转变的种子 · 隐私政策
生效日期：2026 年 9 月 17 日
一、一句话说完
你写下的东西存在你自己的手机里。这个应用没有账号、不用注册，也没有任何统计、埋点、广告标识或设备标识。
只有一处会联网：你主动用 AI 帮忙的时候。除此之外，你记的每一笔都不出这台设备。
二、我们存什么，存在哪
存在你的设备本地，我们看不到：
| 数据 | 内容 |
|---|---|
| 目标与计划 | 你设定的目标、方向、成果、卡点 |
| 六时书记录 | 你每天记下的事、正负方向、打算 |
| 人物 | 你为这个目标记下的人（姓名由你自己填） |
| 四力量 / 之约 / 瑜伽 / 感恩支票 / 冥想 | 各自的记录与时间 |
| 设置 | 提醒时刻、语言偏好 |
加密：你自己写的那些自述文字（记录正文、归因、四力量的自述）在落盘前先过一层本地可逆加密。另外两个原生端还各自套了系统级的一层：
- Android：
EncryptedSharedPreferences，主密钥 AES-256-GCM，存在系统密钥库里 - iOS：数据文件设
.completeFileProtection（锁屏后由系统加密保护） - 微信小程序：只有上面那层本地加密，没有系统级的第二层
⚠️ 诚实的能力边界：本地加密防的是同一台设备上的旁观与导出泄露，不是服务器级的强加密。别把它当成「任何人都拿不到」。
三、什么会离开这台设备
只有你主动用 AI 那几处（陪聊页、向导里的 AI 建议）。你不用它，这一节整节都不发生。
3.1 发出去的是什么
- 你为这一次对话打的字（以及向导里你写的目标句、成果）
- 一段固定的提示词与判据全文（我们这边的东西，与你无关）
- 一个随机标识：原生端是首次使用时生成的一串随机 UUID（⛔ 不是设备号、不是广告标识，重装即变）；微信小程序用的是微信给的 openid
3.2 人名会先换成代号 —— 但这不是匿名，也不是加密
出网前，我们会把两类人名换成 P1/P2 这样的代号：你在人物档案里填过的名字，以及「姓＋称谓」那种写法（如「王医生」「李老师」）。换回来在你自己的设备上完成，对照表不出网。
⚠️ 说清它做不到什么：没有称谓、档案里也没有的写法（比如「小林」）识别不出来，会原样发出去。所以：
- ⛔ 这不是「匿名化」——我们没有能力保证发出去的文本里不含可识别信息
- ⛔ 这不是「加密传输」——传输本身走 HTTPS/HTTP，与换名是两回事
- ✅ 它能做到的是：你档案里那些人的名字，绝大多数不会离开你的手机
你可以为自己的数据做决定，但你没有资格替别人做。这一层的存在就是为了这句话。即便如此，请不要在 AI 那几处写下别人不愿被写下的事。
3.3 云端留下什么
请求先到我们自己的服务（微信云开发云函数），再由它转给模型服务商。
| 集合 | 存什么 | 留多久 |
|---|---|---|
ai_calls | 随机标识、时间、动作名、token 计数、成功与否 —— 正文一个字都不存 | 用于配额（24 小时窗口）；注销时删除 |
ai_jobs | 那些要跑十几秒的请求，模型返回的结果暂存在这里 | 你的应用取走那一下即删；没人来取的最多 30 分钟后清掉 |
⚠️ 你发出去的正文从不写进数据库——它只在函数内存里经过一次，转给模型就没了。数据库里可能短暂存在的是模型给你的回答，取走即删。
模型服务商会按其自己的条款处理这段文本。
四、权限
| 权限 | 什么时候要 | 不给会怎样 |
|---|---|---|
| 网络 | 只有用 AI 那几处 | 其余功能全部照常，完全可离线使用 |
| 日历（写） | 你选择把六时书的六个提醒写进系统日历时 | 不写日历，改用应用内提醒 |
| 通知 | 到点提醒你回来记一笔 | 不推送，你自己想起来再打开 |
| 开机自启 / 精确闹钟（Android） | 重启后把已排的提醒恢复；让提醒准点 | 提醒可能不准或重启后丢失 |
⛔ 没有位置、通讯录、相机、麦克风、相册、电话，也不读取任何设备标识。
五、删除
设置页的「注销并清除全部数据」会物理删除，不是标记删除：
- 本机全部数据清空
- 云端那条用量记录与未取走的结果一并删除
- 已排的通知取消
⚠️ 日历里那几条要分平台说：
- Android / iOS：我们会连同记着事件 id 的那份本地数据一起把日历事件删掉
- 微信小程序：微信的接口只允许写入、不允许修改或删除（
wx.addPhoneRepeatCalendar）。所以如果你确实写进去过，注销前我们会如实提示一次，需要你自己去日历里删。而那些标题里可能带着你自己打的字。
卸载应用同样会带走本机的全部数据。云端那份不会自动删——请在卸载前先注销。
六、其他
- 不面向儿童。这是一套需要自我省察的方法，不是给儿童使用的产品。
- 不出售、不共享你的数据给任何第三方做广告或画像。除模型服务商（仅第三节那段文本）外，没有任何第三方接触你的数据。
- 没有第三方 SDK：没有统计、没有崩溃上报、没有广告、没有推送 SDK。
- 政策有实质变更时，会在应用内告知，并更新本页顶部的生效日期。
七、联系
有任何疑问或要求（包括要求删除数据），请通过 Google Play / App Store 商店页面上列出的开发者邮箱联系。
The Seeds of Transition — Privacy Policy
Effective date: 17 September 2026
1. In one sentence
What you write stays on your phone. There is no account and no sign-up, and there is no analytics, telemetry, advertising identifier, or device identifier of any kind.
