守见 FramePing

中文

本政策说明 PUBLISHER_NAME（“我们”）如何在守见 FramePing Android 应用中处理数据。参考图片和结构化读数监控以本地处理为默认且不要求账号；自然语言配置和多设备同步需要用户登录。

1. 本地处理的数据

• 相机帧、临时选区、视觉中间结果和实时推理在设备内存中处理，不上传云端。
• 用户选择的参考照片保存在 App 私有目录，禁止系统备份；删除任务或卸载 App 时删除。
• 参考目标或通用文字目标每次出现时最多保存一张本机触发图。只有同账号用户在另一台在线手机主动查看时，来源手机才会发送一份不超过 720 px／120 KiB 的端侧加密临时副本；Supabase Realtime 只中继请求元数据和密文且不持久化，查看端副本只进入 App 私有临时缓存。
• 本机任务、事件时间线、设置和模型包保存在设备上。用户确认通用文字目标后，该目标会作为任务配置保存在本机；拒绝的草稿和原始自然语言请求不写入本机数据库。
• 手动创建的参考图片和结构化读数监控不要求创建账号。

2. 账号、自然语言配置与可选云端同步

自然语言配置要求登录。App 向 Supabase Edge Function 提交用户文字、locale、已验签 Catalog 的身份与 SHA-256，以及不含序列号或稳定设备 ID 的 Android API、ABI、RAM 档位和 GMS 可用性摘要；Supabase 使用这些信息复验目录和设备资格。Edge 随后只把用户文字、locale 和从当前签名目录生成的精简 active inventory 发送给 OpenAI Responses API，用于选择监控类型并生成配置草稿；OpenAI 不接收设备摘要、Catalog SHA、相机帧、参考照片、视频、音频或任意候选模型 URL。草稿必须由用户确认，确认前不会创建任务、下载模型或启动相机。

原始文字和未确认草稿不写入 App 数据库或 Supabase 数据库，也不进入 App 或 Supabase 应用日志。OpenAI API 请求设置 store=false；OpenAI 仍可能按其数据控制政策在滥用监控日志中保留客户内容，默认最长 30 天，除非发布者的项目已获批并启用更严格的数据保留控制。

用户登录后，我们还会处理邮箱、账号标识、设备标识、FCM 推送 token、已确认的任务摘要（可包含文字目标）、结构化事件和送达状态，用于登录、同账号设备同步和用户主动开启的事件通知。云端事件不包含图片、视频或音频。Event payload 自服务端收到之时起保留 30 天；账号删除时删除关联的云端账号、设备、任务、事件和投递记录。

3. 权限

• Camera：仅在用户从可见页面主动开始监控后，用于本地视觉分析。
• Notifications：仅在用户开启对应开关后显示运行状态或事件提醒。
• Internet：用于签名模型包下载、登录后的自然语言配置，以及用户选择的账号同步和推送。

4. 服务提供商

我们使用 Supabase 提供账号、数据库、自然语言请求中继和端侧加密临时预览的 Realtime 密文中继，OpenAI Responses API 根据用户文字生成模型选择与配置草稿，Cloudflare R2 分发签名模型包，Firebase Cloud Messaging 提供用户可选的推送。应用不会向 OpenAI 开放工具、相机或设备控制能力。上述提供商按各自条款、数据处理协议与隐私说明处理数据。

5. 安全与选择

网络请求使用 HTTPS；账号 session 以 Android Keystore 保护的加密密文存放且不进入系统备份。用户可以不登录而手动创建参考图片或结构化读数监控，可以拒绝任何自然语言草稿，可以分别关闭本机和其他设备事件通知，可以删除单条任务及其本地素材，也可以在 App 内删除云端账号。

6. 联系与变更

隐私与支持问题请联系 SUPPORT_EMAIL；涉及漏洞、密钥或用户数据的报告请使用私密安全报告入口，不要提交到公开 Issue。政策有实质变化时，我们会更新本页的生效日期，并按适用要求在 App 或商店页面提示。

删除账号 / Delete account

已登录用户可在 App 的“账号与其他手机”页面选择“删除云端账号”，并再次确认。无法访问 App 的用户可直接发送邮件至 SUPPORT_EMAIL，主题写明“FramePing account deletion”，并使用注册邮箱发送请求。我们可能只要求完成必要的账号归属验证，不要求重新安装 App。

删除完成后，云端账号及其设备、任务摘要、结构化事件、回执和推送记录会删除。本机数据独立保存在设备上；如需一并删除，请在 App 内删除任务或卸载 App。

Signed-in users can choose “Delete cloud account” from “Account and other phones” in the app and confirm the action. If the app is unavailable, email SUPPORT_EMAIL from the registered address with the subject “FramePing account deletion.” We may perform only the verification needed to confirm ownership; reinstalling the app is not required.

