AgreeAI 隐私政策
草稿 v0.2（2026-11-11，内测版：按实际使用的服务商改写——AI 统一用 DeepSeek 官方、在中国处理，后端在新加坡；正式上线前需律师审阅）
生效日期：2026-11-11（内测） 最近更新：2026-11-11
AgreeAI（以下简称“我们”）由张秀康（个人开发者）运营。本政策说明你使用 AgreeAI iPhone App 和网页参与端（统称“本服务”）时，我们收集哪些信息、怎么用、交给谁、存多久，以及你有哪些权利。
最重要的几点：
- 私密卡片只有 AI 能读。发起人、其他参与者和我们的员工默认都看不到卡片原文。
- 桌子结束 30 天后，我们删除卡片和对话的原文，只保留不能识别到你的统计数据。
- 我们不出售你的个人信息，不投放广告，也不用你的数据做跨应用追踪。
- 本服务仅面向 18 岁及以上的用户。
1. 我们收集哪些信息
| 类别 | 具体内容 | 来源 |
|---|
| 账号信息 | 用 Sign in with Apple 登录时：Apple 提供的用户标识，以及你选择分享的姓名和邮箱（可能是 Apple 的中转邮箱）；用邮箱注册时：邮箱地址；你设置的昵称、头像、用户名 | 你 / Apple |
| 好友关系 | 你添加的好友、好友链接和二维码 | 你 |
| 圆桌内容 | 你开的桌（模板、背景、硬性条件、交卡时限）、群聊消息、@ 主持人的对话、投票、你提交的方案 | 你 |
| 私密卡片 | 你在卡片里填写的内容，以及在卡片里和主持人的对话（例如预算区间、哪些日期不行、想要和不要的、饮食或喝酒方面的限制、体力强度） | 你 |
| 自建主持人 | 你描述的设定、名字、头像、说话方式 | 你 |
| 网页匿名参与 | 昵称；为了保证“一台设备一票”而在浏览器里保存的随机标识；你在桌里的内容（同上） | 你 / 你的浏览器 |
| 设备和使用信息 | 设备型号、系统版本、App 版本、语言和地区设置、推送令牌、IP 地址、错误日志 | 自动收集 |
| 使用统计 | 你用了哪些功能、流程走到哪一步、用了多长时间、整桌的汇总数字（例如交了几张卡、票数分布）、满意度分数、定案后你可选回答的“会不会照着做”、碰到免费版上限的次数。只记录固定选项和数字，从不记录你写的任何文字；不记录谁投了哪个方案、谁交卡或弃权。只有“开桌”这一条记录带一个由账号推算出的化名编号（用来统计“30 天内有没有再开桌”），其他记录不带任何人的编号。我们不用任何第三方统计或广告 SDK | 自动收集 |
| 举报和客服 | 你提交的举报、屏蔽记录、你发给我们的邮件 | 你 |
| 反馈 | 你在 App 或网页里写的反馈文字、你自己选择附上的 1 张截图、可选的满意度评分；自动附上 App 版本、手机型号、系统版本、语言、当前在哪一步和错误码；桌子编号由你决定附不附（只附编号，不附桌里的内容）。卡片内容、聊天记录不会被自动附上。网页匿名参与者的反馈不记录昵称和设备编号 | 你 / 自动收集 |
我们不收集：精确位置、通讯录、照片库（除非你主动选一张图片作为头像，或者附在反馈里）、广告标识符（IDFA）。
健康相关信息：卡片里的“饮食、喝酒、体力”等问题都不是必填。请不要写健康原因（例如疾病、怀孕），只写限制本身就够了（例如“不喝酒”）。如果你选择填写，我们会把它当作敏感信息，只用来生成方案，并按下面第 5 节的期限删除。填卡前我们会单独请你确认同意。
2. 我们怎么用这些信息
| 目的 | 用到的信息 | 依据 |
|---|
| 提供本服务：开桌、拉人、讨论、填卡、出方案、投票、定案 | 账号、圆桌内容、私密卡片 | 履行我们和你的约定 |
| 由 AI 主持人发言、整理卡片、联网查信息、生成和检查方案 | 圆桌内容、私密卡片（先整理成不含原话的条件） | 履行约定；对私密卡片和健康相关信息，另外取得你的单独同意 |
| 内容安全：审核主持人设定和群聊消息，处理举报和屏蔽 | 圆桌内容、自建主持人、举报记录 | 法律义务、保护用户安全 |
| 发送通知（有人进桌、方案出来了、轮到投票等） | 推送令牌 | 你的同意（可在系统设置里关掉） |
| 保证安全、防止刷票和滥用、排查故障 | 设备信息、IP、日志、浏览器随机标识 | 合法利益 |
| 改进产品和 AI 效果 | 使用统计（见第 1 节），看的是汇总数字（例如定案率、用时、满意度），少于 3 张桌或 3 个人的分组不显示 | 合法利益 |
