隐私政策
本政策说明 Coode iOS 应用、账号服务与远程连接服务如何处理数据。Coode 开发者负责这些服务；隐私联系邮箱为 loki_st@163.com。
账号与个人资料
使用 Coode 需要通过邮箱验证码登录。未注册邮箱在验证成功并同意协议后自动创建账号；首次使用会随机分配昵称、用户 ID 和默认头像，可稍后修改。我们保存邮箱、账号标识、用户名、昵称、账号创建时间和你自愿选择的头像，用于身份验证、个人资料展示及账号恢复。昵称、头像和符合格式且未被占用的用户 ID 可以修改；内部账号标识保持不变。更换绑定邮箱需要先验证当前邮箱，再验证新邮箱；换绑过程会临时保存这两个邮箱、账号及设备标识、验证码摘要和有效期，相关请求最长 20 分钟有效。更换邮箱不会创建新账号，也不会重新发放赠送期。头像上传前会缩小并重新编码。验证码通过腾讯云邮件推送发送，10 分钟有效；服务器保存验证码的加密摘要，不以明文持久保存验证码。登录会话最长有效 30 天，服务器仅保存会话凭据摘要。
设备、授权与安全记录
我们保存登录设备名称、设备标识、公钥、创建及最近登录时间，以及电脑名称、连接标识、公钥和设备授权关系，用于配对、撤销权限及在同一账号下恢复连接。为核验正版应用和防止滥用，服务还处理 Apple App Attest 验证信息、请求计数、每日中继流量统计，以及邮箱和 IP 的摘要形式限流记录。网络服务需要处理连接的 IP 地址和必要运行日志；这些数据用于服务运行与安全，不用于广告跟踪。
远程连接与加密
手机和已授权电脑之间的远程消息使用端到端加密，中继转发加密内容，不取得消息解密密钥。为完成转发，中继在内存中临时处理请求、加密载荷和连接状态；请求完成、超时或断开后会清理对应临时状态。配对请求有有效期，账号、设备及授权记录则会持续保存以支持后续连接。端到端加密不涵盖我们为登录、个人资料和交易核验而保存的服务数据，也不改变电脑上 Agent 及其模型服务商的数据处理方式。
聊天、附件、API Key 与模型服务商
手机上的聊天、附件及模型 API Key 不上传到 Coode 账号服务器，也不会因登录账号而自动同步到其他手机。API Key 保存在设备系统钥匙串中。当你发送模型请求时，相关聊天上下文、所选附件、图片或原始音频，以及请求所需的认证信息，会发送到你配置的模型服务商或 API 地址。远程 Agent 的模型调用由电脑上的 Agent 和所选服务商处理。服务商可能位于其他国家或地区，其保留、训练使用及删除规则由其政策和你与其约定决定；请在配置和发送内容前查看相应政策。
发送前的模型授权
首次向云端模型发送前，Coode 显示所选服务商及 API 接收地址，并说明会发送聊天上下文、你选择的附件或音频，以及启用的个性化指令。只有你点击同意才会发送；取消会保留草稿而不发送。新版可在「设置 → 数据与存储 → AI 数据授权」中撤销；较早测试版本可在对话右上角菜单选择「撤销 AI 数据授权」。撤销会停止该服务当前的回复，后续发送会再次询问，不会收回已发送的内容。修改接收地址或认证配置后需要重新同意。Apple 本机模型在支持的设备上处理内容，不发送给云端模型。Free 根据 AI Horde 的实时目录筛选模型，请求由第三方志愿计算节点处理，节点会接收请求内容；模型数量和可用性会变化，请勿发送敏感或私密资料。手机端授权不会代替电脑 Agent 自身的服务商授权与工具审批。
个性化与任务完成通知
个性化设置保存在本机；启用后，相关偏好和自定义指令会随手机端模型请求发送给你选择的服务商。Coode 不提供自动汇总全部 API 与 Agent 对话的统一记忆。任务完成通知需经你开启并授予系统权限，通知只包含完成状态，不包含聊天正文。通知偏好按账号保存在本机；你主动导入的提示音转换后保存在本机，不上传到 Coode 账号服务器。当前通知由 App 收到完成结果后在本机生成，没有远程推送服务；App 被关闭或被系统暂停时无法实时收到远程任务完成通知。你可关闭通知或移除自定义提示音。
麦克风、语音识别与所选照片
只有你启用录音或听写时，应用才请求麦克风或语音识别权限。系统语音识别在设备支持时使用设备端识别；不支持时可能由 Apple 服务处理音频。录音临时文件在处理或取消后清理；若你将录音添加到消息，音频会成为该本地对话的一部分，并在发送时交给所选模型服务。选择头像或附件时，应用读取你主动选择的文件或照片。你可在 iOS 设置中撤销这些权限，仍可使用键盘输入。
购买与会员
付费交易由 Apple 处理。我们保存交易标识、原始交易标识、关联账号、商品标识、有效期、验证时间及撤销或退款状态，用于提供会员、恢复购买及核验退款；我们不接收银行卡信息。新账号的赠送期按邮箱领取一次；更换邮箱后，原邮箱及新邮箱均记录为已领取。为防止注销后重复领取，我们保存由邮箱计算的带密钥哈希校验标记；该标记不直接保存邮箱明文，也不应理解为所有关联风险都已消除。
服务商、存储与披露
Coode 账号资料和连接记录存储在中国境内的腾讯云服务器；腾讯云提供基础设施与验证码邮件投递，Apple 提供购买、应用验证和系统语音识别等相关能力。邮箱服务商会处理发送给你的验证码邮件。我们仅为上述功能、你发起的支持请求、维护安全和履行适用法定义务而处理或披露必要数据。Coode 不出售个人信息，不用这些数据进行跨应用广告跟踪。本支持网站没有广告、分析脚本或账号登录表单；网站托管服务会为交付网页处理必要的网络请求信息。
保存期限与账号注销
