生效日期：待定
哨隼（以下称「本 App」）由 上饶市信州区雷蒙智能科技工作室（以下称「我们」）开发。本 App 是开发工具 Claude Code 的配套客户端：你在自己的电脑上运行一个服务程序（以下称「hub」），本 App 连接这台电脑，让你在手机上查看编程会话、审批命令、回答提问、发送消息和接收提醒。
我们的原则：你的会话内容在你的手机和你的电脑之间端到端加密；用云中转时，我们的服务器只转发加密数据，看不到内容。 为了记录购买、提供云中转和推送、管理登录的设备，使用本 App 需要注册账号；账号只收集下面写明的信息。本 App 不接入任何第三方统计、广告或崩溃收集服务，不做跨 App 追踪。
一、账号
使用本 App 需要用手机号（目前只支持中国大陆手机号）或邮箱注册并登录。演示模式不需要登录。
| 信息 | 用途 | 保存方式 |
|---|
| 手机号或邮箱（注册时二选一） | 登录、找回密码、接收验证码 | 保存在我们的服务器上，直到你删除账号 |
| 密码 | 登录 | 只保存加盐哈希值（argon2id 算法），我们和任何人都无法从中还原你的密码 |
| 注册时间、最近登录时间、连续输错密码的次数和锁定时间 | 账号安全（输错太多次暂时锁定） | 同上 |
| 登录的设备：设备名（机型 · 系统版本）、登录时间、最近使用时间 | 在「已登录的手机」列表里显示，方便你移除不用的设备；每个账号最多同时登录 2 台手机，超出时退出最久没用的那台 | 登录状态 90 天不用自动失效；你退出登录或移除设备时删除 |
| 注册时这部手机的编号（iOS 的「供应商标识符」identifierForVendor，安卓的 ANDROID_ID） | 新用户礼包（注册后 30 天全部功能）每部手机、每台电脑只送一次，防止反复注册领取 | 只保存不可逆的哈希值。删除账号后，「这部手机、这台电脑已领取过礼包」的标记仍保留 3 年，这时它不和任何账号、手机号、邮箱关联，也不用于其他用途；期满自动删除。不用于广告或追踪 |
验证码：注册、验证码登录、找回密码、删除账号时，我们向你的手机号或邮箱发送 6 位验证码。
- 短信验证码由阿里云短信服务发送：我们只把你的手机号和验证码交给阿里云。
- 邮件验证码目前通过网易 126 邮箱的发信服务发送：发信服务商会看到你的邮箱地址和邮件内容（验证码）。
- 验证码在我们的服务器上只保存哈希值，10 分钟内有效，输错 5 次作废，用过即删。
- 为防止短信被滥用，我们会记录每次发送短信的手机号、请求的 IP 地址、用途和时间，48 小时后自动删除。
登录令牌在我们的服务器上只保存哈希值。
二、电脑绑定、会员和订阅
登录后，本 App 会把你连接的电脑加到你的账号下，这样电脑才能使用账号里的会员权益（含云中转）。你也可以在电脑端登录同一个账号，把电脑加到账号下。
| 信息 | 用途 |
|---|
| 绑定的电脑：电脑的公钥（匿名编号）、电脑名、绑定时间、最近在线时间 | 让这台电脑使用账号里的权益；在账号页显示你的电脑 |
| 电脑的证书指纹 | 让你的手机安全地连上你的电脑：手机连账号下的电脑时，只认这个指纹对应的证书 |
| 云中转的用量：每台电脑每天的流量字节数和连接次数 | 统计用量、防止滥用。不包含任何内容 |
| 权益：会员（含云中转）的来源（App Store 订阅、新用户免费体验、激活码）、状态、到期时间 | 确定你能用哪些功能 |
| App Store 购买：交易编号（原始交易 ID）、商品、到期时间 | 确认购买、续订、退款。我们只校验苹果签名后的交易信息，不保存交易原文 |
| 激活码：只保存激活码的哈希值、兑换的账号和时间 | 防止重复兑换 |
| 权益变更记录：哪个账号在什么时间因为什么（购买、续订、退款、新用户免费体验、兑换、管理员调整）获得或失去权益 | 处理退款和争议、排查问题 |
付款由苹果处理，我们收不到你的银行卡、Apple ID 等支付信息。App Store 购买时，本 App 会把一个由账号编号生成的匿名标识（appAccountToken）交给苹果，用来把这笔购买对应到你的账号。
电脑定期确认权益：电脑加到账号后，会定期（约每 6 小时）连接我们的服务器更新权益，只发送这台电脑的匿名编号和证书指纹。
