KeyFlow草稿，需律师审阅。本政策为上线前草稿（2026-10-17），尚未生效，未经律师审阅前不得作为正式文本发布。
KeyFlow 隐私政策
最后更新：2026-10-18（草稿） 数据控制者：KeyFlow （法律主体：待律师审阅时填写） 联系：hello@usekeyflow.app
一句话版本
KeyFlow 的功能在你的 Mac 上运行。AI 功能只在你主动触发时，经由我们的服务器把这一次需要的内容发给 AI 模型服务商；我们的服务器不把这些内容写进数据库或日志。云同步（即将推出）推出后，登录即可把待办、笔记、设置、记忆和对话加密同步到你的账户。我们不出售数据，不投放广告，网站统计不用 cookie。
1. 保存在你 Mac 上的数据
- 按键内容：KeyFlow 响应快捷键，但不记录、不保存、不上传你输入的内容；
- 快捷键、改键、手势和菜单栏布局配置；
- 剪贴板历史（加密保存，密钥在你的钥匙串里；不参与云同步）；
- 截图、标注、识别出的文字和生成的图片文件；
- 待办与笔记、对话、记忆与技能、学习记录（加密保存；登录后其中一部分会同步，见第 2b 节）；
- 效率统计和专注记录（只统计每个功能每天用了几次）；
- 通过辅助功能权限读取到的应用内容（例如你选中的文字），只在本机处理，除非你把它交给 AI 功能。
2. 我们处理的数据
| 数据 | 用途 | 法律依据 |
|---|---|---|
| 邮箱地址 | 登录（验证码或 Google 登录）、试用与订阅通知、购买邮件 | 履行合同 |
| 设备哈希（由 Mac 硬件 UUID 单向哈希得到，不上传原始 UUID 或序列号） | 试用记账（每台 Mac 只能领一次试用 Credit）、设备数量上限（每个账户 3 台）、授权绑定 | 履行合同；防止滥用的正当利益 |
| 设备名称、机型、macOS 版本、App 版本 | 在「账户 › 设备」中列出你的 Mac，判断兼容性 | 履行合同 |
| 试用与订阅状态、订单记录（方案、金额、币种、时间、退款状态） | 授权判定、退款、税务记录 | 履行合同；法定义务 |
| Credit 账本与 AI 用量（每次请求的类型、长度、Credit、所用模型和费用，不含你的内容） | 额度、计费、成本控制 | 履行合同 |
| 付款卡指纹（由 Paddle 提供的卡组织、后四位和有效期计算的不可逆哈希） | 只用于识别邀请作弊；我们看不到也不存储完整卡号 | 防止滥用的正当利益 |
| 邀请码、邀请绑定与奖励记录 | 运行邀请计划。邀请人只看到匿名序号（「朋友 3」）、加入日期和状态，看不到朋友的邮箱、名字或设备 | 履行合同 |
| 同步数据（第 2b 节所列类别，加密存储） | 在你的多台 Mac 之间同步，重新登录后恢复 | 履行合同 |
| 匿名崩溃报告（第 2d 节） | 发现并修复崩溃、卡顿和耗电问题 | 正当利益（可关闭） |
| 使用步骤计数（第 2c 节） | 了解试用用户是否用上了核心功能，改进产品 | 正当利益（可关闭） |
| IP 地址（只用于限流，以加盐哈希形式短期保存） | 防止滥用 | 正当利益 |
2a. AI 功能与记忆
- 什么时候发送：只有你主动触发 AI 功能时（翻译、优化、解释、自定义指令、AI 助手对话、技能、识别结果整理、语音整理、生图和改图），KeyFlow 才把这一次需要的内容发出：你选中、口述或输入的文字，你的问题，你附上的图片或文件，相关的几条记忆和你的风格，最近几轮对话，今天待办的标题；生图时还有描述和参考图。
- 发给谁：请求经过我们的服务器，转发给 AI 模型服务商生成结果。我们按速度、质量和成本在多个服务商之间路由，主要通过 OpenRouter（它再把请求交给具体的模型提供方，例如 OpenAI、Anthropic、Google、DeepSeek、Moonshot），也直接使用 Vercel AI Gateway、OpenAI、Groq 等接口。我们只使用付费的商用接口，并在可用时开启「零数据保留」；它们作为数据处理者处理请求，按其条款不会用你的内容训练模型。
- 联网搜索：助理需要联网时，只把搜索词发给搜索服务商（例如 Exa、Brave、Tavily，或 OpenRouter 的搜索工具）。