账号资料和有效连接记录为提供服务而保存。你可从侧栏头像与昵称打开设置，再点顶部个人资料进入“编辑资料”，修改资料或进入“注销账号”，取得邮箱注销验证码并确认永久注销。若显示会员页面，也可通过“账号资料与注销”进入。注销会删除在线账号、头像、个人资料及云端连接记录，并撤销关联手机的远程访问；执行注销的手机会清理该账号的本地资料。电脑上的 Agent、项目和文件不会被删除。其他设备上的本地文件、系统备份和第三方服务保存的内容需要在对应位置处理。
注销后的保留与你的选择
防重复领取的哈希标记及必要交易核验记录不会随账号注销自动删除，以支持防滥用、购买与退款核验等必要目的；应用安全验证记录和已有运维备份也可能保留。历史备份不会因在线注销立即逐份重写。我们不承诺一个尚未实现的统一自动删除期限。如需访问、更正、导出或删除相关资料，或了解、清理历史备份及这些例外记录，请联系 loki_st@163.com；我们会核验身份并按适用义务与实际保留目的处理请求。请勿在邮件中提供验证码、密码或 API Key。注销账号不会取消 Apple 自动续费订阅，请另行在 Apple 订阅设置中取消。
未成年人和政策更新
Coode 面向需要使用模型服务或远程 Agent 的用户，并非儿童专用应用。未成年人应在监护人指导下使用，并满足所选第三方服务的使用条件。如监护人认为存在不当收集，可通过支持邮箱联系我们。数据处理发生重要变化时，我们会更新本页，并在需要时通过应用提示或取得相应同意；本页显示最近更新日期。
Privacy Policy
This policy covers the Coode iOS app, account service and remote connection service. The Coode developer is responsible for these services. Contact: loki_st@163.com.
Accounts and profile
An email verification code is required to sign in. An unregistered email creates an account after successful verification and agreement to the terms. A random nickname, user ID and default avatar are assigned and may be changed later. We store your email, account ID, username, nickname, account creation time and optional avatar for authentication, profile display and account recovery. You may change your nickname, avatar and a valid, available user ID; the internal account ID stays the same. Changing the bound email requires verification of the current and new addresses. The change request temporarily stores both addresses, account and device identifiers, code digests and expiry, for up to 20 minutes. Changing email does not create a new account or renew introductory access. Avatars are resized and re-encoded before upload. Tencent Cloud delivers verification emails. Codes expire after 10 minutes and are persisted as keyed digests, not plaintext. Sessions last up to 30 days; the server stores token digests.
Devices and security
We store device names and IDs, public keys, creation and last-login times, computer names, connection IDs and authorization relationships for pairing, revocation and account-based connection recovery. We also process Apple App Attest verification information, request counts, daily relay traffic totals and hashed email/IP rate-limit records. Network services process IP addresses and necessary operational logs for operation and security, not advertising tracking.
