风中小屋返回芽途介绍

芽途隐私政策

生效日期：2026 年 10 月 7 日；更新日期：2026 年 10 月 20 日

本政策说明芽途（Yatu）的开发者如何处理你使用 App、登录及 AI 功能时的信息。各功能的实际可用范围以你安装的版本为准。隐私联系邮箱：privacy@lnception.cn。

1. 我们处理哪些信息，以及用途

2. 日历权限

只有在你授权后，芽途才访问日历。它根据你选择计入占用的日历在设备上判断时间可用性，并创建或更新你确认的行动事件。用于云端规划的是相关安排和候选时段，而不是上传整个日历。你可在 iOS 设置中撤销日历权限；不授权时仍可使用不依赖日历的功能。已经写入 Apple 日历的事件可能独立保留，可通过日历 App 管理；其同步取决于你所使用的日历账户。

3. 服务提供方及数据传输

Apple 提供 Apple 登录、系统钥匙串和日历能力。Cloudflare 提供后端运行、账号数据库（D1）、验证码邮件发送和 AI 推理服务；其全球基础设施可能在你所在国家或地区之外处理信息。我们仅为上述功能向服务提供方传递必要的信息，不出售个人信息，当前未接入广告或跨 App 广告追踪 SDK。

Cloudflare 的数据处理适用其服务条款及隐私政策。根据其Workers AI 数据使用说明，Cloudflare 不使用经 Workers AI 处理的客户内容训练 AI 模型；其内容处理、运行元数据及安全、法律等例外适用该说明及相关条款。芽途不将你的内容用于模型训练。访问外部资源链接时，目标网站会按自己的政策处理信息。

4. 保存期限与安全

本地业务数据保留至你删除相应内容或设备上的 App 数据。后端账号标识保留至账号删除；退出登录不会删除账号。当前会话有效期为 7 天，邮箱验证码为 10 分钟，Apple 登录挑战为 5 分钟。过期即失效，过期记录在后续相关请求触发清理时删除，并非到期瞬间全部物理删除。验证码发送配额按一小时窗口管理，过期限流记录在后续相关请求中清理。

当前启用 Cloudflare Workers 运行日志，保留期由 Cloudflare 套餐决定，通常为 3 至 7 天；App 后端代码不主动记录令牌、验证码、请求正文、AI 提示词或生成内容。网站服务器也可能保留常规访问日志，用于运行与安全；没有设置按固定天数自动删除的承诺。依法必须保留的信息及服务商备份按适用要求处理。

推荐卡片及其证据快照、关闭和类型拒绝偏好、发布历史、每日新增计数、曝光/来源查看/行动或探索入口标记及最近规划的覆盖说明按账号保存在本设备。过期或源记录变化可使卡片停止展示，但不代表所有缓存或历史立即删除；相关本地推荐状态可通过「停止并重置推荐」或删除账号清理。退出登录会保留账号隔离的本地记录。后端不维护完整的推荐偏好或曝光账本；不保存业务聊天记录不等于基础设施或服务商不处理、留存必要的运行信息。

学习材料、摘要和记忆按账号保存在设备上。符合条件的临时对话原文在成功提交摘要后删除；未成功总结的材料按 7 天有效期、重试次数和数量限制，在后续学习检查时清理。行为摘要及其中的用户陈述按 90 天有效期和数量限制，在后续检查时清理；自动生成的记忆按各自有效期清理。这些不是到期瞬间物理删除的保证，设备未运行 App 时尤其如此。关闭学习会清除当前学习材料与行为摘要，但保留已有记忆且不再将其用于个性化；如需删除已有记忆，请使用「清空沉淀内容」。正式行动与执行记录不适用学习材料的短期清理期限。

网络请求使用 HTTPS，设备登录凭证保存在系统钥匙串，后端会话令牌以哈希形式保存。我们采用合理的访问控制，但无法保证任何系统绝对安全。

5. 你的选择与删除请求

你可以在 App 中查看、修改或删除支持管理的内容，并在系统设置中撤销日历授权。首页主动推荐的数据处理说明和控制入口位于「设置 → 推荐」，完整隐私政策在本网站提供。

在「设置 → 推荐」执行「停止并重置推荐」后，App 不再发起新的自动或手动首页推荐请求，并清空本设备当前账号的推荐卡片、关闭和类型拒绝偏好、发布与曝光历史、计数及规划缓存；关闭状态在重启或重新登录后保留。已经发出的请求可能继续处理，返回结果不再采用；该操作不能撤回已经上传的数据或改变服务商适用的留存规则。重新开启后从初始推荐状态开始，不删除探索、资源、行动或进展记录。