English

This policy explains how PUBLISHER_NAME (“we”) handles data in the FramePing Android app. Reference-image and structured-reading monitoring are on-device by default and do not require an account. Natural-language configuration and multi-device sync require sign-in.

1. Data processed on the device

• Camera frames, temporary regions, intermediate visual results, and live inference are processed in device memory and are not uploaded.
• Reference photos selected by the user stay in private app storage, are excluded from system backup, and are removed when the task is deleted or the app is uninstalled.
• At most one local trigger image is saved for each reference-target or general-text-target appearance. Only when the same-account user requests it from another online phone does the source phone send a client-side-encrypted temporary copy of no more than 720 px / 120 KiB. Supabase Realtime relays only request metadata and ciphertext without persistence; the viewer copy enters only private temporary app cache.
• Local tasks, event timeline, settings, and model packages remain on the device. After the user accepts a general text target, that target is saved as task configuration on the device. Rejected drafts and original natural-language requests are not written to the local database.
• Manually creating reference-image and structured-reading monitors does not require an account.

2. Account, natural-language configuration, and optional cloud sync

Natural-language configuration requires sign-in. The app submits the user's text, locale, verified Catalog identity and SHA-256, plus a summary of Android API, ABI, RAM class, and GMS availability without a serial number or stable device ID to a Supabase Edge Function; Supabase uses them to revalidate the catalog and device eligibility. The Edge Function then sends only the user text, locale, and a minimized active inventory derived from the current signed catalog to the OpenAI Responses API to select a monitoring type and generate a configuration draft. OpenAI does not receive the device summary, Catalog SHA, camera frames, reference photos, video, audio, or arbitrary candidate-model URLs. The user must confirm the draft; no task is created, model downloaded, or camera started before confirmation.

Original text and unconfirmed drafts are not written to the app database or Supabase database and are excluded from app and Supabase application logs. OpenAI API requests set store=false. OpenAI may still retain customer content in abuse-monitoring logs under its data-control policy, by default for up to 30 days, unless the publisher's project has been approved for and enabled stricter retention controls.

After sign-in, we also process an email address, account identifier, device identifier, FCM push token, confirmed task summaries (which may include a text target), structured events, and delivery status to provide authentication, same-account device sync, and notifications explicitly enabled by the user. Cloud events do not contain photos, video, or audio. Event payloads are retained for 30 days from server receipt. Deleting the account removes the associated cloud account, device, task, event, receipt, and delivery records.

3. Permissions

• Camera: used for local visual analysis only after the user starts monitoring from a visible screen.
• Notifications: used for running status or event alerts only when the related setting is enabled.
• Internet: used to download signed model packages, provide signed-in natural-language configuration, and support optional account sync and push.

4. Service providers

We use Supabase for accounts, database services, natural-language request relay, and Realtime relay of ciphertext for client-side-encrypted temporary previews; the OpenAI Responses API to generate model-selection and configuration drafts from user text; Cloudflare R2 to distribute signed model packages; and Firebase Cloud Messaging for optional push notifications. The app does not give OpenAI tools, camera access, or device-control capability. These providers process data under their respective terms, data-processing agreements, and privacy notices.

5. Security and choices

Network requests use HTTPS. Account sessions are stored as encrypted ciphertext protected by Android Keystore and are excluded from system backup. Users may manually create reference-image or structured-reading monitors without signing in, reject any natural-language draft, turn local or remote-device notifications off independently, delete a task and its local material, and delete the cloud account from within the app.

6. Contact and changes

For privacy and support questions, contact SUPPORT_EMAIL. Report vulnerabilities, secrets, or user-data exposure through the private security-report channel, not a public issue. If this policy changes materially, we will update the effective date and provide any notice required in the app or store listing.