岁月史书 隐私政策

岁月史书（meHistory）是一个日记 App。下面说明哪些数据留在你的设备上、哪些会发送出去，以及发给谁。

你的日记

日记、事件、朋友们和纪念日保存在你的设备上；如果你开启了 iCloud 云盘，则保存在你自己的 iCloud 里。我们的服务器不保存你能读的日记；唯一的例外是你自己开启的「云端备份」（见下），那是加密的，我们读不到。

云端备份（可选）

只有在你登录后在「设置 → 日记 → 备份与导出 → 云端备份」里点「立即备份」或打开「每天自动备份」时，App 才会把日记文件夹打包，在你的设备上用 AES-256-GCM 加密，再上传到我们的服务器（Amazon S3，美国俄勒冈区域）。加密用的钥匙是在你设备上随机生成的，只以三种加密形式随备份保存：用你设的备份密码加密的一份、用你的恢复码加密的一份，以及用一把存在你自己 iCloud 钥匙串里的钥匙加密的一份。我们没有你的密码、恢复码或 iCloud 钥匙串，所以读不到备份里的内容。服务器只能看到备份的大小、时间，以及一个小的说明（格式版本、App 版本、天数和条目数等数量）。

• 每个账户最多保留最近 5 份可用的备份，App 里只显示最新的一份；更早的几份只在你联系我们、需要找回时使用（我们也只能把它设为最新，不能打开它）。
• 来自 Apple 健康的体重从不放进备份。
• 忘了备份密码也能找回：同一 Apple 账号、开启了 iCloud 钥匙串的设备可以直接恢复，或者用恢复码。如果密码、恢复码和 iCloud 钥匙串都没有了，备份就无法恢复，我们也帮不了忙。
• 在 App 里删除备份、删除账户、超出 5 份的旧备份，以及欠费 30 天后（App 里会提前提示）的备份，都会被停用：App 里再也看不到、也无法恢复。加密的备份文件仍保存在我们的服务器上，因为是端到端加密的，我们读不到内容；只有你主动联系我们时，我们才能把它重新启用，你再用自己的密码、恢复码或 iCloud 钥匙串恢复。

云端 AI（问史官、云端分析日记）

只有在你使用这些功能时，才会把以下内容通过加密连接（HTTPS）发送到我们的服务器，再转给你在「设置 → 史官 → 史官用的模型」里选择的 AI 服务商，用来生成回答：

• 你输入或说出的问题、你附上的图片；
• 史官为了回答你而查到的相关日记片段和事件；
• 你开启的数据源（日历、通讯录、照片）里与问题相关的摘要，例如某几天的日程标题或照片拍摄地点（照片本身不会上传）。

懒人日记：你点「懒人日记」时，发送的是这一天已经写的文字，以及在你设备上从这一天的照片里得到的文字描述（拍摄时间、地点、场景标签、照片里的文字、人脸数量，不识别是谁）。只有在你打开「发送照片缩略图给 AI，更准确」（默认关闭）时，才会另外发送最多 6 张这一天照片的缩略图（不超过 512 像素），经我们的服务器转给 AI 服务商，我们不保存。

AI 服务商：OpenAI（GPT），以及 Amazon Web Services 的 Amazon Bedrock（运行 Anthropic Claude、DeepSeek、Qwen 模型，数据在 AWS 美国区域处理，不发送给这些模型的开发公司）。如果所选模型不能识别图片，带图片的那一次会交给 OpenAI 处理。

我们的服务器只转发、不保存这些内容。OpenAI 不会用通过 API 发送的数据训练模型，但可能为防止滥用保留最多 30 天；Amazon Bedrock 不保存这些内容，也不用于训练。第一次使用云端 AI 前，App 会征求你的同意；你也可以只用 Apple Intelligence（在设备上运行）来分析日记。

网页搜索（史官）

默认关闭。只有你在「设置 → 史官 → 史官可以访问」里打开「网页搜索」后，史官才会在需要最新信息时（例如航班、营业时间、天气）上网搜索：只把搜索关键词发给 AWS 的搜索服务（Amazon Bedrock AgentCore 网页搜索，在 AWS 内部处理），不发送日记内容；关键词不写进我们的日志。

天气

写今天的日记时，App 会记下今天的天气（每天一次）：把城市级别的大致位置（精确到约 0.1°，或你在「住址」里记下的城市）直接发给 Apple 的 WeatherKit 查询今天的天气，不经过我们的服务器。天气只保存在你自己的日记里。可以在「设置 → 日记 → 天气 → 记录天气」里关掉。