我们不会用你的卡片内容训练模型，也不会允许我们的 AI 服务商用它来训练模型（以服务商的合同承诺为准）。
关于 AI：方案由 AI 根据大家的卡片综合生成，最后由全桌匿名投票决定。AI 不会对你个人作出有法律效果或类似重大影响的自动化决定。
3. 私密卡片怎么保密
- 卡片原文单独存储，发起人、其他参与者都没有任何页面或接口能看到。
- 群聊里的主持人拿不到卡片原文；出方案的 AI 只拿到整理好的条件，方案发出前还会自动检查有没有泄露任何人的原话或可识别的原因。
- 3–4 人的小桌，方案说法会更含糊，避免被反推出是谁。
- 宗教、健康这类能看出是谁的条件，不管桌子多大，方案和主持人都只说类别（例如“照顾了饮食上的限制”），不写具体内容。
- 我们的员工默认看不到原文，也不做随机抽查。只有在处理你本人的请求、调查举报、核实自动检查发现的疑似泄露，或者法律要求时，经过单独授权，才能查看与这件事有关的那部分内容，并且每次查看都会留下记录。
- 你写在卡片里的“忽略规则”之类的话，只会被当作普通内容，不会改变 AI 的行为。
但请注意：AI 综合出的方案会照顾所有人的条件，其他人可能根据方案猜到某些情况。我们尽力降低这种可能，但不能完全排除。
4. 我们把信息交给谁
我们不出售个人信息，也不会为了广告和别人“共享”。只有下面这些服务商替我们处理数据，他们只能按我们的要求使用，不能挪作他用：
| 服务商 | 做什么 | 涉及的信息 | 处理地点 |
|---|
| 杭州深度求索人工智能基础技术研究有限公司（DeepSeek）的官方 API | 主持人发言、整理卡片、生成和检查方案、内容安全审核、联网查信息 | 圆桌内容（群聊消息、主持人设定）、整理后的卡片条件、昵称、搜索关键词 | 中国 |
| Supabase, Inc. | 账号、数据库、实时消息、文件存储、服务端程序 | 上面第 1 节的大部分信息 | 新加坡 |
| Cloudflare, Inc. | 托管网页参与端（只提供网页文件，不存你的圆桌数据） | 访问网页时的 IP 地址和浏览器信息 | 全球节点 |
| Apple Inc.（Sign in with Apple、Apple 推送通知服务、TestFlight） | 登录、推送、内测分发 | Apple 用户标识、推送令牌、通知内容；TestFlight 的崩溃报告和你主动提交的反馈 | 美国等 |
另外，在下面这些情况下我们可能提供信息：法律、法院或政府依法要求；为保护用户或他人的人身安全；公司合并或收购时（我们会提前通知你）。
AI 处理地在中国：不管你在哪个国家或地区，你在圆桌里写的内容和整理后的卡片条件都会发给 DeepSeek，在中国处理。第一次把你的内容交给 AI 之前，App 会弹出同意页单独告诉你这一点，你同意后才会发送。
内测期间我们没有使用其他数据分析、AI 调用记录或看板服务。以后如果增加服务商，我们会先更新本政策并提醒你。
5. 保存多久
| 信息 | 保存期限 |
|---|
| 私密卡片原文、卡片里和主持人的对话、群聊消息原文、发起人写的背景摘要 | 桌子结束后 30 天内删除，只保留匿名统计数据 |
| 方案、投票结果、定案卡 | 跟着桌子保存，直到你删除账号；桌里其他人看到的方案在他们的“我的桌”里保留 |
| 账号信息、好友、自建主持人 | 直到你删除账号 |
| 网页匿名参与者的昵称和浏览器标识 | 桌子结束后 30 天内删除 |
| 安全日志、错误日志 | 不超过 90 天 |
| 员工查看保密内容的记录 | 3 年，只含编号和查看原因，不含内容 |
| 举报记录 | 处理完后 1 年，法律要求更长的除外 |
| 使用统计的原始记录 | 13 个月后删除；你删除账号时，开桌记录上的化名编号会被清除。不含个人信息的汇总数字可以长期保存 |
| 反馈文字和评分 | 提交后 180 天自动删除；你删除账号时一起删除 |
| 反馈截图 | 提交后 90 天自动删除；你删除账号时一起删除 |
| 正在处理的隐私或安全投诉 | 处理完再按上面的期限删除；法律要求更长的除外 |
| 备份 | 删除后最多 30 天内从备份中清除 |
6. 你的权利
你可以：
- 查看和导出你的个人信息；
- 更正你的资料；
- 删除：在 App 的“我的 → 隐私中心”里一键删除账号和全部数据；网页匿名参与者可以写邮件给我们，并提供桌子链接和昵称；
- 撤回同意：例如关掉推送；撤回对卡片处理的同意后，你就不能再填卡，但不影响之前已经进行的处理；
