生成内容标识：从首个公开发行版本 1.0.0 起，对外分享的 AI 来源图纸 PNG、PDF 会显示“AI 生成”或相应语言的提示，并在文件元数据中保留 AIGC 属性、应用标识、任务编号和独立导出编号。修改署名或镜像不会移除这些标识。请保留标识，在其他平台发布时主动说明 AI 的参与。公开图纸的这些溯源字段不含宝石交易号、钱包密钥或 Apple 账号密码；个人工程备份可能另含恢复和退款核对所需的来源记录，不宜作为公开分享文件。
4. Apple iCloud 与已保存内容同步
当系统 iCloud 账号可用且 App 中的自动备份或同步设置开启，或你主动执行备份／同步时，已保存图纸、草稿、逐格进度、作品照片、作品记录、用豆流水及相关元数据会通过 Apple CloudKit 上传到该账号下本 App 的私有云端数据库。App 会读取必要的账号可用状态，并在本机使用账号身份摘要隔离不同账号的数据；不读取你的 Apple 密码。
广告服务默认关闭。你在「工坊设置 → 广告与隐私」阅读说明并选择允许后，App 才会启动广告相关的隐私信息更新和 SDK 初始化，并在符合当前隐私选择时请求广告。App 使用 Google AdMob SDK 展示横幅和自愿选择观看的激励广告，使用 Google UMP SDK 获取适用地区的隐私选择。
广告 SDK 可能处理 IP 地址（可推断大致位置）、设备及应用标识符、系统和应用信息、广告展示与点击、其他广告互动、崩溃日志及性能诊断，用于广告投放、效果统计、反作弊、安全和服务改进。当前广告请求采用非个性化设置，App 不请求 ATT 跨应用追踪授权；非个性化广告仍涉及数据处理。标识符的实际可用性取决于系统权限、SDK 和隐私设置。App 的广告请求不主动包含你选取的照片、图纸或作品内容。
你可以关闭广告服务，停止后续广告请求；已经发出的请求可能仍会完成。对适用地区，可在同一设置中查看或更新 Google 隐私选择。关闭广告不会撤回已传输的数据，也不表示已初始化的 SDK 所有内部活动即时停止。激励广告仅在你主动选择时展示，奖励按照 App 中说明发放。
为了验证宝石订单与 AI 消耗，本机钱包编号、随机授权密钥的摘要，以及 Apple 签名订单中的必要交易编号、商品、环境、购买和撤销状态会交由我们的 HTTPS 服务处理。服务端使用 Apple 官方验签库验证订单，保存去重和结算所需字段、宝石余额、任务扣费及失败补偿记录；沙盒与正式环境分开记账。我们不接收银行卡信息或 Apple 账户密码，不通过 iCloud 文档同步合并消费余额。已支付但尚未完成验证的订单保留待交付，不因网络失败再次收费。
7. 网站访问与主动联系
拼豆介绍页和本隐私政策页不加载广告 SDK、第三方统计脚本或追踪像素，也不为浏览页面设置营销 Cookie。浏览器仍会向网站服务器发送 IP 地址、请求路径、时间、浏览器／设备信息等必要网络信息；服务器可能在访问或错误日志中记录这些信息，用于提供网页、排查故障与保障安全，日志随服务器轮转规则清理。
Standard pattern processing runs primarily on-device. Saving and synchronization are separate operations.
Online AI
On your request, the selected image travels through our gateway to Tencent TokenHub.
iCloud
Saved content enters your private CloudKit database when the account and sync settings permit.
Advertising
Off by default. Once allowed, Google processes necessary ad/device data. Non-personalized does not mean no collection.
1. Scope and contact
This policy covers Radish Beads (萝卜拼豆) for iOS and iPadOS, provided by an individual developer, and its introduction pages on this domain. Other apps hosted on the same domain have their own policies. The app is being prepared for public release. Feature, AI, advertising and purchase availability depends on the version you use.
Data controller: the individual developer of Radish Beads. Contact: crossshiftalarm@outlook.com. Use this address for questions, support or privacy requests. We do not ask you to email Apple or Google passwords, verification codes or full bank card details.
