PILOT DISCLOSURE / NOT A RELEASE APPROVAL
Privacy and application processing disclosure
Current data handling and unverified production boundaries. Final retention rules require approval; no certification or unverified deletion deadline is claimed.
Pilot disclosure only. Commercial policies, provider acceptance and production deployment are not approved by publishing this page. Live billing remains disabled.
Document version：2026-10-11-interface-language-v2
Account and operational records
Email codes authenticate product users. The system records accounts, sessions, API Key scopes/expiry, projects, jobs, file hashes, entitlement ledgers and necessary audit facts. Administrator identity is separate, and permissions are enforced by the backend.
Codes are short-lived. An encrypted outbox holds mail pending delivery; successful delivery clears its code ciphertext. Local development delivers only into a private directory. Real Feishu SMTP delivery is still unverified.
Packages, resources and results
Processing requires original packages, job metadata, outputs and reports. Apps may embed personal data, business secrets or credentials; inspect and remove unnecessary secrets before uploading. Do not upload signing keys or email packages/authentication credentials to support.
Customer content is not included in ordinary administrator lists; downloads require account and permission checks. Access controls are not independent certification of storage encryption, hostile-code isolation or hardware security.
Locations and providers
The planned US website/China worker architecture may transfer application packages across borders. Independent local tests do not upload to cloud servers. Tencent deployment, inter-node transport and real providers have not completed all acceptance checks. Production submission must disclose the location and request an explicit choice.
Paddle is the planned Merchant of Record, rather than our service directly receiving consumer card details. Live billing is disabled; the new product's real Sandbox, website and checkout-domain review remain pending.
AI processing and secrets
AI functional replication assessment is not open. Any future external-model analysis requires a separate disclosure of actual providers, data scope and retention. This page does not authorize sending your app to arbitrary external AI services.
Keep API Keys in your own CI/Agent secret manager, not URLs, public repositories or screenshots. Customer signing remains local and does not require handing signing identities to the platform.
Retention, deletion and necessary records
Explicit application/output deletion, waiting, isolation, exact cleanup and configurable file expiry are implemented. Automatic expiry is disabled by default; files are not promised to disappear after a fixed number of hours. Final account, accounting, audit and backup retention rules remain pending.
Deleting a package does not delete every accounting fact, securely erase storage media or immediately remove all backups. Contact support about account and other data concerns. Automated account deletion and response deadlines are not claimed as verified.
Browser state
Sign-in uses a necessary session cookie. The browser retains interface language preferences, email-challenge and uncertain-job request state to recover original requests and avoid duplicate creation. Language preferences contain no account, code, API Key or job content. Closing a tab, clearing storage or switching devices may lose that local recovery state.
This version adds no marketing trackers, newsletter subscription or advertising cookies. Processing consent is not marketing consent or acceptance of unapproved paid-service terms.