- 反对或限制某些处理；
- 投诉：向你所在地的监管机构投诉。
我们会在 30 天内答复（法律另有规定的从其规定）。联系方式见第 10 节。我们不会因为你行使这些权利而区别对待你。
美国各州居民：我们不出售或“共享”（用于跨情境行为广告）个人信息，也不把敏感个人信息用于提供本服务以外的目的。你可以通过第 10 节的方式行使你所在州法律赋予的权利（包括通过授权代理人），如果我们拒绝，你可以申诉。
华盛顿州等州的消费者健康数据：我们只在你单独同意后才收集卡片里可能涉及健康的信息，并只交给上面列出的、用于提供服务的服务商。【待律师确认是否需要另设《消费者健康数据隐私政策》】
7. 年龄
本服务仅面向 18 岁及以上的用户。注册时我们会通过 Apple 提供的年龄范围功能确认你已成年；网页匿名参与时，你需要确认自己已满 18 岁。如果我们发现收集了未满 18 岁用户的信息，会尽快删除。如果你认为有未成年人在使用本服务，请联系我们。
8. 数据安全和跨境
- 数据在传输时加密（HTTPS/TLS），在存储时加密；卡片原文和其他数据隔离存储，按最小权限访问。
- 你的信息可能在你所在国家以外的地方处理（见第 4 节）。
- 账号和圆桌数据存储在新加坡的 Supabase 服务器上；
- 交给 AI 处理的内容（圆桌内容、整理后的卡片条件、搜索关键词）发往中国，由 DeepSeek 处理；
- 对中国大陆用户，存储在新加坡属于个人信息出境，境外接收方是 Supabase, Inc.。我们会单独征得你的同意后再这样处理。【国区上线后改为境内存储】
- 任何安全措施都不能保证百分之百安全。如果发生个人信息泄露，我们会按法律要求通知你和监管机构。
9. 政策更新
政策有重要变化时，我们会在 App 里提醒你，必要时重新征得你的同意。
10. 联系我们
- 运营者：张秀康（个人开发者）
- 邮箱：zxiuk1537@gmail.com
- 中国大陆个人信息保护负责人：【待填，国区上线时】
- 欧盟或英国代表：【待填，如果在这些地区上架】
AgreeAI Privacy Policy
Draft v0.2 (2026-11-11, beta: rewritten for the providers actually in use: DeepSeek official API processed in China for everyone, backend in Singapore; needs legal review before public launch)
Effective date: 2026-11-11 (beta) Last updated: 2026-11-11
AgreeAI ("we", "us") is operated by Zhang Xiukang, an individual developer. This policy explains what information we collect when you use the AgreeAI iPhone app and the web participation page (together, the "Service"), how we use it, who we share it with, how long we keep it, and your rights.
The most important points:
- Private cards are read only by the AI. By default, the host, other participants, and our staff cannot see what you write on your card.
- We delete the original text of cards and conversations 30 days after a table ends. We keep only statistics that cannot identify you.
- We do not sell your personal information, do not show ads, and do not track you across other apps or websites.
- The Service is only for people aged 18 and over.
