This page is available in Chinese and English only; showing English.
隐私政策
生效日期：2026-09-08 · 最后更新：2026-09-14
本政策说明 Zhuyuan（个人开发者，对外品牌「Nonzero Lab」，以下称「我们」）在你使用「盲盘 / ColdRead」（App、网站 coldread.win 与云服务）时如何收集、使用与保护你的信息。
1. 我们不收集什么
- 行情数据。 你导入或抓取的 K 线数据只保存在你的设备上，从不上传到我们的服务器。AI 点评只发送脱敏摘要（见第 3 节）。
- 不登录时的任何个人信息。 本地训练无需账号，此时我们不收集你的身份信息。Web 版会上报一组匿名使用计数（见下表最后一行），移动端 App 不上报。
- 我们不使用广告 SDK，不接入第三方统计脚本，不向第三方出售数据。
2. 我们收集什么
| 信息 | 何时 | 用途 | 保存位置 |
|---|
| 邮箱地址 | 登录 | 身份验证、发送验证码与重要通知 | 我们的服务器（Cloudflare） |
| 第三方账号标识（如 Google / Apple 提供的用户 ID 与邮箱） | 用第三方账号登录 | 身份验证 | 同上 |
| 设备标识（随机生成）、平台、App 版本 | 登录与云同步 | 设备上限管理、问题诊断 | 同上 |
| 训练记录（每局的操作序列、结果、标签、自评；不含 K 线数据） | 开启云同步 | 跨设备同步、战绩统计 | 同上 |
| 偏好设置 | 开启云同步 | 跨设备同步 | 同上 |
| 站内消息内容与附带的诊断信息（App 版本、平台、最近几局摘要） | 你主动发送消息 | 客服支持 | 同上 |
| 路线图投票与提议内容 | 使用路线图 | 统计票数、展示候选、回复你的提议 | 我们的服务器 |
| 购买记录（订单号、邮箱、权益） | 购买 | 授予与核验权益 | 同上；我们不接触支付信息 |
| 网站访问统计（页面路径、外部来源域名、界面语言、被点击的按钮名、按日更换盐值的匿名访客哈希） | 浏览 coldread.win | 了解哪些页面与内容被看到、改进网站 | 我们的服务器；不用 cookie，不保存 IP，哈希不可还原且次日失效 |
| Web 版匿名使用计数（打开次数、开局次数、每局时长的粗略区间、界面语言、按日更换盐值的匿名访客哈希；不含 K 线数据、盈亏与任何操作细节） | 使用 app.coldread.win | 了解有没有人在用、用到多深；改进产品 | 同上 |
3. AI 点评如何处理数据
当你点击「AI 点评」时，我们把本局的脱敏摘要（周期、根数、每笔交易的相对时点与仓位、止损设置、结果、已判定的标签）发送给第三方模型服务（目前为 DeepSeek）生成解释。摘要不含真实标的名、不含时间、不含任何 K 线数据。模型服务商按其政策处理该请求；我们不用你的数据训练模型。
4. 第三方服务
- Cloudflare：服务器与数据库托管。
- Resend：发送登录验证码邮件。
- DeepSeek：AI 点评（仅脱敏摘要）。
- Google / Apple：第三方登录（仅在你选择时）。
这些服务商各自的隐私政策适用于其处理的部分。
5. 数据保存与删除
- 账号与云端记录在你使用期间保存；账号删除后 30 天内清除（备份中的副本在备份轮换后清除）。
- 你可以随时在 App 设置中：清除本地数据、解绑设备、关闭云同步、申请删除账号（或发邮件到 [email protected]）。
- 本地数据完全由你掌控：卸载 App 即删除。
6. 你的权利
依据你所在地法律，你可能有权访问、更正、导出或删除你的个人信息，或撤回同意。请联系 [email protected]，我们会在 30 天内回复。
7. 未成年人
本服务面向成年人。我们不会故意收集 18 岁以下未成年人的信息；如发现，将尽快删除。
8. 跨境传输
我们的服务器由 Cloudflare 在全球节点托管；你的账号数据可能在你所在国家 / 地区之外处理。我们采取传输加密（TLS）与访问控制保护数据。
9. 安全
验证码与激活码只以哈希形式保存；登录令牌不落明文；行情数据永不离开设备。没有任何系统能保证绝对安全，若发生数据泄露我们将依法通知你。
10. 变更
本政策更新后将在 App 内与网站公布；重大变更提前通知。
11. 联系我们
[email protected]
Privacy Policy
Effective: 2026-09-08 · Last updated: 2026-09-14
This policy explains how Zhuyuan (individual developer, operating as Nonzero Lab; "we") collects, uses and protects your information when you use ColdRead (the app, the website coldread.win and cloud services).