关闭单张卡片或拒绝某类内容仅影响后续推荐选择，不会关闭云端推荐。「停止并重置推荐」也不关闭其他 AI 功能或独立的偏好学习：之后使用行动建议、资源整理或调整时，仍会发送该功能所需的内容；学习仍开启且满足条件时，也可能继续发送后台总结和记忆刷新请求。登录和普通网络请求仍会处理必要的账号与请求信息。

「设置 → 用户记忆」提供「从已采纳行动中学习」开关、已有记忆展示及「清空沉淀内容」。关闭学习会停止新学习材料采集、后台总结与记忆更新，并停止将已有记忆用于个性化；不会关闭你主动使用的其他 AI 功能或首页推荐本身。「清空沉淀内容」删除当前账号在本设备上的记忆及学习材料，清除用于学习的首页旧反馈，不删除正式探索、资源、行动、安排、进展或首页屏蔽规则，也不会自动关闭学习开关。若仍开启学习，后续符合条件的新操作可继续产生学习材料；已清空的旧对话不会重新学习。已发出的请求可能仍由服务商处理，但失效的返回不再写入；这些控制不能撤回已上传内容或改变服务商适用的留存规则。

在支持账号删除的版本中，你可以打开「设置 → 删除账号」，查看删除范围并确认。邮箱账号使用当前登录会话验证身份；Apple 登录账号需重新通过 Apple 验证，后端会处理本次身份凭证和授权码，换取临时访问令牌并向 Apple 撤销授权。删除无需发送邮件。如旧版本没有入口，请更新至支持该功能的版本。

成功删除后，后端账号、登录身份、所有设备的登录会话，以及关联的邮箱验证码和发送限流记录会被删除。本设备随后清理探索、资源、行动、安排、进展、记忆与学习材料、推荐卡片及偏好与历史、待导入分享及登录凭证。若设备清理失败，App 会提示你删除 App 以清除剩余本地数据。退出登录不是删除账号。其他设备上的本地数据、系统备份及已写入的 Apple 日历事件不会自动删除；请在相应设备、系统或日历 App 中管理。依法须保留的信息及服务商备份按适用要求处理。

如需查询、纠正信息或咨询删除问题，请联系 privacy@lnception.cn。我们会在核实账号归属后处理请求。请勿发送密码、验证码或完整身份凭证。

6. 未成年人及政策更新

芽途不专门面向儿童。未成年人应在监护人指导下使用；如发现未经必要同意处理了未成年人信息，请联系上述邮箱。处理方式发生变化时，我们会更新本页日期，并在适当情况下提供提示或取得必要同意。

Yatu Privacy Policy

Effective: October 7, 2026. Updated: October 20, 2026.

This policy describes how Yatu’s developer handles information when you use the app, sign in, and use AI assistance. Feature availability depends on the version you install. Contact: privacy@lnception.cn.

1. Information and purposes

2. Calendar permission

Calendar access requires your permission. Yatu calculates availability on your device using the calendars you select and creates or updates confirmed action events. Cloud planning uses relevant arrangements and candidate slots rather than an upload of your entire calendar. You can revoke permission in iOS Settings and use features that do not require calendar access. Events already added may remain in Apple Calendar; manage them there. Calendar synchronization depends on your calendar account.

3. Providers and transfers

Apple supplies Apple sign-in, Keychain and calendar capabilities. Cloudflare supplies backend hosting, the D1 account database, verification email delivery and AI inference. Its global infrastructure may process information outside your country or region. We disclose necessary information for these functions, do not sell personal information, and currently include no advertising or cross-app advertising tracking SDKs.

Cloudflare processing is subject to its terms and Privacy Policy. Its Workers AI data documentation states that Customer Content processed by Workers AI is not used to train AI models. Its documentation and terms describe content handling, operational metadata, and safety, security and legal exceptions. Yatu does not use your content for model training. External resource websites apply their own privacy policies.

4. Retention and security

Local business content remains until you delete it or the app’s device data. Backend account identifiers remain until account deletion; signing out does not delete the account. Sessions currently expire after 7 days, email codes after 10 minutes and Apple sign-in challenges after 5 minutes. Expired records become invalid and are removed by subsequent relevant cleanup requests, not necessarily physically deleted immediately at expiry. Email delivery quotas use one-hour windows; expired rate-limit records are cleaned up by subsequent relevant requests.

