上海沐小阳网络科技有限公司（以下称“我们”）开发并运营 Numable 应用及其桌面小组件（iOS、iPadOS、macOS、Android、HarmonyOS、Windows 等客户端，以下统称“本应用”）。我们将按《中华人民共和国个人信息保护法》（PIPL）、《网络安全法》《数据安全法》及适用的境外法律（如欧盟 GDPR、美国加州 CCPA）保护您的个人信息。
Numable 采用“本地优先（local-first）”架构：您的仪表盘、收藏、已安装的工具等使用数据默认仅保存在您的设备本地，不上传至我们的服务器；应用直接从第三方网站或服务获取展示数据，我们的服务器不经手、不留存这些数据（例外是您主动启用的 Claude Code 用量组件，见 §3.1；以及您为某个工具开启的服务器通知，通知文字经我们的服务器转发、不保存，见 §3.4）。 本政策说明我们如何收集、使用、存储、共享和保护您的个人信息，以及您享有的权利。逐项清单另见《个人信息收集清单》与《第三方信息共享清单》。请在使用本应用前仔细阅读；继续使用即表示您认可本政策。
Shanghai Muxiaoyang Network Technology Co., Ltd. ("we", "us") develops and operates the Numable app and its home-screen widgets (iOS, iPadOS, macOS, Android, HarmonyOS, Windows; the "App"). We protect your personal information under China's PIPL, Cybersecurity Law and Data Security Law, and applicable overseas laws including the EU GDPR and California CCPA. Numable is local-first: your dashboards, favorites and installed tools stay on your device by default and are not uploaded to our servers; the App fetches display data directly from third-party sources, which our servers never receive or retain (the exceptions are the Claude Code usage widget, which you opt into — see §3.1 — and server notifications you turn on for a tool, whose text our server forwards without keeping it — see §3.4). Item-by-item lists: data we collect and third-party SDKs. By using the App you acknowledge this policy.
我们坚持“最小必要”原则。
2.1 您主动提供的信息
| 场景 | 收集信息 | 是否必需 |
|---|---|---|
| 登录账号 | 可用的登录方式：iOS / iPadOS 为 Apple、微信、Google、GitHub；macOS 为 Apple、Google、GitHub；Android 为微信、Google、GitHub；HarmonyOS 为华为账号、微信、Google、GitHub；Windows 为 Google、GitHub；任一设备也可用已登录的手机扫码登录。收集第三方返回的用户唯一标识、邮箱（微信不提供）、名称或用户名、头像 URL、登录方式，以及您自行设置的昵称（可选）。微信登录时我们获得微信 unionid、昵称与头像；openid 只在当次登录请求里使用，不保存；华为账号登录时我们获得华为账号 UnionID（您授权时另有昵称与头像），OpenID 不保存；使用 Apple 登录时，我们保存 Apple 授权凭据，仅用于注销账号时撤销授权 | 登录为可选；不登录可使用浏览、安装、仪表盘、桌面小组件等功能；购买与使用会员、多设备同步、发布、举报、申诉需要登录 |
| 购买会员 | 商品（月付 / 年付 / 年卡 / 永久）、支付渠道（App Store / Google Play / 微信支付）、订单或交易编号、购买状态与到期时间、是否自动续费、所属账号；微信支付另有订单金额、付款时间与微信支付订单号。不收集银行卡号等支付账户信息（见 §6） | 仅购买时 |
| 兑换码领取会员 | 兑换的批次、兑换码末四位（活动口令则为口令本身）、赠送天数、兑换后的会员到期时间、兑换时间、所属账号。兑换码本身只保存哈希值（见 §6） | 仅兑换时 |
| 免费试用会员 | 试用开始与到期时间、所属账号；另存一份账号标识的哈希值，用于防止重复领取（见 §6、§7） | 仅开始试用时 |
| 意见反馈 | 反馈类别与正文、您自愿填写的联系方式；登录状态下提交时关联您的账号标识，未登录则为匿名；另附诊断信息（见下），您可在提交前关闭 | 仅使用该功能时 |
| 举报 / 申诉 | 被举报工具的标识与版本、举报类别、您填写的说明及您的账号标识；发布者申诉时的申诉说明及账号标识 | 仅使用该功能时（需登录） |
| 发布组件（UGC） | 您上传的内容包及关联账号标识；发布者名称（取自您的账号名称或第三方账号用户名）会在安装面板中公开展示 | 仅发布时 |
| 分享文件 | 您选择分享的工具内容包（仅用于校验与签名，签名后不保存）；签名记录：工具标识、版本、内容指纹、您的账号标识、时间；您的显示名称（昵称或账号名）会写入分享文件，收到文件的人可以看到 | 仅在您使用「分享文件」时（需登录） |
| 一句话建盘（AI，可选） | 您输入的那句话、App 语言、当前仪表盘还能放几个组件，以及同一次建盘里上一轮生成的组件清单，发给 Anthropic 用于挑选组件与填写参数（见 §3.2、§5），我们不保存这句话；服务器只记录每个账号每天用了几次（保留 7 天）和本次建盘的会话（随机编号、所属账号、第几轮，24 小时后删除） | 仅使用该功能时（需登录；中国大陆不提供） |
| 官网上线通知 | 您在 get.numable.app 登记的邮箱与语言偏好 | 仅登记时 |
| 服务器通知（可选） | 本机的设备推送令牌（Apple 推送服务，或 Android 上 Google 的 Firebase 云消息服务（FCM），分配给本机本应用的令牌）、设备平台类型（Apple 或 Android）与环境（正式 / 测试）、App 语言、App 随机生成的设备钥匙（只保存其哈希）；每一条授权对应的工具、授权时刻与最后一次发送时刻；我们为「这台设备 × 这个工具」生成的通知凭据（只保存其哈希）。不保存通知内容；工具拿不到设备推送令牌；不与您的 Numable 账号关联（见 §3.4） | 默认关闭；仅在您对某个工具点了「允许」后（目前只在 iPhone、iPad、Mac 与 Android 的 Google Play 版上提供；不需要登录） |
| 多设备同步（会员功能，可选） | 开启后，您的仪表盘、已安装工具清单、组件内记录的数据、提醒与工具排序，以及您添加的第三方凭证的名称、类型、适用网站与使用它的组件（不含凭证的值），会在您的设备上加密后上传到我们的服务器，在您的其他设备间同步；我们无法解密其内容。凭证的值默认不同步，仅当您在同步中另外开启「同步密钥与凭证」时，才以同样的端到端加密方式同步（授权登录类连接除外，每台设备各自连接）。另收集：本应用为同步随机生成的设备编号（不是系统或广告标识）、设备平台类型（如 iPhone / Mac）、加入与移除时间、最后同步时间、记录条数与大小（用于同步与配额）、用于核对恢复码的校验串。不同步登录令牌、桌面小组件设置、主题与语言 | 仅开启同步时；可随时在「我的 › 多设备同步」关闭并删除云端数据 |
反馈诊断信息：服务端只接受以下 8 项，其余一律丢弃——App 版本、平台、系统版本、设备型号（如 "iPhone16,2"）、语言、网络类型、提交时正在打开的工具标识、内容地区及其判定依据（例如「按 App Store 账号地区判定为中国大陆」）。各端实际附带的项少于 8 项；反馈界面会展示将要附带的内容，您可以关闭。反馈不支持上传截图或附件。
2.2 自动收集：登录令牌（JWT），仅保存在您的设备本地（iOS / iPadOS / macOS 存于系统钥匙串 Keychain，Android 存于加密存储 EncryptedSharedPreferences，HarmonyOS 与 Windows 存于本应用私有数据目录）；下载工具 / 检查更新产生的必要网络信息（如 IP、平台与版本，用于分发、安全以及按您所在地区提供可用的工具）；您提交反馈或在官网登记邮箱时，我们只保存 IP 地址的加盐哈希值（不保存原始 IP、无法还原），用于防滥用；每台登录设备的记录：平台、设备类型、设备名、App 版本、登录方式、首次登录与最近活跃时间、最近活跃时按 IP 估算的城市级位置（城市与国家），只用于在「我的 › 账号 › 登录设备」里展示、并让您退出某台设备的登录；不保存原始 IP，退出后 30 天删除，60 天没有活跃的设备自动删除。设备名取自系统：iPhone / iPad 为系统给出的设备名，Android 为您在系统设置里起的设备名（没有则为机型），Mac 与 Windows 为电脑名，HarmonyOS 为机型名。用已登录的手机扫码登录另一台设备（电脑、平板、手机、电视，或兑换会员时的网页浏览器）时，我们会记录发起登录的那台设备的平台、设备类型、设备名、App 版本与按 IP 估算的大致位置（城市、省 / 州与国家），只用于在您手机的确认页上显示「是哪台设备在请求登录」、帮助您识别冒用；不保存原始 IP，相关记录约 1 天后删除；为防止滥用，扫码登录接口按 IP 限制请求频率，限流记录只保存 IP 的哈希值，约 1 天后删除。
崩溃与诊断：本应用未集成任何崩溃上报、统计分析或广告 SDK，我们不另外收集崩溃日志与使用分析数据。服务器通知在 iPhone、iPad、Mac 上使用 Apple 推送通知服务（APNs），这是 Apple 的系统服务，不是另行集成的 SDK；在 Android 的 Google Play 版上使用 Google 的 Firebase Cloud Messaging SDK，这是本应用唯一的推送 SDK，只用于服务器通知，未启用 Firebase 的统计分析（见 §3.4、§5）。若您在系统设置中同意与开发者共享分析数据，Apple（App Store）、Google（Google Play）等平台可能依其自身政策收集崩溃与性能统计，并以汇总形式提供给我们；这部分由平台收集和处理，您可在系统设置中随时关闭。
