01照片库与设备权限
Mne 访问你授权的照片、视频和相关信息，包括拍摄日期、已有地点、尺寸、格式、时长、容量、喜欢状态及相册归属，用于浏览、整理、统计、旅程展示和你主动选择的编辑操作。你可以授予完整或有限照片访问权限。
归档、喜欢、创建或修改相册、编辑和删除通过 Apple 的系统照片库接口执行。Mne 不请求相机、麦克风或设备实时位置权限。设备倾斜用于卡片视差和暂存区物理效果，在本机使用，不存储或上传。
02设备上的照片识别
相似照片比较，以及小猫、小狗、小鸟、植物、食物和建筑六类主题识别，都在设备上完成。扫描排除共享相册，读取本地可用缩略图；主题识别对视频仅抽取少量本地画面。扫描不会为识别下载 iCloud 原图，不识别人脸身份。
识别标签、相似分组、扫描缓存和照片标识留在本机，不上传到 Mne 服务器。功能使用次数和所选主题类别可能进入下述使用统计，但不包含识别出的照片或其标识。
03照片地点、地图与 iCloud
旅程根据照片已有的时间和坐标在本机分组。显示地图或将照片坐标转换为地名时，Apple 地图与地理编码服务可能收到相关坐标、地图区域和语言偏好；使用“查找地点名称”时，你输入的地名会发送给 Apple。连接也会涉及 IP 地址等网络信息。这些请求不发送给 Mne 的账号服务器。
Mne 不读取设备实时位置。旅程展示和地名解析本身不改动照片地点；如果你进入照片地点编辑器并确认保存，Mne 会将你选择的地点写入系统照片库，也支持主动移除地点。
本地识别的限制不代表 App 完全离线：查看照片、播放 Live Photo 或视频、编辑、分享，或主动读取原始信息时，系统可能从 iCloud 获取所需媒体。系统照片库中的编辑、相册变化与删除，也可能按你的 iCloud 照片设置同步。Apple 服务适用 Apple 隐私政策。
04可选账号与资料同步
基础照片整理可以作为访客使用；部分实验功能需要登录。注册和登录使用开发者的服务器，处理邮箱、密码、昵称、账号 ID 和邀请码／邀请关系；服务器保存密码的加盐验证摘要。你主动提供的生日及选择上传的个人头像，也作为账号资料保存。
登录后，资料和部分本地数据会自动同步，也可以使用“立即同步”：包括头像、昵称、个人背景、佩戴的成就、整理数量、估算容量、整理日期、成就获得日期，以及主题、语言和照片显示比例等偏好。同步使用随机生成的设备标识区分设备。
照片库原件、视频、相册名称和成员列表、照片标识、逐张删除明细以及识别标签不进入这些备份。你主动选作个人头像的图片是单独上传的账号资料。
05默认启用的使用统计
当前版本默认向开发者服务器发送使用统计，访客也在内。统计包含随机访客／设备标识、会话时间和前台使用时长、App 与 iOS 版本、运行环境、连接入口、照片访问权限状态、可访问照片和视频的数量、浏览／喜欢／归档／删除数量、容量汇总、主题和图标选择，以及固定页面和功能的访问、操作、时长与导航汇总。相似主题还记录选择的类别、次数和使用时长。
这些数据用于了解功能使用和改进 App，不包含照片内容、媒体标识、相册名、输入的地名或照片坐标。访客统计会在之后登录时关联到账号，因此不是无法关联身份的完全匿名数据。当前界面没有独立的使用统计关闭开关。
06你主动提交的错误报告
登录用户可以在开发者面板主动确认上传一份错误报告。它包含 App／系统版本、设备环境、图库与操作的数量汇总、性能和资源读取计数，以及最近的诊断事件，并关联当前账号。报告不包含照片、媒体标识、相册名、照片坐标、邮箱字段、文件路径或登录凭据。
进程内诊断不会作为错误报告持续自动上传。手动报告与默认使用统计是不同的流程。
07本地数据与卸载
Mne 在设备上保存相册显示顺序、封面照片引用、自定义图标、最近相册、偏好、暂存区照片引用、成功操作和删除明细、统计、记忆碎片／成就进度，以及旅程分组、地名和识别缓存。暂存区保存的是引用，照片仍在系统图库。
Mne 没有为这些本地记录实现独立的 iCloud／CloudKit 同步。系统设备备份是否包含可备份的 App 数据，取决于你的 Apple 设置；部分可重建缓存已排除备份。账号同步另按上文说明进行。
