Privacy Policy · 隐私政策
一、两种模式，两种隐私强度
本地模式（不注册账号）。 桌面端把你的笔记只存在你自己的设备上。这个模式下我们不收集任何数据——没有账号、没有遥测、没有使用统计、没有广告标识符。
云端模式（账号 + 订阅）。 如果你为了云端同步创建了账号，我们会处理下列数据。你随时可以取消订阅并退出登录，回到纯本地使用。
二、我们收集什么
| 数据 | 用途 | GDPR 合法性基础 |
|---|---|---|
| 邮箱地址 | 账号标识、邮箱验证、找回密码、必要服务通知 | 履行合同 |
| 密码 | 身份认证——只存加了盐的 scrypt 哈希，绝不存明文 | 履行合同 |
| 会话记录 | 保持登录状态；只存 token 的哈希，带过期时间 | 履行合同 |
| 你上传的附件 | 提供云端同步 | 履行合同 |
| 同步所需的笔记标题与元数据 | 提供云端同步 | 履行合同 |
| 上传时间与字节数 | 计算存储额度、防止滥用 | 合法利益 |
| IP 地址与基础请求日志 | 安全、防滥用、排查故障；保留 30 天 | 合法利益 |
| 账务记录（套餐、日期、金额、国家） | 会计与税务义务 | 法定义务 |
我们不收集：你的姓名、手机号、住址、通讯录、位置、浏览记录、广告标识符。我们不使用追踪像素、第三方统计，不出售、不共享个人数据用于广告。
支付数据。 卡号在 Creem 的收银台输入，我们看不到也不存储。Creem 作为记录商户是支付数据的控制者，我们只收到付款确认、客户编号和交易关联国家（用于计税）。
三、你的笔记是如何被处理的
笔记存在你的设备上。正文只有在你开启云端同步时才上传，且上传按单个文件授权、凭据短时有效——客户端里不存在能读整个账号的密钥。
内容在传输中加密（TLS 1.2+），在存储端由服务商做静态加密。当前版本不是端到端加密：这意味着在极窄的情形下——你主动请求我们帮你找回某个文件，或我们被法律强制要求——内容可能被访问。除此之外我们不读取你的笔记，也不用你的笔记训练机器学习模型。端到端加密在路线图上，上线时会公告。
四、我们与谁共享
我们只用少量受托处理方，每家都签有数据处理协议：
| 处理方 | 用途 | 位置 |
|---|---|---|
| Creem | 支付处理、开票、税务（记录商户） | 欧盟 / 美国 |
| Resend | 发送验证邮件与找回密码邮件（会收到你的邮箱和邮件正文） | 美国 |
| Cloudflare R2 | 同步附件的对象存储 | 全球节点——数据可能存储于你所在国家以外的数据中心，包括中国大陆以外 |
| 云主机服务商 | 运行 API 与数据库 | 新加坡 |
我们不出售个人数据。仅在法律要求时向主管部门披露；在法律允许的范围内，我们会告知你。
五、跨境传输
我们的服务器和处理方可能位于你所在国家之外。个人数据离开欧洲经济区或英国时，我们依据标准合同条款或充分性认定；数据离开中国时，我们遵守适用的数据出境规定。
六、保存期限
| 数据 | 保留时间 |
|---|---|
| 账号与已同步文件 | 直到你删除，或注销后 90 天 |
| 已删除的附件 | 30 天内从存储与备份中移除 |
| 服务器日志与 IP | 30 天 |
| 账务记录 | 10 年（会计与税务法律要求） |
| Resend 的邮件投递记录 | 30 天 |
订阅到期后，你的文件会保留 90 天——我们不会因为付款结束就删数据。
七、你的权利
视你所在地区，你可能有权：查阅、更正、删除、以可携带格式导出你的数据，限制或反对处理，以及撤回同意。大部分操作你可在应用内自助完成（导出、注销账号）。其余请求发邮件至 privacy@ordflux.com，我们 30 天内答复。
你也可以向当地数据保护机构投诉——欧盟为各国监管机构，英国为 ICO。
八、安全
密码用 scrypt 加每用户随机盐做哈希。会话与验证 token 只存 SHA-256 哈希、一次性使用且有期限（登录链接 10 分钟，邮箱验证 24 小时）。登录尝试有限流。改密码会使所有既有会话失效。
没有绝对安全的系统。若发生影响你个人数据的安全事件，我们会依法及时通知你和相关监管机构。
九、儿童
本服务不面向 16 周岁以下儿童，我们不会在知情情况下收集其数据。若你认为有儿童注册了账号，请联系我们删除。
十、政策变更
重大变更会提前至少 14 天通过邮件或应用内公告，并更新本页顶部的日期。
1. Two modes, two levels of privacy
Local mode (no account). The desktop app stores your notes on your device only. In this mode we collect nothing — no account, no telemetry, no usage analytics, no advertising identifiers.