2.3 设备权限与我们不收集的信息：相机仅在您主动扫码时使用（用手机扫码登录另一台设备、添加同步设备、连接桌面端编辑器），画面在设备上实时识别，不保存、不上传；相册仅在您主动保存分享图时申请「仅添加」权限，在扫一扫里主动选一张图片识别二维码时只读取您选中的那一张、在设备上识别、不上传，我们不读取您的相册；本地网络仅在连接桌面端编辑器时使用（在同一 Wi-Fi 下把正在编辑的组件预览到本机）；通知在您添加提醒或开启服务器通知时申请，提醒在设备本地定时触发，服务器通知默认关闭、只有在您为某个工具点了「允许」后才会开启（见 §3.4）；面容 ID / 触控 ID 仅在查看同步恢复码前确认是您本人，由系统在设备上完成，我们拿不到任何生物特征信息；我们会检测设备上是否安装了微信，用于决定是否显示微信登录 / 付款，不读取您的应用列表。我们不收集：您设备的定位（GPS 等）、通讯录、麦克风；设备标识符（IDFA、IMEI、Android ID、OAID、MAC 地址等）；剪贴板内容（仅在您于桌面端编辑器里主动粘贴时读取所粘贴的内容）；您在组件中浏览的具体数据内容。我们不进行用户画像或广告追踪。
(2.1) Information you provide: account identity from sign-in — Apple, WeChat, Google or GitHub on iOS/iPadOS; Apple, Google or GitHub on macOS; WeChat, Google or GitHub on Android; HUAWEI ID, WeChat, Google or GitHub on HarmonyOS; Google or GitHub on Windows; any device can also sign in by scanning a code with a signed-in phone (provider user id, email (not provided by WeChat), name or username, avatar URL, provider, and an optional nickname you set; for WeChat we receive your unionid, nickname and avatar, and the openid is used only within that sign-in request and never stored; for HUAWEI ID we receive your UnionID (plus nickname and avatar if you authorize them) and do not store the OpenID; for Sign in with Apple we keep an Apple authorization credential, used only to revoke that authorization when you delete your account). Sign-in is optional: browsing, installing, dashboards and home-screen widgets work signed-out; buying and using Pro, multi-device sync, publishing, reporting and appeals require it. Membership purchases: the product (monthly / annual / one-year pass / lifetime), the channel (App Store / Google Play / WeChat Pay), the order or transaction identifier, purchase status and expiry, whether it auto-renews and the account it belongs to; for WeChat Pay also the amount, payment time and WeChat Pay transaction number — never your card or payment-account details (§6). Gift codes: when you redeem a code on get.numable.app/redeem, the code's batch, its last four characters (or the promo word itself for a shared code), the days granted, the resulting expiry, the time and the account — the code itself is stored only as a hash (§6). Free trial: when you start the 7-day Pro trial, its start and end times and the account, plus a hash of the account identifier kept to prevent claiming it twice (§6, §7). Feedback: category, text and an optional contact; linked to your account id if you are signed in, anonymous otherwise; plus diagnostics you can switch off before sending — the server accepts only eight fields (app version, platform, OS version, device model, language, network type, the tool open at the time, and the content region together with how it was determined — e.g. "mainland China, by App Store account region") and discards everything else; no screenshots or attachments. Reports/appeals: the reported tool id and version, category, your note and your account id (sign-in required). Publishing: the pack you upload and its account id; the publisher name (your account name or provider username) is shown publicly in the install panel. Sharing as a file: the pack of the tool you choose to share, used only to check and sign it and not kept after signing; a signing record (tool id, version, content fingerprint, your account id, time); your display name (nickname or account name) is written into the file and visible to whoever receives it (sign-in required). Building a dashboard from a sentence (AI, optional; not offered in mainland China): the sentence you type, the App language, how many more widgets the current dashboard can hold and, within the same session, the widget list from the previous round are sent to Anthropic to pick widgets and fill in their settings (§3.2, §5); we do not keep the sentence. Our server records only how many times each account used it each day (kept 7 days) and the session (random id, account, round number; deleted after 24 hours); sign-in required. Launch notification: the email and language you leave on get.numable.app. Server notifications (optional, off by default; currently iPhone, iPad, Mac and the Google Play version of Android only; no sign-in needed): once you allow a tool, the device push token (the token Apple's push service — or, on Android, Google's Firebase Cloud Messaging (FCM) — assigns to this app on this device), the device platform type (Apple or Android) and environment (production / test), the App language