1. What we do not collect
- Market data. The candlestick data you import or fetch stays on your device and is never uploaded to our servers. AI review sends only a de-identified summary (see Section 3).
- Anything personal while you are not signed in. Local training needs no account and we collect no identity data. The web app reports a small set of anonymous usage counts (last row of the table below); the mobile apps report none.
- We use no advertising SDKs or third-party analytics scripts, and never sell data to third parties.
2. What we collect
| Data | When | Purpose | Where |
|---|
| Email address | Sign-in | Authentication, verification codes, important notices | Our servers (Cloudflare) |
| Third-party account identifiers (e.g. the user ID and email provided by Google / Apple) | Third-party sign-in | Authentication | Same |
| Device identifier (randomly generated), platform, app version | Sign-in and cloud sync | Device limit, troubleshooting | Same |
| Training records (each session's actions, results, tags, self-tags; no candlestick data) | Cloud sync enabled | Sync across devices, statistics | Same |
| Preferences | Cloud sync enabled | Sync across devices | Same |
| In-app messages and attached diagnostics (app version, platform, summaries of recent sessions) | You send a message | Support | Same |
| Roadmap votes and proposal text | Using the roadmap | Counting votes, listing candidates, replying to your proposals | Our servers |
| Purchase records (order id, email, entitlement) | Purchase | Granting and verifying entitlements | Same; we never handle payment details |
| Website usage statistics (page path, referring site domain, interface language, name of the button clicked, an anonymous visitor hash whose salt changes daily) | Visiting coldread.win | Seeing which pages and content are read; improving the site | Our servers; no cookies, IP addresses are not stored, the hash cannot be reversed and expires the next day |
| Anonymous usage counts on the web app (app opens, sessions started, a coarse bucket for how long each session lasted, interface language, an anonymous visitor hash whose salt changes daily; no candlestick data, no P&L, no action details) | Using app.coldread.win | Seeing whether and how much the app is used; improving the product | Same |
3. How AI review handles data
When you tap "AI review" we send a de-identified summary of the session (timeframe, bar count, relative timing and size of each trade, stop settings, result, tags already determined) to a third-party model provider (currently DeepSeek) to generate an explanation. The summary contains no real instrument name, no dates and no candlestick data. The provider processes the request under its own policy; we do not train models on your data.
4. Third-party services
- Cloudflare: hosting and database.
- Resend: sign-in code emails.
- DeepSeek: AI review (de-identified summaries only).
- Google / Apple: third-party sign-in (only if you choose it).
Each provider's privacy policy applies to the part it processes.
5. Retention and deletion
- Account and cloud records are kept while you use the Service and erased within 30 days after account deletion (backup copies expire with backup rotation).
- At any time in the app you can clear local data, remove devices, turn off cloud sync, or request account deletion (or email [email protected]).
- Local data is entirely under your control: uninstalling the app deletes it.
6. Your rights
Depending on where you live you may have the right to access, correct, export or delete your personal data, or withdraw consent. Contact [email protected]; we respond within 30 days.
7. Children
The Service is intended for adults. We do not knowingly collect data from anyone under 18 and will delete such data promptly if discovered.
8. International transfers
Our servers are hosted by Cloudflare on a global network; your account data may be processed outside your country. We protect it with encryption in transit (TLS) and access controls.
9. Security
Verification codes and activation codes are stored only as hashes; sign-in tokens are never stored in plain text; market data never leaves your device. No system is perfectly secure; if a breach occurs we will notify you as required by law.
10. Changes
Updates to this policy are published in the app and on the website; material changes are announced in advance.
11. Contact
[email protected]