在电脑端登录账号：电脑端用你输入的手机号或邮箱和验证码短暂登录一次，把自己加到账号下后马上退出，电脑上不保存账号的登录令牌；之后电脑只用自己的密钥和我们的服务器通信。
手机连接账号下的电脑：新手机第一次连接时，电脑上会弹窗，由你点「允许」。人不在电脑旁时，可以用发到你账号邮箱或手机号的验证码连接；这时电脑上会弹窗提醒，已经连着这台电脑的其他手机也会收到一条推送，方便你发现不是自己操作的连接。
匿名汇总统计：我们会用已有的账号、购买和云中转连接记录统计匿名的汇总数字（例如每天的注册数、新用户免费体验后开通会员的比例），用来改进服务。这些统计只看总数，不涉及具体某个人，不会提供给第三方，也不为此另外收集信息。
三、在你的手机和你的电脑之间传输的数据
以下数据只在本 App 和你自己电脑上的 hub 之间传输：走局域网直连、你自己配置的公网地址，或下面第四节的云中转（全程加密，我们无法解密）。我们无法访问这些内容：
| 数据 | 用途 | 存放位置 |
|---|
| 会话内容：消息、回复、命令、文件改动对比、提问和你的回答 | 在手机上查看和操作会话 | 你的电脑（hub 的会话记录）；手机本地缓存 |
| 审批结论（批准 / 拒绝） | 转达给电脑上的 Claude Code | 你的电脑 |
| 你发送的图片 | 发给会话 | 你电脑上的 ~/.cc-remote/uploads，7 天后自动删除 |
| 设备名（机型 · 系统版本） | 在电脑的「已登录设备」列表里区分不同手机 | 你的电脑 |
| 登录令牌 | 证明这台手机已和电脑配对 | 你的电脑和手机钥匙串 |
| 界面语言 | 让电脑端返回对应语言的文字 | 你的电脑 |
| 错误报告（见第六节） | 帮你排查 App 问题 | 你的电脑 |
连接使用 HTTPS 加密。你的电脑使用自签证书时，本 App 在扫码配对时记下证书指纹，之后只信任这张证书。
一台电脑能同时登录的手机数量有上限（免费版 1 台，会员默认 3 台，以电脑上的设置为准）。另外，每个账号最多同时登录 2 台手机，在新手机上登录时，多出来的那台会退出账号。已登录的设备可以在 App 里互相移除。
四、云中转
开通云中转后，你不在电脑所在的网络时，手机经我们运营的中转服务器连接你的电脑。
- 中转只按地址把加密的连接原样转发给你的电脑，不解密。手机和电脑之间的 TLS 加密是端到端的，中转看不到会话内容。
- 中转只记录每台电脑每天的流量字节数和连接次数，不记录传输的内容。
- 连接出错时，服务器日志可能记录对方的 IP 地址，用于排查问题和防范攻击（日志保存期限见第九节）。
五、推送通知
需要你处理（例如有命令等待审批）或一轮结束时，本 App 可以给你发推送。推送有两种方式：
1. 推送中转（默认）
推送中转是我们运营的服务器，作用是把你电脑上 hub 发出的推送转交给苹果推送服务（APNs）。
- 中转保存：APNs 推送令牌（苹果分配给本 App 在这台设备上的推送地址）、编译环境（开发版或正式版）、你电脑上 hub 的公钥、设备密钥的哈希值、登记时间和最近一次推送的时间。这些信息只用于把推送送到你的手机，以及确认推送请求确实来自你配对的 hub。推送登记本身不关联你的账号、手机号或邮箱。
- 推送内容由你电脑上的 hub 用本 App 生成的密钥做端到端加密（AES-256-GCM），在手机上解密显示。中转和苹果都只能看到密文，看不到命令、问题或回复的内容。
- 中转日志不记录推送内容。
- 你退出登录、移出这台电脑，或这台设备被其他设备移除时，本 App 会向中转注销这台设备，中转删除对应的登记。苹果告知推送令牌已失效，或登记后 30 天从未推送、超过 180 天没有推送时，中转也会自动删除登记。
2. 直连
hub 也可以用开发者自备的 APNs 密钥直接把推送发给苹果，不经过推送中转。这种方式主要供开发阶段自用。
通知内容设置：你可以在设置里选择「只提示有事」，这时通知里不显示命令、问题和回复的具体内容。
无论哪种方式，推送都经过苹果的推送服务，苹果对推送的处理适用苹果的隐私政策（https://www.apple.com/legal/privacy/）。
六、错误报告和「吐槽与建议」
错误报告：本 App 发生未处理的异常或 iOS 原生崩溃时，会把异常消息、调用栈、App 版本和系统版本发送给你自己电脑上的 hub，记录在你电脑上，方便你或你求助的人排查问题。错误报告不包含会话内容，不发送给我们或任何第三方。你可以在设置里关闭此功能（「发送错误报告到我的电脑」，默认开启）。
