本清单按功能逐项列出 Numable 收集的个人信息：收集什么、用来做什么、在什么场景下收集、是否必须提供、保存多久。Numable 是本地优先的应用：您的仪表盘、已安装的工具、组件数据默认只保存在您的设备上，不在本清单之列；组件的实时数据由您的设备直接向第三方网站获取，我们不经手。未登录也能使用浏览、安装、仪表盘与桌面小组件。更完整的说明见《隐私政策》（get.numable.app/privacy）；我们与第三方的信息共享见《第三方信息共享清单》（get.numable.app/privacy/sdk）。
This list shows, feature by feature, the personal information Numable collects: what it is, why, when, whether it is required, and how long we keep it. Numable is local-first: your dashboards, installed tools and widget data stay on your device by default and are not on this list; live widget data is fetched by your device straight from third-party websites and never reaches us. Browsing, installing, dashboards and home-screen widgets work without signing in. See the Privacy Policy (get.numable.app/privacy) for the full picture and the third-party sharing list (get.numable.app/privacy/sdk) for what third parties receive.
| 功能 | 收集的信息 | 使用目的 | 收集场景 | 是否必要 | 保存期限 |
|---|---|---|---|---|---|
| 账号登录 | 登录方式；第三方账号标识（Apple、Google、GitHub 的用户标识，微信为 unionid，华为账号为 UnionID）；邮箱（微信不提供）；名称或用户名；头像网址；使用 Apple 登录时的 Apple 授权凭据（仅用于注销账号时撤销授权） | 建立并识别您的账号 | 您选择用 Apple / 华为账号 / 微信 / Google / GitHub 登录，或用已登录的手机扫码登录时 | 登录可选；购买会员、多设备同步、发布、举报、申诉时必要 | 账号存续期间；注销后立即删除 |
| 绑定其他登录方式 | 新绑定的登录方式及其账号标识 | 让您用多种方式登录同一账号 | 您在账号里绑定微信等其他登录方式时 | 否 | 解绑或注销后删除 |
| 昵称 | 您自行设置的昵称 | 在应用内显示 | 您设置昵称时 | 否 | 账号存续期间；注销后立即删除 |
| 登录设备记录 | 平台、设备类型、设备名、App 版本、登录方式、首次登录与最近活跃时间、按 IP 估算的城市与国家（不保存原始 IP） | 在「登录设备」里列出您的设备，让您退出某台设备的登录 | 每次登录，以及登录状态下启动 App、续期登录时 | 登录即产生 | 退出该设备后 30 天删除；60 天未活跃自动删除；注销账号时删除 |
| 扫码登录 | 发起登录那台设备的平台、设备类型、设备名、App 版本、按 IP 估算的城市、省 / 州与国家（不保存原始 IP）；确认扫码的账号 | 在手机确认页显示是哪台设备在请求登录，帮您识别冒用 | 您在某台设备上、或在兑换会员的网页上选择扫码登录时 | 仅使用扫码登录时 | 约 1 天后删除 |
| 扫码登录防滥用 | IP 地址的哈希值与请求次数 | 限制请求频率，防止滥用 | 访问扫码登录接口时 | 使用该功能时必要 | 约 1 天后删除 |
| 购买会员（App Store） | 商品、交易标识、购买状态、到期时间、是否自动续费、所属账号 | 开通与维持会员、处理续费与退款 | 您在 iPhone、iPad、Mac 上购买或恢复购买时，以及 Apple 通知续费、退款时 | 购买时必要 | 会员状态：账号存续期间，注销后删除；购买记录：自交易完成之日起不少于三年 |
| 购买会员（Google Play） | 商品、购买凭证的哈希值（不保存凭证本身）、购买状态、到期时间、是否自动续费、所属账号 | 同上，并向 Google 确认交付 | 您在 Android（Google Play 版）上购买或恢复购买时，以及 Google 通知续费、退款时 | 购买时必要 | 同上 |
| 购买会员（微信支付） | 订单号、所属账号、商品、金额、付款场景（App / 扫码）、订单状态、下单与付款时间、微信支付订单号；不保存付款人的微信标识 | 创建订单、确认到账、开通会员、处理退款 | 您在国内 Android、HarmonyOS、Windows 上用微信支付购买时 | 购买时必要 | 会员状态：账号存续期间，注销后删除；订单与购买记录：自交易完成之日起不少于三年 |
| 兑换码领取会员 | 兑换的批次、兑换码末四位（活动口令则为口令本身）、赠送天数、兑换后的会员到期时间、兑换时间、所属账号；兑换码本身只保存哈希值 | 开通赠送的会员、防止同一活动重复领取 | 您在网页 get.numable.app/redeem 兑换时 | 兑换时必要 | 账号存续期间；注销后与账号解除关联 |
| 免费试用会员 | 试用开始与到期时间、所属账号；账号标识的哈希值 | 开通试用、防止同一账号重复领取 | 您在会员页开始免费试用时 | 试用时必要 | 试用记录（哈希值与起止时间）：注销后仍保留，用于防止重复领取；会员状态：账号存续期间 |
| 意见反馈 | 反馈类别与正文；您自愿填写的联系方式；登录状态下的账号标识；诊断信息（App 版本、平台、系统版本、设备型号、语言、提交时打开的工具、内容地区及其判定依据，可在提交前关闭）；从组件或工具的「反馈」入口进来时，所反馈的工具与组件；心愿的选填项（数据从哪来、多久更新、放在哪）；IP 地址的加盐哈希（不保存原始 IP）。心愿会和其他人相近的心愿归在一起评估，其他用户只能看到评估后的标题与结果，看不到您的原话 | 处理反馈、定位问题、防滥用 | 您提交反馈时 | 否 | 账号存续期间；注销后删除账号标识与联系方式，正文与诊断信息保留用于改进产品 |