and a device key the App generates at random (we keep only its hash); for each permission, the tool, when you granted it and when it last sent; and the notification credential we create for that device and tool (we keep only its hash). We do not keep notification content, tools never receive the push token, and none of this is linked to your Numable account (§3.4). Multi-device sync (paid, optional): see §3; besides the encrypted content we keep a random device number generated by the App for sync (not a system or advertising identifier), platform type, when a device joined or was removed, last-sync time, record counts and sizes, and a check value for the recovery code. (2.2) Automatically collected: your login token (JWT), stored only on your device — Keychain on iOS/iPadOS/macOS, EncryptedSharedPreferences on Android, the app's private data directory on HarmonyOS and Windows; basic network data (IP, platform and version) from tool downloads and update checks, for distribution, security and offering the tools available in your region; when you submit feedback or join the launch list, a salted hash of your IP (never the raw IP, not reversible) for abuse prevention; a record for each signed-in device: platform, device type, device name, app version, sign-in method, first sign-in and last active time, and the city-level location (city and country) estimated from its IP when it was last active — used only to list your devices under Me › Account › Signed-in devices and let you sign any of them out; the raw IP is not stored, records are deleted 30 days after a device is signed out, and devices inactive for 60 days are removed automatically. The device name comes from the system: the name iOS reports on iPhone / iPad, the name you gave the device in Android settings (or its model), the computer name on Mac and Windows, the model name on HarmonyOS. When you sign in on another device (computer, tablet, phone, TV, or a web browser when redeeming a gift code) by scanning with your signed-in phone, we record that device's platform, device type, device name, app version and approximate location estimated from its IP (city, state/province and country), used only to show on your phone's confirmation screen which device is asking to sign in so you can spot misuse; the raw IP is not stored and the record is deleted after about a day; the scan sign-in endpoint is rate-limited per IP, keeping only a hash of the IP for about a day. Crash & diagnostics: the App integrates no crash-reporting, analytics or advertising SDK and we collect no crash logs or usage analytics ourselves. Server notifications use the Apple Push Notification service (APNs), a system service from Apple and not a separately integrated SDK, on iPhone, iPad and Mac, and Google's Firebase Cloud Messaging SDK in the Google Play version of Android — the App's only push SDK, used for server notifications alone, with Firebase analytics not enabled (§3.4, §5). If you opt in to sharing analytics with developers in your system settings, platforms such as Apple (App Store) and Google (Google Play) may collect crash and performance statistics under their own policies and provide them to us in aggregate; you can turn this off in system settings. (2.3) Permissions, and what we do not collect. Camera: only when you choose to scan a code (signing in on another device, adding a sync device, connecting the desktop editor); frames are decoded on the device and never stored or uploaded. Photos: add-only permission only when you save a share image; when you pick an image in the scanner, only that one image is read, on the device, and never uploaded; we do not read your photo library. Local network: only to connect the desktop editor over the same Wi-Fi. Notifications: requested when you add a reminder or turn on server notifications; reminders fire locally on the device, and server notifications are off by default and turn on only after you tap Allow for a particular tool (§3.4). Face ID / Touch ID: only to confirm it is you before showing the sync recovery code; the system does this on the device and we receive no biometric data. We check whether WeChat is installed to decide whether to show WeChat sign-in / payment; we do not read your list of installed apps. We do not collect your device's location (GPS etc.), contacts or microphone; device identifiers (IDFA, IMEI, Android ID, OAID, MAC address etc.); clipboard contents (except what you paste yourself in the desktop editor); or the data you view inside widgets. We do no profiling or advertising tracking.
