隐私政策

1. Personal information we process

TONEBIRD is designed to keep as little as possible off your Mac. We process the following categories:

1.1 Information you provide

• Account: the email address, third-party account identifier, and auth tokens used when you sign in.
• Connector authorization: OAuth tokens and connection status when you connect Gmail, Slack, and similar channels.
• Payment: transaction information handled by the payment provider when you buy or subscribe (we do not store full card numbers).
• Feedback you submit: your optional note, a bounded structured diagnostic timeline, and any generated reply, conversation excerpt, transcript, counterpart information, or screenshot that you separately preview and choose to include.

1.2 Information processed transiently to draft a reply

• Conversation context: the conversation text visible in the current window on your trigger, your instruction, and the local tone/profile memory needed for this reply.
• Screenshots (fallback): an in-memory, cropped image of the current conversation area when Accessibility cannot read it (discarded after local OCR; no gallery is kept).
• Voice: audio while you hold to talk (for on-device speech recognition; TONEBIRD does not keep the raw recording).

1.3 Automatically collected anonymous data

Anonymous product metrics for improvement: event names, enums, counts, app version, OS version, an anonymous install id, and an optional signed-in user id. Excludes message bodies, drafts, recipient names, screenshots, and raw audio.

1.4 Sensitive personal information

TONEBIRD does not actively seek sensitive personal information. However, your conversation may contain it (e.g. location, health, financial data, depending on your chats). When you use the managed model path, that content is processed as conversation context and transferred to overseas model providers. We request separate consent for this in Section 6.

2. What stays on your Mac

TONEBIRD's live read starts locally: Accessibility reads the current window's visible text; screenshots are handled in memory; OCR runs first on-device via Apple Vision.

Your tone profile, personal profile, person cards, reply events, learned corrections, and usage counts are stored locally in Application Support. You can view them, open the data folder, or clear them any time in Settings. Diagnostic traces also stay on your Mac unless you actively submit a feedback report; the submission screen shows the exact structured diagnostics and optional content you selected to send. TONEBIRD does not keep a remote copy of everything you see, type, or browse.

3. What is sent to AI models (incl. abroad)

When you ask TONEBIRD to draft, rewrite, summarize, distill memory, detect to-dos, or use a vision model to transcribe a screenshot that on-device OCR cannot read reliably, TONEBIRD sends the context needed for that task to the selected model.

• Managed proxy path (default): when you are signed in without your own key, requests are forwarded through TONEBIRD's model proxy to the upstream provider. The proxy is designed as stateless forwarding and does not log request or response bodies, but the content still reaches the overseas upstream provider.
• Bring-your-own-key direct path (recommended): once you enter your own API key in Settings, model requests go straight from your Mac to the provider you chose, with TONEBIRD's servers out of the path. This is our most recommended privacy path; here the cross-border transfer is initiated by you, directed at the provider you chose.

In either path, the model provider's own retention and use policies still apply.

4. Screenshots, OCR & voice

Screenshots are only for apps Accessibility cannot read. TONEBIRD crops to the current conversation area, runs OCR on-device first, and discards the image after use. Only if OCR is insufficient may a vision-capable model receive the screenshot for transcription.

Raw hold-to-talk audio is not stored by TONEBIRD. TONEBIRD uses Apple Speech and requests on-device recognition when the locale supports it. If Apple's framework falls back to cloud recognition because the locale is unsupported, that processing is governed by Apple's own policy.

5. Overseas recipients

Because the following vendors are located outside mainland China, using the corresponding TONEBIRD features causes your personal information to be provided abroad. We disclose each overseas recipient's name, location, purpose, and the categories involved:

To exercise your rights regarding overseas recipients, or to learn about these vendors' privacy policies, contact us via Section 9.

6. Matters requiring your separate consent

Under the PIPL, the following require your separate consent. You can opt in item by item during onboarding and withdraw any time in Settings; withdrawal does not affect processing already carried out.

