提腕记隐私政策与支持

1. 谁负责，以及我们如何处理语音

提腕记（TilJot）由个人开发者维护。本政策涵盖 提腕记的 Mac、iPhone 和 Apple Watch 应用。你可通过本页邮箱联系维护者；网站其他页面的访问政策见 Xravity 网站隐私政策。

输入模式：你主动开始录音后，Apple Watch 采集语音，经加密蓝牙传到已配对的 Mac，由 Mac 本地识别并通过你选择的 提腕记输入法输入文字。iPhone 用于安装、可信配对与配置同步。输入模式有单轮时长限制；它不等同于灵感录音的时长限制。

灵感模式先把原音保存在录音设备。手表默认补传配对手机，也可选择优先发送到已配对的 Mac；开始录音时 Mac 未就绪则使用手机，已确定发往 Mac 后中断则留在手表等待补传。Mac 还可在你主动开始后用所选麦克风记录灵感。Mac 录制的原音不会自动反向发送到手机。灵感会保留原音，普通输入模式默认不留存录音。

构建 1.4.1 的手机到 Mac 灵感同步默认关闭。开启后只自动同步之后的新记录；历史记录须主动选择。所选原音、标题、转写和编辑通过已认证加密连接传送到配对 Mac，需要两端运行且本地网络可达。关闭同步会停止后续同步，但不删除已有副本。Mac 对手机来源记录的编辑、删除和恢复需要手机确认；离线冲突由用户选择处理。这不是云同步。

灵感本地转写使用 Apple 的设备端识别能力，需要支持的设备、语言及 iOS 26／macOS 26。首次使用可能联网下载系统语言资源；不支持或资源未就绪时，不会自动改用开发者的云端转写。普通输入模式仍由 Mac 本地识别引擎处理。旧 Mac 1.1.9-r2 不支持这些新版灵感功能。

提腕记不会自动向开发者上传录音、转写正文或本机词语记忆，不会将这些内容用于模型训练。新版可在本机记忆支持的短词纠正及拼音选词，具体保存与控制方式见下节。正式发布包不提供开发用录音留存入口。识别过程中需要音频缓冲；这些说明并不保证操作系统的交换、崩溃记录或所有日志都不含数据。

录音、语音识别及蓝牙连接需要相应系统权限。可选的手表发送或控制功能还需要 Mac 辅助功能权限：启用后，提腕记会在本机临时核对受支持目标应用的进程、窗口、草稿文字和对应控件。只有你明确操作对应按钮才请求发送或执行该控件操作；具体点击或长按方式以当前界面为准。核验失败不会自动发送，结果不确定时不会自动重试。

关闭可选提交功能、撤销系统权限或退出应用可以停止相应处理。普通听写不会自动提交聊天消息，也不会执行听写内容中的命令。

2. 哪些数据会保留，怎样删除

灵感原音、转写与编辑

接收设备在本地保存灵感原音、转写、标题和编辑。构建 1.4.1 提供“最近删除”和恢复；不会按固定天数自动清空，永久删除需要明确操作且不可恢复。手表仅清理已被目标端确认完整接收的副本，不删除接收端原音。跨设备删除需恢复连接及同步后才能传播，离线副本不会立即消失。仅移除 Mac 上的手机记录副本会保留手机记录，并保护待同步编辑。

灵感没有云备份，相关存储被排除在系统备份之外。退出录音界面不等于删除；卸载一端不等于删除其他端副本，且可能丢失该端记录。旧安装包不能恢复已永久删除的灵感；自行导出的文件须独立管理。请先用非敏感短录音测试，勿把它当作唯一长期存档。

最近转写与当前草稿

Mac 进程内的最近转写列表最多 20 条，该路径不保存到磁盘；退出进程会结束此列表。Codex 草稿核对是本机临时处理，不是训练集。已经输入其他应用的文字，须在该应用中自行处理。

本机词库与词语记忆

人工词库保存你添加的词条。在启用短词纠正学习时，提腕记可从支持的、已确认听写插入片段中的修改保存短词的原词、纠正词及确认次数；候选记录可能在首次合适纠正后保留，两次不同听写中的一致纠正后才加入个人词库。这不是整段草稿存档，也不是模型训练。可在 Mac 词库中暂停学习、暂停应用词库或删除已生成的词条；暂停不会自动清空已有记录。

