隐私政策（测试版）

更新日期：2026 年 10 月 24 日（新增"联网搜索""朗读""头像和名字审核""收到确认"，写明运营者和联系方式、处理依据、你的权利怎么行使）

本政策说明"语崽"（网站 ptt.ymgymg.xin、安卓 App 和 iPhone 测试版 App，以下称"本服务"）在测试期间如何处理你的个人信息。本服务的运营者，也就是你的个人信息的处理者，是 北京锁儿哥科技发展中心（下称"我们"），联系方式：App 里的「意见反馈」。本服务目前为内部测试版本，仅邀请测试人员使用。

1. 我们收集哪些信息

• 手机号：用于短信验证码登录和识别你的账号。
• 昵称、配对号：昵称由你设置（默认"用户+手机尾号"），配对号由系统随机生成，用于让好友添加你。
• 头像（仅当你设置时）：你自己的头像，以及你给助理换的头像。你的头像会显示给你的好友、同群和同团队的人；给助理换的头像只有你自己看得到。
• 群名和团队名：你建群、建团队或改名时起的名字，群里和团队里的人都看得到。
• 好友和群关系：你添加的好友、创建或加入的群。
• 语音消息：只有在你按住说话键时才会录音；录音会发送给你选择的好友或群，并保存在服务器上以便回放。同时保存发送时间和时长。
• 语音转成的文字（如果你开启了"语音转文字"）：安卓手机用下载到本机的识别模型在手机上转写；iPhone 使用苹果自带的语音识别（手机支持离线识别时在本机完成，否则由苹果的服务器识别）。转写出的文字会上传到我们的服务器，显示在聊天记录里。我们的服务器不做语音识别。
• 文字消息：你在对话里打的字，和语音消息一样只发给你选择的好友、群或助理。
• 收到确认：别人发语音时要你确认收到，或者助理的消息要你确认时，我们记下你在什么时间、用什么方式（按音量键、点"确认收到"或在对话里回复）确认的。对话里的人看得到你几点确认的。只记这一件事，不记别的；你可以在设置里关掉"收到确认"。
• 和 AI 助理的对话（仅当你使用助理时）：你发给助理的文字和语音转成的文字、助理的回答；助理按你的要求记下的事、提醒和待办；你通过助理派出或接到的活。
• 团队信息（仅当你创建或加入团队时）：团队名称、成员和各自的角色（老板、管理员、成员）、邀请链接。
• 技术日志：IP 地址、请求时间等，用于防止恶意刷验证码、排查故障。
• iPhone 设备信息（仅当你在 ptt.ymgymg.xin/ios 主动登记 iPhone 时）：设备标识（UDID）、型号和系统版本，用于把这台 iPhone 加入测试安装名单。
• 本人确认（仅当你在手机上开通时，用于在对话里确认税额这类要本人做的事）：这台手机生成的一把公钥、手机型号，以及每次本人确认的记录（确认了什么、什么时间、用的是指纹面容还是锁屏密码）。你的指纹、面容和锁屏密码只由手机系统自己核对，不会传给我们，也不会传给智能体。开通时还会收到手机安全芯片对这把密钥的证明（证明它在安全芯片里，不含个人信息）。退出登录后这台手机的密钥一起删除。确认记录是涉税资料的凭证，保存 10 年（《税收征收管理法实施细则》第二十九条）；注销账号后只保存、不再和你的账号关联。
• 意见反馈（仅当你主动提交时）：你写的内容、选填的联系方式和你选择的截图。如果你勾选了"附带诊断信息"（可以取消），还会附带：手机型号、系统版本、App 版本、各项权限和后台设置的状态、最近的连接记录、App 的运行日志和出错/崩溃记录、系统结束 App 的原因。诊断信息不包含聊天内容、录音、通讯录或照片。

