隐私政策
Privacy Policy

1. 适用范围与责任主体 / Scope and Data Controller

本政策说明 PaperPhoneLite 客户端和服务端软件如何处理数据。PaperPhoneLite 是可自托管的开源项目。

This Policy explains how the PaperPhoneLite client and server software process data. PaperPhoneLite is self-hostable open-source software.

2. 我们处理的信息 / Information Processed

账号与关系数据

用户名、昵称、密码哈希、头像、两步验证状态、好友关系、备注、标签、拉黑关系、群组、成员和邀请信息。注册不强制要求手机号或电子邮箱。

通信和路由元数据

发送方和接收方或群组标识、消息标识、类型、时间、投递/已读状态、客户端序号、自动删除设置、密钥版本，以及 WebSocket、同步和防重复投递所需信息。项目没有朋友圈、时间线、公开帖子或举报审核数据。

设备与会话数据

设备名称和类型、操作系统、客户端或浏览器标识、会话标识、登录和最后活动时间、刷新令牌哈希，以及服务器可见的连接信息。Tor 降低来源 IP 暴露，但其他可关联元数据仍可能产生。

3. 消息加密与限制 / Message Encryption and Limits

当前共享源码的私聊使用 X25519、XSalsa20-Poly1305 与 Ed25519 消息签名；新群消息强制使用签名与 Sender Key 加密。身份私钥和 Sender Key 保留在本地，原生客户端使用系统安全存储。双方须在线下约定文本外观密码并完成双向身份验证，安全号码仍应通过可信线下渠道核对；身份密钥变化会撤销信任。当前签名路径不宣称 ML-KEM 后量子保护。

加密不隐藏账号关系、群成员、时间、消息类型或路由等必要元数据。服务器保存上传的附件文件；文件本身不因消息签名而获得端到端加密。签名也不能保护已被控制的设备或收件人保存的副本。额外密码只在线下交流，不上传或自动同步。

Current shared source uses X25519, XSalsa20-Poly1305 and Ed25519 signatures for private messages. New group messages require signatures and Sender Key encryption. Private keys and Sender Keys remain local, with operating-system secure storage in native clients. Participants must agree on a text-appearance password offline and complete mutual identity verification, and independently compare safety numbers through a trusted offline channel. Identity-key changes revoke trust. The current signed protocol makes no claim of ML-KEM post-quantum protection.

Encryption does not hide necessary account, membership, time, type or routing metadata. Uploaded attachment files are stored on the server and are not end-to-end encrypted by message signatures. Signatures cannot protect compromised devices or recipient-saved copies. Share the extra password only offline; it is not uploaded or automatically synchronized.

4. 文件与数据存储 / Files and Data Storage

上传的图片、视频、语音和文档保存在所选服务器的持久卷中，由 Rust 服务端传输，单文件上限 500MB；本项目不使用 Cloudflare R2。用户及群头像永久保存；聊天附件按服务端配置清理，默认保留 14 天，升级时自动迁移旧文件。附件保留与消息自动删除分别配置。客户端通过 localStorage 和 IndexedDB 保存登录状态、设置、本地密钥、联系人、群组、消息与媒体缓存。服务器运营者负责存储位置、备份、访问控制和保留期限。

Uploads remain on the selected server’s persistent volume and are transferred by the Rust server, with a 500MB per-file limit; Cloudflare R2 is not used. User and group avatars are permanent; chat attachments expire under server configuration, after 14 days by default, with legacy-file migration on upgrade. Attachment retention and message expiry are configured separately. The client stores state, settings, local keys, contacts, groups, messages, and media cache locally. The server operator controls storage, backups, access, and retention.