6.1 Cross-border transfer

Consent for TONEBIRD to provide your personal information to the overseas recipients in Section 5 to enable reply generation, authentication, and connectors. If you decline, you cannot use the managed proxy path that relies on overseas models; you may still use the bring-your-own-key direct path (where the transfer is initiated directly by you).

6.2 Sensitive personal information

Consent for TONEBIRD, on your trigger, to process sensitive personal information that a conversation may contain — used solely to draft the reply for that interaction.

6.3 Sharing with third parties

Consent for TONEBIRD to provide the necessary information to the model and connector providers listed in Section 5 to complete the task you requested.

6.4 Automated processing notice

TONEBIRD uses AI to automatically process the conversation and produce reply candidates. These are suggestions only; whether to adopt, edit, or send is entirely your decision. TONEBIRD makes no automated decision with a significant effect on your rights.

6.5 Active problem reports

Feedback is never sent automatically. The submission screen itemizes the diagnostics and optional content to be sent. By pressing Submit, you consent to provide the displayed material to Linear, Supabase, and authorized internal reviewers solely to investigate that report. You can remove every optional item before submission.

7. Retention & security

Local data stays on your device until you delete it or uninstall. A submitted feedback report may remain in an encrypted local outbox for up to seven days while delivery is retried. The complete live Supabase feedback record, including its copy of your note, bounded structured diagnostics, and any selected private content, becomes inaccessible after 14 days and is scrubbed from live storage within 24 hours; encrypted provider backups may remain recoverable for up to seven additional days. The full delivery row is removed by 30 days. A minimal, long-lived anti-duplicate record retains only the random report ID, account-bound owner, terminal result or error, and any Linear receipt; it contains no note, diagnostics, environment data, or attachment reference and exists only to prevent report-ID takeover and duplicate Linear issues. The safe Linear issue summary is retained for support, security, and product-quality records until it is no longer needed or you request deletion where applicable. Account and connection status are kept while you use the service and are deleted or anonymized within a reasonable period after account closure, unless the law requires otherwise. The managed proxy is designed as stateless forwarding, not to store bodies.

We use transport encryption, access controls, encryption at rest, and encrypted token storage (Keychain). But no assistant that must send context to an external AI model can claim 100% local privacy.

8. Your rights

To the extent the law provides, you may access and copy your personal information; correct or supplement inaccurate data; delete it; withdraw consent; close your account; request an explanation of our processing rules; and, where eligible, request portability. In-app you can open the local data folder and clear reply history and learned memory; use the contact below for the rest. We respond within statutory timeframes.

TONEBIRD is not intended for anyone under 18, and we do not knowingly collect minors' personal information.

9. Contact & complaints

Personal information handler: Beijing Suofeiya Feilun Technology Co., Ltd.

Registered address: Rm 201, 1F North Bldg, Xijiao Hotel, 18 Wangzhuang Rd, Haidian District, Beijing
Office: 1F North Bldg, Xueyuan Rd International Talent Innovation Lab, 18 Wangzhuang Rd, Haidian District, Beijing (100083)

For personal-information matters, contact support@amplift.ai. If you believe our processing infringed your rights, you may also complain to the competent regulator.

10. Updates

We may update this policy from time to time. Material changes will be notified in-app or on the website; where a new separate-consent matter is involved, we will ask again. This policy is part of the TONEBIRD Terms of Service (Mainland China); in case of conflict, the Terms' provisions on disputes and validity control.

