隱私政策
更新日期：2026 年 10 月 11 日
我們只為登入、提問、保存記錄、付款，以及你主動開啟的「書的記憶」與「回訪」而處理你的資料。下面說明保存什麼、交給誰、保存多久，以及你能怎麼做。
我們保存什麼
- 帳號資料：已驗證的電子郵件、登入方式、密碼的加鹽雜湊；不保存明文密碼或驗證碼。
- 安全資料：會話權杖的雜湊、IP 與瀏覽器標識的雜湊、驗證碼嘗試次數與短期頻率限制。
- 問答記錄：辨認後的問題、回答、符象與時間，自動保留最近 100 條；不包含手寫原圖與錄音。
- 辨認後的文字（暫存）：提問前，書會先把你寫的或說的內容辨認成文字；這段文字只暫存很短的時間：提問用完即刪；沒有用到的，會在到期後、最遲於每日的清理中刪除。
- 設定：時區、書向你說明自己的進度、你對記憶、回訪與靜默時段的選擇，以及你同意的記錄與你聲明已年滿十八歲的記錄。
- 書的記憶（只在你開啟之後）：從你自己寫下的話裡記下的簡短筆記與「進行中的事」。你可以隨時查看、修改、刪除、匯出。書也會留一行你問過什麼事的簡記（最多保留 60 條），讓它記得你問過。性與取向、政治、出身、官司、帳號與證件，以及你身處危機時說的話，一律不記。若你另外答應「更私密的事」（身體與心情、身邊的人與感情、金錢的壓力、信仰），書才會記下這些，它們單獨標示，你可以隨時關掉、逐條刪除；關掉後書不再使用。關於「進行中的事」的筆記約半年後會自行失效；書回頭問過什麼的紀錄保留 90 天；書問過「要不要記住你說過的話」的紀錄（問過幾次、你怎麼答）會一直保留，以免重複打擾你。
- 推送訂閱（只在你開啟之後）：瀏覽器提供的推送訂閱資料，用於傳送不含內容的提醒。
- 交易資料：Stripe 的結帳會話、訂閱標識、支付狀態、金額、帳期、退款或爭議狀態。完整卡號與支付憑證由 Stripe 處理，本站不保存。
- 本機偏好：靜音、音量、語言、主題，以及付款跳轉前暫存的筆跡，只保存在你的瀏覽器裡。
手寫、錄音與文字怎麼處理
- 手寫：提問時，筆跡會被轉成一張圖片，只在這一次提問中傳給模型服務辨認；我們不保存這張圖片。
- 語音：錄音只在你主動開始錄音後傳到我們的伺服器，經 Cloudflare 的語音轉文字服務轉成文字後即丟棄；我們不保存錄音。
- 鍵盤：你打的字直接使用。
服務提供方與資料去向
本站運行在 Cloudflare 上（網站託管、資料庫與語音轉文字）。回答由階躍星辰（StepFun）的語言模型生成：你的問題文字、手寫時的筆跡圖片，以及在你開啟記憶時書的記憶筆記，會在生成回答時傳給它。在你開啟記憶時，書每回答一次，還會把你的問題、書的回答（只取前段）與已有的筆記再交給同一個模型一次，讓它整理新的筆記。驗證碼郵件由 Resend 寄出，付款由 Stripe 完成，人機驗證由 Cloudflare Turnstile 完成。Google 登入與手機簡訊登入目前未啟用。這些服務會在完成各自功能所必需的範圍內接收資料，並可能在你所在地之外處理；它們各自如何保存資料，以其條款與政策為準。如果你開啟通知，提醒會經由你瀏覽器廠商的推送服務（Google、Apple、Mozilla 或 Microsoft）送達：訊息經過加密、不含內容，但該服務知道你的瀏覽器在什麼時間收到了一則訊息。
日誌
網站的執行環境會記錄請求的時間、路徑與結果碼等中繼資料。我們不把你的問題、書的回答、記憶或錄音寫進日誌。
保存與刪除
驗證碼短期失效，會話可登出撤銷。你可以刪除單條或全部問答；刪除問答不會刪除書的記憶，記憶在「書的記憶」頁另外管理，可逐條刪除、匯出或全部清空。你可以注銷帳號：身分、會話、問答、記憶、回訪與推送訂閱都會被刪除；支付記錄因財務與反詐騙稽核而去識別後保留，並按適用法律的要求保存。Cloudflare 的資料庫有還原功能，過往的狀態可能在其保留期內仍然存在。
你的選擇
你可以不建立帳號，只體驗書寫；提交問題需要登入。記憶、回訪與推送預設關閉，你可以隨時開啟或關閉。你也可以關閉音樂、刪除問答、登出或注銷帳號。如需查詢、更正或行使其他法定權利，請來信：（聯絡信箱待補）。
年齡
本服務供年滿 18 歲的人使用。開啟記憶與回訪時，會再請你自己確認已年滿 18 歲，並記下你確認的時間。
政策的變更
政策有變更時，我們會更新上方的日期。
隐私政策
更新日期：2026 年 10 月 11 日
我们只为登录、提问、保存记录、付款，以及你主动开启的「书的记忆」与「回访」而处理你的数据。下面说明保存什么、交给谁、保存多久，以及你能怎么做。
我们保存什么
- 账号数据：已验证的邮箱、登录方式、密码的加盐哈希；不保存明文密码或验证码。