我们不收集你的位置、通讯录、短信内容或相册：只有你自己选中的那张图片（发图片或设置头像时）才会上传。摄像头只用于扫描好友二维码，画面不会上传。

2. 我们如何使用这些信息

仅用于：登录验证；把语音转发给你选择的好友或群；保存聊天记录供你和对方回放；显示在线状态；让 AI 助理回答你、记事、提醒、替你派活和跟进、发每天的安排和小结；按规定审核头像和名字；保障服务安全；处理和回复你的反馈、修复问题。我们不会用于广告，也不会出售你的信息。

处理的依据：大部分是为了订立和履行你和我们之间的用户协议所必需（登录、转发消息、AI 助理等）；审核头像和名字、留存网络日志，是为了履行法律规定的义务（《互联网用户账号信息管理规定》《网络安全法》）；其他情况会先征得你的同意，例如附带诊断信息、把事交给智能体、登记 iPhone、开通本人确认。

3. AI 助理

• 助理的回答由人工智能生成，界面上标有"AI"，朗读前有一声提示音。回答可能不准确，重要的事请自行核实。
• 生成回答时，我们会把你这次说的话和必要的背景（你的称呼、助理记得的事、你的提醒和派活记录、最近几轮对话）发给中国境内已完成备案的大模型服务处理，例如 DeepSeek（杭州深度求索人工智能基础技术研究有限公司）、通义千问（阿里云）。不会发送你的手机号。
• 联网搜索：你问到需要最新信息的问题（新闻、天气、价格、政策等）时，助理会把它拟的一句搜索词发给火山引擎（北京火山引擎科技有限公司）的联网搜索服务，搜到的公开网页摘要用来生成回答，回答下面会列出来源。搜索词按规则不包含你的手机号、姓名等个人信息；搜索结果在我们的服务器上缓存 30 分钟，供相同的搜索复用，不和你的账号关联。
• 朗读：助理的回复在你的手机上合成语音朗读，不上传。朗读用的声音包从公开的模型下载站（hf-mirror.com，不通时 huggingface.co）下载到手机，下载时不附带你的任何个人信息。
• 如果你在"使用自己的大模型"里填了自己的密钥，你的请求会发给你选择的那家服务；密钥加密保存，只用于你本人的请求，你可以随时删除。
• 团队频道：只有叫助理的话（"@助理"或以"助理"开头的话）才会交给助理和大模型处理，其他对话助理看不到。助理在频道里的回答全团队可见；它在频道里只用团队的信息，不使用任何人的个人记忆。在频道里叫某个智能体时（"@记账助手 这是打车票"），这句话和你在这之前 1 分钟内在频道里发的图片，会在你授权后交给那个智能体（见第 4 节）；它只知道这来自一个团队（用一个只对它有效的随机编号）和你在团队里的角色，它的回复只私下发给你。频道里别人发的和其他的消息都不会交给它。
• 团队派活：团队的老板和管理员可以看到团队里派的活：谁派给谁、内容、状态、截止时间和被派活的人的回复。助理不会向任何人输出对员工个人的评价。
• 助理记得我什么：在"设置"里可以查看助理记下的每一条，逐条删除、全部清除或导出；也可以关闭"个性化"，关闭后助理不再使用、也不再记录关于你的事。
• 夜间整理（会员，以及使用自己大模型密钥的用户）：每天凌晨，助理会把当天和你的对话整理进上面的记忆，合并重复的、删掉过时的、补充以后用得上的，整理出的条目会标"夜间整理"。整理时不记录、也不推断健康、宗教、政治倾向、财务状况、行踪等敏感信息。关闭个性化后不再整理。