1. Information we collect
| Category | What | Source |
|---|
| Account | With Sign in with Apple: your Apple user identifier, and the name and email you choose to share (which may be an Apple relay address). With email sign-up: your email address. Your nickname, avatar, and username | You / Apple |
| Friends | Friends you add, friend links, and QR codes | You |
| Table content | Tables you create (template, background, hard constraints, card time limit), group chat messages, conversations where you @ the host, votes, and options you propose | You |
| Private cards | What you write on your card and your conversation with the host inside the card (for example, budget range, dates that don't work, must-haves and deal-breakers, food or drinking restrictions, activity level) | You |
| Custom hosts | The description, name, avatar, and speaking style you create | You |
| Anonymous web participation | Your nickname; a random identifier stored in your browser so each device gets one vote; your table content (as above) | You / your browser |
| Device and usage | Device model, OS version, app version, language and region settings, push token, IP address, error logs | Collected automatically |
| Usage statistics | Which features you use, which step a table reached, how long steps took, table-level totals (for example, how many cards were submitted and how votes were distributed), satisfaction scores, your optional answer after a decision to "will you actually go with it?", and how often a table hits a free-plan limit. We record only fixed options and numbers, never any text you write, and we never record who voted for which option or who submitted or skipped a card. Only the "table created" record carries a pseudonymous ID derived from your account (to count whether creators open another table within 30 days); no other record carries anyone's ID. We use no third-party analytics or advertising SDKs | Collected automatically |
| Reports and support | Reports and blocks you submit, and emails you send us | You |
| Feedback | Feedback text you write in the app or on the web, one screenshot if you choose to attach it, and an optional satisfaction rating; automatically attached: app version, device model, OS version, language, the current step, and error code; the table ID only if you choose to include it (the ID only, never the table's content). Card content and chat messages are never attached automatically. Feedback from anonymous web participants does not record a nickname or device identifier | You / collected automatically |
We do not collect precise location, contacts, your photo library (except an image you pick as your avatar or choose to attach to feedback), or the advertising identifier (IDFA).
Health-related information. Questions on cards about food, drinking, or activity level are optional. Please don't write the health reason (such as an illness or pregnancy); the restriction itself is enough (for example, "no alcohol"). If you choose to include it, we treat it as sensitive information, use it only to create options, and delete it on the schedule in Section 5. We ask for your separate consent before you fill in a card.
2. How we use information
| Purpose | Information used | Basis |
|---|
| Provide the Service: create tables, invite people, discuss, fill in cards, generate options, vote, and decide | Account, table content, private cards | Performing our agreement with you |
| Let the AI host speak, structure cards, search the web, and generate and check options | Table content, private cards (first turned into structured conditions without your original wording) | Performing our agreement; for private cards and health-related information, your separate consent |
| Safety: moderate custom hosts and chat messages, handle reports and blocks | Table content, custom hosts, reports | Legal obligations; keeping users safe |
| Send notifications (someone joined, options are ready, time to vote, etc.) | Push token | Your consent (you can turn it off in Settings) |
| Security, preventing vote stuffing and abuse, fixing bugs | Device info, IP, logs, browser identifier | Legitimate interests |
| Improve the product and AI quality | Usage statistics (see Section 1), viewed as totals (for example, decision rate, time taken, satisfaction); groups with fewer than 3 tables or 3 people are hidden | Legitimate interests |
We do not use your card content to train AI models, and we do not allow our AI providers to do so (subject to their contractual commitments).
About the AI. Options are generated by AI from everyone's cards, and the final decision is made by an anonymous vote of the table. The AI does not make decisions about you that have legal or similarly significant effects.
3. How we keep private cards private
- Original card text is stored separately. The host and other participants have no screen or API that shows it.
- The host in the group chat cannot see original card text. The AI that generates options only receives structured conditions, and every option is checked automatically before it is shown, so that no one's wording or identifiable reason leaks.
- At small tables (3–4 people), options are described more vaguely, so it's harder to tell who said what.
- Needs that could reveal who someone is, such as religious or health needs, are only ever described by category (for example, "accommodates dietary restrictions"), at any table size.
- Our staff cannot see original text by default, and we do not do random spot checks. Access is allowed only with separate authorization to handle your own request, investigate a report, confirm a possible leak flagged by our automatic checks, or meet a legal requirement; only the content related to that case may be viewed, and every access is logged.
- Text in a card like "ignore the rules" is treated as ordinary content and does not change how the AI behaves.
Please note: because options try to work for everyone, other people might guess some of your situation from the options. We work to reduce this but cannot rule it out completely.
