隐私政策Privacy Policy

1. 适用范围与责任方1. Scope and controller

本政策由 MNV LIMITED（下称「我们」）发布。MNV LIMITED 是一家注册于中国香港特别行政区的 iOS 软件公司，成立于 2022 年 5 月 16 日；Reflib 是其旗下的 iOS 开发团队与产品品牌。就本政策而言，MNV LIMITED 是《个人资料（私隐）条例》所指的资料使用者，在 GDPR 语境下为数据控制者。 This policy is issued by MNV LIMITED (“we”, “us”), an iOS software company incorporated in the Hong Kong SAR, China on 16 May 2022. Reflib is its iOS development team and product brand. For the purposes of this policy, MNV LIMITED is the data user under the Personal Data (Privacy) Ordinance and the data controller under the GDPR.

政策适用于以下六款应用及其附带的扩展与小组件： It applies to the following six apps together with their extensions and widgets:

• Reflib BW com.reflib.browser
• Reflib CAL com.reflib.cal
• Reflib DNS com.reflib.dns
• Reflib Mail com.reflib.mail
• Reflib NIC com.reflib.nic
• Reflib PWD com.reflib.password

本政策也适用于你正在浏览的 about.reflib.com 网站本身。本网站是纯静态页面，不设置任何 Cookie、不嵌入第三方脚本、不做访客分析。服务器会按常规记录访问日志（IP 地址、时间、请求路径与 User-Agent）用于运维与防滥用，保留期不超过 14 天。 It also covers this website, about.reflib.com. The site is fully static: it sets no cookies, embeds no third-party scripts and runs no visitor analytics. The server keeps ordinary access logs (IP address, timestamp, request path, user agent) for operations and abuse prevention, retained for no more than 14 days.

2. 一句话总结2. The short version

我们不收集你的个人资料。Reflib 没有账号系统，没有用户数据库，也没有一台用于保存用户内容的服务器。你在应用里创建的一切都留在你的 iPhone 上。当某款应用需要联网时，它会由你的设备直接请求相应服务商（Cloudflare、Microsoft、NameSilo 等）的官方接口，中间不经过 Reflib。 We do not collect your personal data. Reflib has no account system, no user database and no server that stores user content. Everything you create inside an app stays on your iPhone. When an app needs the network, your device talks directly to the relevant provider’s official API (Cloudflare, Microsoft, NameSilo and so on) — nothing is relayed through Reflib.

3. 我们绝不做的事3. What we never do

• 不要求你注册 Reflib 账号，也不收集你的姓名、电话或身份信息。We never ask you to register a Reflib account, and we never collect your name, phone number or identity details.
• 不集成任何第三方分析、崩溃上报、归因或广告 SDK。六款应用中不存在 Firebase、Google Analytics、Sentry、Mixpanel、AppsFlyer 或同类组件。We integrate no third-party analytics, crash-reporting, attribution or advertising SDK. There is no Firebase, Google Analytics, Sentry, Mixpanel or AppsFlyer in any of the six apps.
• 不请求 IDFA，不参与跨 App 追踪，因此也不会向你弹出 App 追踪透明度（ATT）授权框。We never request the IDFA and never track you across apps, so you will never see an App Tracking Transparency prompt from us.
• 不出售、不出租、不以任何形式交易用户数据——我们手上没有可交易的数据。We never sell, rent or trade user data. There is no user data on our side to trade.
• 不在应用内投放广告。We never show ads inside the apps.
• 不读取你其他应用的数据。每款 Reflib 应用只能访问自己的沙盒，彼此之间也不共享数据。We never read data belonging to your other apps. Each Reflib app can only reach its own sandbox, and the apps do not share data with one another.

4. 你的数据存在哪里4. Where your data lives

所有你创建或导入的内容都保存在 iOS 分配给该应用的沙盒容器内，通常是下列几种形式： Everything you create or import is stored inside the sandbox container iOS assigns to the app, typically in one of these forms:

• 本地数据库（SwiftData 或 SQLite）——事件、书签、历史、域名备注、密码条目等结构化内容。A local database (SwiftData or SQLite) for structured content such as events, bookmarks, history, domain notes and password entries.
• 沙盒内的文件——附件、离线快照、下载的文件与备份。Files in the sandbox for attachments, offline snapshots, downloads and backups.
• 应用偏好设置——视图选项、主题、提醒间隔等设置项。App preferences for view options, themes, reminder intervals and similar settings.
• iOS 钥匙串（Keychain）——Reflib BW 的自动填充主密钥、Reflib DNS 的 Cloudflare 凭据、Reflib Mail 的 OAuth 令牌均存放于此，由系统提供保护。The iOS Keychain, which holds Reflib BW’s autofill master key, Reflib DNS’s Cloudflare credentials and Reflib Mail’s OAuth tokens under system protection.

