This policy explains what Glance collects, why, where it is stored, who it is shared with, and the rights you have. The short version: files you open stay on your Mac; only media you deliberately send to a cloud Widget leaves it.

1. What stays on your Mac

• Images, videos and files you open, browse, compare, capture or process with local tools. They are never uploaded.
• Preferences, local history and the app log at ~/Library/Application Support/Glance.
• If you enable Peek, the text you select is read locally to find a link or path. It is not sent to our servers; previews of web links load directly from that website.

2. What we collect

• Account data: your email address; with Google sign-in also your name, profile picture and Google account ID. Sign-in sessions are stored only as a one-way hash.
• Email verification: a hashed one-time code and rate-limit counters, deleted after expiry.
• Device data for licensing and abuse prevention: a hashed device identifier, the Mac's name and last-used time, used to enforce the device limit, the one-trial-per-Mac rule and the one-bonus-per-Mac rule.
• Cloud Widget tasks: the media you choose to upload, task parameters you enter (for example a prompt), the result, task status, timestamps and the credit cost.
• Credits and orders: your credit balance and ledger, and order records from our payment provider: order ID, product, amount, currency, buyer email, billing country and status. We never receive your full card number.
• Request metadata: IP-derived country (used to pick the default currency and the processing region) and standard server logs.

3. How we use it

To sign you in, run the Widgets you request and return results, charge and refund credits, deliver purchases and licences, prevent fraud and abuse, answer support requests, and meet legal obligations. We do not sell personal data, we do not use it for advertising, and we do not use your media to train AI models.

4. Where it is stored

Account, credit, order and task records are stored in Cloudflare D1, and uploaded media and results in Cloudflare R2, operated by Cloudflare, Inc. on its global network.

5. Who we share it with

• Cloudflare — hosting, database and file storage.
• Google — only if you choose Google sign-in.
• Resend — delivers email verification codes.
• RunningHub (runninghub.cn) — receives the media and parameters of tasks for the AI Widgets that run on it.
• Freeimage.host — receives images you upload with the Image Hosting Widget from mainland China; such links are public.
• Pancake by Waffo — our Merchant of Record; processes payments, taxes and refunds under its own privacy policy.
• Authorities, when required by law.

6. Retention

Account, credit and order records are kept while your account exists; order records may be kept longer where tax or accounting law requires. Uploaded media and results are currently kept until you ask us to delete them or delete your account; we will announce any automatic retention period on this page before introducing it. Expired verification codes and sessions are deleted.

7. Your rights

You can ask to access, correct, export or delete your personal data, delete specific uploads, or delete your account, and you can object to processing or withdraw consent. Email [email protected] from your account email address. We respond within 30 days. You may also complain to your local data protection authority.

8. Security

Traffic uses HTTPS. Sign-in tokens are stored on your Mac in the macOS Keychain and on our servers only as hashes. Result links to Glance storage are time-limited signed URLs.

9. Children

Glance is not directed to children under 13, and we do not knowingly collect their data. Contact us if you believe a child has given us data.

10. Changes and contact

We will post changes on this page and, for material changes, notify you by email. Questions: [email protected].

本政策说明 Glance 收集哪些数据、为什么收集、存储在哪里、与谁共享，以及你拥有哪些权利。简单来说：你打开的文件保留在你的 Mac 上；只有你主动交给云端 Widget 的媒体才会离开它。

1. 只留在你 Mac 上的数据

• 你打开、浏览、对比、截取或用本地工具处理的图片、视频和文件，从不上传。
• 偏好设置、本地历史记录和日志，位于 ~/Library/Application Support/Glance。
• 开启 Peek 后，选中的文字只在本地读取，用于识别链接或路径，不会发送到我们的服务器；网络链接的预览会直接从该网站加载。

2. 我们收集的数据

• 账户数据：邮箱地址；使用 Google 登录时，还包括姓名、头像和 Google 账户 ID。登录会话只以单向哈希形式保存。
• 邮箱验证：经过哈希的一次性验证码和频率限制计数，过期后删除。
• 用于授权与防滥用的设备数据：经过哈希的设备标识、Mac 名称和最近使用时间，用于执行设备名额、每台 Mac 一次试用和一次新用户赠送的规则。
• 云端 Widget 任务：你选择上传的媒体、你输入的任务参数（例如提示词）、结果、任务状态、时间和点数费用。
• 点数与订单：点数余额与流水，以及支付渠道提供的订单记录：订单号、商品、金额、币种、买家邮箱、账单国家和状态。我们不会收到你的完整银行卡号。
• 请求元数据：根据 IP 判断的国家（用于选择默认币种和处理区域）及标准服务器日志。

3. 数据用途

用于登录、运行你请求的 Widget 并返回结果、扣点与退点、交付购买内容与授权、防止欺诈与滥用、处理客服请求以及履行法律义务。我们不出售个人数据，不用于广告，也不用你的素材训练 AI 模型。

4. 存储位置

账户、点数、订单和任务记录存储在 Cloudflare D1，上传的媒体和结果存储在 Cloudflare R2，由 Cloudflare, Inc. 在其全球网络上运营。

5. 共享对象

• Cloudflare：托管、数据库和文件存储。
• Google：仅在你选择 Google 登录时。
• Resend：发送邮箱验证码。
• RunningHub（runninghub.cn）：接收在其平台上运行的 AI Widget 任务的媒体和参数。
• Freeimage.host：接收中国大陆用户通过「免费图床」Widget 上传的图片，生成的链接是公开的。
• Pancake by Waffo：我们的记录商户，依照其自身隐私政策处理付款、税费和退款。
• 依法要求时，向有关机关提供。

6. 保存期限

账户、点数和订单记录在账户存续期间保存；税务或会计法规要求时，订单记录可能保存更久。上传的媒体和结果目前保存至你要求删除或删除账户为止；如将来设置自动保存期限，会先在本页公布。过期的验证码和会话会被删除。

7. 你的权利

你可以要求访问、更正、导出或删除个人数据，删除特定上传内容或删除账户，也可以反对处理或撤回同意。请用账户邮箱发邮件到 [email protected]，我们会在 30 天内答复。你也可以向所在地的数据保护机构投诉。

8. 安全

传输均使用 HTTPS。登录令牌在你的 Mac 上保存在 macOS 钥匙串中，在服务器上只保存哈希。指向 Glance 存储的结果链接是有时效的签名地址。

9. 儿童

Glance 不面向 13 岁以下儿童，我们不会有意收集其数据。如你认为有儿童向我们提供了数据，请联系我们。

10. 变更与联系

政策变更会在本页公布，重大变更会通过邮件通知。如有疑问：[email protected]。