Data Privacy 数据隐私

When you restore a purchase, the request to our payment service carries four fields: 当你恢复购买时，发往我们支付服务的请求带有四个字段：

• network address网络地址
  Requests arrive from somewhere, but what gets stored or forwarded is a hash of the address, never the bare IP. Hammering is rate-limited in the moment; only the hash lands in the log. 请求总有来源，但被存下或转发的只是地址的哈希，不是裸 IP。高频刷接口当场就会被限流，落进日志的只有哈希。
• attempt count尝试次数
  How many restores were tried that day. A stolen license usually shows up here first. 当天试了多少次恢复。授权被盗时，通常最先从这里露出痕迹。
• device model设备型号
  The hardware name, for example MacBookPro18,3. Scripted abuse rarely fakes this convincingly. 硬件型号，比如 MacBookPro18,3。脚本批量伪造的请求很难在这里装得像真机。
• one-way email hash prefix邮箱单向哈希前缀
  A few characters from a one-way hash of your purchase email. Enough to match the restore to a purchase record, not enough to reconstruct the address. 购买邮箱做单向哈希后取开头几位。够用来对上购买记录，不够还原出邮箱本身。

Address and email are hashed before anything stores or forwards them, so the review alert the author receives never carries a plaintext email or a bare IP. To actually confirm a purchase, the author looks up the order in the payment provider's records and replies to the email on that order; the hashes only cross-check the audit log. Nothing here feeds profiling or marketing. 地址和邮箱在存储或转发之前就已经哈希，作者收到的审核提醒里不会出现明文邮箱或裸 IP。真正要确认一笔购买，是拿订单号去支付商后台查那笔订单、给订单上的邮箱回信；哈希只用来和审计记录交叉对账。这里没有任何数据用于画像或营销。

If Puffy crashes, you can send the author an error report describing what went wrong, so the bug can be reproduced and fixed. Nothing is sent without your action. 如果 Puffy 崩溃，你可以把一份描述出错过程的错误报告发给作者，用来复现和修掉这个缺陷。你不点发送，就不会发出任何内容。

Where your AI chats travel depends on which lane you use. Local models run entirely on your Mac and nothing goes out. Bring your own API key and the app talks straight to that vendor; the traffic never routes through us. Puffy hosted AI is the only lane that touches our infrastructure: chats pass through our relay to the model provider and are gone once delivered, with no storage and no content logs. AI 对话走到哪，取决于你用哪条通道。本地模型全程在你的 Mac 上跑，什么都不发。用自己的 API key，客户端直连那家厂商，流量根本不经过我们。只有选 Puffy 托管 AI 时才会碰到我们的设施：对话经中转送达模型方，送到即走，不存储，也不留内容日志。

A random device code that Puffy generates. It is tied to nothing on your machine and identifies nothing about you. 一串由 Puffy 生成的随机设备码，不绑定你机器上的任何东西，也识别不出你是谁。

The app downloads a version file to see if a newer build exists. Nothing about you is attached to the request. 应用下载一个版本文件来判断有没有新版本，请求里不附带任何关于你的信息。