4. 共享与委托处理

• 验证码短信通过阿里云短信服务发送，因此你的手机号和验证码会提供给阿里云用于发送短信。
• 你登记 iPhone 时，这台 iPhone 的设备标识（UDID）、型号和系统版本会提交给苹果公司（Apple Inc.，美国）的开发者账号，这是苹果对测试版安装包签名的要求，不会附带你的手机号。这些信息会传到中国境外，所以登记前要你单独勾选同意；不同意就不要登记（有 TestFlight 安装方式时可以改用它）。
• 你的好友和同群成员可以收听你发给他们的语音、看到语音转成的文字，以及你的昵称、头像和在线状态；他们看不到你的手机号。
• 头像和名字审核：按《互联网用户账号信息管理规定》，你新设的头像、昵称，以及你给群和团队起的名字，要先审核，通过后别人才看得到（审核期间别人看到的还是原来的）。审核先用我们自己的规则（例如名字里不能有电话、微信号、网址），再由 AI 自动判断：我们把这张头像（缩小到 384 像素）或这个名字发给火山引擎（北京火山引擎科技有限公司）的大模型，不附带你的手机号或聊天内容。AI 拿不准、或审核服务暂时不可用时，由我们的管理员人工查看。没通过的头像会被删除，没通过的名字不会生效，我们会告诉你原因和怎么改；对结果有异议，可以在「意见反馈」里提出，由人工复核。我们也会按规定不定期检查已经在用的名字，有问题的经管理员人工确认后才会改回默认名，并告诉你原因。给助理换的头像只有你自己看得到，不需要审核。
• iPhone 上的语音转文字由苹果公司的语音识别完成（不支持离线识别的手机会把这段语音发给苹果识别）。可在 iPhone 应用"设置"中关闭"自动把我发的语音转成文字"。
• 你提交的反馈、截图和诊断信息只保存在我们位于中国境内的服务器上，由我们的人员处理，不会传到境外。
• 智能体（例如"记账助手"）：智能体是由我们或其他提供方提供的专项服务。你第一次把事交给某个智能体时，会先收到授权卡片，写明提供方和联系方式、它会做什么、会拿到什么信息、存放在哪里、保存多久、怎么撤销，以及它的隐私政策和服务条款；涉及银行流水等敏感个人信息的，还要你单独同意。只有你同意之后，我们才把你交给它的那句话和附带的图片转给它；不转你的其他聊天内容、手机号或助理记得的事，它看到的是一个只对它有效的随机编号。智能体发来的消息和卡片会标出它的名字和"AI"。你可以随时在"设置 → 已授权的智能体"里撤销（注销账号时自动撤销），撤销后我们不再转发，并通知它按它的隐私政策删除或停止处理你的信息。我们会记录每次转发的时间、对象、状态和大小，保存 200 天，不保存转发的内容。智能体怎样处理你的信息，以它自己的隐私政策为准。
• AI 助理使用的大模型服务见上文第 3 节。
• 除上述情况和法律法规要求外，我们不向任何第三方提供你的个人信息。

5. 存储地点和保存期限

• 数据存储在中国大陆境内（阿里云杭州）。
• 语音消息保存 30 天，到期自动删除；语音转成的文字保存 1 年。
• 登录状态 90 天未使用自动失效。
• 反馈和截图保存 1 年（从最后一次回复算起），注销账号时一并删除。
• 和助理的对话记录（包括团队频道里叫助理的话）保存 1 年；已完成或取消的提醒、待办和派活记录保存 1 年；助理记下的事保存到你删除它或注销账号为止。
• 头像保存到你换掉、删除它或注销账号为止；没通过审核的头像立即删除。
• 账号信息保存到你注销账号为止。
• 技术日志按《网络安全法》的要求保存不少于 6 个月，之后删除。

6. 你的权利

• 随时修改昵称、更换或删除头像、删除好友、退出群或团队。团队老板可以移出成员或解散团队（解散会删除团队频道和其中的消息）。
• 在"助理记得我什么"里查看、删除、导出助理记下的事，或关闭个性化（见第 3 节）。
• 注销账号：在"设置 → 注销账号"中操作。注销后会立即删除你的账号、好友关系、群成员身份、你发出的所有语音以及你和好友之间的单聊记录，你登记的 iPhone 也会从测试名单中移除；助理保存的关于你的一切（记忆、提醒、对话记录、你派出的活）也会一并删除，别人派给你、还没完成的活会关闭。以上无法恢复。（已提交给苹果的设备标识按苹果规定要到会员年度结束才能清除，在那之前我们只保留这一串设备标识，不再与任何账号关联。）
• 你可以随时在手机系统设置中关闭麦克风、通知或摄像头权限（关闭麦克风后将无法发送语音）。
• 查阅、复制、更正你的个人信息，撤回你给过的同意，或者要求我们解释怎么处理你的信息：通过 App 里的「意见反馈」 或 App 里的「意见反馈」联系我们。核实是你本人后，我们会在 15 个工作日内答复；拒绝的会说明理由。