如果你主动把错误日志发给我们求助，我们只把它用于排查问题。
吐槽与建议：你可以在「设置 → 吐槽与建议」里主动给我们提交问题和建议，并和我们来回沟通。只有你主动提交时才会发送，内容包括：
- 你写的文字和你选的截图（每次最多 4 张）。截图上传前在手机上缩小；到服务器后会重新编码，去掉 EXIF 等元数据（包括拍摄地点）。
- 设备信息：App 版本、系统版本、机型、界面语言，以及当时连着的电脑上的 hub 版本。提交页面上写明了会附带这些信息。
这些内容存放在我们的服务器上，跟着你的账号，只用于排查问题和改进产品，只有我们授权的管理员能查看。截图里的内容由你决定，请不要提交密码、密钥等敏感信息；如果截图里有会话内容，我们也只把它用于处理这条反馈。我们回复后，App 里会显示小红点；如果你用邮箱注册，还会收到一封提醒邮件（30 分钟内最多一封，邮件里不含回复内容），手机号账号不发短信。删除账号时，你的反馈和截图一起删除（备份中的在 30 天内随备份轮换删除）。
七、保存在手机本地的数据
- 钥匙串：账号登录令牌和登录用的手机号或邮箱、账号信息缓存（最多 7 天）；每台电脑的地址、登录令牌、证书指纹；推送中转登记信息和推送内容密钥。
- 本地数据库：会话列表、你看过的会话记录、未发送的草稿。
- 本 App 的设置：文字大小、界面语言、面容 ID 解锁等。
这些数据只保存在你的设备上。退出账号时清除账号令牌和账号信息缓存；移出一台电脑时清除这台电脑的记录和本地数据库；卸载本 App 会删除本地数据库（钥匙串条目可能由 iOS 保留到下次安装时被本 App 清理，需确认）。
八、系统权限
本 App 只在你使用相应功能时请求权限，你可以随时在 iOS「设置」里关闭：
| 权限 | 用途 |
|---|
| 相机 | 扫描电脑上的配对二维码；拍照发给会话或附在「吐槽与建议」里 |
| 照片 | 选择图片发给会话或附在「吐槽与建议」里 |
| 麦克风、语音识别 | 语音输入：把你说的话转成文字填进输入框 |
| 面容 ID / 触控 ID | 解锁本 App。验证由 iOS 完成，本 App 拿不到你的生物特征信息 |
| 本地网络 | 找到同一 Wi-Fi 下装了哨隼电脑端的电脑；连接你电脑上的 hub。不扫码连接时，本 App 会把手机型号和系统版本发给那台电脑，显示在它的确认窗口里；这些信息只到你自己的电脑，不发给我们 |
| 通知 | 接收需要处理的提醒 |
关于语音识别：语音输入使用苹果系统提供的语音识别功能（Speech 框架）。根据苹果的说明，你的语音可能会发送到苹果的服务器进行处理，这部分适用苹果的隐私政策（https://www.apple.com/legal/privacy/），我们收不到你的语音。识别出的文字只填进输入框，由你决定是否发送。
九、存放地点、保存期限和访问
存放地点：账号、权益、电脑绑定、推送中转和云中转的数据存放在我们位于中国大陆的服务器上，不向境外提供。
| 数据 | 保存期限 |
|---|
| 账号、电脑绑定、权益 | 直到你删除账号（删除时怎么处理见第十一节） |
| 「吐槽与建议」的文字、截图和设备信息 | 直到你删除账号，随账号一起删除 |
| 删除账号后的权益和购买记录（已去掉手机号、邮箱等身份信息） | 3 年，用于处理退款和争议（依据《中华人民共和国电子商务法》），期满自动删除 |
| 删除账号后「这部手机、这台电脑已领取过新用户礼包」的标记（不可逆哈希，不关联任何账号） | 3 年，防止删号重注册反复领取，期满自动删除 |
| 登录状态 | 90 天不用自动失效 |
| 验证码 | 10 分钟有效，用过即删 |
| 短信发送记录（手机号、IP） | 48 小时 |
| 推送登记 | 注销时删除；长期不用自动删除（见第五节） |
| 服务器数据备份 | 每天备份，保留 30 天后自动删除 |
| 服务器运行日志 | 6 个月（依据《中华人民共和国网络安全法》），期满自动删除。日志里账号只记编号的前 8 位，手机号打码 |
| 管理员操作记录 | 1 年，期满自动删除 |
谁能访问：只有我们授权的管理员能查看账号信息（包括手机号或邮箱），只用于客服、处理违规和排查问题；管理员的操作都有记录（保留 1 年）。