4. Who we share information with
We do not sell personal information or share it for cross-context behavioral advertising. Only the service providers below process data on our behalf, and they may use it only as we instruct:
| Provider | Purpose | Information | Location |
|---|
| Hangzhou DeepSeek Artificial Intelligence Basic Technology Research Co., Ltd. (DeepSeek), official API | Host messages, structuring cards, generating and checking options, content moderation, web search | Table content (chat messages, custom host settings), structured card conditions, nicknames, search queries | China |
| Supabase, Inc. | Accounts, database, real-time messaging, file storage, server functions | Most information in Section 1 | Singapore |
| Cloudflare, Inc. | Hosting the web participant client (serves web files only; does not store your table data) | IP address and browser information when you open the page | Global network |
| Apple Inc. (Sign in with Apple, Apple Push Notification service, TestFlight) | Sign-in, notifications, beta distribution | Apple user identifier, push token, notification content; TestFlight crash reports and feedback you choose to send | United States and elsewhere |
We may also disclose information when required by law, a court, or a government authority; to protect the safety of users or others; or in a merger or acquisition (we will notify you in advance).
AI processing happens in China. Wherever you are, what you write at a table and your structured card conditions are sent to DeepSeek and processed in China. Before your content goes to the AI for the first time, the app shows a consent screen that tells you this, and nothing is sent until you agree.
During the beta we do not use any other analytics, AI-call logging, or dashboard service. If we add a provider later, we will update this policy and let you know first.
5. How long we keep information
| Information | Retention |
|---|
| Original private card text, card conversations with the host, original chat messages, and the background summary written by the table creator | Deleted within 30 days after the table ends; only anonymous statistics are kept |
| Options, vote results, decision cards | Kept with the table until you delete your account; others at the table keep the options in their own "My tables" |
| Account, friends, custom hosts | Until you delete your account |
| Anonymous web participants' nickname and browser identifier | Deleted within 30 days after the table ends |
| Security and error logs | Up to 90 days |
| Records of staff access to sealed content | 3 years; IDs and the reason for access only, no content |
| Reports | 1 year after resolution, unless the law requires longer |
| Raw usage-statistics records | Deleted after 13 months; when you delete your account, the pseudonymous ID on your "table created" records is cleared. Totals that contain no personal information may be kept |
| Feedback text and ratings | Automatically deleted 180 days after submission, or when you delete your account |
| Feedback screenshots | Automatically deleted 90 days after submission, or when you delete your account |
| Open privacy or security complaints | Kept until resolved, then deleted on the schedule above, unless the law requires longer |
| Backups | Removed from backups within 30 days of deletion |
6. Your rights
You can:
- Access and export your personal information;
- Correct your profile;
- Delete your data: in the app, go to Me → Privacy Center to delete your account and all your data in one tap. Anonymous web participants can email us with the table link and their nickname;
- Withdraw consent, for example by turning off notifications. If you withdraw consent for card processing, you can no longer fill in cards, but processing that already happened is not affected;
- Object to or restrict certain processing;
- Complain to your local data protection authority.
We respond within 30 days (or sooner if the law requires). See Section 10 for how to contact us. We will not treat you differently for exercising these rights.
US state residents. We do not sell or "share" (for cross-context behavioral advertising) personal information, and we do not use sensitive personal information for purposes other than providing the Service. You can exercise the rights your state law gives you (including through an authorized agent) using the contact details in Section 10, and you can appeal if we decline your request.
Consumer health data (Washington and other states). We collect possibly health-related information on cards only with your separate consent, and share it only with the providers listed above to provide the Service. 【待律师确认 whether a separate Consumer Health Data Privacy Policy is required.]
7. Age
The Service is only for people aged 18 and over. When you sign up, we use Apple's age range feature to confirm you are an adult. Anonymous web participants must confirm they are 18 or older. If we learn we have collected information from someone under 18, we delete it promptly. If you believe a minor is using the Service, please contact us.
8. Security and international transfers
- Data is encrypted in transit (HTTPS/TLS) and at rest. Original card text is stored separately from other data, with least-privilege access.
- Your information may be processed outside your country (see Section 4).
- Account and table data are stored on Supabase servers in Singapore.
- Content sent to the AI (table content, structured card conditions, search queries) goes to China and is processed by DeepSeek.
- For users in mainland China, storage in Singapore is a cross-border transfer of personal information; the overseas recipient is Supabase, Inc. We ask for your separate consent before doing this. 【To change to in-China storage when the China version launches.】
- No security measure is 100% secure. If a data breach happens, we will notify you and regulators as the law requires.
9. Changes
If we make important changes, we will tell you in the app and ask for your consent again where required.
10. Contact us
- Operator: Zhang Xiukang (individual developer)
- Email: zxiuk1537@gmail.com
- Mainland China personal information protection officer: 【待填，when the China version launches】
- EU / UK representative: 【待填，if we launch there】