您创建的仪表盘、收藏、已安装的工具、偏好等默认仅存于设备本地（App Group / 应用私有目录），我们的服务器不保存副本。组件展示的实时数据由本应用在您的设备上直接向第三方网站或服务获取，数据不经过我们的服务器。
您自行提供的第三方凭证：部分组件需要您提供第三方服务的凭证（如 API Key、访问令牌）。凭证保存在设备的系统安全存储中，仅随请求发往该组件声明的域名，不会写入本地备份文件，也不会随意见反馈上传。凭证默认不上传到我们的服务器；仅当您在多设备同步中开启「同步密钥与凭证」时，凭证的值才会在您的设备上加密后同步到您的其他设备，我们的服务器只保存密文、无法解密（见下段）。您可在「我的」页的凭证管理中随时解除绑定。您导出的备份文件由您自行保管，我们不接收、不存储。
多设备同步（会员功能，默认关闭）：开启同步后，上述使用数据会以端到端加密的形式上传到我们的服务器，用于在您的其他设备间同步。加密密钥只在您的设备上生成与保存（另以「恢复码」形式交由您自行保管），我们的服务器只保存密文，无法解密、不做分析；服务器能看到的只有 §2.1 所列的同步元数据。开启同步后，您添加的第三方凭证的名称、类型、适用网站及使用它的组件（不含凭证的值）也会一并同步，便于在新设备上直接补填；凭证的值默认不同步，仅在您另外开启「同步密钥与凭证」（开启前会请您确认）后才同步，同样端到端加密。通过授权登录连接的服务不同步凭证的值，每台设备需各自连接。请妥善保管恢复码：恢复码一旦泄露，已同步的凭证也会随之泄露。关闭该开关时，我们删除云端的凭证值，各设备上已保存的保留。登录令牌、桌面小组件设置、主题与语言不参与同步。您可随时在「我的 › 多设备同步」关闭同步或删除云端数据（立即删除）；会员到期后同步暂停，云端数据保留 180 天（期间您仍可在新设备上取回）后自动删除；注销账号时一并删除。
重要：您获取的第三方数据受该第三方各自隐私政策约束。第三方网站会看到您的 IP 地址与工具发出的请求内容（例如您关注的股票代码、城市名）。请一并阅读遵守其条款；我们对第三方网站或服务的数据处理不承担责任。
3.1 例外：Claude Code 用量组件（可选） — 该组件的数据来自我们运营的投递服务 usage.numable.app，是本应用中唯一经由我们服务中转的展示数据，仅在您主动安装我们提供的 Claude Code 插件并在本应用中完成绑定后才会产生：
usage.numable.app 保存 Numable 通知中继发放的通知凭据（不是设备推送令牌）、您选的提醒条件（等授权多少分钟、长任务多少分钟、是否提醒可能卡住）与 App 语言，在会话需要您处理时经 Numable 通知中继给您发通知（见 §3.4）。通知文字包含：项目名（没上传项目名时为「项目 A」这样的代号）、状态（在等您授权、长任务跑完了、可能卡住了），以及等了或跑了几分钟、卡住的原因。关闭即删除。3.2 例外：一句话建盘（可选，需登录，中国大陆不提供） — 您使用该功能时，输入的那句话会经我们的服务器发给 Anthropic, PBC（美国）的 Claude 模型，用于从公开的组件目录里挑选组件、填写参数；一同发送的只有 App 语言、当前仪表盘还能放几个组件，以及同一次建盘里上一轮生成的组件清单。不发送您的账号信息、已有的仪表盘和组件里的数据。我们不保存这句话；Anthropic 不用它训练模型，为安全审查最多保留 30 天。请不要在这句话里写入密码、证件号码等敏感信息。
3.3 官网首页的实时演示 — 您打开 get.numable.app 首页时，页面上那块仪表盘的数字由您的浏览器直接向公开的第三方接口获取（中文页：东方财富、gold-api.com、Frankfurter、Open-Meteo；英文页另有 Coinbase），不经过我们的服务器。这些网站会看到您的 IP 地址与浏览器发出的请求（例如取哪只股票、哪座城市的天气）。天气城市按浏览器的时区推断，不读取您的位置。我们的服务器只提供页面本身，不接收这些请求，也不接收取到的数据。
3.4 服务器通知（可选，默认关闭） — 有的工具需要在事情发生的那一刻提醒您（例如 Claude Code 在等您授权时）。这类通知由工具自己的服务触发，经我们的服务器转给 Apple 推送通知服务（APNs，用于 iPhone、iPad、Mac）或 Google 的 Firebase 云消息服务（FCM，用于 Android 的 Google Play 版），送到您的设备。目前只在 iPhone、iPad、Mac 与 Android 的 Google Play 版上提供；中国大陆发行的 Android 版、HarmonyOS 版与 Windows 版不提供。
api.numable.app（设备钥匙只保存其哈希）。我们为「这台设备 × 这个工具」生成一个通知凭据交给该工具（服务器只保存其哈希），并记录每条授权对应的工具、授权时刻与最后一次发送时刻。工具拿不到您的设备推送令牌。这些信息不与您的 Numable 账号关联，不登录也能使用。Your usage data is stored only on your device by default; our servers keep no copy. Live widget data is fetched directly from third-party sources by the App on your device and does not pass through our servers. Credentials you provide (e.g. API keys or access tokens some widgets need) are kept in the device's system secure store, sent only to the hosts the widget declares, and are never written into local backup files or attached to feedback. By default they are not uploaded to our servers; only if you turn on "Sync keys and credentials" in multi-device sync are their values encrypted on your device and synced to your other devices, and our servers hold ciphertext only and cannot decrypt it (see below). You can unbind them under "Me" at any time. Backup files you export stay with you; we never receive them. Data you obtain from a third-party source is governed by that source's own privacy policy; the third-party website sees your IP address and what the tool asks for (e.g. the ticker or city you follow). We are not responsible for third parties' data practices.
Multi-device sync (a paid feature, off by default). If you turn it on, the usage data above is uploaded to our servers end-to-end encrypted and synced to your other devices. The key is generated and kept only on your devices (and in a recovery code you keep yourself); our servers store ciphertext only and cannot decrypt or analyze it — they see only the sync metadata listed in §2.1. With sync on, the name, type, applicable sites and using widgets of each third-party credential you add (not its value) are synced too, so you only need to fill in the value on a new device; credential values are not synced by default — only after you separately turn on "Sync keys and credentials" (you are asked to confirm first), with the same end-to-end encryption. Services connected through sign-in authorization (OAuth) never sync their values; connect them on each device. Keep your recovery code safe: if it leaks, the synced credentials leak with it. Turning that switch off deletes the credential values from the cloud; copies already saved on your devices stay. Login tokens, home-screen widget settings, theme and language are never synced. You can turn sync off or delete the cloud copy at any time under "Me › Sync across devices" (deleted immediately); when your membership lapses, sync pauses and the cloud copy is kept for 180 days (you can still restore it on a new device meanwhile) and then deleted; deleting your account deletes it too.