十、第三方服务
除你电脑上运行的软件外，本 App 只涉及下面这些第三方：
| 第三方 | 用途 | 涉及的信息 |
|---|
| 阿里云短信服务 | 发送短信验证码 | 手机号、验证码 |
| 网易 126 邮箱 | 发送邮件验证码；「吐槽与建议」有回复时的提醒邮件 | 邮箱地址、验证码邮件、提醒邮件（不含回复内容） |
| 苹果（App Store、推送服务、语音识别） | 应用内购买、推送通知、语音输入 | 见苹果的隐私政策 |
本 App 不接入第三方统计、广告或崩溃收集 SDK。
十一、删除账号和数据
删除账号：在 App 里「设置 → 账号 → 删除账号」，输入密码或验证码确认后立即删除。
- 立即删除：账号本身（手机号或邮箱、密码哈希）、所有登录状态、发给你的验证码、你在「吐槽与建议」里提交的文字和截图；会员和订阅等权益随之失效。
- 解除关联：加到账号的电脑从账号移除，按免费版运行。电脑本身的记录（公钥、在线时间）不含你的个人信息，用于推送和云中转，会保留到这台电脑停止使用；兑换过的激活码不再关联你的账号。
- 继续保留：「这部手机、这台电脑已领取过新用户礼包」的标记（不可逆哈希，不关联任何账号、手机号、邮箱）保留 3 年，防止删号重注册反复领取；权益和购买记录（含 App Store 交易编号）保留 3 年，用于处理退款、争议和对账（依据《中华人民共和国电子商务法》）；删除账号时去掉其中的手机号、邮箱等能识别你身份的信息，满 3 年自动删除。短信发送记录 48 小时后删除；服务器备份中的数据在 30 天内随备份轮换删除。
- 苹果订阅不会自动取消：删除账号前，请先在 iOS「设置 → Apple 账户 → 订阅」里取消，否则苹果会继续扣费。
其他数据：
- 手机上的数据：在 App 里退出登录、移出电脑，或卸载本 App。
- 电脑上的数据：都在你自己的电脑上，由你管理。完全删除可以运行
deploy/install.sh uninstall --purge。 - 推送中转上的登记：退出登录、移出电脑或设备被移除时自动注销。如果手机已丢失或已卸载 App，可以从其他已登录设备移除它，或通过 待定 联系我们处理。
十二、我们不做的事
- 不收集你的姓名、身份证号、通讯录、位置等信息。
- 不接入第三方统计、广告或崩溃收集 SDK。
- 不做跨 App 或跨网站追踪，不出售你的个人信息，不用于广告。
- 不读取、不保存你的会话内容（你在「吐槽与建议」里主动提交的截图除外，只用于处理那条反馈）。
- 演示模式使用 App 内置的模拟数据，不连接任何服务器。
十三、儿童
本 App 是面向开发者的工具，不面向儿童，我们不会有意收集儿童的个人信息。（需确认年龄表述，建议律师看）
十四、你的权利
你可以：
- 查看：在 App 的账号页查看你的账号信息、登录的设备、电脑和权益。
- 更正：修改密码；更换手机号或邮箱请联系我们。
- 删除：按第十一节删除账号，或移除单个设备、电脑。
- 撤回同意：删除账号即撤回对本政策的同意；撤回不影响此前已进行的处理。
如有疑问或请求，请联系 待定，我们会在 15 个工作日内答复。（适用于中国大陆《个人信息保护法》等法律规定的权利表述需确认，建议律师看）
十五、政策变更
本政策更新时，我们会在 https://www.sggoai.com/ 和 App 内更新本页面并修改生效日期。重大变更会在 App 内提示。
十六、联系我们
上饶市信州区雷蒙智能科技工作室邮箱：待定网站：https://www.sggoai.com/
Effective date: TBD
WhistleFalcon (the "App") is developed by 上饶市信州区雷蒙智能科技工作室 ("we", "us"). The App is a companion client for the developer tool Claude Code: you run a service (the "hub") on your own computer, and the App connects to it so you can view coding sessions, approve commands, answer questions, send messages and get notified from your phone.