7. 安全措施

全站使用 HTTPS 加密传输；服务器对验证码、配对号查询和语音大小做了频率与容量限制；服务器上的数据文件仅服务进程可读。如果发生个人信息泄露等安全事件，我们会按法律要求及时告诉你和主管部门，并说明我们采取的措施。

8. 未成年人

本测试版面向成年人。未满 14 周岁的未成年人请勿使用。

9. 联系我们

运营者：北京锁儿哥科技发展中心。联系方式：App 里的「意见反馈」；也可以在 App 里用「意见反馈」。有任何问题、要求或投诉（包括查询、更正、删除个人信息），我们会在 15 个工作日内答复。

10. 本政策的更新

本政策更新后会在本页公布，并更新上面的日期；处理目的、方式或个人信息种类有重要变化的，我们会在 App 里另行告诉你，需要你同意的会重新征得你的同意。

Privacy Policy (test version)

Last updated: 24 October 2026 (web search, reading aloud, checking pictures and names; who we are, the legal bases and how to use your rights)

This policy explains how "Yuzai" (the website ptt.ymgymg.xin, the Android app and the iPhone test app, "the Service") handles your personal information during testing. The Service is run by 北京锁儿哥科技发展中心 ("we"), the handler of your personal information; contact: Feedback in the app. The Service is an internal test version available to invited testers only.

1. What we collect

• Phone number — to log you in with an SMS code and identify your account.
• Nickname and pairing code — you choose the nickname; the pairing code is random and lets friends add you.
• Profile pictures (only if you set one) — your own picture, and the one you give your assistant. Yours is shown to your friends and to the people in your groups and teams; your assistant's is seen only by you.
• Group and team names — the names you give a group or team when you create or rename it, seen by its members.
• Friends and groups — who you added and which groups you created or joined.
• Voice messages — recorded only while you hold the talk button, sent to the friend or group you picked, and stored so they can be replayed, together with their time and length.
• Text of voice messages (if "Voice to text" is on) — Android phones transcribe on the phone with a speech model downloaded to it; iPhones use Apple's built-in speech recognition (on the iPhone when it supports offline recognition, otherwise on Apple's servers). The text is uploaded to our server and shown in the chat. Our server does no speech recognition.
• Text messages — what you type in a conversation, sent like voice messages only to the friend, group or assistant you picked.
• Conversations with the AI assistant (only if you use it) — what you write or say to it (as text), its answers, the things it noted for you at your request, reminders and to-dos, and work you hand out or receive through it.
• Team details (only if you create or join a team) — the team's name, its members and their roles (owner, admin, member), and its invite link.
• Technical logs — IP address and request times, to stop abuse and fix problems.
• iPhone device details (only if you register an iPhone at ptt.ymgymg.xin/ios) — the device identifier (UDID), model and iOS version, to add that iPhone to the test install list.
• Personal confirmation (only if you turn it on on your phone, to confirm things only you may, such as a tax amount, in the chat) — a public key made on that phone, the phone model, and a record of each confirmation (what you confirmed, when, and whether a fingerprint/face or the screen lock was used). Your fingerprint, face and screen lock are checked only by the phone's own system and are never sent to us or to agents. When you turn it on we also receive the phone's attestation that the key lives in its secure hardware (no personal information). Logging out deletes that phone's key. Confirmation records back tax filings and are kept 10 years (PRC Tax Collection Rules, art. 29); after you delete your account they are only stored, no longer linked to it.
• Feedback (only when you send it) — what you write, an optional contact and the screenshots you pick. If "Attach diagnostics" is ticked (you can untick it): phone model, system and app version, permission and background settings, recent connection log, the app's own log with errors and crashes, and why the system last stopped the app. Diagnostics never include chats, recordings, contacts or photos.