(3.1) Exception — the Claude Code usage widget (optional). Its data comes from our delivery service usage.numable.app and is the only display data that passes through a service we run. It exists only if you install our Claude Code plugin and bind it in the App. Daily summary: the plugin sends aggregate usage numbers — daily sessions, messages, tokens and tool-call counts, hourly activity counts, tokens per model, session-length statistics and the 5-hour usage window; per-project figures carry only an anonymous id. Project folder names are not included by default — only if you explicitly turn on the project-name option in the plugin is the folder name (last path segment only) attached; conversation content, code, full paths, branch names and session ids are never included. Devices are distinguished only by a hashed id. Daily review: sent with the daily summary as soon as the plugin is installed, with nothing else to turn on: for each of the last 14 days, per project, the number of sessions, active time, output tokens and lines added and removed. Projects carry only the anonymous id used above by default; the project folder name (last path segment only) is attached only if you turn on the project-name option; if you turn on the session-title option, session titles are attached too (at most 8 per project per day, with the same replacements made on your computer as for live-session titles below). There is one session-title option in the plugin, covering both the daily review and live sessions. Live sessions (on by default for new installs from plugin 0.10.0; you can turn them off at any time): a newly installed plugin turns on "Live sessions · sync to phone" by default; installs from before keep their existing setting (off by default), and you can turn it on in the plugin or tap "Turn on for my computer" on this tool's Live page in the App — that only records the time of the request on our server, and your computer reads it the next time it uploads usage and turns this on (only the status and turn shape below, never project names or session titles). After you turn it off in the plugin, it comes back on only if you request it again from your phone. When on, the plugin also sends each session's status (running, waiting for permission, waiting for input, ended, etc.) and the shape of each turn: its time, the categories of tools used and how often, token counts, consecutive failures, context compactions, and when sub-agents start and finish. Session and project ids are sent as salted hashes; the project folder name (last path segment only) and the session title (up to 80 characters, with URLs, email addresses, paths and key-like long strings replaced by … on your computer before upload) each need their own option. Prompts, replies, commands, file names, tool arguments and results, full paths and branch names are never included. Live data is kept on the server for only 24 hours. Server notifications (optional): if you turn them on in this tool, usage.numable.app keeps the notification credential issued by the Numable notification relay (not the device push token), the alert conditions you choose (how many minutes waiting for permission, how many minutes for a long task, whether to alert when a session may be stuck) and the App language, and sends you a notification through the Numable notification relay when a session needs you (§3.4). The notification text contains the project name (or a code name such as "Project A" if you haven't uploaded project names), the status (waiting for your permission, a long task has finished, may be stuck) and how many minutes it has waited or run, or why it seems stuck. Turning them off deletes these. Data sits in an anonymous space not linked to your Numable account, written and read with plugin-generated tokens. A space with no upload for 90 consecutive days is deleted automatically; live data is deleted after 24 hours and notification settings when you turn them off; requests are rate-limited by IP and those rate-limit records are purged after about a day. Uninstall the plugin to stop uploads; unbind the credential in the App to stop reads.
(3.2) Exception — building a dashboard from a sentence (optional, sign-in required, not offered in mainland China). The sentence you type is sent through our server to Anthropic, PBC (United States) and its Claude model to pick widgets from the public widget catalog and fill in their settings; the only other things sent are the App language, how many more widgets the current dashboard can hold and, within the same session, the widget list from the previous round. Your account details, existing dashboards and widget data are not sent. We do not keep the sentence; Anthropic does not use it to train models and keeps it for up to 30 days for safety review. Please don't put passwords, ID numbers or other sensitive information in it.
(3.3) The live demo on our website. When you open the get.numable.app home page, the numbers on its dashboard are fetched by your browser directly from public third-party APIs (East Money, gold-api.com, Frankfurter and Open-Meteo; the English page also uses Coinbase), not through our servers. Those sites see your IP address and what your browser asks for (e.g. which stock, or which city's weather). The weather city is inferred from your browser's time zone; we don't read your location. Our servers only serve the page itself; they never receive these requests or the data they return.
(3.4) Server notifications (optional, off by default). Some tools need to alert you the moment something happens (for example, when Claude Code is waiting for your permission). These notifications are triggered by the tool's own service and passed by our server to the Apple Push Notification service (APNs) on iPhone, iPad and Mac, or to Google's Firebase Cloud Messaging (FCM) in the Google Play version of Android, which delivers them to your device. They are currently offered on iPhone, iPad, Mac and the Google Play version of Android only; the Android version distributed in mainland China, HarmonyOS and Windows do not offer them. Turning them on: off by default; they are turned on for a tool only when that tool asks and you tap Allow for that tool in the App's own panel — each tool is allowed separately. On Android 13 and later, the system also asks for notification permission at that point. What we receive and keep: when you turn them on, the App sends our server api.numable.app the device push token (the token Apple's push service — or, on Android, Google's Firebase Cloud Messaging (FCM) — assigns to this app on this device), the device platform type (Apple or Android) and environment (production / test), the App language and a device key the App generates at random (we keep only its hash). We create a notification credential for that device and tool and give it to the tool (our server keeps only its hash), and we record, for each permission, the tool, when you granted it and when it last sent. The tool never receives your device push token. None of this is linked to your Numable account, and it works without signing in. Firebase SDK on Android: for this, the Google Play version of Android integrates Google's Firebase Cloud Messaging SDK (the Android version distributed in mainland China does not include it). It does not start by default; it initializes and obtains a registration token only after you tap Allow for a tool, and from then on it sends Google the FCM registration token, a Firebase installation ID (FID) the SDK generates, app and package information, and the basic device and OS information needed to deliver messages. We have not enabled Google Analytics for Firebase or any other Firebase component. Google's handling of this information is governed by its privacy policy (policies.google.com/privacy) and Firebase's privacy information (firebase.google.com/support/privacy). Sending: when something happens, the tool's own service asks our server, with the credential, to send a notification. The notification text is written by the tool that sends it; we put the tool's name before the title and limit the rate (at most 6 per tool per device per minute and 60 per day), then deliver it through Apple's or Google's push service. The notification text passes through Apple's or Google's push service; we discard it once forwarded and do not keep notification content. Turning them off: under "Me › Reminders › Server notifications" you can turn them off tool by tool; the tool's credential stops working immediately. Retention: a permission you turn off is deleted after 30 days; a device with no active permission and no update for 30 days is deleted together with its push token; once Apple or Google tells us a token is no longer valid (for example, you uninstalled the App), we stop using it. Wish progress: when you submit a wish on iPhone, iPad, Mac or Android (Google Play version) with “Tell me when it's ready” on (on by default, can be turned off, no sign-in needed), the App registers the device the same way — for Numable itself rather than a tool — and we record only the device id and App language on that wish, not linked to your account; when the wish is built or an existing widget already covers it, our server sends one notification and then deletes that record.
仅用于：(a) 提供与维护账号、会员、多设备同步、发布、分享文件、一句话建盘、服务器通知、举报/申诉、反馈等功能；(b) 分发与更新工具并保障其完整性与来源可信（Ed25519 签名校验）；(c) 处理会员购买、续费、退款与售后；(d) 安全防护、滥用与欺诈防范；(e) 履行法律义务。我们不将您的个人信息用于广告投放或出售。
We use information only to: (a) provide account, membership, multi-device sync, publishing, file sharing, building a dashboard from a sentence, server notifications, report/appeal and feedback features; (b) distribute/update tools and verify their integrity and authenticity (Ed25519); (c) process membership purchases, renewals, refunds and support; (d) ensure security and prevent abuse/fraud; (e) meet legal obligations. We do not use your personal information for advertising, and we do not sell it.