Our principle: your session content is end-to-end encrypted between your phone and your own computer. When you use the cloud relay, our server only forwards encrypted data and cannot read it. To keep track of purchases, provide the cloud relay and push notifications, and manage signed-in devices, the App requires an account. The account collects only the information described below. The App includes no third-party analytics, advertising or crash-reporting SDKs, and does not track you across apps.
1. Your account
You sign up and sign in with a phone number (currently mainland China numbers only) or an email address. Demo mode does not require an account.
| Information | Purpose | How it is kept |
|---|
| Phone number or email (one of them, chosen at sign-up) | Signing in, resetting your password, receiving codes | On our servers until you delete your account |
| Password | Signing in | Only a salted hash (argon2id) is stored; neither we nor anyone else can recover your password from it |
| Sign-up time, last sign-in time, failed sign-in count and lockout time | Account security (temporary lockout after too many wrong passwords) | Same as above |
| Signed-in devices: device name (model · OS version), sign-in time, last used time | Shown under "Signed-in Phones" so you can remove devices you no longer use; each account can be signed in on up to 2 phones at once, and the least recently used one is signed out when you exceed that | Expires after 90 days without use; deleted when you sign out or remove the device |
| This phone's identifier at sign-up (the "identifier for vendor" on iOS, ANDROID_ID on Android) | Making sure the new-user gift (every feature free for 30 days after sign-up) is given once per phone and per computer, to prevent repeated sign-ups | Only an irreversible hash is stored. After you delete your account, a marker that "this phone / this computer has claimed the gift" is kept for 3 years; it is then not linked to any account, phone number or email and is used for nothing else, and is deleted automatically afterwards. Never used for advertising or tracking |
Verification codes: when you sign up, sign in with a code, reset your password or delete your account, we send a 6-digit code to your phone or email.
- Text messages are sent through Alibaba Cloud SMS. We give Alibaba Cloud only your phone number and the code.
- Emails are currently sent through NetEase 126 Mail. The mail provider sees your email address and the email content (the code).
- On our servers codes are stored only as hashes. They are valid for 10 minutes, become invalid after 5 wrong attempts, and are deleted once used.
- To prevent abuse of text messages, we record the phone number, requesting IP address, purpose and time of each text message sent, and delete these records automatically after 48 hours.
Sign-in tokens are stored on our servers only as hashes.
2. Linked computers, Plus and subscriptions
After you sign in, the App adds the computers you connect to your account, so they can use the Plus membership (including the cloud relay) in your account. You can also sign in to the same account in the desktop app to add the computer to your account.
| Information | Purpose |
|---|
| Linked computers: the computer's public key (an anonymous ID), computer name, link time, last online time | Letting the computer use your account's entitlements; listing your computers in the Account page |
| The computer's certificate fingerprint | Letting your phone connect to your computer securely: when a phone connects to a computer on your account, it only accepts the certificate matching this fingerprint |
| Cloud relay usage: bytes transferred and number of connections per computer per day | Usage statistics and abuse prevention. Contains no content |
| Entitlements: source of Plus, including the cloud relay (App Store subscription, new-user free period, activation code), state, expiry | Determining which features you can use |
| App Store purchases: transaction ID (original transaction ID), product, expiry | Confirming purchases, renewals and refunds. We only verify Apple's signed transaction information and do not keep the original transaction data |
| Activation codes: only a hash of the code, the account that redeemed it and when | Preventing reuse |
| Entitlement history: which account gained or lost an entitlement, when and why (purchase, renewal, refund, new-user free period, redemption, administrator adjustment) | Handling refunds and disputes, troubleshooting |
Payments are processed by Apple. We never receive your card details, Apple ID or other payment information. When you buy in the App Store, the App gives Apple an anonymous identifier derived from your account ID (appAccountToken) so the purchase can be matched to your account.