| 心愿进展通知（可选） | 您在提交心愿时打开「做好了告诉我」后：本机在服务器通知中登记的设备标识（不是设备推送令牌本身）与 App 语言，记在这条心愿上。不保存通知内容；与您的 Numable 账号不关联 | 心愿做好了或已经有现成的组件时通知您一次 | 您在 iPhone、iPad、Mac 或 Android（Google Play 版）上提交心愿并打开「做好了告诉我」时（默认打开，可关闭；不需要登录） | 否 | 通知发出后立即删除设备标识；没发出的随这条心愿保留 |
| 举报 | 被举报工具的标识与版本、举报类别、您填写的说明、您的账号标识 | 内容治理、防止重复举报 | 您举报工具时（需登录） | 否 | 长期保留，用于治理追溯；注销后仍保留账号标识 |
| 申诉 | 被下架工具的标识与版本、申诉说明、您的账号标识 | 处理下架申诉 | 发布者申诉时（需登录） | 否 | 同上 |
| 发布工具 | 您上传的内容包、您的账号标识；发布者名称会在安装面板上公开展示 | 分发您发布的内容、可追责 | 您发布工具时 | 发布时必要 | 按《用户协议》§5.1 处理；发布者封禁记录注销后仍保留 |
| 分享文件 | 您分享的内容包（仅校验与签名，签名后不保存）；签名记录：工具标识、版本、内容指纹、您的账号标识、显示名称、时间 | 生成可验证的分享文件、停用违规分享、可追责 | 您分享文件时 | 分享时必要 | 签名记录保留；注销时与账号解除关联、显示名称清除（已发出的文件不受影响） |
| 一句话建盘（AI，可选） | 每个账号每天的使用次数；本次建盘的会话（随机编号、所属账号、第几轮、创建时间）。您输入的那句话只转发给 Anthropic、不保存 | 限制每日次数、在同一次建盘里继续调整 | 您登录后使用一句话建盘时（中国大陆不提供） | 否 | 次数 7 天后删除；会话 24 小时后删除 |
| 服务器通知（可选） | 设备推送令牌（Apple 推送服务，或 Android 上 Google 的 Firebase 云消息服务（FCM），分配给本机本应用的令牌）、设备平台类型（Apple 或 Android）与环境（正式 / 测试）、App 语言、App 随机生成的设备钥匙的哈希；每条授权对应的工具、授权时刻与最后一次发送时刻；通知凭据的哈希。不保存通知内容；与您的 Numable 账号不关联 | 把您允许的工具发来的通知送到您的设备、限制发送频率、让您逐个关闭 | 您在 iPhone、iPad、Mac 或 Android（Google Play 版）上对某个工具点了「允许」后（默认关闭，不需要登录） | 否 | 关闭的授权 30 天后删除；设备已没有任何有效授权且 30 天没有更新时，连同设备推送令牌一起删除；Apple 或 Google 告知令牌失效后不再使用 |
| 多设备同步（会员功能） | 在您设备上加密后的同步内容（仪表盘、已安装工具清单、组件记录的数据、提醒、工具排序、凭证的名称与适用网站；开启「同步密钥与凭证」后另含凭证的值）——我们无法解密；以及同步元数据：随机生成的设备编号、设备平台类型、加入与移除时间、最后同步时间、记录条数与大小、恢复码校验串 | 在您的多台设备之间同步 | 您开启或加入同步后 | 否 | 同步开启期间保留；您删除云端数据或注销账号时立即删除；会员到期后保留 180 天再删除 |
| 官网上线通知 | 邮箱、语言、IP 地址的加盐哈希 | 上线时通知您 | 您在 get.numable.app 登记时 | 否 | 直至您联系我们删除 |
| 下载与更新工具 | IP 地址、平台与版本、所在地区（按 IP 或应用渠道判断） | 分发工具、提供您所在地区可用的工具、安全防护 | 浏览商店、安装与更新工具时 | 使用该功能时必要 | 不单独保存（仅在云服务商的访问日志中按其政策短期留存） |
| Claude Code 用量组件（可选，匿名） | 您电脑上的 Claude Code 插件上报的汇总用量：按日的会话、消息、token、工具调用次数，按小时活跃次数，按模型 token 数，会话时长，5 小时用量窗口；项目只带匿名编号（您打开项目名开关后才附项目文件夹名）；设备的哈希标识；限流用的 IP（约 1 天删除）。每日回顾（随每日汇总一起上报，无需另外开启）：近 14 天每天按项目的会话数、活跃时长、输出 token 数、增删行数，项目默认只带匿名编号（打开项目名开关后附项目文件夹名），打开会话标题开关后附会话标题（与实时会话共用同一个开关；每个项目每天最多 8 条，上传前先在您的电脑上把网址、邮箱、路径和像密钥的长串替换成 …）。实时会话（插件 0.10.0 起新安装默认开启；更早安装的默认关闭，可在插件里或在 App 该工具的「实时」页打开；随时可关闭）：各会话的状态与每一轮的结构（时刻、用到的工具类别与次数、token 数、连续失败次数、上下文压缩次数、子代理起止），会话号与项目号为加盐哈希，项目文件夹名与会话标题（最多 80 字，同样先替换）各需另开开关；不含提示词、回复、命令、文件名、工具参数与结果、完整路径、分支名。服务器通知（您在该工具里开启后）：Numable 通知中继发放的通知凭据（不是设备推送令牌）、您选的提醒条件、App 语言；通知文字包含项目名（或「项目 A」这样的代号）、状态，以及等了或跑了几分钟、卡住的原因。与您的 Numable 账号不关联 | 在该组件里显示您的用量；在会话需要您处理时给您发通知 | 您安装插件并在 App 里绑定后；实时会话新安装默认开启（可关闭），服务器通知需您另外开启 | 否 | 连续 90 天无新上报整体删除；实时数据 24 小时后删除；通知凭据与提醒条件在您关闭服务器通知时删除 |
Sign-in: provider; provider account id (Apple / Google / GitHub user id; WeChat unionid; HUAWEI ID UnionID); email (not provided by WeChat); name or username; avatar URL; for Sign in with Apple, an Apple authorization credential (used only to revoke the authorization when you delete your account) — to create and identify your account; when you sign in with Apple / HUAWEI ID / WeChat / Google / GitHub or by scanning with a signed-in phone; optional, but required for membership, sync, publishing, reports