心桥隐私政策
本政策说明心桥（“心桥”“我们”）如何处理您的个人信息。我们只收集提供、保护和改进心桥所需要的信息，不出售个人信息，也不使用跨应用广告追踪。
1. 我们处理的信息
- 账号与身份：账号标识、显示名称、电子邮箱、Apple 或 Google 登录标识、通行密钥信息以及登录安全记录。
- 个人资料：您主动填写的头像、昵称、语言、地区、性别、新爱号及可见范围设置。
- 内容与通信：您发送的文字、语音、图片、动态、评论、举报原因，以及为处理举报而随举报提交的相关对话片段。
- 您选择导入的信息：只有在您主动授权和操作时，心桥才会读取您选择的联系人、照片、相机或麦克风内容。
- 熟人圈的位置：只有在您主动开启或刷新“1 公里熟人圈”时，我们才获取当前位置，用于计算其他已开启成员是否在 1 公里内。我们不向其他成员显示坐标。
- 内置内容包：您可以启用或停用随应用安装并参与审核的内置内容包。AI 小会计可能处理收支、金额和凭证图片；小梦可能处理心情、呼吸和随笔；小康可能处理经期、亲密与性相关状态、乳房和皮肤记录。这些记录默认保存在本机。启用涉及敏感资料的内容包前，我们会先说明用途并征得您的选择。
- 技术与安全信息：设备生成的登录标识、语言、请求时间、错误与安全日志。我们不会为了广告目的建立设备画像。
2. 使用目的与依据
我们使用这些信息来创建和保护账号、同步资料、传递消息、提供您主动调用的 AI 或语音功能、展示您选择发布的内容、处理屏蔽与举报、预防欺诈滥用、排查故障，并履行适用的法律义务。您可以拒绝非必要权限；相应功能可能不可用，但不会影响其他功能。
3. 权限
- 麦克风与语音识别：仅在您录音或使用语音输入时使用。
- 相机与照片：仅在您拍摄、选择头像或上传内容时使用。
- 联系人：仅在您选择导入联系人时使用。您可以在系统设置中随时撤销权限。
- 使用期间的位置：仅在您主动使用“1 公里熟人圈”时获取一次，不进行后台持续定位。
4. 信息共享
我们仅在提供功能所必需的范围内，与托管、安全、邮件投递、Apple/Google 登录以及您主动调用的 AI 服务提供商处理信息。您拍摄凭证、请求财务建议、情绪陪伴或健康建议时，所选凭证、相关财务汇总、情绪记录或健康记录可能发送给 AI 服务以完成本次请求；我们不会在您没有主动使用相关功能时把这些本机记录发送给 AI 服务。服务提供商只能按我们的指示处理信息。公开发布的资料或内容会按您选择的可见范围展示。我们也可能在法律要求、保护用户安全或公司重组时依法披露必要信息。
5. 保存与删除
账号和资料通常保存至您删除账号。消息内容以完成传递为目的短期保存：已交付的入站消息会从消息服务移除，未交付内容最长保留 30 天；不含正文的安全与合规元数据可能依法或为防滥用保留更长时间。举报记录在处理、安全审计或法律需要期间保存，并会定期审查。
“1 公里熟人圈”会把本次位置按约 100 米精度保存，最多保留 2 小时，且只返回距离范围，不返回坐标。您可随时选择“关闭并删除位置”；删除账号也会同时删除该位置。
内置内容包的账本、情绪和健康记录默认保存在本机。停用内容包不会自动删除记录，方便您以后重新启用；退出登录、切换账号或删除账号会清除这些本机内容包记录，防止其他账号读取。卸载应用也会由系统移除应用本机数据。
您可在心桥的“账号”面板中选择“删除账号”。删除会移除账号、个人资料、云端聊天记录以及相关屏蔽关系，并使现有登录令牌失效。若使用 Apple 登录，我们会在可用时同时撤销 Apple 授权令牌。法律要求保存或为解决安全争议所必需的最少记录，可能在限定期限内隔离保存。
6. 您的选择与权利
您可以在应用内查看和修改资料、调整可见范围、屏蔽或举报用户、撤销系统权限、退出登录或删除账号。您也可以联系我们申请访问、更正、删除或限制处理您的信息。我们可能需要验证身份后再处理请求。
7. 安全与跨境处理
我们采用访问控制、传输加密、令牌验证和最小权限等措施保护信息。互联网服务无法保证绝对安全。因全球服务提供商所在地不同，信息可能在您所在国家或地区之外处理；我们会使用适用的合同和安全措施保护信息。
8. 未成年人
心桥不面向未达到所在地区数字服务最低同意年龄的儿童。未成年人应在父母或监护人同意和指导下使用。若您认为儿童未经适当同意向我们提供了个人信息，请联系我们。
9. 联系我们与政策更新
隐私问题、权利请求或投诉请发送至 zhouyawu@xinai.me。我们可能更新本政策；重大变化会通过应用内公告或其他适当方式提示，并在本页标明新的生效日期。
XinQiao Privacy Policy
This policy explains how XinQiao handles personal information. We collect only what is needed to provide, secure, and improve the service. We do not sell personal information or use cross-app advertising tracking.