使用 iOS 的“删除 App”会移除 App 沙盒中的本地数据；“卸载 App”可能保留文稿与数据。系统照片库和服务器资料不会因此被删除。登录与访客凭据存放在仅限本设备的系统钥匙串，不通过 iCloud 钥匙串同步，但可能在删除并重新安装后仍可读取。
08服务器保存与删除
账号资料与同步数据保留到账号删除；使用统计和服务事件不会按固定天数自动清理。手动错误报告按 30 天窗口清理，并受数量限制，可能提前移除。
账号删除会清除主数据库中关联的账号资料、登录会话、备份、错误报告、统计与已关联访客历史。为阻止旧请求重放，服务器保留随机身份的单向撤销摘要；删除请求回执摘要在七天后过期。这些摘要不包含原始资料或使用明细。
账号删除不会清除设备上的照片和整理记录。删除账号后若继续作为访客使用，默认使用统计仍可能产生新的记录。若你需要了解服务器独立备份的清理，或请求协助处理访客数据，请通过下方邮箱联系开发者。
09你可以控制什么
- 照片权限：在“设置 → 隐私与安全性 → 照片 → Mne”中调整授权范围或关闭访问。
- 照片去留：暂存可以恢复。实际删除交由系统照片库确认和执行；适用项目进入系统“最近删除”，保留与最终移除由 iOS 管理。Mne 不提供绕过系统的永久清空操作。
- 缓存：个人中心设置中的“清理缓存”移除可重建缓存；不会清除账号、统计、成就、操作历史或暂存区。当前没有一键清空全部本地个人记录的入口。
- 账号：在设置的服务器连接区长按已登录邮箱，选择“删除账号”，输入当前密码并确认。只有服务器确认成功才算删除完成；服务不可用时需要重试。退出登录不会删除已保存的服务器资料。
- 分享：使用系统分享时，你选择的内容会交给你指定的接收方，接收方可能适用自己的隐私规则。
10服务、SDK 与广告
Mne 使用 Apple 的系统框架和地图／地理编码／照片服务，以及开发者运营的账号、备份、使用统计、错误报告、内容和更新服务。开发者服务使用 HTTPS，入口为 mne-api.yifanovo.com 和 cn-api.yifanovo.com；连接会涉及 IP 地址等必要网络信息，服务端也短暂使用连接地址进行请求限流。更新检查会发送 iOS 版本以判断兼容性，内容请求用于下载公开的文字和卡画。
App 没有集成第三方统计、广告、自动崩溃收集或登录 SDK，也没有广告标识符或跨 App 广告跟踪实现。使用统计用于 App 自身的功能分析，不用于广告定向。当前版本没有 App 内购买或自动续订订阅。
开发者使用 Cloudflare 和腾讯云提供网络代理、中转或基础设施支持。连接必然涉及 IP 地址等网络信息；开发者不持久保存 IP 地址或 HTTP 访问日志。服务端为防止滥用，会短暂在内存中使用连接地址进行限流。使用统计、账号操作记录和主动错误报告按本政策另行处理，不属于 HTTP 访问日志。
网络服务商可能根据自身的安全和服务规则处理连接信息，适用 Cloudflare 隐私政策和 腾讯云隐私政策。开发者不出售个人数据，不将其用于广告或跨 App 广告跟踪，也不向本政策所述服务之外的接收方提供数据用于其他目的。
11儿童与监护人
Mne 未另行设置产品最低使用年龄；App Store 的年龄分级应以商店页面为准。如果你是未成年人，请与监护人一起阅读本政策，尤其是账号资料和默认使用统计的说明。监护人如需了解或协助处理未成年人的账号资料，可通过下方邮箱联系开发者。
01Photo library and device permissions
Mne accesses the photos, videos and related information you allow, including capture dates, existing locations, dimensions, formats, duration, sizes, favorites and album membership. This supports browsing, organizing, statistics, journeys and edits you choose to make. You can grant full or limited photo access.