为实现登录、付款等功能，本应用集成或使用了以下第三方 SDK / 服务。本应用未集成任何崩溃上报、统计分析或广告 SDK；服务器通知在 iPhone、iPad、Mac 上使用的 Apple 推送通知服务（APNs）是 Apple 的系统服务，不是另行集成的 SDK；Android 的 Google Play 版为服务器通知集成了 Google 的 Firebase Cloud Messaging SDK，这是本应用唯一的推送 SDK。完整清单（含各 SDK 的隐私政策链接与不涉及个人信息的开源库）见《第三方信息共享清单》。
| 名称 | 提供方 | 平台 | 用途 | 涉及个人信息 |
|---|---|---|---|---|
| 微信 OpenSDK | 深圳市腾讯计算机系统有限公司 | iOS/iPadOS（仅登录，不含支付模块）、Android、HarmonyOS | 微信登录；国内 Android 与 HarmonyOS 版另用于拉起微信付款 | 我们获得微信 unionid、昵称、头像；付款时向微信传递本次订单的预支付信息 |
| 微信支付 | 财付通支付科技有限公司 | 国内 Android、HarmonyOS、Windows（扫码付款）；服务端 | 会员付款、查询订单、退款 | 商户订单号、商品描述、金额、支付结果、微信支付订单号、支付时间；不含支付账户信息 |
| StoreKit（App 内购买，系统框架） | Apple | iOS/iPadOS/macOS | 会员购买、恢复购买、管理订阅 | 交易标识、商品、订阅状态与到期时间 |
| Google Play 结算库 | Android | Google Play 版会员购买、恢复购买 | 购买凭证（服务器只存其哈希）、商品、订阅状态与到期时间 | |
| Sign in with Apple | Apple | iOS/iPadOS/macOS | Apple 账号登录（系统原生能力） | Apple 用户标识、邮箱（可为 Apple 隐藏邮箱）、姓名（仅首次授权） |
| Apple 推送通知服务（APNs，系统服务） | Apple | iOS/iPadOS/macOS；服务端 | 仅在您开启服务器通知后使用，把通知送到您的设备 | Apple 会处理设备推送令牌与通知文字 |
| Firebase Cloud Messaging（FCM） | Android（仅 Google Play 版）；服务端 | 仅在您开启服务器通知后初始化，把通知送到您的设备 | Google 会处理 FCM 注册令牌、SDK 生成的 Firebase 安装标识（FID）、应用与设备基本信息以及通知文字；未启用 Google Analytics for Firebase | |
| 华为账号服务（Account Kit） | 华为 | HarmonyOS | 华为账号登录（系统原生能力） | 华为账号 UnionID；昵称与头像（仅在您授权时） |
| Google 账号登录 | 全部客户端 | 系统浏览器完成 OAuth（不集成 Google 登录 SDK） | 用户标识、邮箱、姓名、头像 URL | |
| GitHub 账号登录 | GitHub | 全部客户端 | 系统浏览器完成 OAuth（不集成 GitHub SDK） | 用户标识、用户名、邮箱、姓名、头像 URL |
| Cloudflare | Cloudflare | 服务端 | 工具的分发、账号、会员、反馈、同步等后端服务的托管（Workers / D1 / R2） | 见 §7 |
| Anthropic（Claude 模型） | Anthropic, PBC | 服务端（中国大陆以外） | 一句话建盘：挑选组件、填写参数 | 您输入的那句话、App 语言、额度状态、同一次建盘上一轮的组件清单；不含账号信息；不用于训练模型，Anthropic 为安全审查最多保留 30 天 |
| ZXing Android Embedded | 开源 | Android | 扫码 | 相机画面（实时识别，不留存） |
| Glide / Coil | 开源 | Android | 组件图片加载与本地缓存 | 访问图片网址时的网络请求 |
| AndroidX Browser / Security | Google（开源） | Android | 系统浏览器登录 / 本地加密存储 | 本地令牌加密 |
其余开源库（MJRefresh、ZIPFoundation、Kanna、SwiftDraw、SmartRefreshLayout、Material Components、BouncyCastle 等）只在设备本地运行，不涉及个人信息。若清单变更，我们将同步更新本政策与《第三方信息共享清单》。
The App integrates or uses the third-party SDKs and services above. It integrates no crash-reporting, analytics or advertising SDK; server notifications use the Apple Push Notification service (APNs), a system service from Apple and not a separately integrated SDK, on iPhone, iPad and Mac, and, in the Google Play version of Android, Google's Firebase Cloud Messaging SDK — the App's only push SDK. The full list, with each SDK's privacy policy and the open-source libraries that process no personal information, is on the third-party SDK page. In short: WeChat OpenSDK (Tencent; iOS/iPadOS sign-in only without the payment module, Android, HarmonyOS) for WeChat sign-in and, in the Android (China) and HarmonyOS versions, to open WeChat for payment; WeChat Pay (Tenpay; Android (China), HarmonyOS, Windows by QR code; server side) for membership payments, order queries and refunds — order number, product description, amount, result, WeChat Pay transaction number and payment time, never payment-account details; StoreKit (Apple system framework) and the Google Play Billing Library for in-app purchases, restores and subscriptions — transaction identifier (Google purchase tokens are stored only as a hash), product, status and expiry; Sign in with Apple on Apple platforms; the Apple Push Notification service (APNs), an Apple system service on iPhone, iPad and Mac, used only after you turn on server notifications, to deliver them to your device — Apple handles the device push token and the notification text; Firebase Cloud Messaging (FCM) (Google; Android, Google Play version only — not in the version distributed in mainland China; server side), initialized only after you turn on server notifications, to deliver them — Google handles the FCM registration token, the Firebase installation ID (FID) the SDK generates, basic app and device information and the notification text; Google Analytics for Firebase is not enabled; Google and GitHub sign-in on all clients through the system browser, without any provider SDK; Cloudflare hosts our backend (see §7); Anthropic (Claude model; server side, outside mainland China) for building a dashboard from a sentence — the sentence you type, the App language, quota state and the previous round's widget list, without account details; not used for model training, kept by Anthropic for up to 30 days for safety review; ZXing, Glide / Coil and AndroidX Browser / Security on Android. We update this list when integrations change.