1. 我们处理哪些个人信息

TONEBIRD 以「尽量少离开你的 Mac」为设计原则。我们处理的个人信息分为以下几类：

1.1 你主动提供的信息

• 账户信息：你登录时使用的邮箱地址、第三方账号标识、鉴权令牌。
• 连接器授权：你选择连接 Gmail、Slack 等渠道时的 OAuth 授权令牌与连接状态。
• 付款信息：购买或订阅时，由支付渠道处理的必要交易信息（我们不存储你的完整银行卡号）。
• 你主动提交的问题反馈：可选说明、有限的结构化诊断时间线，以及你在提交页分别预览并主动勾选的生成回复、对话片段、转写片段、对方信息或截图。

1.2 为生成回复而临时处理的信息

• 对话上下文：你触发时当前窗口中可见的对话文字、你输入的指令，以及为写好这条回复所需的本地语气与人物档案。
• 截图（兜底）：当辅助功能读不到内容时，在内存中截取并裁剪的当前会话区域图像（本机 OCR 后丢弃，不建相册）。
• 语音：你按住说话时的音频（用于本机语音识别，TONEBIRD 不保存原始录音）。

1.3 自动采集的匿名信息

用于产品改进的匿名指标：事件名、枚举值、计数、应用版本、系统版本、匿名安装标识，以及可选的登录用户标识。不包含消息正文、草稿、收件人姓名、截图或原始音频。

1.4 敏感个人信息

TONEBIRD 本身不主动索取敏感个人信息。但你的对话内容可能包含敏感个人信息（如行踪轨迹、健康、财务信息等，取决于你与他人的对话）。当你使用托管模型路径生成回复时，这些内容会作为对话上下文被处理并传输至境外模型服务商。我们就此在第 6 节单独征求你的同意。

2. 哪些信息留在你的本机

TONEBIRD 的实时读取流程从本机开始：辅助功能读取当前窗口可见文字；截图只在内存中处理；OCR 优先使用 Apple Vision 在本机识别。

你的语气档案、个人资料、人物卡、回复事件、学习到的修正与用量计数，保存在本机的 Application Support 目录。你可以随时在设置中查看、打开数据文件夹或清空这些内容。诊断 trace 也默认只留在本机；只有你主动提交问题反馈时，提交页展示的诊断与所选内容才会离开设备。TONEBIRD 不会把你看到、输入或浏览的所有内容远程复制一份留存。

3. 哪些信息会发送给 AI 模型（含出境）

当你要求 TONEBIRD 起草、改写、总结、蒸馏记忆、识别待办，或用视觉模型转写本机 OCR 无法可靠识别的截图时，TONEBIRD 会把完成该任务所需的上下文发送给所选模型。

• 托管代理路径（默认）：你登录后未配置自有 Key 时，请求经 TONEBIRD 的模型代理转发至上游模型服务商。代理按无状态转发设计，不记录请求或响应正文，但内容仍会到达境外的上游模型服务商。
• 自带 Key 直连路径（推荐）：你在设置中填入自己的 API Key 后，模型请求从你的 Mac 直接发往你选择的模型服务商，TONEBIRD 服务器不在这条链路中。这是我们最推荐的隐私路径；此路径下，出境行为由你自主发起并直接指向你选择的服务商。

无论哪条路径，模型服务商自身的留存与使用政策仍然适用。

4. 截图、OCR 与语音

截图仅用于辅助功能难以读取的应用。TONEBIRD 会裁剪到当前会话区域，优先在本机运行 OCR，并在使用后丢弃图像。仅当 OCR 不足时，具备视觉能力的模型才可能收到该截图用于转写。

按住说话的原始音频不会被 TONEBIRD 保存。TONEBIRD 使用 Apple Speech，并在当前语言环境支持时要求本机识别。如果 Apple 框架因语言环境不支持而回落到云端识别，则该处理受 Apple 自身政策约束。