Periodic entitlement checks by your computer: once a computer is linked to your account, it contacts our servers about every 6 hours to update its entitlements, sending only the computer's anonymous ID and certificate fingerprint.
Signing in on the desktop app: the desktop app signs in once with the phone number or email and code you enter, adds itself to your account, then signs out right away. It doesn't keep your account's sign-in token; afterwards the computer talks to our servers only with its own key.
Connecting a phone to a computer on your account: the first time a new phone connects, the computer shows a window and you click Allow. If you're away from the computer, you can connect with a code sent to your account's email or phone number; the computer then shows a notice, and other phones already connected to it get a notification, so you can spot a connection you didn't make.
Anonymous aggregate statistics: we use the account, purchase and cloud relay connection records we already have to compute anonymous totals (for example, daily sign-ups, or the share of new users who subscribe to Plus after the free period) to improve the service. These statistics only look at totals, don't concern any individual, aren't shared with third parties, and don't involve collecting any additional information.
3. Data exchanged between your phone and your computer
The following data travels only between the App and the hub on your own computer: over your local network, a public address you configure yourself, or the cloud relay described in Section 4 (encrypted end to end; we cannot decrypt it). We cannot access this content:
| Data | Purpose | Where it is stored |
|---|
| Session content: messages, replies, commands, file diffs, questions and your answers | Viewing and operating sessions on your phone | Your computer (hub session history); local cache on your phone |
| Approval decisions (approve / deny) | Relayed to Claude Code on your computer | Your computer |
| Images you send | Sent to a session | ~/.cc-remote/uploads on your computer, deleted automatically after 7 days |
| Device name (model · OS version) | Telling phones apart in the computer's "Logged-in Devices" list | Your computer |
| Sign-in token | Proving this phone is paired with the computer | Your computer and your phone's Keychain |
| Interface language | Letting the hub return text in your language | Your computer |
| Error reports (see Section 6) | Helping you troubleshoot the App | Your computer |
Connections use HTTPS. If your computer uses a self-signed certificate, the App records the certificate fingerprint when you scan the pairing QR code and trusts only that certificate afterwards.
The number of phones that can be signed in to one computer at the same time is limited (1 on the free plan, 3 by default on Plus, subject to the setting on your computer). Separately, each account can be signed in on up to 2 phones at once; signing in on a new phone signs the extra one out of the account. Signed-in devices can remove each other in the App.
4. Cloud relay
With the cloud relay, when you are away from your computer's network your phone connects to your computer through a relay server operated by us.
- The relay forwards the encrypted connection to your computer as is and does not decrypt it. TLS encryption between your phone and your computer is end to end, so the relay cannot see session content.
- The relay records only the bytes transferred and the number of connections per computer per day, never the content.
- When a connection fails, server logs may record the remote IP address for troubleshooting and attack prevention (see Section 9 for log retention).
5. Push notifications
The App can notify you when something needs your attention (for example, a command waiting for approval) or when a turn finishes. There are two delivery methods:
a) Push relay (default)
The push relay is a server operated by us. It forwards notifications from the hub on your computer to the Apple Push Notification service (APNs).
- The relay stores: the APNs device token (the push address Apple assigns to the App on this device), the build environment (development or production), the public key of the hub on your computer, a hash of the device secret, the registration time and the time of the last notification. This is used only to deliver notifications to your phone and to verify that a request comes from the hub you paired with. The push registration itself is not linked to your account, phone number or email.
- Notification content is end-to-end encrypted (AES-256-GCM) by the hub on your computer with a key generated by the App, and decrypted on your phone. The relay and Apple only see ciphertext; they cannot read commands, questions or replies.
- Relay logs never record notification content.