Information we process
This may include account identifiers, display name, email, Apple or Google sign-in identifiers, passkey and login-security data; profile fields and visibility choices; messages, voice, images, posts, comments, reports, and relevant conversation excerpts submitted with a report; contacts or media you explicitly choose to import; location obtained only when you enable or refresh the One-Kilometre Familiar Circle; financial entries and receipt images used with AI Accountant; mood, breathing, and journal records used with Xiaomeng; cycle, intimate or sexual-status, breast, and skin records used with Xiaokang; and limited device-generated identifiers, language, request time, error, and security logs. Content-pack records are stored on the device by default, and the app explains sensitive-data use before you choose to enable a relevant pack.
How we use it
We use information to create and protect accounts, sync profiles, deliver communications, provide AI or voice features you request, show content according to your visibility choices, process blocks and reports, prevent abuse, troubleshoot, and meet legal obligations. Optional permissions may be declined without disabling unrelated features.
Permissions
Microphone and speech recognition are used only when you record or use voice input. Camera and photos are used only when you capture or select media. Contacts are accessed only when you choose to import them. When In Use location is requested only when you actively enable or refresh the One-Kilometre Familiar Circle; the app does not continuously locate you in the background. Permissions can be withdrawn in system settings.
Sharing
Information is shared only as needed with hosting, security, email delivery, Apple/Google sign-in, and AI providers used for a feature you request. When you scan a receipt or request financial, emotional, or health assistance, the selected receipt or relevant financial summary, emotional record, or health record may be sent to the AI provider to complete that request. These on-device records are not sent to an AI provider unless you actively use the relevant feature. Providers may process information only for the relevant service. Public content is shown according to your selected audience. Necessary information may also be disclosed where legally required, to protect safety, or in a corporate reorganisation.
Retention and deletion
Account and profile data is generally retained until account deletion. Incoming message content is removed after delivery; undelivered content is retained for up to 30 days. Security and compliance metadata that does not contain message text may be retained longer where required for safety or law. Reports are retained while needed for review, safety audit, or legal obligations.
The One-Kilometre Familiar Circle stores the current location at approximately 100-metre precision for no more than two hours and returns only a distance, never another person's coordinates. You can choose “Turn off and delete location” at any time, and account deletion also removes it.
Content-pack ledger, emotional, and health records are stored on the device by default. Disabling a pack does not automatically erase its records so that you can enable it again later. Signing out, switching accounts, or deleting your account clears these local content-pack records to prevent access by another account. Uninstalling the app removes its local app data through the operating system.
You can delete your account in the in-app Account panel. This removes the account, profile, cloud conversations, and related block relationships, and invalidates existing login tokens. Where available, Apple authorisation tokens are also revoked. Minimal records may be isolated for a limited period where retention is legally required or necessary to resolve a security dispute.
Your choices
You may edit your profile and visibility, block or report users, withdraw permissions, sign out, or delete the account. You may also request access, correction, deletion, or restriction by contacting us. We may verify identity before completing a request.
Security, international processing, and children
We use access controls, encrypted transport, token validation, and least-privilege practices. No internet service can guarantee absolute security. Providers may process information outside your country, subject to applicable contractual and security safeguards. XinQiao is not directed to children below the minimum digital-consent age in their region; minors should use it with parent or guardian consent and guidance.
Contact and updates
Contact zhouyawu@xinai.me for privacy requests or complaints. Material policy changes will be communicated appropriately and a new effective date will appear here.