Cloud mode (account + subscription). If you create an account to enable Cloud Sync, we process the data listed below. You can return to local-only use at any time by cancelling and signing out.
2. What we collect
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Email address | Account identity, email verification, password reset, essential service notices | Performance of contract |
| Password | Authentication — stored only as a salted scrypt hash, never in plaintext | Performance of contract |
| Session records | Keep you signed in; stored as a hash of the token, with expiry | Performance of contract |
| Attachments you upload | Provide Cloud Sync | Performance of contract |
| Note titles and metadata needed for sync | Provide Cloud Sync | Performance of contract |
| Upload timestamps and byte counts | Enforce storage quota, prevent abuse | Legitimate interest |
| IP address and basic request logs | Security, abuse prevention, debugging; retained 30 days | Legitimate interest |
| Billing records (plan, dates, amount, country) | Accounting and tax obligations | Legal obligation |
We do not collect: your name, phone number, address, contacts, location, browsing history, or advertising identifiers. We do not use tracking pixels, third-party analytics, or sell or share personal data for advertising.
Payment data. Card details are entered on Creem's checkout and are never seen or stored by us. Creem, as Merchant of Record, is the controller of payment data; we receive only a confirmation, a customer identifier, and the country associated with the transaction (for tax).
3. How your notes are handled
Your notes are stored on your device. Note body text is only uploaded if you turn on Cloud Sync, and uploads are scoped to individual files with short-lived signed credentials — there is no account-wide read key in the client.
Content is encrypted in transit (TLS 1.2+) and encrypted at rest by our storage provider. Your notes are not end-to-end encrypted in the current version: this means that in the narrow case of a support request where you ask us to recover a file, or where we are legally compelled, content could be accessed. We do not read your notes for any other purpose, and we do not use them to train machine-learning models. End-to-end encryption is on our roadmap; we will announce it when it ships.
4. Who we share it with
We use a small number of processors, each bound by a data-processing agreement:
| Processor | Purpose | Location |
|---|---|---|
| Creem | Payment processing, invoicing, tax (Merchant of Record) | EU / US |
| Resend | Sending verification and password-reset emails (receives your email address and the message body) | US |
| Cloudflare R2 | Object storage for synced attachments | Global — data may be stored in data centers outside your country, including outside mainland China |
| Cloud hosting provider | Running the API and database | Singapore |
We do not sell personal data. We disclose data to authorities only where legally required and, where permitted, we will tell you.
5. International transfers
Our servers and processors may be located outside your country. Where personal data leaves the EEA or UK, we rely on Standard Contractual Clauses or an adequacy decision. Where data leaves China, we comply with applicable cross-border transfer requirements.
6. How long we keep it
| Data | Retention |
|---|---|
| Account and synced files | Until you delete them, or 90 days after account deletion |
| Deleted attachments | Removed from storage and backups within 30 days |
| Server logs and IP addresses | 30 days |
| Billing records | 10 years (tax and accounting law) |
| Email delivery records at Resend | 30 days |
If your subscription lapses, your files are kept for 90 days — we do not delete data simply because a payment ended.
7. Your rights
Depending on where you live, you may have the right to: access your data, correct it, delete it, export it in a portable format, restrict or object to processing, and withdraw consent. You can do most of this yourself in the app (export, delete account). For anything else, email privacy@ordflux.com; we respond within 30 days.
You may also complain to your local data protection authority — in the EU, your national supervisory authority; in the UK, the ICO.
California residents: we do not sell or share personal information as defined by the CCPA/CPRA, and we do not knowingly collect data from consumers under 16 for sale.
8. Security
Passwords are hashed with scrypt and a per-user random salt. Session and verification tokens are stored only as SHA-256 hashes, are single-use, and expire (10 minutes for login links, 24 hours for email verification). Login attempts are rate-limited. Changing a password invalidates all existing sessions.
No system is perfectly secure. If a breach affects your personal data, we will notify you and the relevant authority without undue delay, as required by law.
9. Children
The Service is not directed to children under 16, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will delete it.
10. Changes
We will announce material changes by email or in-app at least 14 days before they take effect, and update the date at the top of this page.