We do not collect your location, contacts, text messages or photo library: only the picture you pick yourself (to send it or as a profile picture) is uploaded. The camera is only used to scan a friend's QR code; images are not uploaded.

2. How we use it

Only to log you in, deliver voice messages to the people you choose, keep the history for replay, show online status, let the AI assistant answer you, note things, remind you, hand out and follow up work for you and send the daily summaries, check pictures and names as the rules require, keep the Service secure, and answer your feedback and fix problems. No advertising, and we never sell your information.

Legal bases: mostly what is needed to provide the Service under our terms with you (login, delivering messages, the AI assistant…); checking pictures and names and keeping network logs are legal obligations (PRC rules on internet user account information; Cybersecurity Law); everything else only with your consent, such as attaching diagnostics, handing something to an agent, registering an iPhone or turning on personal confirmation.

3. The AI assistant

• The assistant's answers are generated by AI, marked "AI" on screen and preceded by a short chime when read aloud. They can be wrong; check anything important.
• To answer, we send what you just said plus the context it needs (what you're called, what the assistant noted for you, your reminders and handed-out work, the last few exchanges) to large-model services registered in mainland China, such as DeepSeek (Hangzhou DeepSeek AI) and Qwen (Alibaba Cloud). Your phone number is never sent.
• Web search: when you ask about something that needs current information (news, weather, prices, rules…), the assistant sends a search phrase it writes to the web search service of Volcano Engine (Beijing Volcano Engine Technology); summaries of the public pages found are used for the answer, whose sources are listed under it. By rule the phrase contains no phone number, name or other personal information; results are cached on our server for 30 minutes to answer the same search again, not linked to your account.
• Reading aloud: the assistant's replies are turned into speech on your phone, nothing is uploaded. The voices are downloaded to the phone from public model sites (hf-mirror.com, or huggingface.co when that fails), without any of your personal information.
• If you enter your own key under "Use my own AI model", your requests go to the provider you picked; the key is stored encrypted, used only for your own requests, and you can delete it at any time.
• Team channels: only what is addressed to the assistant ("@assistant", or starting with its name) reaches the assistant and the model; it doesn't see anything else. Its answers in a channel are visible to the whole team, and there it uses only the team's information, never anyone's personal memories. When you call an agent in a channel ("@Bookkeeper here's the taxi receipt"), those words and the pictures you posted in the channel in the minute before go to that agent once you have agreed (section 4); it only learns that they come from a team (by a number valid for it alone) and your role there, and it answers you privately. Nothing anyone else posts, and nothing else in the channel, goes to it.
• Work in a team: a team's owner and admins see the work handed out in the team: who gave what to whom, its status, deadline and the assignee's reply. The assistant never gives anyone its opinion of an employee.
• What the assistant remembers: in Settings you can see every item it noted, delete them one by one or all at once, export them, and switch personalisation off; then it neither uses nor records anything about you.
• Overnight tidy-up (members, and people using their own model key): every night the assistant folds the day's conversation into those memories — merging duplicates, dropping what is out of date, adding what will matter later — and marks such items "tidied up overnight". It never records or infers sensitive information such as health, religion, political views, finances or whereabouts. With personalisation off, nothing is tidied up.