我们保存的账户数据

• 通过「通过 Apple 登录」得到的匿名账户标识（不含你的 Apple ID 邮箱）；
• 你创建的用户 ID（用来在你联系我们、申请退款时找到你的账户；不会展示给其他用户，创建后不能修改；删除账户后仍保留并标为「已删除」，不会再分配给别人）；
• 你设置的昵称和头像；
• 你在「站内信」里发给我们的反馈和功能建议，以及我们的回复：和你的账户一起保存，方便我们阅读和回复；从你的列表里删除一封信只是对你隐藏，删除账户时全部删除；
• 如果你用了云端备份：加密的备份文件（我们读不到，停用后也继续保存，见上）和它的大小、时间、说明；
• 分数余额，以及购买（Apple 交易编号、所买的分数包或会员、Apple 告知的价格、币种和 App Store 地区）、会员状态（到期时间、是否自动续订、本月用量）、赠送的分和每次使用扣分的记录；
• 每次请求的技术记录：时间、大小、用量（token 数）、使用的模型、是否出错。保存 90 天。这些记录里从不包含你的问题、日记或 AI 的回答。

设备上的功能

语音转文字、定位、日历、通讯录、照片都需要你在系统里授权，读取都在设备上完成。语音识别由 Apple 提供。只有在你提问时，与问题相关的摘要才会像上面说的那样发送。

Apple 健康（体重）

只有在你打开「设置 → 史官 → Apple 健康 · 体重」并在系统里允许后，App 才会从 Apple 健康读取体重，且只读取体重、只读不写。读到的体重只保存在这台设备上的一个单独文件里，不进日记文件夹，也不会上传 iCloud（无论日记存在 iCloud 云盘还是本机），在「体重」时间线上和日记一起显示；我们的服务器不保存它，开发者也看不到。只有在你向史官提问、而回答需要查到这些记录时，它们才会和其他日记内容一样，按上面「云端 AI」的方式发送，不会用于广告或其他用途。关掉开关即停止读取。

私密的日子和时间线

你可以把某一天或某条时间线设为「不给史官看」：它不会被发给任何 AI——问史官、云端分析日记、Apple Intelligence 都会跳过它，命令行和 MCP 等外部 agent 也读不到、写不进。还可以用你自己设的密码给它「上锁」：内容在设备和 iCloud 云盘里都是加密的（AES-GCM，钥匙用你的密码加密后随日记同步），打开 App 也要输入密码才能看到；上锁的内容同样不会发给 AI。我们和 Apple 都没有你的密码，忘记密码就无法找回已上锁的内容。

我们不做的事

没有广告，不跟踪你，不出售或出租任何数据。

删除账户

在 App 里「设置 → 账户 → 删除账户」即可删除账户：昵称、头像、余额、使用统计和站内信（你发出的反馈和收到的回复，包括你已从列表里删除的）会被删除，剩余的分（包括购买的）一并作废；云端备份会被停用、不再关联到账户，App 里无法再恢复，加密文件仍保存在服务器上（我们读不到）。购买和扣分流水作为财务记录保留（只关联匿名标识）；用户 ID 标为「已删除」保留，不会再给别人用。设备和 iCloud 里的日记不受影响，删除 App 或文件即可删除。

儿童

本 App 不面向 13 岁以下儿童。

meHistory Privacy Policy

Your diary

Entries, events, people and dates are stored on your device, or in your own iCloud Drive if you turn it on. Our server does not store your diary in readable form; the one exception is the optional cloud backup below, which is encrypted so that we can't read it.

Cloud backup (optional)

Only if you sign in and tap 立即备份 (Back up now) or turn on daily automatic backup in Settings → 日记 (Journal) → 备份与导出 (Backup & export) → Cloud backup, the app packs your diary folder, encrypts it on your device with AES-256-GCM, and uploads it to our server (Amazon S3, US West (Oregon)). The encryption key is generated at random on your device and is stored with the backup only in encrypted form, three ways: encrypted with the backup password you set, with your recovery code, and with a key kept in your own iCloud Keychain. We don't have your password, recovery code or iCloud Keychain, so we can't read your backup. The server sees only its size and time and a small description (format version, app version, counts such as days and entries).

• Up to the 5 most recent backups are kept available per account; the app shows only the newest. The older ones are used only if you contact us to recover one (even then we can only make it the newest again, not open it).
• Weight from Apple Health is never included.
• Forgot the backup password? Your devices signed in to the same Apple Account with iCloud Keychain can restore directly, or use the recovery code. Without the password, the recovery code and iCloud Keychain, a backup can't be restored, and we can't help.
• Deleting your backup in the app, deleting your account, backups older than the newest 5, and a backup left unpaid for 30 days (the app warns you first) are deactivated: the app no longer shows them and can't restore them. The encrypted file is retained on our server; it is end-to-end encrypted, so we can't read it. Only if you contact us can we reactivate it, and you then restore it with your own password, recovery code or iCloud Keychain.