Archiving, favorites, album creation and changes, editing and deletion use Apple’s system photo-library interfaces. Mne does not request camera, microphone or live device-location permission. Device tilt supports card perspective and staged-photo physics locally; tilt readings are not stored or uploaded.
02Recognition on your device
Similar-photo comparison and recognition of six themes—cats, dogs, birds, plants, food and buildings—run on your device. Scans exclude shared albums and use locally available thumbnails; video theme recognition samples a few local frames. Scanning does not download iCloud originals for recognition and does not identify people by their faces.
Recognition labels, similarity groups, scan caches and photo identifiers stay on the device and are not uploaded to Mne servers. Feature-use counts and the selected theme category may be included in the usage statistics below, without the recognized photos or their identifiers.
03Photo locations, Maps and iCloud
Journeys are grouped locally using the dates and coordinates already attached to photos. When displaying maps or resolving photo coordinates into place names, Apple’s Maps and geocoding services may receive the relevant coordinates, map area and language preference. “Find a place name” sends the place text you enter to Apple. Connections also involve network information such as your IP address. These requests are not sent to Mne’s account servers.
Mne does not read your live device location. Journey display and place-name resolution do not themselves change photo locations. If you open the photo-location editor and confirm Save, Mne writes your chosen location to the system photo library; you can also explicitly remove a location.
Local recognition does not mean the entire app is offline. Viewing media, playing Live Photos or videos, editing, sharing or explicitly requesting original information may cause the system to retrieve the required media from iCloud. Photo-library edits, album changes and deletions may also sync according to your iCloud Photos settings. Apple’s processing is governed by the Apple Privacy Policy.
04Optional account and sync
You can curate photos as a guest; some experimental features require sign-in. Registration and sign-in use the developer’s servers and process your email, password, nickname, account ID and invitation code or referral relationship. The server stores a salted password-verification hash. A birthday you provide and a personal avatar you choose to upload are also stored as account information.
After sign-in, your profile and selected local data sync automatically, with a “Sync now” action also available. This includes your avatar, nickname, profile backdrop, equipped achievement, organizing counts, estimated sizes, organizing days, achievement dates, and preferences such as theme, language and photo aspect ratio. Sync uses a randomly generated device identifier to distinguish devices.
These backups exclude photo-library originals, videos, album names and member lists, photo identifiers, item-level deletion records and recognition labels. An image you deliberately choose as your profile avatar is separately uploaded account information.
05Usage statistics enabled by default
The current version sends usage statistics to the developer’s servers by default, including for guests. These include random guest and device identifiers, session times and foreground duration, app and iOS versions, runtime environment, connection entry, photo-permission status, accessible photo and video counts, reviewed/favorited/archived/deleted counts, size totals, theme and icon choices, and summaries of fixed pages, feature visits, actions, time and navigation. Theme recognition also records the selected category, frequency and duration.
This data helps understand feature use and improve the app. It excludes photo content, media identifiers, album names, entered place names and photo coordinates. Guest statistics are associated with your account when you later sign in, so they are not fully anonymous or unlinkable. The current interface has no separate switch for disabling usage statistics.
06Error reports you choose to submit
A signed-in user can explicitly confirm an error-report upload in the developer panel. It contains app and OS versions, device environment, library and action totals, performance and resource-read counters, and recent diagnostic events, linked to the current account. Reports exclude photos, media identifiers, album names, photo coordinates, email fields, file paths and sign-in credentials.