这些数据不会被上传到 Reflib。当你的 iPhone 设置了锁屏密码时，沙盒内的文件由 iOS 数据保护（Data Protection）在设备层面加密。我们强烈建议你为设备设置密码并开启 Face ID 或 Touch ID——这是保护应用内数据最有效的一层。 None of this is uploaded to Reflib. When your iPhone has a passcode set, files in the sandbox are encrypted at the device level by iOS Data Protection. We strongly recommend setting a passcode and enabling Face ID or Touch ID; it is the single most effective layer protecting in-app data.

5. 逐款应用说明5. App-by-app detail

下表概括了每款应用的数据处理方式。「我们能看到」一栏指 Reflib 作为开发者实际能获取到的信息。 The table below summarises how each app handles data. “What we can see” means the information actually available to Reflib as the developer.

Reflib BW（浏览器）Reflib BW (browser)

书签、历史、阅读列表、站点偏好、拦截统计，以及你选择保存的登录信息、银行卡与 TOTP 密钥，均写入设备上按用户配置文件隔离的本地数据库。这些敏感条目使用 AES-GCM 加密，主密钥存放在 iOS 钥匙串中并标记为「仅本机」，不会随 iCloud 钥匙串同步到其他设备。 Bookmarks, history, reading list, site preferences, blocking statistics and any logins, cards or TOTP secrets you choose to save are written to a local database isolated per user profile. Those sensitive entries are encrypted with AES-GCM under a master key held in the iOS Keychain and marked this-device-only, so it never syncs to other devices through iCloud Keychain.

作为浏览器，它当然会连接你主动访问的网站，以及你在设置中选择的搜索引擎（Reflib Search、DuckDuckGo、Google 或 Bing）。为保持拦截规则有效，它会定期从 EasyList、EasyPrivacy 与 EasyList China 等公开规则源下载更新，这些请求只包含规则文件本身，不携带你的浏览记录。若你使用起始页的 Reflib Search 搜索建议或 AI 回答功能，相应查询会发送至 search.reflib.com，其数据处理方式适用该服务自身的隐私政策。 Being a browser, it naturally connects to the sites you visit and to the search engine you pick in Settings (Reflib Search, DuckDuckGo, Google or Bing). To keep blocking effective it periodically downloads updates from public rule sources such as EasyList, EasyPrivacy and EasyList China; those requests fetch the rule files only and carry none of your browsing history. If you use the Reflib Search suggestions or AI answers on the start page, those queries go to search.reflib.com and are handled under that service’s own privacy policy.

Reflib CAL（日历）Reflib CAL (calendar)

这是六款中最简单的一款：它没有任何网络代码。日历、事件、参与者、富文本备注与附件全部存于设备本地的 SwiftData 数据库与沙盒文件中。港澳、内地、美国、日本、新加坡的公众假期由内置算法离线计算得出，不需要下载。提醒通过 iOS 本地通知发出，不经过任何推送服务器。 This is the simplest of the six: it contains no networking code at all. Calendars, events, participants, rich notes and attachments live entirely in an on-device SwiftData database and sandbox files. Public holidays for Hong Kong, Macau, the mainland, the United States, Japan and Singapore are computed offline by a built-in algorithm with nothing to download. Reminders are delivered as iOS local notifications and never touch a push server.

Reflib DNS（Cloudflare DNS 管理）Reflib DNS (Cloudflare DNS manager)

你填入的 Cloudflare API Token 或 Global API Key 保存在 iOS 钥匙串中。所有管理操作都由你的 iPhone 直接向 api.cloudflare.com 发起，Reflib 不设中转服务器，也无从得知你管理着哪些域名。此外，DoH 查询会发往你自行选择的公共解析器，RDAP 查询发往 rdap.org，SSL 证书检查则直接连接你指定的目标主机 443 端口。 The Cloudflare API token or Global API Key you enter is stored in the iOS Keychain. Every management action goes straight from your iPhone to api.cloudflare.com; Reflib operates no relay and has no way to learn which domains you manage. DoH lookups go to the public resolver you select, RDAP queries go to rdap.org, and certificate checks connect directly to port 443 on the host you name.

导出的 .reflibdns 备份文件由你自行保存与分享，请注意其中可能包含账户配置信息。 The .reflibdns backup file is yours to store and share; be aware that it can contain account configuration.

Reflib Mail（Microsoft 邮件）Reflib Mail (Microsoft mail)

登录采用 OAuth 2.0 授权码模式配合 PKCE，界面由系统的 ASWebAuthenticationSession 承载。这意味着你的邮箱密码只会输入在微软自己的登录页面上，Reflib 从头到尾都接触不到它。授权完成后拿到的访问令牌与刷新令牌保存在 iOS 钥匙串中。 Sign-in uses the OAuth 2.0 authorisation-code flow with PKCE, presented through the system’s ASWebAuthenticationSession. That means your mailbox password is only ever typed into Microsoft’s own sign-in page and Reflib never touches it. The resulting access and refresh tokens are kept in the iOS Keychain.