5. 境外接收方清单

由于下列服务商位于中国境外，使用 TONEBIRD 相应功能会导致你的个人信息向境外提供。我们向你说明每一境外接收方的名称、所在地、处理目的与涉及的信息种类：

行使你对境外接收方的相关权利，或了解上述服务商的隐私政策，可通过第 9 节的联系方式与我们联系。

6. 需要你单独同意的事项

根据《个人信息保护法》，下列处理需要取得你的单独同意。你可在应用引导（onboarding）中逐项勾选，也可随时在设置中撤回；撤回不影响撤回前已进行的处理。

6.1 个人信息出境（跨境传输）

同意 TONEBIRD 依第 5 节的境外接收方清单，为实现回复生成、身份认证与连接器功能，向境外接收方提供你的相关个人信息。若你不同意出境，将无法使用依赖境外模型的托管代理路径；你仍可选择自带 Key 直连路径（该路径下出境由你直接发起）。

6.2 敏感个人信息处理

同意 TONEBIRD 在你触发回复时，处理对话中可能包含的敏感个人信息（用于且仅用于为该次交互生成回复）。

6.3 向第三方提供

同意 TONEBIRD 为完成你请求的任务，向第 5 节所列模型服务商与连接器服务商提供必要信息。

6.4 自动化处理说明

TONEBIRD 使用 AI 对对话进行自动化处理以生成回复候选。这些候选仅是建议，是否采用、编辑或发送完全由你决定；TONEBIRD 不会据此作出对你权益有重大影响的自动化决策。

6.5 主动问题反馈

问题反馈不会自动发送。提交页会展示将发送的结构化诊断，并逐项展示你选择附上的可选内容；你点击「提交」即同意为排查该问题，将所展示内容提供给 Linear、Supabase 及授权的内部处理人员。你可以在提交前取消任一可选内容。

7. 保存期限与安全

本机数据保存在你的设备上，直至你删除或卸载应用。已提交但尚未送达的反馈可在加密本地 outbox 中保留最多 7 天。完整的 Supabase 在线反馈记录（包括其中的反馈说明副本、有限结构化诊断和你选择的私有内容）在 14 天后停止访问，并在 24 小时内从在线存储清除；加密备份最多可能再恢复 7 天。完整投递行会在 30 天内删除。系统会长期保留一条最小防重复记录，仅含随机 report ID、账户绑定的归属、终态结果或错误及可选 Linear 回执；它不含说明、诊断、环境数据或附件引用，只用于防止 report ID 被接管和重复创建 Linear 问题。Linear 中不含私聊正文的安全摘要会为支持、安全与产品质量记录保留至不再需要，或依法按你的删除请求处理。账户与连接状态等信息在你使用服务期间保存，账户注销后在合理期限内删除或匿名化，法律另有要求的除外。托管代理按无状态转发设计，不以存储正文为目的。

我们采用传输加密、访问控制、静态加密、令牌加密存储（Keychain）等措施保护你的信息。但任何需要把上下文发送给外部 AI 模型的助手，都无法声称 100% 本地隐私。

8. 你的权利

在法律规定的范围内，你有权：查阅、复制你的个人信息；更正、补充不准确的信息；删除个人信息；撤回你已作出的同意；注销账户；要求解释我们的个人信息处理规则；在符合条件时要求转移。你可在应用内打开本地数据文件夹、清空回复历史与学到的记忆，或通过下方联系方式行使其余权利。我们将在法定期限内响应。

TONEBIRD 的服务不面向未满 18 周岁的未成年人，我们不会在明知的情况下收集未成年人的个人信息。

9. 联系与投诉

个人信息处理者：北京索菲亚飞轮科技有限公司

注册地址：北京市海淀区王庄路 18 号西郊宾馆北楼一层 201
办公地址：北京市海淀区王庄路 18 号学院路国际人才创新实验室北楼一层（100083）

个人信息保护相关事宜，请联系：support@amplift.ai。如你认为我们的处理侵害了你的权益，你也有权向有管辖权的监管部门投诉、举报。

10. 政策更新

我们可能不时更新本政策。重大变更将通过应用内或官网通知你；涉及新的单独同意事项时，会再次征求你的同意。本政策是《TONEBIRD 用户协议（中国大陆）》的一部分；如有冲突，以用户协议中关于争议与效力的条款为准。