- 接着之前的对话：你在 AI 助手里开始一段新对话时，为了判断这是不是在接着之前的某段对话，KeyFlow 可能把你的问题，连同最多 4 段之前对话的片段（标题、摘要和最近两个问题，合计约 1,500 字以内）发给一个 AI 模型打分。发送前会去掉邮箱、电话、长数字和密钥，「永不学习」的内容不会被包含。这次打分不计 Credit；这些内容不写入我们的数据库或日志，服务器只记录分数等数字。
- 语音输入：说话过程中的实时文字由本机 Apple 识别产生。松开后，录音会发送给语音识别服务商转成文字，再由 AI 模型整理；中文录音可能由火山引擎（豆包）在中国大陆处理，其他语言由 OpenAI 等服务商处理。密码框里不录音。打开「仅本机识别」后录音不会离开你的 Mac。
- 学习（可选，默认开启；可在「设置 › 个人」暂停或关闭）：一段对话结束后、以及每天一次，KeyFlow 把你自己说过的话和学习记录的少量片段发给 AI 模型，整理成记忆、风格和技能提议；发送前会先去掉邮箱、电话、长数字和密钥。密码、银行卡号、证件号等即使你要求也不会保存。学到的每一条都在「个人」页可见、可编辑、可撤销。
- 我们的服务器不把这些内容写入数据库或日志：你的文字、录音、图片、提示词、记忆和对话在 AI 请求中只经过我们的服务器转发，服务器只记录类型、长度、用量和费用。（对话与记忆的同步存储是另一回事，见第 2b 节。）
- 在「极速」档下，写实照片或绘画风格的生图可能由 Recraft（经 OpenRouter）生成；Recraft 不用你的提示词训练模型，但会把它保留一段尚未公开的期限。
2b. 云同步
- 同步什么：试用期间和订阅期间，可以同步设置（AI 指令、快捷键、语音词汇和各功能的设置）、待办与笔记、记忆、风格和技能以及对话，四个类别各有开关。剪贴板历史、学习记录原文、截图和生成的图片、专注记录与统计、菜单栏布局不参与云同步，服务器也没有接收它们的接口。
- 何时开始：云同步即将推出；推出后登录即默认开启。任何时候都可以在「设置 › 数据与同步」关闭，或「删除云端数据」（云端清空、同步关闭，本机数据不动）。
- 怎么存：传输使用 TLS。每条记录的内容在服务器上用你账户专属的密钥（AES-256-GCM）加密后写入数据库，数据库里只有密文、字段名和时间戳；该密钥再由只保存在服务器环境中的密钥保护。这不是端到端加密：服务器在处理你的请求时会解密，所以重新登录就能恢复，不需要恢复密钥；我们不会在同步服务之外读取或分析这些内容。
- 存在哪里：Supabase（东京区域）。中国大陆用户请注意：开启云同步意味着这些数据会存储在中国境外；关闭同步则不会有这一项传输。
- 订阅停止后：同步暂停，云端数据保留到你删除它或删除账户为止，续订后接着同步。
- 保存多久：删除的记录以「墓碑」（只有标识和时间戳，没有内容）保留 90 天用于多设备对账，之后清除。删除账户时，全部同步数据和你账户的加密密钥立即删除。
2c. 统计
- 网站：我们用 Plausible Analytics 统计访问量，经由我们自己的域名转发。不设 cookie，不保存 IP 地址（Plausible 只用每日更换的盐对 IP 做哈希来区分访客），链接里的查询参数在转发前去掉。除访问量外只记录三个按钮事件（开始试用、看到价格、上线通知）和标题版本号。
- App：不包含任何第三方统计 SDK。登录后，App 会把少数几个上手和升级步骤的计数（例如「试过语音输入」「看到付费页」，以及看到付费页的原因，如「试用结束」「Credit 用完」）发给我们，不含你的文字、剪贴板、截图或提示词。这些计数关联到你的账户，只用来按试用开始的周统计有多少比例的用户用上了核心功能；报告里只有汇总数字。默认开启，可以在「设置 › 数据与同步」关闭「发送使用步骤计数」（对你账户的所有 Mac 生效），关闭时已发送的计数立即删除。计数保留 180 天，删除账户时一并删除。试用、付费和取消的统计直接来自订阅记录，不需要 App 额外发送。
2d. 崩溃报告与诊断信息
- 匿名崩溃报告（默认开启，每台 Mac 单独设置；可在「设置 › 数据与同步」关闭「发送匿名崩溃报告」）：KeyFlow 崩溃、卡顿或出现 CPU / 磁盘写入异常时，macOS 自带的 MetricKit 会生成一份诊断报告，还有每天一份性能数字。KeyFlow 只保留其中的调用记录（stack trace）、程序模块标识、异常类型和数字，再加上 App 与 macOS 版本；发送前在你的 Mac 上逐项筛选，邮箱、用户文件夹名和类似密钥的字符串会被抹掉，服务器收到后再筛一遍。报告里没有你的文字、剪贴板、截图、录音或账户信息。