and appeals; kept while the account exists, deleted immediately on account deletion. Linked sign-in methods: the extra method and its id — deleted when unlinked or on account deletion. Nickname you set — deleted on account deletion. Signed-in devices: platform, device type, device name, app version, sign-in method, first sign-in and last active time, city and country estimated from the IP (raw IP not stored) — to list your devices and let you sign them out; deleted 30 days after sign-out, after 60 days inactive, or on account deletion. Scan sign-in (including from the gift-code web page): the requesting device's platform, type, name, app version and city, state/province and country estimated from its IP (raw IP not stored), and the confirming account — shown on your phone's confirmation screen; deleted after about a day; the endpoint is rate-limited per IP using a hash of the IP and a request count, deleted after about a day. Membership via App Store: product, transaction identifier, status, expiry, auto-renew flag, account. Via Google Play: the same, with only a hash of the purchase token. Via WeChat Pay: order number, account, product, amount, scene (app / QR), status, order and payment times, WeChat Pay transaction number — never the payer's WeChat identifier. Required when you buy; membership state is kept while the account exists and deleted on account deletion; purchase records are kept for at least three years from the transaction. Gift codes: batch, last four characters of the code (or the promo word itself), days granted, resulting expiry, time and account — the code itself only as a hash — to grant the gifted membership and stop repeat redemptions of one offer; collected when you redeem on get.numable.app/redeem; required to redeem; kept while the account exists and detached from it on deletion. Free trial: trial start and end times, the account, and a hash of the account identifier — to start the trial and stop the same account claiming it twice; collected when you start the trial on the membership page; required for the trial; the hash and trial times are kept after account deletion to prevent repeat trials. Feedback: category, text, optional contact, account id if signed in, diagnostics you can switch off (app version, platform, OS version, device model, language, the tool open at the time, content region and how it was determined), the tool and widget when you start from their “Feedback” entry, a wish's optional fields (where the data comes from, how often it updates, where you'd use it), salted IP hash — optional; wishes are grouped with similar wishes from other people for review, and other people see only the reviewed title and result, never your wording; on account deletion the account id and contact are removed and the text and diagnostics kept for product improvement. Wish updates (optional): when you turn on “Tell