邮件的读取、发送、搜索与文件夹操作全部通过 graph.microsoft.com 完成，请求由你的设备直接发出。邮件正文与附件仅在使用期间缓存于设备本地。导出的 .reflibmail 配置文件仅含账户设置，不包含任何令牌或凭据。若你的邮箱属于企业租户，管理员可能依据贵司政策对该应用的访问进行管控或审计，这部分不在我们的控制范围内。 Reading, sending, searching and folder operations all run through graph.microsoft.com, requested directly by your device. Message bodies and attachments are cached locally only while in use. The exported .reflibmail configuration contains account settings only and never includes tokens or credentials. If your mailbox belongs to a corporate tenant, your administrator may govern or audit the app’s access under your organisation’s policy, which is outside our control.

Reflib NIC（NameSilo 域名管理）Reflib NIC (NameSilo domain manager)

你的 NameSilo API Key 与账户配置保存在设备本地的应用存储中，域名列表、分组与备注则缓存在本地数据库。所有请求由 iPhone 直接发往 www.namesilo.com/api，Reflib 不参与其中。到期提醒使用 iOS 本地通知，主屏小组件读取的也是本地缓存。 Your NameSilo API key and account configuration are kept in the app’s local storage on device, while the domain list, groups and notes are cached in a local database. All requests go straight from your iPhone to www.namesilo.com/api with no involvement from Reflib. Expiry reminders use iOS local notifications, and the Home Screen widget reads the same local cache.

Reflib PWD（密码管理）Reflib PWD (password manager)

密码库保存在设备本地的 App Group 容器中，以便系统自动填充扩展能够读取。该应用没有任何联网代码：不上传、不同步、不备份到云端，也没有账号。CloudKit 已明确关闭，数据不会进入 iCloud。Face ID 或 Touch ID 用于解锁应用与自动填充；你也可以启用计算器伪装，让 App 在主屏上看起来只是一个计算器。 The vault lives in an on-device App Group container so the system AutoFill extension can read it. The app contains no networking code whatsoever: nothing is uploaded, synced or backed up to a cloud, and there is no account. CloudKit is explicitly disabled, so nothing reaches iCloud. Face ID or Touch ID unlocks the app and AutoFill, and you can enable the calculator disguise so the app looks like a plain calculator on the Home Screen.

6. 第三方服务6. Third-party services

我们不向任何第三方共享数据。但当你主动使用某项功能时，你的设备会直接连接下列服务，这些连接受各自服务商的隐私政策约束： We share data with no one. When you actively use a given feature, however, your device connects directly to the services below, each governed by its own provider’s privacy policy:

7. 设备权限7. Device permissions

应用只在你使用到对应功能时才向系统申请权限，你随时可以在 iOS「设置」中撤销。拒绝任何一项权限都不会导致应用无法使用，只会关闭相应的单个功能。 An app only asks the system for a permission at the moment you use the matching feature, and you can revoke it in iOS Settings at any time. Declining any permission never disables the app as a whole — it only switches off that one feature.

• 相机——扫描二维码（网址、TOTP 密钥）与拍摄附件。图像只在设备本地处理。Camera — scanning QR codes (URLs, TOTP secrets) and capturing attachments. Images are processed entirely on device.
• 照片——选取图片作为邮件或事件附件。Photos — picking images to attach to messages or events.
• Face ID / Touch ID——解锁应用与自动填充。生物特征数据由 iOS 的安全隔区处理，应用只会收到「成功」或「失败」，永远拿不到你的指纹或面容数据。Face ID / Touch ID — unlocking the app and AutoFill. Biometric data is handled by the iOS Secure Enclave; the app only receives a success or failure result and never sees your fingerprint or face data.
• 通知——发送本地提醒（日程提醒、域名与证书到期、新邮件）。全部为本地通知，不经过远程推送服务器。Notifications — local reminders for events, domain and certificate expiry, and new mail. All are local notifications and never pass through a remote push server.

8. Apple 与 App Store8. Apple and the App Store

应用的下载与付费全部由 Apple 处理，我们看不到你的 Apple 账户、付款方式或联系方式。我们能从 App Store Connect 取得的，只有 Apple 提供的匿名汇总统计（例如某地区某天的下载量与销售额），其中不含任何可识别个人身份的信息。若你通过 App Store 提交评分或评论，该内容将公开显示，并遵循 Apple 的条款。 Downloads and payments are handled entirely by Apple; we cannot see your Apple Account, payment method or contact details. All we can obtain from App Store Connect is the anonymous aggregate reporting Apple provides — for example downloads and revenue by region and day — which contains nothing personally identifiable. If you leave a rating or review on the App Store, it is published publicly under Apple’s terms.