- 不关联账户：上传不需要登录，也不带账户信息。报告只带一个随机生成的安装标识，每 90 天自动更换，从不随账户相关的请求一起发送；为了限流和去重，服务器只保存它经 HMAC 处理后的值，不保存 IP，无法与你的账户或设备列表对应。崩溃报告存放在 Supabase（东京区域），保留 90 天后自动删除。
- 导出诊断信息：「设置 › 关于 › 导出诊断信息…」会在你的「下载」文件夹里生成一个 zip（版本信息、数据文件的名称和大小、最近的崩溃报告、KeyFlow 自己最近 24 小时的日志，均已筛选），只保存在你的 Mac 上，不会自动上传。只有你自己决定把它发给我们时，我们才会收到。
3. 服务提供方（数据处理者）
- Paddle（记录商户，Merchant of Record）：处理付款、发票、税费和退款。付款信息由 Paddle 直接收集，适用 Paddle 隐私政策。
- Supabase：账号、数据库、同步数据和匿名崩溃报告托管（东京区域）。
- Vercel：网站和 API 托管。和大多数托管服务一样，Vercel 会保留标准的访问日志（包括 IP 地址、请求时间和地址、浏览器或 App 版本），按其保留期限短期保存，用于运行和保障服务安全。我们自己的数据库不把 IP 与崩溃报告或你的内容一起保存（限流只用加盐哈希）。
- Resend：从 hello@usekeyflow.app 发送登录验证码、试用和购买邮件。
- Google：仅当你选择「使用 Google 登录」时用于验证身份（只获取邮箱）。
- Plausible（欧盟）：网站访问统计，见第 2c 节。
- Cloudflare：域名解析（DNS）。
- AI、语音和搜索服务商：见第 2a 节。
我们不出售个人数据，不投放广告，也不与广告网络共享数据。网站只使用必要的本地存储（语言偏好、标题版本）和邀请 cookie（kf_ref，30 天，只在你打开邀请链接时设置）。
4. 国际传输
上述服务提供方可能在你所在国家以外处理数据，我们依赖其提供的标准合同条款等保障措施。中国大陆用户的账号、订单和同步数据存储在中国境外（见第 2b 节），AI 请求可能由境外模型服务商处理，中文语音的云端识别可能在中国大陆处理（见第 2a 节）。
5. 保存期限
- 账号数据：保存到你删除账号为止。
- 订单记录：按税务法规要求保存（通常 7–10 年），删除账号后与账号解除关联。
- 同步数据：保存到你删除它或删除账号为止；删除记录的墓碑 90 天。
- Credit 账本和 AI 用量记录（不含内容）：保存到账号删除。
- 匿名崩溃报告：90 天。使用步骤计数：180 天。邀请点击日志：180 天。限流记录：2 天。
- 网站统计：Plausible 只保存汇总数据，不含 cookie 或 IP。
- 本机：学习记录默认 30 天，专注记录 90 天，剪贴板历史默认 7 天或 100 条；对话和记忆由你自己删除。
6. 你的权利
你可以随时在 App 的「账户」页删除账号：我们会取消订阅续费，吊销 License Key，并删除账号、设备、邀请码、使用计数和同步数据。「设置 › 数据与同步」可以单独删除云端数据，或关闭使用计数和匿名崩溃报告（崩溃报告不关联账户，所以删除账号不会删除已上传的报告，它们在 90 天后自动删除）；「个人」页可以导出、编辑或清空记忆。你也可以发邮件到 hello@usekeyflow.app 要求访问、更正、导出或删除你的数据，或向当地数据保护机构投诉。
7. 儿童
KeyFlow 不面向 16 岁以下的儿童。
8. 变更
本政策如有重大变更，我们会提前通过网站或 App 通知。
DRAFT, needs lawyer review. This is a pre-launch draft (2026-10-17). It is not in effect and must not be published as final until a lawyer has reviewed it.