In-process diagnostics are not continuously uploaded as error reports. Manual reports and default usage statistics are separate processes.
07Local storage and uninstalling
Mne stores album display order, cover-photo references, custom icons, recent albums, preferences, staged-photo references, successful-action and deletion details, statistics, memory-fragment and achievement progress, and journey groups, place names and recognition caches on the device. Staging stores references; the photos remain in the system library.
Mne does not implement separate iCloud or CloudKit sync for these local records. Whether system device backups include eligible app data depends on your Apple settings; some rebuildable caches are excluded from backup. Account sync works separately as described above.
iOS “Delete App” removes local data in the app sandbox; “Offload App” may retain documents and data. Neither deletes the system photo library or server records. Sign-in and guest credentials use the system’s device-only Keychain and do not sync through iCloud Keychain, but may remain readable after deleting and reinstalling the app.
08Server retention and deletion
Account information and synced data are retained until account deletion. Usage statistics and service events do not automatically expire after a fixed number of days. Manual error reports are pruned on a 30-day window and subject to count limits, so they may be removed sooner.
Account deletion removes the associated profile, sign-in sessions, backups, error reports, statistics and linked guest history from the primary database. To prevent old requests from being replayed, the server retains one-way revocation hashes of random identities; deletion-receipt hashes expire after seven days. These hashes do not contain the original profile or usage details.
Deleting an account does not remove photos or organizing records on your device. If you continue using Mne as a guest after deletion, default usage statistics may generate new records. For questions about removal from independent server backups, or help with guest data, contact the developer using the email below.
09Your controls
- Photo access: Change or revoke access in Settings → Privacy & Security → Photos → Mne.
- Keeping and deleting photos: Staged items can be restored. Actual deletion is submitted to the system photo library for confirmation and execution. Eligible items go to the system’s Recently Deleted area; iOS manages retention and final removal. Mne provides no bypass to permanently empty it.
- Cache: “Clear cache” in profile settings removes rebuildable caches, not your account, statistics, achievements, action history or staged items. There is currently no single action to erase all local personal records.
- Account: In the server-connection section of Settings, press and hold your signed-in email, choose “Delete account,” enter your current password and confirm. Deletion is complete only after the server confirms it; retry if the service is unavailable. Signing out does not delete saved server data.
- Sharing: System sharing sends the content you choose to the recipient you select. That recipient may apply its own privacy rules.
10Services, SDKs and advertising
Mne uses Apple’s system frameworks, Maps, geocoding and Photos services, plus developer-operated account, backup, usage-statistics, error-report, content and update services. Developer services use HTTPS through mne-api.yifanovo.com and cn-api.yifanovo.com. Connections involve network information such as IP addresses; the server temporarily uses connection addresses for rate limiting. Update checks send the iOS version for compatibility; content requests download public writing and card artwork.
The app integrates no third-party analytics, advertising, automatic crash-reporting or sign-in SDKs, and implements no advertising identifiers or cross-app advertising tracking. Usage statistics support analysis of Mne’s own features, not targeted advertising. The current version has no in-app purchases or auto-renewing subscriptions.
The developer uses Cloudflare and Tencent Cloud for network proxying, relaying or infrastructure. Connections necessarily involve network information such as IP addresses. The developer does not persist IP addresses or HTTP access logs. The server temporarily uses connection addresses in memory for rate limiting. Usage statistics, account-operation records and reports you explicitly submit are handled separately under this policy; they are not HTTP access logs.
Network providers may process connection information under their own security and service rules; see the Cloudflare Privacy Policy and Tencent Cloud Privacy Policy. The developer does not sell personal data, use it for advertising or cross-app advertising tracking, or provide it to recipients beyond the services described in this policy for other purposes.
11Children and guardians
Mne does not set an additional minimum product-use age; consult the App Store listing for its age rating. If you are a minor, please read this policy with a parent or guardian, particularly the account-information and default-usage-statistics sections. Guardians can contact the developer below for questions or help concerning a minor’s account information.