- 安全数据：会话令牌的哈希、IP 与浏览器标识的哈希、验证码尝试次数与短期频率限制。
- 问答记录：辨认后的问题、回答、符象与时间，自动保留最近 100 条；不包含手写原图与录音。
- 辨认后的文字（暂存）：提问前，书会先把你写的或说的内容辨认成文字；这段文字只暂存很短的时间：提问用完即删；没有用到的，会在到期后、最迟于每日的清理中删除。
- 设置：时区、书向你说明自己的进度、你对记忆、回访与静默时段的选择，以及你同意的记录与你声明已年满十八岁的记录。
- 书的记忆（只在你开启之后）：从你自己写下的话里记下的简短笔记与「进行中的事」。你可以随时查看、修改、删除、导出。书也会留一行你问过什么事的简记（最多保留 60 条），让它记得你问过。性与取向、政治、出身、官司、账号与证件，以及你身处危机时说的话，一律不记。若你另外答应「更私密的事」（身体与心情、身边的人与感情、金钱的压力、信仰），书才会记下这些，它们单独标示，你可以随时关掉、逐条删除；关掉后书不再使用。关于「进行中的事」的笔记约半年后会自行失效；书回头问过什么的纪录保留 90 天；书问过「要不要记住你说过的话」的纪录（问过几次、你怎么答）会一直保留，以免重复打扰你。
- 推送订阅（只在你开启之后）：浏览器提供的推送订阅数据，用于发送不含内容的提醒。
- 交易数据：Stripe 的结账会话、订阅标识、支付状态、金额、账期、退款或争议状态。完整卡号与支付凭证由 Stripe 处理，本站不保存。
- 本机偏好：静音、音量、语言、主题，以及付款跳转前暂存的笔迹，只保存在你的浏览器里。
手写、录音与文字怎么处理
- 手写：提问时，笔迹会被转成一张图片，只在这一次提问中传给模型服务辨认；我们不保存这张图片。
- 语音：录音只在你主动开始录音后传到我们的服务器，经 Cloudflare 的语音转文字服务转成文字后即丢弃；我们不保存录音。
- 键盘：你打的字直接使用。
服务提供方与数据去向
本站运行在 Cloudflare 上（网站托管、数据库与语音转文字）。回答由阶跃星辰（StepFun）的语言模型生成：你的问题文字、手写时的笔迹图片，以及在你开启记忆时书的记忆笔记，会在生成回答时传给它。在你开启记忆时，书每回答一次，还会把你的问题、书的回答（只取前段）与已有的笔记再交给同一个模型一次，让它整理新的笔记。验证码邮件由 Resend 寄出，付款由 Stripe 完成，人机验证由 Cloudflare Turnstile 完成。Google 登录与手机短信登录目前未启用。这些服务会在完成各自功能所必需的范围内接收数据，并可能在你所在地之外处理；它们各自如何保存数据，以其条款与政策为准。如果你开启通知，提醒会经由你浏览器厂商的推送服务（Google、Apple、Mozilla 或 Microsoft）送达：讯息经过加密、不含内容，但该服务知道你的浏览器在什么时间收到了一则讯息。
日志
网站的执行环境会记录请求的时间、路径与结果码等元数据。我们不把你的问题、书的回答、记忆或录音写进日志。
保存与删除
验证码短期失效，会话可退出撤销。你可以删除单条或全部问答；删除问答不会删除书的记忆，记忆在「书的记忆」页另外管理，可逐条删除、导出或全部清空。你可以注销账号：身份、会话、问答、记忆、回访与推送订阅都会被删除；支付记录因财务与反欺诈审计而去标识后保留，并按适用法律的要求保存。Cloudflare 的数据库有还原功能，过往的状态可能在其保留期内仍然存在。
你的选择
你可以不建立账号，只体验书写；提交问题需要登录。记忆、回访与推送默认关闭，你可以随时开启或关闭。你也可以关闭音乐、删除问答、退出或注销账号。如需查询、更正或行使其他法定权利，请来信：（联系邮箱待补）。
年龄
本服务供年满 18 岁的人使用。开启记忆与回访时，会再请你自己确认已年满 18 岁，并记下你确认的时间。
政策的变更
政策有变更时，我们会更新上方的日期。
Privacy Policy
Updated 11 October 2026
We handle your data only to sign you in, answer your questions, keep your records, take payment, and run “the book’s memory” and “revisits” if you switch them on. Below is what we keep, who gets it, for how long, and what you can do.