中文拼音输入法还会在本机保存已确认选词、拼音和次数，用于候选排序及常用词／人名召回。这些记录不上传开发者，通常不随卸载自动删除；完整清除前请核实实际存储位置，不确定时联系支持。

本地诊断

提腕记保存阶段、时间、耗时和计数等有界数字记录。诊断摘要按需预览最近 3 轮；另有最多 50 轮、7 天窗口的本地历史，加载或新增记录时裁剪，不承诺停用后到时自动擦盘。摘要不会自动上传，选择复制会覆盖系统剪贴板。

模型、设置与安装备份

模型文件、下载校验信息、偏好设置和升级恢复备份保存在本机，通常不随卸载自动删除。完整清除应先核实实际存储位置，再针对性删除；如不确定，请联系支持，勿清空其他应用目录。

配对身份与凭证

设备身份、信任信息及配对凭证用于认证连接，部分保存在系统钥匙串或本地配对存储。配对二维码包含短期凭证，请勿公开。撤销配对或“清除本机配置”不等于清除全部钥匙串、模型和其他设备数据；卸载也不保证清除这些内容。

你自愿发送的反馈

你发送的邮件、说明、经检查的截图或诊断摘要保存在支持邮箱及其服务商，仅用于支持、问题调查和回复，在处理问题所需期间保留，不设统一30天期限。你可通过支持邮箱申请删除自己提交的反馈；法律要求或处理纠纷确需保留的部分除外。

请勿在反馈中发送密码、验证码、配对二维码、密钥或他人的私人资料。默认测试不要求上传录音或全天录屏；若需要录音诊断，会另行说明采集范围、保存与删除安排并征求同意。诊断同意不等于训练同意。

3. 哪些操作会联网

安装、TestFlight、Mac 模型下载和更新，以及手机首次准备系统语音识别资源，可能需要互联网。Mac 模型下载来源按版本锁定并进行摘要校验；下载服务及托管服务可能处理 IP 地址等常规请求信息。Apple/TestFlight 的安装、系统语言资源与诊断处理适用 Apple 自身政策。

把文字提交给 Codex 或其他目标应用后，适用该应用自身的数据处理规则。提腕记的本地识别不表示目标应用也离线。邮件支持使用邮箱服务商，服务商可能按自身政策保留邮件及技术记录。

本页自身不加载统计脚本、广告、外部字体或联系表单，但网站托管和网络服务仍可能记录访问请求。提腕记不出售听写内容，也不以听写正文或录音投放个性化广告。

4. 反馈、删除请求与退出

支持及隐私联系：xravityai@outlook.com。可在主题写“提腕记反馈”或“提腕记隐私请求”。删除请求请说明要处理哪封反馈邮件，无需发送身份证或全部听写内容。

你可以停止使用、撤销权限或退出内测，不需要提交私人录音。远程支持无法代你清除已输入目标应用的内容，或远程删除本机模型、钥匙串和备份。

政策如有更新会在本页注明日期；涉及新的音频上传、训练用途或显著变化时，须先说明并取得所需同意。问题仍无法解决时，可向适用的数据保护机构反映。

ENGLISH SUMMARY

TilJot privacy and support

Effective October 2, 2026 · Revised October 15, 2026 · Version 0.1.0 series, including build 1.4.1

TilJot is maintained by an individual developer. This policy covers its Mac, iPhone and Apple Watch apps. In Input mode, you start recording on Apple Watch; encrypted Bluetooth delivers audio to your paired Mac for local recognition and input. iPhone handles installation, pairing and configuration. Input-session duration limits are separate from Ideas recording limits.

Ideas first saves original audio on the recording device. Watch defaults to transferring to its paired iPhone, with an optional paired-Mac-first destination. If Mac is unavailable when recording starts, iPhone is used; after a Mac destination has been fixed, interruptions leave the recording on Watch for later transfer to Mac. Mac can also record Ideas with your selected microphone after you explicitly start recording. Mac originals are not automatically sent back to iPhone. Ideas retains audio; ordinary Input mode does not retain recordings by default.

In build 1.4.1, iPhone-to-Mac Ideas sync is off by default. Enabling it automatically syncs only subsequent recordings; historical items require explicit selection. Selected audio, titles, transcripts and edits travel over an authenticated encrypted connection to your paired Mac, with both apps running and local network reachability. Turning sync off stops future sync without deleting existing copies. Mac edits, deletions and restores of phone-origin records require phone acknowledgement; offline conflicts require a user decision. This is not cloud sync.