Exactly one thing goes online: when you choose to use the AI help. Nothing else you record ever leaves the device.
2. What we store, and where
Stored locally on your device. We cannot see it:
| Data | Contents |
|---|---|
| Goal and plan | The goal you set, its area, the outcomes, the blockers |
| Six-slot records | What you write each day, its direction (＋/−), and intentions |
| People | The people you note for this goal (names are yours to type) |
| Four Powers / appointments / yoga / gratitude cheques / meditation | Each method's records and times |
| Settings | Reminder times, language preference |
Encryption: the free text you write yourself (record bodies, attributions, the Four Powers statements) passes through a local reversible encryption layer before it is written to disk. The two native apps add a system-level layer on top:
- Android:
EncryptedSharedPreferences, AES-256-GCM master key held in the Android Keystore - iOS: the data file is set to
.completeFileProtection(OS-encrypted while the device is locked) - WeChat Mini Program: only the local layer above; there is no second, system-level layer
⚠️ An honest limit: local encryption protects against someone looking at or exporting data from the same device. It is not server-grade encryption. Do not read it as "nobody can ever get at this".
3. What leaves the device
Only the parts where you choose to use AI (the chat page, and the AI suggestions in the goal-setting walkthrough). If you never use them, none of this section happens.
3.1 What is sent
- The text you typed for that exchange (and, in the walkthrough, your goal sentence and outcomes)
- A fixed prompt and reference text of ours — nothing to do with you
- A random identifier: on the native apps, a random UUID generated the first time you use the feature (⛔ not a device ID, not an advertising ID; it changes on reinstall). The WeChat Mini Program uses the openid WeChat provides.
3.2 Names are replaced with codes — but this is not anonymisation, and not encryption
Before anything is sent, two kinds of names are replaced with codes such as P1/P2: names you entered in your people list, and surname-plus-title forms (e.g. "Dr Wang", "Professor Li"). The mapping back happens on your own device, and the mapping table is never sent.
⚠️ What it cannot do: a name with no title that is also absent from your list (say, a nickname) is not recognised and goes out as you typed it. Therefore:
- ⛔ This is not anonymisation — we cannot guarantee the sent text contains no identifying information
- ⛔ This is not encrypted transport — transport security is a separate matter from name replacement
- ✅ What it does achieve: the names of the people in your list mostly never leave your phone
You may decide about your own data; you are not entitled to decide for other people.That is the whole reason this layer exists. Even so, please do not write down, in the AI parts, things other people would not want written down.
3.3 What the server keeps
Requests go first to our own service (a WeChat CloudBase function), which forwards them to the model provider.
| Collection | Contents | Retention |
|---|---|---|
ai_calls | Random identifier, timestamp, action name, token counts, success flag — not one character of your text | Used for rate limiting (24-hour window); deleted when you delete your account |
ai_jobs | For requests that take tens of seconds, the model's reply is held here | Deleted the moment your app collects it; anything uncollected is purged after 30 minutes |
⚠️ The text you send is never written to the database. It passes through function memory once and is forwarded to the model. What may exist briefly in the database is the model's answer to you, deleted on collection.
The model provider processes that text under its own terms.
4. Permissions
| Permission | When it is needed | If you decline |
|---|---|---|
| Network | Only for the AI parts | Everything else works; the app is fully usable offline |
| Calendar (write) | Only if you choose to put the six daily reminders into your system calendar | No calendar entries; in-app reminders instead |
| Notifications | To remind you to come back and record | No push; you open the app when you remember |
| Boot completed / exact alarm (Android) | Restore scheduled reminders after a restart; keep them on time | Reminders may drift or be lost after a restart |
⛔ No location, contacts, camera, microphone, photos, or phone. No device identifiers are read.
5. Deletion
"Delete account and erase all data" in Settings performs a physical delete, not a flag:
- All on-device data is erased
- The server-side usage records and any uncollected results are deleted
- Scheduled notifications are cancelled
⚠️ Calendar entries differ by platform:
- Android / iOS: we delete the calendar events, along with the local record of their event IDs
- WeChat Mini Program: WeChat's API only allows writing — not editing or deleting(
wx.addPhoneRepeatCalendar). So if entries were actually written, we tell you plainly before you delete, and you need to remove them from your calendar yourself. Their titles may contain text you typed.
Uninstalling also removes all on-device data. The server-side records are not removed automatically — please delete your account before uninstalling.
6. Other
- Not directed at children. This is a self-examination practice, not a product for children.
- We do not sell or share your data with any third party for advertising or profiling. Apart from the model provider (and only the text described in section 3), no third party touches your data.
- No third-party SDKs: no analytics, no crash reporting, no ads, no push SDK.
- If this policy changes materially, we will say so in the app and update the effective date above.
7. Contact
For any question or request — including a request to delete data — please use the developer email listed on the Google Play / App Store listing.