Numable 的基础功能免费，另提供付费的 Pro 会员。购买会员需要登录，会员挂在您的账号上。不同版本的付款方式与我们处理的信息如下：
兑换码：我们也会通过兑换码赠送会员。兑换只能在网页 get.numable.app/redeem 上进行：您输入兑换码，用手机上已登录的 Numable 扫码登录，确认账号后领取，会员挂在该账号上；领取完成后网页立即退出登录。我们保存：兑换的批次、兑换码末四位（活动口令则为口令本身）、赠送天数、兑换后的会员到期时间、兑换时间与所属账号；兑换码本身只保存哈希值。赠送的会员不涉及付款，我们不收集任何支付信息。
免费试用：从来没有开通过 Pro 的账号，可以在会员页免费试用 Pro 7 天，每个账号一次，到期自动回到免费版，不会扣费，也不收集任何支付信息。为防止重复领取，我们保存账号标识的哈希值与试用起止时间。
我们不收集、不保存您的银行卡号、支付密码等支付账户信息，这些信息由 Apple、Google 或财付通（微信支付）处理，受其各自隐私政策约束。为核对账目、处理退款与争议，购买记录（商品、金额、时间、交易编号、状态变化）依据《中华人民共和国电子商务法》等法律法规，自交易完成之日起保存不少于三年；您注销账号后，会员状态随之删除，购买记录按上述要求保留。会员的价格、续费、取消、退款与到期规则，见《用户协议》§8。
The core of Numable is free, and we offer a paid Pro membership. Signing in is required to buy it; membership belongs to your account. App Store (iOS / iPadOS / macOS): Apple takes the payment; we receive the transaction identifier, our server verifies it with Apple and records the product, transaction identifier, purchase status and expiry, whether it auto-renews and the account it belongs to, and receives Apple's renewal and refund notifications; we do not keep the Apple receipt itself. Google Play (Android): Google Play takes the payment; we receive the purchase token, our server verifies it with Google and confirms delivery, and keeps only a hash of the token plus the product, status and expiry, auto-renew flag and account, and receives Google's renewal and refund notifications. WeChat Pay (Android (China), HarmonyOS, Windows): we create the order and you pay inside WeChat (by QR code on Windows); we keep the order number, account, product, amount, payment scene, order status, order and payment times, and the WeChat Pay transaction number, and we do not keep the payer's WeChat identifier. Gift codes: we also give Pro through gift codes, redeemed only on the web page get.numable.app/redeem — you enter the code, sign in by scanning with Numable on your signed-in phone, confirm the account and redeem; the page signs out right after. We keep the code's batch, its last four characters (or the promo word itself), the days granted, the resulting expiry, the time and the account, and store the code itself only as a hash; no payment is involved and no payment details are collected. Free trial: an account that has never had Pro can try it free for 7 days from the membership page, once per account; it goes back to Free when it ends, with no charge and no payment details collected. To prevent repeat trials we keep a hash of the account identifier and the trial's start and end times. We never collect or store your card number, payment password or other payment-account details; Apple, Google or Tenpay (WeChat Pay) handle them under their own privacy policies. To reconcile accounts and handle refunds and disputes, purchase records (product, amount, time, transaction number, status changes) are kept for at least three years from the transaction under China's E-Commerce Law and other applicable laws; when you delete your account, the membership state is deleted and purchase records are kept as described. Prices, renewal, cancellation, refunds and expiry are covered in Terms §8.
账号、会员、反馈、举报、发布记录等后端数据存储于 Cloudflare（Workers / D1 / R2）。因我们以海外分发为主，数据可能存储于中国境外；如您在中国境内且涉及个人信息出境，我们将依 PIPL 履行告知—单独同意及相应合规义务（详见 §11）。登录令牌仅保存在设备本地；第三方凭证保存在设备的系统安全存储中，仅在您开启「同步密钥与凭证」时以端到端加密形式同步到您的其他设备（见 §2、§3）；与我们服务之间的网络传输经 HTTPS/TLS 加密。
账号信息在您使用期间保留。注销账号时，我们立即删除账号资料（登录方式、第三方账号标识、邮箱、名称、头像、昵称）、会员状态、登录设备记录与多设备同步的云端数据，并将您提交的反馈与账号解除关联（清除账号标识与联系方式，反馈正文保留用于产品改进），兑换码的兑换记录同样与账号解除关联；使用 Apple 登录的账号，我们同时向 Apple 撤销授权并删除所存的 Apple 授权凭据。以下信息在注销后仍会保留：购买记录（见 §6）；免费试用记录（账号标识的哈希值与试用起止时间，用于防止重复领取）；举报与申诉记录中的账号标识（用于防止重复举报与治理追溯）；发布者封禁记录（防止通过注销后重新登录规避封禁）；您已发布的内容（按《用户协议》§5.1 处理）；分享文件的签名记录（工具标识、版本、内容指纹、时间，用于停用违规分享，与账号解除关联；已发出的文件里的显示名称无法收回）；法律法规要求留存的记录。反馈、举报、申诉在账号存续期间保留；官网上线通知邮箱保留至您联系我们删除。多设备同步的云端数据（密文）在您开启同步期间保留；您在「我的 › 多设备同步」删除云端数据或注销账号时立即删除；会员到期后保留 180 天后自动删除。服务器通知的授权在您关闭后 30 天删除；某台设备已没有任何有效授权、且 30 天没有更新时，连同设备推送令牌一起删除（见 §3.4）。各类信息的保留期逐项见《个人信息收集清单》。
Backend data (account, membership, feedback, reports, publishing records) is stored on Cloudflare (Workers/D1/R2) and, as we distribute primarily overseas, may be stored outside China; cross-border transfer of mainland-China users' personal information is handled under PIPL (§11). Login tokens stay on your device; third-party credentials stay in the device's secure store and are synced end-to-end encrypted to your other devices only if you turn on "Sync keys and credentials" (§2, §3); traffic to our services uses HTTPS/TLS. We retain account data while your account is active. When you delete your account we immediately delete the account profile (provider, provider id, email, name, avatar, nickname), membership state, signed-in device records and the cloud sync copy, and detach your feedback from it (account id and contact removed; the feedback text is kept for product improvement) as well as your gift-code redemptions; for Sign in with Apple accounts we also revoke the authorization with Apple and delete the stored Apple authorization credential. Retained after deletion: purchase records (§6); the free-trial record (a hash of the account identifier and the trial times, to prevent repeat trials); the account id on reports and appeals (to prevent duplicate reports and keep moderation auditable); publisher-ban records (so deletion and re-login cannot evade a ban); content you published (handled under Terms §5.1); signing records of files you shared (tool id, version, content fingerprint, time — detached from your account, kept to disable abusive shares; the display name inside files already sent cannot be recalled); and records the law requires us to keep. Feedback, reports and appeals are kept while your account exists; launch-list emails until you ask us to delete them. Encrypted sync data is kept while sync is on, deleted immediately when you delete the cloud copy under "Me › Sync across devices" or delete your account, and purged 180 days after your membership lapses. A server-notification permission is deleted 30 days after you turn it off; a device with no active permission and no update for 30 days is deleted together with its push token (§3.4). Per-item retention is on the data-we-collect page.