me when it's ready” while making a wish, the device id this app registered for server notifications (not the push token itself) and the app language, stored with that wish; no notification content is kept; not linked to your account — to notify you once when the wish is ready or something that already covers it exists — deleted as soon as the notification is sent. Reports / appeals: tool id and version, category or message, your account id — kept for moderation audit, including after account deletion. Publishing: the pack and your account id; the publisher name is public — handled under Terms §5.1; ban records survive deletion. Sharing as a file: the pack you share (checked and signed, not kept); a signing record with tool id, version, content fingerprint, account id, display name and time — to create a verifiable file, disable abusive shares and keep them accountable; required to share; the record is kept, detached from your account and stripped of the display name on account deletion (files already sent are unaffected). Building a dashboard from a sentence (AI, optional; not offered in mainland China): how many times each account used it each day, and the session (random id, account, round number, creation time) — to enforce the daily limit and let you keep adjusting within the same session; collected when you use it while signed in; optional; counts deleted after 7 days, sessions after 24 hours. The sentence you type is only forwarded to Anthropic and never kept. Server notifications (optional; iPhone, iPad, Mac and the Google Play version of Android): the device push token (the token Apple's push service — or, on Android, Google's Firebase Cloud Messaging (FCM) — assigns to this app on this device), the device platform type (Apple or Android) and environment (production / test), the App language and a hash of a device key the App generates at random; for each permission, the tool, when you granted it and when it last sent; a hash of the notification credential — no notification content, and not linked to your Numable account — to deliver notifications from tools you allow, limit how often they are sent and let you turn them off one by one; collected after you tap Allow for a tool (off by default, no sign-in needed); optional; a permission you turn off is deleted after 30 days, a device with no active permission and no update for 30 days is deleted together with its push token, and a token Apple or Google reports as no longer valid is no longer used. Multi-device sync (Pro): content encrypted on your device that we cannot decrypt, plus metadata (random device number, platform type, join / removal time, last sync, record counts and sizes, recovery-code check value) — kept while sync is on, deleted immediately when you delete the cloud copy or your account, or 180 days after membership lapses. Launch list: email, language, salted IP