KeyFlow Privacy Policy
Last updated: 2026-10-18 (draft) · Controller: KeyFlow (Legal entity: TODO, to be filled in at lawyer review) · Contact: hello@usekeyflow.app
The short version
KeyFlow's features run on your Mac. AI features send only what one request needs, only when you trigger them, through our server to an AI model provider; our server does not write that content to its database or logs. Once cloud sync arrives (coming at launch), signing in syncs your to-dos, notes, settings, memory and conversations to your account, encrypted. We don't sell data or run ads, and our website analytics use no cookies.
1. What is kept on your Mac
- What you type: KeyFlow responds to shortcuts but never records, stores or uploads your keystrokes.
- Hotkey, remapping, gesture and menu bar configuration.
- Clipboard history (stored encrypted with a key in your Keychain; never part of cloud sync).
- Screenshots, annotations, recognized text and generated image files.
- To-dos and notes, conversations, memory and skills, the learning log (stored encrypted; some of these sync once you sign in, see section 2b).
- Usage stats and Focus history (only how many times each feature was used per day).
- Content read from other apps under the Accessibility permission (such as text you select), processed on your Mac unless you hand it to an AI feature.
2. What we process
| Data | Why | Legal basis |
|---|---|---|
| Email address | Sign-in (email code or Google), trial and subscription notices, purchase emails | Contract |
| Device hash (a one-way hash of your Mac's hardware UUID; the raw UUID and serial number are never sent) | Trial accounting (each Mac gets trial credits once), the device limit (3 per account), binding licenses | Contract; legitimate interest in preventing abuse |
| Device name, model, macOS version, app version | Listing your Macs under Account › Devices; compatibility | Contract |
| Trial and subscription status; orders (plan, amount, currency, time, refund status) | Deciding your access, refunds, tax records | Contract; legal obligation |
| Credit ledger and AI usage (type, size, credits, model and cost of each request, without your content) | Credits, billing, cost control | Contract |
| Card fingerprint (an irreversible hash of card brand, last 4 digits and expiry, provided by Paddle) | Only to detect invite abuse; we never see or store full card numbers | Legitimate interest in preventing abuse |
| Invite codes, bindings and rewards | Running the invite program. Inviters see only an anonymous number ("Friend 3"), a join date and a status, never a friend's email, name or device | Contract |
| Synced data (the categories in section 2b, stored encrypted) | Syncing between your Macs and restoring after you sign in again | Contract |
| Anonymous crash reports (section 2d) | Finding and fixing crashes, hangs and energy problems | Legitimate interest (you can turn it off) |
| Usage step counts (section 2c) | Learning whether trial users reach the core features; improving the product | Legitimate interest (you can turn it off) |
| IP address (rate limiting only, kept briefly as a salted hash) | Abuse prevention | Legitimate interest |
2a. AI features and memory
- When content is sent: only when you trigger an AI feature (translate, polish, explain, custom actions, assistant conversations, skills, OCR clean-up, dictation clean-up, image generation and editing) does KeyFlow send what that request needs: the text you selected, dictated or typed, your question, images or files you attach, a few relevant memories and your style, recent turns, and today's to-do titles; for images, your prompt and reference image.