2. Selected photos and local creation data
When you select a photo or save a work, the app processes relevant photos, source materials, pattern grids, brand color codes, bead lists, drafts, crafting progress, finished works, bead-use records and related dates. Standard photo-to-pattern processing, subject extraction, reverse recognition, four-corner alignment, recoloring and step-by-step crafting primarily run on your device. These local operations do not by themselves upload the photo to our AI gateway.
The app uses the system photo picker for content you select and does not proactively scan your entire photo library. Saved content and some resumable creation states may include copies of the source photo or material. Manage system permissions in iOS Settings. Exported or shared copies are managed by the destination app or recipient.
3. Optional online AI image generation
Only after you read the recipient and purpose notice, explicitly agree to upload and start AI generation does the app send the selected image as a processed JPEG, generation options such as preserving accessories, a request ID, and necessary installation and authorization information to our HTTPS gateway. The gateway sends the image, generation instructions and necessary parameters to Tencent Cloud TokenHub (currently using a Hunyuan image model) and returns the result to the app. Images may contain personal information. Upload only content you are authorized to process.
Our gateway stores necessary installation identifiers, authorization token hashes, request IDs, expiry and usage/quota records for access control, duplicate prevention and quota management. To recover interrupted AI tasks, generated results are temporarily stored on our server for up to 7 days. After the app has saved a local draft, you can also delete the temporary server result. Original images and inspiration notes are not persisted with task records on our server disk; they are still processed in memory during execution and by Tencent Cloud. Task status, request digests and necessary settlement/deduplication records are retained for authorization, replay prevention and compensation. Expiry or deletion of a result does not delete those necessary records, operational backups or third-party copies. Network servers may still keep necessary access and error logs.
Tencent Cloud processing, retention and deletion follow its applicable terms and privacy statement. We do not promise unverified third-party zero retention, immediate deletion or training exclusions. You may decline AI and use available local tools. Deleting a local image does not recall an already transmitted request.
Generated-content labels: starting with the first public release, version 1.0.0, shared PNG and PDF patterns derived from AI display an “AI generated” label or its localized equivalent. Their file metadata retains an AIGC attribute, application identifier, task identifier and a separate export identifier. Changing the signature or mirroring does not remove these labels. Preserve them and disclose AI involvement when publishing elsewhere. These public-pattern provenance fields do not include gem transaction IDs, wallet secrets or Apple passwords. Private project backups may separately retain source records needed for recovery and refund reconciliation and are not intended as public sharing files.
4. Apple iCloud synchronization
If a system iCloud account is available and automatic backup/sync is enabled in the app, or you initiate backup/sync, saved patterns, drafts, cell progress, work photos, work records, bead-use records and related metadata are uploaded through Apple CloudKit to this app’s private database under that account. The app reads necessary account availability information and uses a local account identity hash to separate accounts. It does not read your Apple password.
Offline or failed changes remain on-device for later handling. Switching accounts does not migrate the previous account’s works to the new account. Spendable gems use separate device and server ledgers and are not merged or restored by document synchronization. Apple processing is governed by its Privacy Policy and iCloud terms.
5. Google AdMob ads and privacy choices
Advertising is off by default. After you read the notice and allow the advertising service in app settings, the app updates advertising consent information and initializes the SDK, then requests ads only when permitted by the current privacy state. Google AdMob provides banners and voluntarily selected rewarded ads; Google UMP obtains applicable regional privacy choices.
The SDK may process IP addresses (which can imply approximate location), device/app identifiers, system/app information, ad impressions, clicks and other ad interactions, crash logs and performance diagnostics for delivery, measurement, fraud prevention, security and service improvement. Current requests use non-personalized settings and the app does not request ATT tracking authorization. Non-personalized ads still involve data processing. Identifier availability depends on system permissions, SDK behavior and privacy choices. Our ad requests do not intentionally include your selected photos, patterns or works.
Turn off advertising in settings to stop new requests; an in-flight request may still complete. Where applicable, open Google privacy options in the same settings to review or change choices. Turning the service off does not recall transmitted data or guarantee that all activity inside an initialized SDK stops immediately. Rewarded ads appear only after you choose them; rewards follow the in-app description.
Apple processes App Store payments, subscriptions and refunds. The app receives and verifies necessary transaction IDs, products, purchase states, expiry/revocation information and related transaction data to deliver benefits, prevent duplicate grants, restore valid ad-free access and handle refunds. We do not receive full card details or your Apple account password through the app.