我们不出售您的个人信息。仅在下列情形共享：(a) 经您同意；(b) 为实现功能所必需的第三方服务商（如 Cloudflare，以及为完成付款的 Apple / Google / 微信支付、为完成一句话建盘的 Anthropic、为送达服务器通知的 Apple 与 Google 推送服务），在合同或其服务条款约束下按最小必要处理；(c) 法律法规或司法/行政机关依法要求。您选择用 Apple / 华为账号 / 微信 / Google / GitHub 登录时，登录过程由该服务商按其隐私政策处理；您付款时，付款过程由 Apple / Google / 财付通按其隐私政策处理。发布 UGC 内容时，您的发布者名称及所发布内容将对其他用户可见（详见《用户协议》）。逐项共享情况见《第三方信息共享清单》。
We do not sell your data. We share only: (a) with your consent; (b) with providers strictly necessary to run the service (e.g. Cloudflare, Apple / Google / WeChat Pay to complete a payment, Anthropic to build a dashboard from a sentence, and Apple's and Google's push services to deliver server notifications) under contract or their service terms and minimization; (c) as required by law or lawful authority. When you sign in with Apple, WeChat, Google or GitHub, that provider handles the sign-in under its own privacy policy; when you pay, Apple, Google or Tenpay handles the payment under its own policy. When you publish UGC, your publisher name and the content become visible to other users (see the Terms). Details are on the third-party SDK page.
您有权查阅、复制、更正、补充、删除您的个人信息；撤回同意；注销账号；获取个人信息副本（可携带）。GDPR 下您另享限制处理、反对处理、可携权及向监管机构投诉的权利；CCPA 下您享有知情、删除、以及“不出售”的权利（我们本就不出售）。行使权利请见 §12，我们将在 15 个工作日内响应。注销账号：在任一平台的应用内进入「我的」页 → 点顶部账号行 → 在登录面板「退出登录」下方点「注销账号」，确认后立即生效；无法登录时可按 注销账号页面所述通过邮件申请。注销账号不会取消您在 App Store / Google Play 的订阅，请先在商店的订阅管理里取消。
You may access, copy, correct, supplement, delete your personal information; withdraw consent; close your account; and obtain a portable copy. GDPR additionally grants restriction, objection, portability, and the right to complain to a supervisory authority; CCPA grants rights to know, delete, and opt out of sale (we do not sell). Contact us via §12; we respond within 15 business days. Account deletion: in the App on any platform, open "Me" → tap the account row → tap "Delete account" below "Sign out"; it takes effect immediately. If you cannot sign in, follow the account deletion page to request deletion by email. Deleting your account does not cancel an App Store or Google Play subscription — cancel it in the store first.
本应用不面向 14 周岁以下儿童。若您为不满 14 周岁的未成年人，请在监护人同意并指导下使用，并在监护人同意后再购买会员；如我们发现在未获监护人有效同意下收集了儿童个人信息，将尽快删除。
The App is not directed to children under 14. Minors under 14 should use it, and buy membership, only with guardian consent. We delete children's data collected without valid guardian consent.
对于中国境内用户的个人信息出境，我们将：向您告知境外接收方信息及处理目的；取得您的单独同意；并采取 PIPL 要求的合规路径（通过安全评估、订立标准合同或通过认证之一）。境外接收方：Cloudflare, Inc.（美国；联系方式 privacyquestions@cloudflare.com），为我们托管服务器与数据库；您开启服务器通知后，另有 Apple Inc.（美国；联系方式 https://www.apple.com/legal/privacy/contact/）经 Apple 推送通知服务、Google LLC（美国；联系方式 https://support.google.com/policies/contact/general_privacy_form）经 Firebase Cloud Messaging，把通知送达您的设备，经手设备推送令牌与通知文字（Google 另经手 Firebase 安装 ID）。出境的信息：账号信息、购买记录、加密后的同步数据、反馈内容、网络地址，以及您开启服务器通知时的设备推送令牌；目的：提供登录、会员、多设备同步、服务器通知与客户服务；方式：经加密网络传输后存储与处理。在中国大陆发行的版本会在首次启动时单独请求你的同意；你可以通过 privacy@numable.app 向我们或境外接收方行使查阅、复制、更正、删除等权利。
Where personal information of mainland-China users is transferred abroad, we provide notice of the overseas recipient and purpose, obtain your separate consent, and adopt a PIPL-compliant transfer mechanism (security assessment, standard contract, or certification). Overseas recipients: Cloudflare, Inc. (United States; privacyquestions@cloudflare.com), which hosts our servers and databases; and, if you turn on server notifications, Apple Inc. (United States; https://www.apple.com/legal/privacy/contact/) through the Apple Push Notification service and Google LLC (United States; https://support.google.com/policies/contact/general_privacy_form) through Firebase Cloud Messaging, which deliver notifications to your device and handle the device push token and the notification text (Google also the Firebase installation ID). Information transferred: account details, purchase records, encrypted sync data, feedback, IP address and, if you turn on server notifications, the device push token; purpose: sign-in, Pro, multi-device sync, server notifications and support; method: sent over encrypted connections, then stored and processed. Versions distributed in mainland China ask for your separate consent on first launch. Contact privacy@numable.app to exercise your rights to access, copy, correct or delete, including against the overseas recipient.
个人信息处理者：上海沐小阳网络科技有限公司，注册地址：上海市浦东新区达秀路151号1幢3层301室。隐私相关事宜：privacy@numable.app；一般客服与会员售后：support@numable.app。App 备案号：沪ICP备2021019734号-4A。
Controller: Shanghai Muxiaoyang Network Technology Co., Ltd., Room 301, 3rd Floor, Building 1, No. 151 Daxiu Road, Pudong New Area, Shanghai, China. Privacy contact: privacy@numable.app; general and membership support: support@numable.app. Mainland China app filing number: 沪ICP备2021019734号-4A.
我们可能适时更新本政策；重大变更将通过应用内显著方式通知，并在必要时重新征得您的同意。继续使用即表示接受更新后的政策。
We may update this policy; material changes will be notified prominently in-app and, where required, re-consented. Continued use constitutes acceptance.