Encrypted relay
Remote messages between the phone and an authorized computer are end-to-end encrypted; the relay forwards encrypted content without obtaining message decryption keys. Requests, encrypted payloads and connection state are processed temporarily in memory, with associated state removed on completion, timeout or disconnection. Pairing requests expire, while account and authorization records persist to support later connections. This encryption does not cover account, profile or billing records, or change how your computer's Agent and model providers handle data.
Local content and third-party providers
Local chats, attachments and model API keys are not uploaded to the Coode account server or automatically restored on another phone. API keys are stored in the device keychain. Sending a model request sends relevant conversation context, selected attachments, images or original audio, and required authentication information to your configured provider or API endpoint. Free selects models from AI Horde’s live catalog; third-party volunteer workers receive and process request content. Model counts and availability vary. Do not send sensitive or private data to these public models. Remote Agent requests are handled by the Agent on your computer and its providers. These providers may operate in other countries; their retention, training and deletion practices depend on their policies and your agreements with them.
Personalization and completion notifications
Personalization preferences are stored on your device. When enabled, relevant preferences and custom instructions are sent with mobile model requests to your selected provider. Coode does not automatically aggregate all API and Agent conversations into a shared memory. Completion notifications require your choice and system permission and contain completion status, not chat text. Notification preferences are stored per account on the device. Audio you explicitly import for a sound is converted and stored locally, not uploaded to the Coode account server. Notifications are generated locally after the app receives completion results; there is no remote push service, so real-time remote completion notifications are unavailable while the app is closed or suspended. You can disable notifications or remove the custom sound.
Voice and selected media
Microphone and speech-recognition permissions are requested when you use recording or dictation. System speech recognition runs on-device when supported and may otherwise send audio to Apple. Temporary recording files are cleared after processing or cancellation. Audio added to a message remains part of the local conversation and is sent to the selected model service when you send it. The app reads photos or files you explicitly select. You may revoke permissions in iOS Settings and continue using keyboard input.
Purchases and service providers
Apple processes payments. We store transaction and original transaction IDs, the associated account, product, validity, verification time and revocation/refund status to manage access, restore purchases and verify refunds. We do not receive payment-card details. A keyed hash derived from each email records whether the one-time introductory period was claimed, including both old and new addresses after an email change; it does not directly store the email, but is not a guarantee of complete anonymity. Account and connection records are stored on Tencent Cloud servers in mainland China. Tencent Cloud provides infrastructure and email delivery; Apple provides payment, app verification and relevant speech services. Your email provider handles delivered messages. We disclose necessary data for these functions, your support requests, security or applicable legal obligations. We do not sell personal information or use it for cross-app advertising tracking. This static support site has no advertising, analytics scripts or account sign-in forms; hosting providers process network information needed to deliver pages.
Retention, deletion and requests
Account and active connection records are retained to provide the service. Open Settings from the sidebar avatar/nickname, then open the profile editor at the top to edit your profile or choose Delete Account, verify your email and confirm deletion. The membership screen also provides an Account profile and deletion link. This removes the online account, avatar, profile and cloud connection records, revokes associated phones' remote access, and clears this account's local data on the phone performing deletion. It does not delete Agents, projects or files on your computer, local files on other devices, system backups or third-party copies. The anti-abuse claim hash, necessary transaction verification records, app-security verification records and existing operational backups may remain. Online deletion does not immediately rewrite every historical backup; we do not promise an automatic retention schedule that is not implemented. To request access, correction, export or deletion, or to discuss retained records and backups, email loki_st@163.com. We verify identity and handle requests according to applicable obligations and the actual retention purpose. Never email verification codes, passwords or API keys. Account deletion does not cancel an Apple subscription; cancel it separately in Apple subscription settings.
Children and updates
Coode is not designed specifically for children. Minors should use it with guardian guidance and meet their selected providers' eligibility requirements. Guardians may contact us about inappropriate collection. We will update this page when practices change and provide an app notice or obtain consent when required. The latest update date is shown above.
In newer versions, manage or withdraw AI service permission in Settings → Data & Storage → AI Data Permissions. Earlier test builds offer withdrawal in the conversation’s top-right menu. Withdrawal stops current responses and requires permission before the next send; it cannot recall content already sent.