Cloud AI (Ask the Historian, cloud analysis)

Only when you use these features, the following is sent over HTTPS to our server and passed to the AI provider you picked in Settings → 史官 → 选一位史官 (Choose a Historian), to produce the answer: your question and any images you attach; diary excerpts and events the assistant looks up to answer; and summaries from data sources you enabled (calendar, contacts, photos — e.g. event titles or where photos were taken; photos themselves are never uploaded). 懒人日记 (Lazy diary): when you tap it, the day's text so far and text descriptions made on your device from that day's photos (time, place, scene labels, text in the photo, a face count — nobody is identified) are sent; only if you turn on 发送照片缩略图给 AI (Send photo thumbnails, off by default) are up to 6 thumbnails (at most 512 px) of that day's photos also sent through our server to the AI provider, and we don't store them.

Providers: OpenAI (GPT) and Amazon Bedrock by Amazon Web Services (running Anthropic Claude, DeepSeek and Qwen models in AWS US regions; nothing is sent to those model makers). If the chosen model cannot read images, a request with images is handled by OpenAI. Our server relays and does not store this content. OpenAI does not train on API data and may keep it up to 30 days for abuse monitoring; Amazon Bedrock does not store it or train on it. The app asks for your consent before its first cloud AI request; on-device Apple Intelligence can be used for analysis instead.

Web search (the Historian)

Off by default. Only if you turn on 网页搜索 (Web search) in Settings → 史官 → 史官可以访问, the Historian may search the web when a question needs current information (flights, opening hours, weather…): only the search keywords are sent to AWS's search service (Amazon Bedrock AgentCore Web Search, handled within AWS), never your diary, and the keywords are not written to our logs.

Weather

When you write today's diary, the app records today's weather (once a day): it sends your approximate, city-level location (rounded to about 0.1°, or the city on your 住址 (home) timeline) directly to Apple's WeatherKit to look up today's weather; nothing goes through our servers. The weather is stored only in your own diary. You can turn this off in Settings → 日记 (Journal) → 天气 (Weather) → 记录天气 (Record weather).

Apple Health (weight)

Only if you turn on Settings → 史官 → Apple 健康 · 体重 (Apple Health · Weight) and allow it in the system prompt, the app reads your body weight from Apple Health — weight only, read-only; it never writes to Health. Readings are kept in a separate file on this device only — never in the diary folder and never in iCloud, whether your diary is in iCloud Drive or on the device — and are shown on the 体重 (weight) timeline next to your diary. Our server does not store them and the developer cannot see them. They are sent off the device only when you ask the Historian a question whose answer needs them, exactly like other diary content under "Cloud AI" above, and are never used for advertising or any other purpose. Turning the switch off stops reading.

Private days and timelines

You can mark a day or a timeline "hidden from the Historian": it is never sent to any AI — Ask the Historian, cloud analysis and Apple Intelligence all skip it, and outside agents such as the command line and MCP can't read or write it. You can also lock it with a password of your own: its content is encrypted on the device and in iCloud Drive (AES-GCM; the key is encrypted with your password and syncs with your diary), and opening it in the app needs the password. Locked content is never sent to the AI either. Neither we nor Apple have your password; if you forget it, locked content can't be recovered.

Account data we keep

An anonymous Sign in with Apple identifier; the user ID you create (so we can find your account when you contact us or ask for a refund; never shown to other users, can't be changed, and kept marked "deleted" after you delete your account, so it is never given to anyone else); your nickname and avatar; if you use cloud backup, the encrypted backup files (unreadable to us, and retained after they are deactivated; see above) with their size, time and description; feedback and feature requests you send us in 站内信 (Messages), and our replies, stored with your account so we can read and reply (removing a message from your list hides it for you; everything is deleted when you delete your account); your credit balance and the record of purchases (Apple's transaction id, the pack or membership, and the price, currency and App Store region Apple reports), your membership status (expiry, auto-renewal, this month's usage), credits granted to you and charges; and per-request technical logs (time, size, token counts, model, errors) kept for 90 days. Logs never contain your questions, diary or the AI's answers.

What we don't do

No ads, no tracking, no selling or renting of any data.

Deleting your account

In the app: 设置 → 账户 → 删除账户. Your nickname, avatar, balance, usage statistics and messages (feedback you sent and our replies, including ones you removed from your list) are deleted and remaining credits (including purchased ones) are forfeited. Your cloud backups are deactivated and unlinked from the account, so they can no longer be restored from the app; the encrypted files are retained on our server (unreadable to us). Purchase and charge records are kept as financial records, linked only to the anonymous identifier; your user ID is kept marked "deleted", so nobody else can take it. Your diary on your devices and iCloud is not affected.

Children

The app is not directed at children under 13.

联系 / Contact: chuanbei666@gmail.com

更新于 / Updated 2026-10-21