What we keep
- Account data: your verified email, how you sign in, and a salted hash of your password. We keep no plain-text password or code.
- Security data: hashes of session tokens, hashes of your IP address and browser identifier, code-attempt counts and short-lived rate limits.
- Question records: the recognised question, the answer, the sigils and the time, automatically limited to the latest 100. Handwritten pictures and recordings are not part of it.
- Recognised text (temporary): before answering, the book turns what you wrote or said into text. That text is held only briefly: it is deleted once the question has been answered, and any that goes unused is removed after it expires and, at the latest, in the daily clean-up.
- Settings: your time zone, how far the book has told you about itself, your choices about memory, revisits and quiet hours, and the record of your consent and of your declaration that you are eighteen or older.
- The book’s memory (only after you switch it on): short notes and “things in progress” drawn from what you wrote yourself. You can see, edit, delete and export them at any time. The book also keeps one line about what you asked (at most 60), so that it remembers you asked. Sex and orientation, politics, origin, legal trouble, accounts and papers, and what you say while in crisis are never kept. Only if you agree separately to “the more private things” (body and mood, the people close to you and love, money worries, belief) does the book keep those; they are marked apart, and you can turn them off at any time or delete them one by one; once off, the book no longer uses them. Notes about “things in progress” lapse on their own after about six months; the record of what the book came back to ask about is kept for 90 days; the record that it asked whether it may remember what you tell it (how often, and what you answered) is kept, so that you are not asked again and again.
- Push subscription (only after you switch it on): the subscription data your browser provides, used to send reminders that carry no content.
- Payment data: Stripe checkout sessions, subscription identifiers, payment status, amounts, billing periods, refund or dispute status. Full card numbers and payment credentials are handled by Stripe and are not kept here.
- On your device: mute, volume, language, theme, and handwriting held briefly across a payment redirect. These stay in your browser.
How handwriting, recordings and text are handled
- Handwriting: when you ask, your strokes are turned into a picture that is sent to the model service for this one question to be read; we do not keep the picture.
- Voice: a recording is sent to our server only after you start recording, is turned into text by Cloudflare’s speech-to-text service, and is then discarded; we do not keep recordings.
- Keyboard: what you type is used as it is.
Service providers and where data goes
This site runs on Cloudflare (hosting, the database and speech-to-text). Answers are generated by a StepFun language model: your question text, the picture of your handwriting when you write by hand, and the book’s memory notes when you have switched memory on are sent to it when an answer is generated. When memory is on, after each answer the book also sends your question, the start of the answer and your existing notes to the same model once more, to write new notes. Verification emails are sent by Resend, payments are taken by Stripe, and bot checks are run by Cloudflare Turnstile. Sign-in with Google and by mobile text message is not currently enabled. These providers receive data only as far as their function needs, and may process it outside where you live; how each keeps data is governed by its own terms and policies. If you switch on notifications, the reminder is delivered through the push service of your browser’s maker (Google, Apple, Mozilla or Microsoft): the message is encrypted and carries no content, but that service knows your browser received a message and when.
Logs
The site’s runtime records request metadata such as time, path and result code. We do not write your questions, the book’s answers, memory or recordings into logs.
Keeping and deleting
Codes expire quickly and sessions can be ended by signing out. You can delete single or all question records; deleting question records does not delete the book’s memory, which is managed separately on the “book’s memory” page, where you can delete items one by one, export them, or clear them all. You can delete your account: your identity, sessions, question records, memory, revisits and push subscription are removed; payment records are kept in de-identified form for financial and anti-fraud audit and as applicable law requires. Cloudflare’s database has a restore feature, so earlier states may still exist within its retention period.
Your choices
You can use the writing page without an account; asking a question needs you to sign in. Memory, revisits and push are off by default and you can switch them on or off at any time. You can also turn off the music, delete question records, sign out or delete your account. To ask about, correct, or exercise other legal rights over your data, write to: (contact email to be added).
Age
The service is for people aged 18 or over. When you switch on memory and revisits you are asked to confirm, yourself, that you are 18 or over, and the time you confirmed is recorded.
Changes to this policy
If this policy changes we will update the date above.