hash — until you ask us to delete it. Tool downloads and updates: IP, platform and version, region — not stored by us beyond the cloud provider's access logs. Claude Code usage widget (optional, anonymous): aggregate usage pushed by the plugin on your computer (daily sessions, messages, tokens, tool calls; hourly activity; tokens per model; session length; 5-hour window; anonymous project ids, folder names only if you turn that on; hashed device id; IP for rate limiting, about a day); the daily review, sent with the daily summary with nothing else to turn on (for each of the last 14 days, per project: sessions, active time, output tokens, lines added and removed; projects as anonymous ids unless you turn on project names; session titles if you turn on the session-title option, the same one that covers live sessions, at most 8 per project per day, with URLs, email addresses, paths and key-like long strings replaced by … on your computer first); live sessions, on by default for installs from plugin 0.10.0 (earlier installs: off until you turn on "Live sessions · sync to phone" in the plugin or tap "Turn on for my computer" on the tool's Live page; you can turn them off at any time) (each session's status and the shape of each turn: time, tool categories and counts, tokens, consecutive failures, context compactions, sub-agent start and finish; session and project ids as salted hashes; the project folder name and the session title (up to 80 characters, same replacements) each behind its own option; never prompts, replies, commands, file names, tool arguments or results, full paths or branch names); and, if you turn on server notifications in this tool, the notification credential issued by the Numable notification relay (not the device push token), your alert conditions and the App language (the notification text contains the project name or a code name such as "Project A", the status, and the minutes waited or run or why it seems stuck) — to show your usage and notify you when a session needs you; not linked to your Numable account; deleted after 90 days without uploads, live data after 24 hours, and the notification credential and conditions when you turn notifications off.
以下信息只在设备上使用，不上传到我们的服务器（开启多设备同步时按上表以密文同步的除外）。
| 功能 | 涉及的信息 / 权限 | 使用目的 | 场景 | 是否必要 | 保存期限 |
|---|---|---|---|---|---|
| 保持登录 | 登录令牌 | 保持登录状态 | 登录后 | 登录时必要 | 保存在系统安全存储或应用私有目录，退出登录即删除 |
| 仪表盘与组件 | 仪表盘、已安装的工具、组件参数与数据、提醒、偏好设置 | 提供核心功能 | 使用过程中 | 是 | 保存在设备上，直至您删除或卸载 |
| 第三方凭证 | 您为工具添加的 API Key、访问令牌等 | 让工具访问需要凭证的数据 | 您添加凭证时 | 否 | 保存在系统安全存储中，直至您删除；只随请求发往该工具声明的网站 |
| 扫码 | 相机权限；您从相册选中的一张图片 | 扫码登录另一台设备、添加同步设备、连接桌面端编辑器 | 您主动扫码时 | 否 | 在设备上实时识别，不保存 |
| 保存分享图 | 相册「仅添加」权限 | 把分享图存进相册 | 您点保存时 | 否 | 不读取相册 |
| 提醒与服务器通知 | 通知权限 | 在设备上按时提醒；显示您允许的工具发来的服务器通知 | 您添加提醒或开启服务器通知时 | 否 | 提醒规则保存在设备上；服务器通知见上表 |
| 查看恢复码 | 面容 ID / 触控 ID | 确认是您本人 | 您查看同步恢复码时（iPhone、iPad） | 否 | 由系统在设备上完成，我们拿不到生物特征信息 |