- When you sign out, remove the computer, or the device is removed by another device, the App unregisters the device from the relay and the relay deletes the registration. The relay also deletes a registration automatically when Apple reports the token is no longer valid, when no notification was sent within 30 days of registering, or when no notification has been sent for 180 days.
b) Direct delivery
The hub can also send notifications directly to Apple with an APNs key supplied by the developer, bypassing the relay. This is mainly for development use.
Notification content setting: you can choose "Alert only" in Settings so notifications do not show commands, questions or replies.
In either case notifications pass through Apple's push service, which is subject to Apple's Privacy Policy (https://www.apple.com/legal/privacy/).
6. Error reports and Feedback
Error reports: when the App hits an unhandled exception or a native iOS crash, it sends the error message, stack trace, App version and OS version to the hub on your own computer, where it is logged so you (or someone you ask for help) can troubleshoot. Error reports contain no session content and are never sent to us or any third party. You can turn this off in Settings ("Send Error Reports to My Computer", on by default).
If you choose to send us error logs when asking for help, we use them only to fix the problem.
Feedback: in Settings → Feedback you can report problems or suggest features and exchange messages with us. Nothing is sent unless you submit it. A submission includes:
- The text you write and the screenshots you choose (up to 4 at a time). Screenshots are scaled down on your phone before upload; on our server they are re-encoded and EXIF and other metadata (including location) are removed.
- Device information: App version, OS version, device model, interface language, and the hub version of the computer you are connected to. The submission screen says this information is included.
This content is stored on our servers with your account, used only to troubleshoot and improve the product, and viewable only by administrators we authorize. You decide what your screenshots show; please don't submit passwords, keys or other sensitive information. If a screenshot contains session content, we use it only to handle that feedback. When we reply, a red dot appears in the App; if you signed up with email, you also get a reminder email (at most one per 30 minutes, without the reply text). Phone-number accounts don't get text messages. When you delete your account, your feedback and screenshots are deleted with it (copies in backups are deleted within 30 days as backups rotate).
7. Data stored on your phone
- Keychain: your account sign-in token and the phone number or email you signed in with, a cache of your account information (up to 7 days); each computer's address, sign-in token and certificate fingerprint; push relay registration and the notification content key.
- Local database: session list, session history you have viewed, and unsent drafts.
- App settings: text size, interface language, Face ID unlock and similar.
This data stays on your device. Signing out of your account clears the account token and cached account information; removing a computer clears that computer's records and local database; uninstalling the App removes the local database (Keychain items may be retained by iOS until the App clears them on next install; to be confirmed).
8. System permissions
The App asks for permissions only when you use the related feature. You can turn them off at any time in iOS Settings.
| Permission | Purpose |
|---|
| Camera | Scanning the pairing QR code on your computer; taking photos to send to a session or attach to Feedback |
| Photos | Choosing images to send to a session or attach to Feedback |
| Microphone, Speech Recognition | Voice input: turning your speech into text in the input field |
| Face ID / Touch ID | Unlocking the App. Authentication is handled by iOS; the App never receives your biometric data |
| Local Network | Finding computers on the same Wi-Fi that have the WhistleFalcon desktop app; connecting to the hub on your computer. When you connect without a QR code, the App sends your phone model and OS version to that computer to show in its confirmation window; this information goes only to your own computer, never to us |
| Notifications | Receiving alerts that need your attention |
About speech recognition: voice input uses Apple's built-in speech recognition (the Speech framework). According to Apple, your voice may be sent to Apple's servers for processing; this is governed by Apple's Privacy Policy (https://www.apple.com/legal/privacy/). We never receive your voice. Recognized text is only placed in the input field, and you decide whether to send it.
9. Storage location, retention and access
Location: account, entitlement, linked-computer, push relay and cloud relay data is stored on our servers in mainland China and is not transferred abroad.
