帮你盯

中文

本政策说明 PUBLISHER_NAME（“我们”）如何在帮你盯 Android 应用中处理数据。参考图片、结构化读数和有限类别文字找目标均以本地处理为默认且不要求账号；多设备同步需要用户登录。

1. 本地处理的数据

• 相机帧、临时选区、视觉中间结果和实时推理在设备内存中处理，不上传云端。
• 用户选择的参考照片保存在 App 私有目录，禁止系统备份；删除任务或卸载 App 时删除。
• 参考目标或类别目标每次出现时最多保存一张本机触发图。只有同账号用户在另一台在线手机主动查看时，来源手机才会发送一份不超过 720 px／120 KiB 的端侧加密临时副本；Supabase Realtime 只中继请求元数据和密文且不持久化，查看端副本只进入 App 私有临时缓存。
• 本机任务、事件时间线、设置和模型包保存在设备上。用户选择的类别会作为任务配置保存在本机；类别输入只匹配签名名称和别名，不调用云端模型。
• 手动创建三类监控均不要求创建账号。

2. 账号与可选云端同步

三类监控的配置和推理默认在设备本地完成。用户选择登录并开启同步后，我们会处理邮箱、账号标识、设备标识、FCM 推送 token、已确认的任务摘要（可包含类别目标）、结构化事件和送达状态，用于登录、同账号设备同步和用户主动开启的事件通知。云端事件不包含图片、视频或音频。Event payload 自服务端收到之时起保留 30 天；账号删除时删除关联的云端账号、设备、任务、事件和投递记录。

3. 权限

• Camera：仅在用户从可见页面主动开始监控后，用于本地视觉分析。
• Notifications：仅在用户开启对应开关后显示运行状态或事件提醒。
• Internet：用于签名模型包下载，以及用户选择的账号同步和推送。

4. 服务提供商

我们使用 Supabase 提供账号、数据库和端侧加密临时预览的 Realtime 密文中继，Cloudflare R2 分发签名模型包，Firebase Cloud Messaging 提供用户可选的推送。应用当前不调用云端模型，也不把类别输入、相机帧或设备控制交给第三方模型服务。上述提供商按各自条款、数据处理协议与隐私说明处理数据。

5. 安全与选择

网络请求使用 HTTPS；账号 session 以 Android Keystore 保护的加密密文存放且不进入系统备份。用户可以不登录而手动创建三类监控，可以分别关闭本机和其他设备事件通知，可以删除单条任务及其本地素材，也可以在 App 内删除云端账号。

6. 联系与变更

隐私与支持问题请联系 SUPPORT_EMAIL；涉及漏洞、密钥或用户数据的报告请使用私密安全报告入口，不要提交到公开 Issue。政策有实质变化时，我们会更新本页的生效日期，并按适用要求在 App 或商店页面提示。

删除账号 / Delete account

已登录用户可在 App 的“账号与其他手机”页面选择“删除云端账号”，并再次确认。无法访问 App 的用户可直接发送邮件至 SUPPORT_EMAIL，主题写明“Be Your Eye account deletion”，并使用注册邮箱发送请求。我们可能只要求完成必要的账号归属验证，不要求重新安装 App。

删除完成后，云端账号及其设备、任务摘要、结构化事件、回执和推送记录会删除。本机数据独立保存在设备上；如需一并删除，请在 App 内删除任务或卸载 App。

Signed-in users can choose “Delete cloud account” from “Account and other phones” in the app and confirm the action. If the app is unavailable, email SUPPORT_EMAIL from the registered address with the subject “Be Your Eye account deletion.” We may perform only the verification needed to confirm ownership; reinstalling the app is not required.

English

This policy explains how PUBLISHER_NAME (“we”) handles data in the Be Your Eye Android app. Reference-image, structured-reading, and finite-category text-target monitoring are on-device by default and do not require an account. Optional multi-device sync requires sign-in.

1. Data processed on the device

• Camera frames, temporary regions, intermediate visual results, and live inference are processed in device memory and are not uploaded.
• Reference photos selected by the user stay in private app storage, are excluded from system backup, and are removed when the task is deleted or the app is uninstalled.
• At most one local trigger image is saved for each reference-target or category-target appearance. Only when the same-account user requests it from another online phone does the source phone send a client-side-encrypted temporary copy of no more than 720 px / 120 KiB. Supabase Realtime relays only request metadata and ciphertext without persistence; the viewer copy enters only private temporary app cache.
• Local tasks, event timeline, settings, and model packages remain on the device. A selected category is saved as task configuration on the device; category input is matched only against signed names and aliases and is not sent to a cloud model.
• Manually creating any of the three monitor types does not require an account.

2. Account and optional cloud sync

All three monitor configurations and inference run on the device by default. If the user signs in and enables sync, we process an email address, account identifier, device identifier, FCM push token, confirmed task summaries (which may include a category target), structured events, and delivery status to provide authentication, same-account device sync, and notifications explicitly enabled by the user. Cloud events do not contain photos, video, or audio. Event payloads are retained for 30 days from server receipt. Deleting the account removes the associated cloud account, device, task, event, receipt, and delivery records.

3. Permissions

• Camera: used for local visual analysis only after the user starts monitoring from a visible screen.
• Notifications: used for running status or event alerts only when the related setting is enabled.
• Internet: used to download signed model packages and support optional account sync and push.

4. Service providers

We use Supabase for accounts, database services, and Realtime relay of ciphertext for client-side-encrypted temporary previews; Cloudflare R2 to distribute signed model packages; and Firebase Cloud Messaging for optional push notifications. The current app does not call a cloud model or provide third-party model services with category input, camera access, or device-control capability. These providers process data under their respective terms, data-processing agreements, and privacy notices.

5. Security and choices

Network requests use HTTPS. Account sessions are stored as encrypted ciphertext protected by Android Keystore and are excluded from system backup. Users may manually create any of the three monitor types without signing in, turn local or remote-device notifications off independently, delete a task and its local material, and delete the cloud account from within the app.

6. Contact and changes

For privacy and support questions, contact SUPPORT_EMAIL. Report vulnerabilities, secrets, or user-data exposure through the private security-report channel, not a public issue. If this policy changes materially, we will update the effective date and provide any notice required in the app or store listing.