| 连接桌面端编辑器 | 本地网络权限 | 在同一 Wi-Fi 下预览正在编辑的组件 | 您连接编辑器时 | 否 | 不保存 |
| 微信登录与付款 | 检测设备上是否安装了微信 | 决定是否显示微信登录 / 付款 | 打开登录或会员页时 | 否 | 不保存；我们不读取应用列表 |
| 设备名 | iPhone / iPad 为系统给出的设备名；Android 为您在系统设置里起的设备名（没有则为机型）；Mac、Windows 为电脑名；HarmonyOS 为机型名 | 在「登录设备」与扫码确认页里区分您的设备 | 登录与扫码登录时（随上表上传） | 登录时必要 | 见上表「登录设备记录」「扫码登录」 |
These stay on your device and are never uploaded to us (except what multi-device sync uploads as ciphertext, above). Login token — in the system secure store or the app's private directory, deleted on sign-out. Dashboards, installed tools, widget parameters and data, reminders, preferences — on the device until you delete them or uninstall. Third-party credentials — in the system secure store until you delete them, sent only to the websites the tool declares. Camera, and one image you pick — for scanning codes (sign in on another device, add a sync device, connect the editor); decoded on the device, not kept. Photos add-only — to save share images; the library is never read. Notifications — for reminders you add and server notifications you turn on (see the table above). Face ID / Touch ID — to confirm it is you before showing the sync recovery code; done by the system, we receive no biometric data. Local network — to preview widgets from the desktop editor on the same Wi-Fi. Whether WeChat is installed — to decide whether to show WeChat sign-in / payment; we do not read your app list. Device name — the name iOS reports on iPhone / iPad, the name you gave the device in Android settings (or its model), the computer name on Mac and Windows, the model name on HarmonyOS; uploaded with the signed-in device and scan sign-in records above.
我们不收集：您设备的定位（GPS 等）、通讯录、短信、通话记录、麦克风、日历；设备标识符（IDFA、IMEI、Android ID、OAID、MAC 地址等）；已安装应用列表；剪贴板内容（仅在您于桌面端编辑器里主动粘贴时读取所粘贴的内容）；您在组件中查看的具体数据；您的银行卡号等支付账户信息。本应用不含崩溃上报、统计分析或广告 SDK；服务器通知在 iPhone、iPad、Mac 上使用 Apple 推送通知服务（Apple 的系统服务），在 Android 的 Google Play 版上使用 Google 的 Firebase Cloud Messaging SDK（只用于服务器通知，未启用 Firebase 统计分析）；我们不做用户画像与广告追踪。
We do not collect your device's location (GPS etc.), contacts, SMS, call logs, microphone or calendar; device identifiers (IDFA, IMEI, Android ID, OAID, MAC address etc.); your list of installed apps; clipboard contents (except what you paste yourself in the desktop editor); the data you view in widgets; or your card and payment-account details. The App has no crash-reporting, analytics or advertising SDK; server notifications use the Apple Push Notification service, a system service from Apple, on iPhone, iPad and Mac, and Google's Firebase Cloud Messaging SDK in the Google Play version of Android (used only for server notifications, with Firebase analytics not enabled). We do no profiling or ad tracking.
如需查阅、更正、删除您的个人信息或注销账号，请见《隐私政策》§9，或联系 privacy@numable.app。
To access, correct or delete your personal information or close your account, see Privacy Policy §9 or email privacy@numable.app.