- Who receives it: requests pass through our server to an AI model provider that produces the result. We route between providers for speed, quality and cost, mainly through OpenRouter (which passes each request to a model maker such as OpenAI, Anthropic, Google, DeepSeek or Moonshot), and also directly through APIs such as Vercel AI Gateway, OpenAI and Groq. We use paid, commercial APIs only, with zero data retention enabled where it is offered; providers act as our processors and, under their terms, do not train models on your content.
- Web search: when the assistant needs the web, only the search query goes to a search provider (such as Exa, Brave, Tavily, or OpenRouter's search tool).
- Continuing an earlier conversation: when you start a new conversation in the assistant, KeyFlow may send your question together with snippets of up to 4 earlier conversations (title, summary and the last two questions, about 1,500 characters in total) to an AI model, which scores whether you are continuing one of them. Emails, phone numbers, long numbers and keys are removed first, and content marked "never learn" is left out. This check costs no credits; the content is not written to our database or logs; the server records only numbers such as the score.
- Voice input: the live text while you speak comes from on-device Apple recognition. When you release the key, the recording is sent to a speech-recognition provider and the transcript is tidied by an AI model; Chinese audio may be processed by Volcengine (Doubao) in mainland China, other languages by providers such as OpenAI. Nothing is recorded in password fields. With "on-device only" turned on, audio never leaves your Mac.
- Learning (optional, on by default; pause or turn it off under Settings › Personal): after a conversation ends, and once a day, KeyFlow sends what you said plus short learning-log snippets to an AI model to produce memory, a style profile and skill proposals. Emails, phone numbers, long numbers and keys are removed first. Passwords, card and bank numbers, ID numbers and the like are never stored, even on request. Everything learned is visible, editable and reversible on the Personal page.
- Our servers do not write this content to the database or logs: your text, audio, images, prompts, memory and conversations only pass through our servers on their way to the provider. The servers record only the type, size, usage and cost of each request. (Storing conversations and memory for sync is a separate matter, see section 2b.)
- At the "fast" speed level, a photo-realistic or painterly image may be generated by Recraft (via OpenRouter); Recraft does not train on your prompts but retains them for a period it has not yet published.
2b. Cloud sync
- What syncs: during your trial and subscription, Settings (AI actions, hotkeys, voice vocabulary and feature settings), To-dos & Notes, Memory, Style & Skills and Conversations can sync, each with its own switch. Clipboard history, the learning log, screenshots and generated images, Focus history and stats, and menu bar layout are never part of cloud sync, and the server has no endpoint that could receive them.
- When it starts: cloud sync is coming at launch; from then on it is on by default once you sign in. You can turn it off at any time under Settings › Data & Sync, or "Delete cloud data" (the cloud copy is erased, sync turns off, data on your Mac is untouched).
- How it is stored: TLS in transit. On our servers, each record's content is encrypted with a key specific to your account (AES-256-GCM) before it is written, so the database holds only ciphertext, field names and timestamps; that key is in turn protected by a key held only in the server environment. This is not end-to-end encryption: the server decrypts while serving your request, which is why signing in again restores everything without a recovery key. We do not read or analyse this content outside of serving sync.
- Where: Supabase, Tokyo region. If you are in mainland China, turning on cloud sync means this data is stored outside China; with sync off, this transfer does not take place.
- If your subscription stops: sync pauses; cloud data is kept until you delete it or your account, and sync resumes if you subscribe again.
- How long: deleted records leave a "tombstone" (identifiers and timestamps only, no content) for 90 days so your other Macs can reconcile, then it is purged. Deleting your account deletes all synced data and your account's encryption key at once.
2c. Analytics
- Website: we count visits with Plausible Analytics, relayed through our own domain. No cookies are set and no IP addresses are stored (Plausible hashes the IP with a salt that changes daily, only to tell visitors apart), and query strings are removed from links before they are relayed. Besides page views we record only three button events (start trial, saw pricing, notify me at launch) and which headline version you saw.
- App: no third-party analytics SDK. While you are signed in, the app sends us counts of a few onboarding and upgrade steps (for example "tried dictation" or "saw the upgrade screen", and why the upgrade screen appeared, such as "trial ended" or "out of Credits"), never your text, clipboard, screenshots or prompts. The counts are linked to your account and are used only to measure, per week of trial start, what share of users reach the core features; reports contain totals only. They are on by default; turn off "Send usage step counts" under Settings › Data & Sync (it applies to every Mac on your account), and the counts already sent are deleted at once. Counts are kept for 180 days and deleted with your account. Trial, payment and cancellation figures come straight from subscription records; the app sends nothing extra for them.