| Data | Retention |
|---|
| Account, linked computers, entitlements | Until you delete your account (see Section 11) |
| Feedback text, screenshots and device information | Until you delete your account; deleted with it |
| Entitlement and purchase records after account deletion (with phone number, email and other identifying information removed) | 3 years, to handle refunds and disputes (under the E-Commerce Law of the People's Republic of China), then deleted automatically |
| After account deletion, the marker that "this phone / this computer has claimed the new-user gift" (an irreversible hash, not linked to any account) | 3 years, to prevent claiming the gift again by deleting and re-registering, then deleted automatically |
| Sign-in sessions | Expire after 90 days without use |
| Verification codes | Valid for 10 minutes, deleted once used |
| Text message records (phone number, IP) | 48 hours |
| Push registrations | Deleted when unregistered; deleted automatically after long inactivity (see Section 5) |
| Server backups | Taken daily, deleted automatically after 30 days |
| Server logs | 6 months (under the Cybersecurity Law of the People's Republic of China), then deleted automatically. Accounts appear only as the first 8 characters of their ID, and phone numbers are masked |
| Administrator action records | 1 year, then deleted automatically |
Who can access it: only administrators authorized by us can view account information (including your phone number or email), and only for customer support, handling violations and troubleshooting. Administrator actions are recorded (kept for 1 year).
10. Third-party services
Apart from the software running on your own computer, the App involves only these third parties:
| Third party | Purpose | Information involved |
|---|
| Alibaba Cloud SMS | Sending text message codes | Phone number, code |
| NetEase 126 Mail | Sending email codes; reminder emails when we reply to your Feedback | Email address, code emails, reminder emails (without the reply text) |
| Apple (App Store, push service, speech recognition) | In-app purchases, push notifications, voice input | See Apple's Privacy Policy |
The App includes no third-party analytics, advertising or crash-reporting SDKs.
11. Deleting your account and data
Deleting your account: in the App, go to Settings → Account → Delete Account and confirm with your password or a code. Deletion takes effect immediately.
- Deleted immediately: the account itself (phone number or email, password hash), all sign-in sessions, codes sent to you, and the text and screenshots you submitted in Feedback. Entitlements such as Plus and subscriptions end.
- Unlinked: computers linked to the account are removed from it and run on the free plan. The computer's own record (public key, online time) contains no personal information and is used for push notifications and the cloud relay; it is kept until the computer is no longer used. Redeemed activation codes are no longer linked to your account.
- Kept: a marker that "this phone / this computer has claimed the new-user gift" (an irreversible hash, not linked to any account, phone number or email) is kept for 3 years to prevent claiming it again by deleting and re-registering; entitlement and purchase records (including App Store transaction IDs) are kept for 3 years to handle refunds, disputes and reconciliation (under the E-Commerce Law of the People's Republic of China). When you delete your account, your phone number, email and other identifying information are removed from them, and they are deleted automatically after 3 years. Text message records are deleted after 48 hours. Data in server backups is deleted within 30 days as backups rotate.
- Apple subscriptions are not cancelled automatically: before deleting your account, cancel them in iOS Settings → Apple Account → Subscriptions, or Apple will keep charging you.
Other data:
- On your phone: sign out, remove computers, or uninstall the App.
- On your computer: all of it is on your own computer and under your control. To remove everything, run
deploy/install.sh uninstall --purge. - Push relay registration: unregistered automatically when you sign out, remove the computer, or the device is removed. If the phone is lost or the App has been uninstalled, remove it from another signed-in device, or contact us at TBD.
12. What we don't do
- We don't collect your name, ID number, contacts, location or similar information.
- No third-party analytics, advertising or crash-reporting SDKs.
- No tracking across apps or websites; we don't sell your personal information or use it for advertising.
- We don't read or store your session content (except screenshots you choose to submit in Feedback, used only to handle that feedback).
- Demo mode uses built-in sample data and connects to no server.
13. Children
The App is a tool for developers and is not directed to children. We do not knowingly collect personal information from children. (Wording to be confirmed; legal review recommended.)
14. Your rights
You can:
- Access: view your account information, signed-in devices, computers and entitlements in the Account page.
- Correct: change your password; contact us to change your phone number or email.
- Delete: delete your account as described in Section 11, or remove individual devices or computers.
- Withdraw consent: deleting your account withdraws your consent to this policy; this does not affect processing carried out before.
For questions or requests, contact TBD. We will reply within 15 working days. (Wording on rights under applicable laws, such as China's Personal Information Protection Law, to be confirmed; legal review recommended.)
15. Changes
When this policy changes, we will update this page at https://www.sggoai.com/ and in the App and revise the effective date. Material changes will be announced in the App.
16. Contact
上饶市信州区雷蒙智能科技工作室Email: TBDWebsite: https://www.sggoai.com/