4. Sharing

• Login codes are sent through Alibaba Cloud SMS, so your phone number and the code are passed to Alibaba Cloud to send the text.
• When you register an iPhone, its device identifier (UDID), model and iOS version go to Apple Inc. (USA) through our developer account, which Apple requires to sign test builds; your phone number is not included. This sends them outside mainland China, so you are asked for a separate yes before registering; if you don't agree, don't register (use TestFlight when it is offered).
• Your friends and group members can hear the messages you send them, read their text, and see your nickname, profile picture and online status; they cannot see your phone number.
• Checking pictures and names: as the PRC rules on internet user account information require, a new profile picture or nickname of yours, and the names you give groups and teams, are checked before others see them (until then they see the previous ones). Our own rules come first (no phone numbers, WeChat IDs or web addresses in names), then an AI: we send the picture (shrunk to 384 pixels) or the name to a model of Volcano Engine (Beijing Volcano Engine Technology), without your phone number or chats. When the AI isn't sure, or the check is unavailable, one of our admins looks. A picture that doesn't pass is deleted and a name that doesn't pass isn't used; we tell you why and what to change, and you can ask for a person to look again through Feedback. We also check names already in use from time to time; one is changed back to a plain name only after an admin confirms it, and you are told why. The picture you give your assistant is seen only by you and isn't checked.
• On iPhone, voice to text is done by Apple's speech recognition (iPhones without offline recognition send that voice to Apple). You can turn off "Turn my messages into text automatically" in the app's Settings.
• Your feedback, screenshots and diagnostics stay on our servers in mainland China and are handled by our staff; they are not sent abroad.
• Agents (for example the bookkeeping agent): agents are specialised services run by us or by other providers. The first time you hand something to an agent you get a consent card saying who provides it and how to reach them, what it does, what it receives, where it keeps it, for how long, how to withdraw, and links to its privacy policy and terms; for sensitive personal information such as bank statements you are asked separately. Only after you agree do we pass it the words you gave it and the pictures attached to them; not your other chats, your phone number or what the assistant remembers, and it only sees a random number that is valid for it alone. Messages and cards from an agent show its name and "AI". You can withdraw at any time in Settings → Agents you allowed (deleting your account withdraws everything); we then stop passing anything on and tell the agent to delete or stop using your information under its own privacy policy. We log the time, agent, status and size of each hand-over for 200 days, without its content. How an agent handles your information is governed by its own privacy policy.
• The model services used by the AI assistant are described in section 3.
• Apart from this and where the law requires, we share your information with no one.

5. Where and how long

• Data is stored in mainland China (Alibaba Cloud, Hangzhou).
• Voice messages are kept for 30 days and then deleted automatically; their text is kept for 1 year.
• Logins expire after 90 days without use.
• Feedback and screenshots are kept for 1 year after the last reply, and deleted with your account.
• Conversations with the assistant (including what was addressed to it in team channels) are kept for 1 year; finished or cancelled reminders, to-dos and work records for 1 year; the things it noted for you until you delete them or your account.
• Profile pictures are kept until you change or delete them or your account; one that doesn't pass the check is deleted at once.
• Account data is kept until you delete your account.
• Technical logs are kept for at least 6 months, as the Cybersecurity Law requires, and then deleted.

6. Your rights

• Change your nickname, change or delete your profile picture, remove friends, or leave groups and teams at any time. A team's owner can remove members or dissolve the team (which deletes the team channel and its messages).
• See, delete and export what the assistant noted for you, or switch personalisation off (section 3).
• Delete your account under Settings → Delete account. This immediately and permanently removes your account, friendships, group memberships, every voice message you sent and your one-to-one conversations, and takes your registered iPhones off the test list. Everything the assistant kept about you (memories, reminders, conversation archive, work you handed out) goes too, and open work others gave you is closed. (Apple keeps a registered device identifier until the membership year ends; until then we keep only that identifier, no longer linked to any account.)
• You can turn off microphone, notification or camera access in your phone's settings at any time (without the microphone you can't send messages).
• To see, copy or correct your personal information, withdraw a consent, or have us explain how we handle it, contact Feedback in the app or use Feedback in the app. Once we have confirmed it is you, we answer within 15 working days, with our reasons if we refuse.

7. Security

All traffic uses HTTPS. The server rate-limits codes and pairing-code lookups, caps message sizes, and keeps its data files readable only by the service. If personal information is leaked or another security incident happens, we tell you and the authorities promptly, as the law requires, with what we are doing about it.

8. Children

This test version is meant for adults. Children under 14 must not use it.

9. Contact

Operator: 北京锁儿哥科技发展中心. Contact: Feedback in the app, or Feedback in the app. We answer questions, requests and complaints (including access, correction or deletion of your data) within 15 working days.

10. Changes to this policy

Changes are published on this page with a new date; when the purposes, ways or kinds of personal information change in an important way, we also tell you in the app, and ask again where your consent is needed.

← 返回Back