2d. Crash reports and diagnostics
- Anonymous crash reports (on by default, set per Mac; turn off "Send anonymous crash reports" under Settings › Data & Sync): when KeyFlow crashes, hangs, or hits a CPU or disk-write exception, Apple's built-in MetricKit produces a diagnostic report, plus a daily set of performance numbers. KeyFlow keeps only the stack traces, binary identifiers, exception types and numbers, together with the app and macOS versions. It filters every field on your Mac before sending, blanking email addresses, your home-folder name and anything that looks like a key, and the server filters again on receipt. Reports never contain your text, clipboard, screenshots, recordings or account details.
- Not linked to your account: uploads need no sign-in and carry no account information. Reports carry only a randomly generated install ID that changes every 90 days and is never sent with account requests; for rate limiting and de-duplication the server stores only an HMAC of it, and no IP address, so reports cannot be matched to your account or device list. Crash reports are stored with Supabase (Tokyo region) and deleted automatically after 90 days.
- Exporting diagnostics: Settings › About › Export Diagnostics… saves a zip to your Downloads folder (version details, the names and sizes of KeyFlow's data files, recent crash reports and KeyFlow's own log lines from the last 24 hours, all filtered). It stays on your Mac and is never uploaded automatically; we only receive it if you choose to send it to us.
3. Service providers (processors)
- Paddle (Merchant of Record): payments, invoices, tax and refunds. Paddle collects payment details directly under the Paddle Privacy Policy.
- Supabase: accounts, database, synced data and anonymous crash reports, hosted in Tokyo.
- Vercel: website and API hosting. Like most hosting providers, Vercel keeps standard request logs (including IP addresses, request time and path, and browser or app version) for a limited period under its retention policy, to operate and secure the service. Our own database does not store IP addresses with crash reports or your content (rate limiting uses salted hashes only).
- Resend: sign-in codes, trial and purchase emails, sent from hello@usekeyflow.app.
- Google: only if you choose "Sign in with Google", to confirm your email.
- Plausible (EU): website visit counts, see section 2c.
- Cloudflare: domain name service (DNS).
- AI, speech and search providers: see section 2a.
We do not sell personal data, run ads, or share data with ad networks. The website uses only essential local storage (language preference, headline version) and the invite cookie (kf_ref, 30 days, set only when you open an invite link).
4. International transfers
These providers may process data outside your country; we rely on safeguards such as the Standard Contractual Clauses they offer. For users in mainland China, account, order and synced data are stored outside China (section 2b), AI requests may be processed by model providers outside China, and cloud recognition of Chinese speech may be processed in mainland China (section 2a).
5. Retention
- Account data: until you delete your account.
- Orders: as long as tax law requires (typically 7–10 years), unlinked from your account once it is deleted.
- Synced data: until you delete it or your account; tombstones of deleted records for 90 days.
- Credit ledger and AI usage records (no content): until your account is deleted.
- Anonymous crash reports: 90 days. Usage step counts: 180 days. Invite click logs: 180 days. Rate-limit records: 2 days.
- Website analytics: Plausible keeps aggregates only, with no cookies or IP addresses.
- On your Mac: the learning log 30 days by default, Focus history 90 days, clipboard history 7 days or 100 items by default; conversations and memory until you delete them.
6. Your rights
You can delete your account at any time from the Account page in the app: we cancel your subscription renewal, revoke your license keys, and delete your account, devices, invite codes, usage counts and synced data. Settings › Data & Sync deletes cloud data on its own, or turns off usage counts and anonymous crash reports (crash reports are not linked to your account, so deleting your account cannot remove reports already sent; they are deleted after 90 days); the Personal page exports, edits or clears memory. You can also email hello@usekeyflow.app to access, correct, export or delete your data, or complain to your local data protection authority.
7. Children
KeyFlow is not directed at children under 16.
8. Changes
We will announce material changes to this policy in advance on the website or in the app.