abuse prevention; it contains no identity information).
• Subscription verification (subscribers): When you use the official service with an active subscription, the app sends the Apple-signed subscription receipt (StoreKit transaction) to our server to verify that your subscription is valid. The receipt contains an anonymous original transaction ID, the subscribed product, and expiry dates — it does not contain your name, Apple ID, email, or any payment details. After verification, the server uses that anonymous transaction ID only as the key for counting your subscription's monthly usage (counts expire automatically after about one month). It is not linked to your identity, not used for tracking, and never shared with third parties.

What we do NOT do

• No retention: Our official service is a stateless relay — it does not store or log your chat content, and your content is never used to train any model.
• No accounts: The app requires no sign-up. We hold no identity information, and content sent is not linked to any identity.
• No tracking: No ad SDKs, no analytics trackers, no cross-app tracking (privacy manifest NSPrivacyTracking = false).

AI providers

• Official service (default): Generation requests are relayed through our proxy server to Anthropic (Claude models). Anthropic's commercial API does not train on customer data by default (see their commercial terms).
• Custom AI routing (an option for Pro subscribers): Pro subscribers may switch to their own provider in Settings (Anthropic / OpenAI / DeepSeek / Kimi / Gemini / a local server). When enabled, your generation requests (including the relevant chat text) are sent by your device directly to the provider you chose — not through our server — under that provider's privacy terms. API keys are stored only in your device's system Keychain; we cannot read them. When this option is not enabled, the app generates only through the official service above.
• Local models: If you connect to your own model server on your local network (e.g. Ollama), content never leaves your network.

Retention & deletion

All chat records and profiles live only on your device. You can delete any contact, message, or entire profile in the app at any time; deleting the app removes all local data. There is no server-side copy of your chat content — none was ever kept; the only server-side records are the anonymous quota counts, device-check keys, and subscription-verification data described above, plus a usage record that contains no chat content — each generation logs the random device identifier (or anonymous subscription number), which feature was called, the model tier, and the number of tokens consumed, used for cost accounting, troubleshooting, and abuse prevention. It contains none of the text you type or receive, and is not shared with advertisers or third-party analytics. All of these expire automatically.
One clarification: to stop people from farming the free allowance by reinstalling, that random device identifier is kept in the system Keychain and survives deleting the app (it is only a random string and carries no identity information). All other local data — chats, profiles, notes — is removed with the app.

Children

This app is intended for users aged 17 and over.

Changes

Updates to this policy will be posted on this page; significant changes will be announced in the app.

Contact

For privacy questions: support@zihuahuang.com