Ideas transcription uses Apple's on-device recognition on supported devices and languages with iOS 26 or macOS 26. Initial system language assets may require an internet download. Unavailable recognition does not automatically fall back to a developer cloud service. Ordinary Input mode continues using the local Mac recognition engine. The older Mac 1.1.9-r2 package does not support these new Ideas features.

TilJot does not automatically upload recordings, transcripts or local word memory to the developer, or use them for model training. New builds can remember supported short-word corrections and Pinyin selections on your Mac, as described below. Public builds do not expose development recording retention. Processing requires temporary audio buffers; this is not a guarantee that all system logs, swap or crash records are data-free.

Recording, speech recognition and Bluetooth require the corresponding system permissions. Optional Watch send/control features need Mac Accessibility permission and temporary, local inspection of a supported target's process, window, draft and relevant control. Only your explicit action on the corresponding button requests submission or that control's action; follow the current interface for tap or long-press gestures. Unverified targets are not submitted and uncertain outcomes are not automatically retried. Ordinary dictation does not send messages or execute spoken instructions.

Receiving devices locally store Ideas audio, transcripts, titles and edits. Build 1.4.1 provides Recently Deleted and restore controls, without automatic purging after a fixed number of days. Permanent deletion is explicit and irreversible. Watch cleanup removes only copies whose complete reception was confirmed by the destination; it does not delete the destination's original. Cross-device deletion propagates after reconnection and sync, not immediately to offline devices. Removing only the Mac copy of a phone record preserves the phone record and protects pending edits.

Ideas has no cloud backup and its storage is excluded from system backups. Leaving the recording screen does not delete audio. Uninstalling one app may lose that device's records and does not imply deletion on other devices. Old installers cannot restore permanently deleted Ideas. Manage exported files separately. Use non-sensitive short test recordings and do not rely on this as your only long-term archive.

The in-memory recent-transcript list holds up to 20 entries and ends when the Mac process exits; text already entered elsewhere remains with that application. Local numeric diagnostics include a three-round preview and a history capped at 50 rounds within a seven-day window, pruned when loaded or updated, not by a guaranteed timed wipe. Diagnostics are not automatically uploaded. Copying a summary replaces the clipboard.

Manual vocabulary stores entries you add. When short-correction learning is enabled, supported edits within confirmed dictation insertions can retain short original/corrected word pairs and confirmation counts locally. A candidate may be retained after the first eligible correction; two consistent corrections in separate dictation sessions are required before it enters your personal vocabulary. This is not a full-draft archive or model training. In the Mac vocabulary controls you can pause learning, disable vocabulary application or delete generated entries. Pausing does not automatically erase existing records.

The Chinese Pinyin input method also stores confirmed word selections, Pinyin and counts locally for candidate ordering and word/name recall. These records are not uploaded to the developer and may remain after uninstalling. Confirm exact storage locations before a complete removal, or contact support if unsure.

Models, settings, installation backups and pairing identities may persist after uninstalling. Some credentials use the system Keychain. Revoking a pairing or clearing local configuration is not a complete data wipe. Confirm exact storage locations before deleting local files; do not clear unrelated applications or your entire Keychain.

Downloads, updates, hosting, Apple/TestFlight and initial preparation of phone system speech resources may require network services, which may process standard request metadata such as IP addresses under their own policies. Submitted text follows the target application's policy; local recognition does not make that application offline. Support email providers process voluntarily shared messages. This page loads no analytics, advertisements, external fonts or contact form, but hosting may retain access logs.

Voluntary feedback is stored in the support mailbox and processed by its email provider, only for support, investigation and replies. It is retained for the time needed to handle the issue, without a uniform 30-day deadline. You may request deletion of feedback you submitted; information necessary for legal obligations or disputes is excepted. Do not share passwords, pairing QR codes or private third-party data. Recording diagnostics require separate informed consent, not implied training permission.

Contact xravityai@outlook.com for support, privacy or feedback deletion requests. Stop using the app or revoke permissions to stop the corresponding processing. Remote support cannot delete your local files or content in other apps. Material new upload or training purposes require advance explanation and the necessary consent. Updates will show a revision date on this page.