Cloudflare Workers runtime logs are enabled. Retention depends on the plan, typically 3–7 days. Our backend code does not intentionally log tokens, codes, request bodies, AI prompts or generated content. The website server may retain ordinary access logs for operation and security; we do not promise automatic deletion after a fixed number of days. Legally required records and provider backups follow applicable requirements.

Recommendation cards and evidence snapshots, dismissal and type-rejection preferences, publication history, daily new-card counts, exposure/source-view/navigation markers and the latest planning coverage summary are stored on this device separately for each account. Expiry or changed source records can hide a card without immediately deleting every cache or history entry. Stop and reset recommendations or account deletion clears the related local recommendation state. Signing out preserves account-isolated local records. Our backend does not maintain complete preference or exposure ledgers; not storing business conversation records does not mean infrastructure or providers process or retain no operational information.

Learning material, summaries and memories are stored on this device separately for each account. Eligible temporary conversation text is removed after a summary is successfully committed. Material not successfully summarized is cleaned up during subsequent learning checks according to a 7-day lifetime, retry limits and count limits. Behavioral summaries and their user statements are cleaned up during subsequent checks according to a 90-day lifetime and count limits; automatically generated memories are cleaned up according to their individual expiry. These are not guarantees of immediate physical deletion at expiry, particularly while the app is not running. Turning learning off clears current learning material and behavioral summaries but retains existing memories without using them for personalization. Use Clear learned context to delete those memories. Formal action and execution records are not subject to the short retention rules for learning material.

Connections use HTTPS, device sign-in credentials use system Keychain, and backend session tokens are stored as hashes. We use reasonable access controls, but no system can be guaranteed completely secure.

5. Your choices and deletion requests

You can view, edit or delete supported content and revoke calendar access in system settings. Data-processing information and controls for proactive Home recommendations are in Settings → Recommendations; the full Privacy Policy is provided on this website.

Stop and reset recommendations in Settings → Recommendations prevents new automatic or manual Home recommendation requests and clears this device’s cards, dismissal and type-rejection preferences, publication and exposure history, counts and planning caches for the current account. The disabled setting persists across app restarts and sign-in. Requests already sent may continue processing, but their results are ignored; the operation cannot withdraw uploaded data or change providers’ applicable retention rules. Enabling recommendations again starts with fresh recommendation state and does not delete explorations, resources, actions or progress.

Dismissing one card or rejecting an insight type only affects recommendation selection and does not stop cloud recommendations. Stopping and resetting recommendations does not disable other AI features or independent preference learning: later action suggestions, resource organization or adjustments still send the content required for those features, and eligible background summary or memory-refresh requests may continue if learning remains enabled. Sign-in and other network requests still process necessary account and request data.

Settings → User memory provides the Learn from accepted actions toggle, a display of existing memories and Clear learned context. Turning learning off stops new learning-material collection, background summaries and memory updates, and stops using existing memories for personalization. It does not disable other AI features you choose to use or Home recommendations themselves. Clear learned context removes this account’s memories and learning material on this device and clears old Home feedback used for learning. It preserves formal explorations, resources, actions, arrangements, progress and Home blocking rules, and does not turn off the learning toggle. If learning stays enabled, eligible future actions may generate new learning material; cleared past conversations are not learned again. Providers may still process requests already sent, but invalidated results are not saved. These controls cannot withdraw uploaded content or change applicable provider retention rules.

In versions that support account deletion, open Settings → Delete account, review the scope and confirm. Email accounts authenticate using the current session. Apple accounts require fresh Apple authorization; the backend processes the identity credential and authorization code, exchanges the code for a temporary access token and revokes the Apple authorization. No email request is required. If an older version has no deletion option, update to a version that supports it.

Successful deletion removes the backend account, login identity, sessions on all devices, and associated email verification and rate-limit records. The app then clears this device’s explorations, resources, actions, arrangements, progress, memories and learning material, recommendation cards, preferences and history, pending shares and sign-in credentials. If device cleanup fails, the app asks you to remove the app to clear remaining local data. Signing out is not account deletion. Local data on other devices, system backups and existing Apple Calendar events are not automatically removed; manage these on the relevant device or in the system or calendar app. Legally required records and provider backups follow applicable requirements.

For access, correction or questions about deletion, contact privacy@lnception.cn. We will verify account ownership before handling requests. Do not send passwords, verification codes or complete identity credentials.

6. Minors and updates

Yatu is not specifically directed at children. Minors should use it with guardian guidance. Contact us if information about a minor has been processed without necessary consent. We will update the date when practices change and provide notice or obtain consent where appropriate.