A device Keychain ledger may hold installation IDs, shard/stamina balances, reward deduplication IDs and necessary transaction records. AI patterns may retain purchase-source references for refund reconciliation. Uninstalling may not erase all Keychain records. The local balance is not a cross-device cloud wallet.
To verify gem orders and AI spending, our HTTPS service processes the device wallet identifier, a hash of its random authorization secret, and necessary transaction IDs, products, environment, purchase and revocation states from Apple-signed transactions. The server uses Apple’s official verification library and stores fields required for deduplication and settlement, gem balances, task debits and failure compensation. Sandbox and Production are accounted for separately. We do not receive card details or Apple account passwords. Spendable balances are not merged through iCloud document sync. A paid order awaiting verification remains pending delivery; network failure does not create another charge.
7. Website access and voluntary contact
The app introduction and this policy page do not load advertising SDKs, third-party analytics or tracking pixels, and set no marketing cookies for page browsing. Your browser still sends the IP address, requested path, time and browser/device information necessary for network access. Servers may record such information in access/error logs for page delivery, troubleshooting and security; logs are cleaned according to server rotation settings.
If you email us, we process the email address, description and attachments you choose to provide to respond and handle the request. Do not include unnecessary identity documents, passwords or verification codes. Email delivery is handled by the mailbox provider.
8. Third parties and processing locations
Relevant services are Apple for photo selection, iCloud and App Store; Tencent Cloud TokenHub for AI you request; Google AdMob/UMP and applicable advertising partners for ads and privacy choices. Cloud servers host the website and gateway. We do not sell your photos, patterns or works, or intentionally provide them to advertising platforms as ad creatives.
Processing locations depend on provider infrastructure, account region and applicable terms. Google, Apple and other services may involve processing outside mainland China. Read the relevant disclosures and provider policies before enabling a feature and make choices required in your situation. “Non-personalized” advertising and “private” iCloud do not mean that no third-party processing occurs.
9. Retention and limits of deletion
Device content generally remains until you delete it in the app, clear relevant system app data or remove its copies. Delete exported/shared files at their destinations. Keychain items and system backups may survive uninstalling.
iCloud records, historical sync revisions and backups may remain after local deletion. In-app deletion does not erase all historical cloud copies. For complete cleanup, inspect iCloud app data management in system settings and copies on each device. Apple’s deletion/backup mechanisms apply.
Generated gateway results are retained temporarily for up to 7 days and their output is cleared after expiry. Once the app has saved a local draft, you may also delete the temporary server result. Authorization, quota, request digests and settlement/deduplication records are retained as necessary for access, replay protection and failure compensation. Network logs serve necessary operations/security purposes. Records no longer needed and not legally required should be deleted or anonymized. Data already received by Tencent Cloud, Google or Apple follows their policies. Contact us to query or request deletion: after verification, we will handle data we control and explain relevant provider request routes. We cannot remotely read or erase your device or private iCloud content.
10. Choices and privacy requests
Skip online AI: do not start generation; continue with available local tools.
Manage ads: turn the advertising service off in settings or review Google privacy choices where applicable.
Manage cloud data: disable automatic app sync and use iOS iCloud settings to manage cloud app data. Stopping sync does not delete cloud copies.
Manage photos/permissions: adjust iOS permissions; remove copies already saved in the app separately.
Manage transactions: restore eligible ad-free purchases in the app and manage subscriptions/refunds through Apple.
Request access, correction, deletion, withdrawal of choices or other applicable rights by emailing crossshiftalarm@outlook.com. Explain the feature and requested scope. We use necessary, proportionate verification and handle requests under applicable rules. Withdrawal does not change the lawfulness of earlier processing.
11. Minors, security and policy updates
Minors should use the app with guardian guidance and obtain necessary authorization and appropriate consent before uploading others’ photos or using online services. Contact us if a minor may have supplied personal information without appropriate consent; we will investigate and handle data we control.
We use HTTPS, system Keychain and system account permissions to help protect relevant data. No storage or transmission can be guaranteed absolutely secure. This policy changes with actual features and data flows; the update date appears on the page. When changes require a new notice or choice, we provide an appropriate means. App publication does not itself confirm that every advertising, payment or privacy-choice test is complete.
萝卜拼豆