5. Tor 网络 / Tor Network

生产客户端必须内嵌 Tor，等待 bootstrap 完成，并仅通过隔离代理连接 v3 .onion 服务，不允许明网回退。Tor 旨在隐藏来源 IP 和服务器公开 IP，但不能保证绝对匿名，也不能消除设备指纹、账号行为、通知服务或用户主动披露造成的关联。

Production clients must embed Tor, wait for bootstrap, and connect only to a v3 .onion service through an isolated proxy with no clearnet fallback. Tor is intended to conceal source and public server IP addresses but cannot guarantee absolute anonymity or eliminate all forms of linkage.

6. 通知服务与第三方 / Notifications and Third Parties

Android 可使用 ntfy：服务器向运营者配置的 ntfy 实例发送主题、通知标题和正文。iOS 用户可提供 Bark 地址；默认仅允许 api.day.app，自建主机需由运营者通过 BARK_ALLOWED_HOSTS 放行；服务器只发送发件人名称和通用的新消息提示，不发送消息正文，Bark App 最终通过 Apple APNs 显示提醒。PaperPhoneLite 自身不注册 APNs token，也不使用 Web Push、FCM、Firebase 或 OneSignal。通知可能显示在锁屏上。

Android may use ntfy, to which the server sends a topic, notification title, and body. iOS users may provide a Bark endpoint; api.day.app is allowed by default and self-hosted hosts require operator configuration via BARK_ALLOWED_HOSTS; only the sender name and a generic new-message alert—not message content—are sent, and Bark ultimately displays the alert through Apple APNs. PaperPhoneLite itself registers no APNs token and uses no Web Push, FCM, Firebase, or OneSignal.

7. 使用目的与信息披露 / Purposes and Disclosure

数据仅用于创建和保护账号、连接联系人和群组、路由与同步消息、传输文件、提供已启用的通知、检测滥用、排查故障及履行法律义务。项目不出售个人信息，不提供广告或跨应用追踪。服务器运营者、ntfy 或 Bark 服务运营者、基础设施供应商或依法提出要求的机构，可能在各自角色和法律范围内接触相关数据。

Data is used to secure accounts, connect contacts and groups, route and synchronize messages, transfer files, provide enabled notifications, detect abuse, troubleshoot, and comply with law. The project does not sell personal information or provide advertising or cross-app tracking. Relevant operators, providers, or legally authorized authorities may access data within their roles and applicable law.

8. 保留、删除与您的选择 / Retention, Deletion, and Your Choices

消息可永久保留，或在 1、3、7、30 天后自动删除。您可以清理本地缓存、撤销设备会话、拉黑用户或请求删除账号。账号删除会触发服务器数据库中关联记录的删除，但离线设备、接收方副本、ntfy/Bark 记录与服务器备份可能按各自周期继续存在。相关法定权利请求应联系所选服务器运营者。

Messages may remain indefinitely or expire after 1, 3, 7, or 30 days. You may clear local cache, revoke sessions, block users, or request account deletion. Offline devices, recipient copies, notification-service records, and backups may persist according to their own cycles. Direct legal-rights requests to the selected server operator.

9. 未成年人 / Children

PaperPhoneLite 不面向 13 岁以下儿童，也不会故意收集其个人信息。部分地区规定更高的数字同意年龄；未达到当地适用年龄的用户应在监护人同意和监督下使用，或停止使用。

PaperPhoneLite is not directed to children under 13 and does not knowingly collect their personal information. Where a higher digital age of consent applies, younger users should use the service only with guardian consent and supervision or stop using it.

10. 安全、变更与联系 / Security, Changes, and Contact

我们采取加密、密码哈希、会话撤销与 Tor-only 连接等措施，但任何系统都无法保证绝对安全。本政策可能随版本更新，重大变更将在应用或仓库中公布。项目问题请联系 4722522@gmail.com；实例数据请求应优先联系您选择的服务器运营者。

Measures include encryption, password hashing, session revocation, and Tor-only connections, but no system is absolutely secure. Material policy changes will be published in the app or repository. For project questions, contact 4722522@gmail.com; direct instance-specific requests to the selected server operator.