9. 数据安全9. Data security

由于数据不离开你的设备，最主要的安全边界就是 iPhone 本身。我们所做的是：把凭据交给 iOS 钥匙串保管、对浏览器中保存的登录信息做 AES-GCM 加密、所有网络请求一律走 HTTPS（TLS）、并为敏感界面提供生物识别锁。 Because data never leaves your device, the primary security boundary is the iPhone itself. On our side we hand credentials to the iOS Keychain, encrypt saved browser logins with AES-GCM, send every network request over HTTPS (TLS), and put a biometric lock in front of sensitive screens.

你能做的、也是最重要的是：为设备设置足够强的锁屏密码，开启 Face ID 或 Touch ID，及时更新 iOS，不要越狱设备，并妥善保管你从应用中导出的任何备份文件。没有任何一种技术手段能在设备本身失控的情况下保证数据安全。 What matters most is on your side: set a strong passcode, enable Face ID or Touch ID, keep iOS up to date, don’t jailbreak the device, and look after any backup file you export. No technical measure can keep data safe once the device itself is compromised.

10. 数据保留与删除10. Retention and deletion

我们不保留你的数据，所以也没有「删除账号」这个步骤。要清除某款应用的全部内容，直接从 iPhone 上删除该应用即可——iOS 会一并移除它的沙盒容器与钥匙串条目。若你只想清空部分内容，各应用内也提供了逐条删除、清空回收站或重置数据的选项。 We retain nothing of yours, so there is no “delete account” step. To wipe an app’s contents, simply delete the app from your iPhone — iOS removes its sandbox container and Keychain items along with it. If you only want to clear part of it, each app offers per-item deletion, emptying the trash, or resetting its data.

你曾导出到「文件」App、iCloud Drive 或其他位置的备份文件不受此影响，需要你自行删除。你主动发送给我们的支持邮件，我们最多保留 24 个月用于问题追溯，你也可以随时来信要求提前删除。 Backup files you previously exported to the Files app, iCloud Drive or elsewhere are unaffected and must be deleted by you. Support emails you send us are kept for up to 24 months for issue tracking, and you may write to us at any time to have them deleted sooner.

11. 儿童隐私11. Children’s privacy

我们的应用面向一般用户，并非专为儿童设计。由于我们不收集任何个人资料，自然也不会有意或无意地收集儿童的个人资料。请注意 Reflib BW 是一款可访问完整互联网的浏览器，如需为未成年人限制内容，建议配合 iOS 的「屏幕使用时间」与「内容与隐私访问限制」使用。 Our apps are made for a general audience and are not directed at children. Since we collect no personal data at all, we neither knowingly nor inadvertently collect data from children. Note that Reflib BW is a browser with access to the open internet; to restrict content for a minor, please pair it with iOS Screen Time and Content & Privacy Restrictions.

12. 你的权利12. Your rights

本政策受中国香港特别行政区法律管辖，并遵循《个人资料（私隐）条例》（第 486 章）的要求。若你身处欧洲经济区、英国或美国加利福尼亚州，你还享有 GDPR、UK GDPR 或 CCPA/CPRA 赋予的权利，包括查阅、更正、删除、限制处理、数据可携以及反对处理。 This policy is governed by the laws of the Hong Kong SAR and follows the Personal Data (Privacy) Ordinance (Cap. 486). If you are in the European Economic Area, the United Kingdom or California, you additionally hold rights under the GDPR, UK GDPR or CCPA/CPRA, including access, rectification, erasure, restriction, portability and objection.

实际操作上有一点需要说明：由于我们不持有你的任何个人资料，通常没有可供查阅、更正或导出的内容。你对应用内数据拥有完全的控制权——它就在你手上。若你曾主动向我们发送过邮件，那部分通信记录属于我们持有的资料，你可以随时要求查阅或删除。我们承诺在收到请求后 30 日内回复，且不会因你行使权利而对你区别对待。 One practical note: because we hold no personal data about you, there is usually nothing for us to disclose, correct or export. You already have full control over the in-app data — it is in your hands. If you have emailed us, that correspondence is data we hold, and you may ask to see or delete it at any time. We commit to responding within 30 days and will never treat you differently for exercising these rights.

13. 政策变更13. Changes to this policy

当应用的功能发生变化时，我们会同步更新本政策，并修改页首的「最后更新」日期。如果变更涉及数据处理方式的实质调整（例如新增一项需要联网的功能），我们会在应用内以显著方式提示，而不是悄悄改掉网页了事。我们建议你在版本更新后回来看一眼。 We update this policy whenever app behaviour changes and revise the “last updated” date at the top. If a change is material — a new feature that requires the network, for instance — we will surface it prominently inside the app rather than quietly editing this page. We suggest checking back after a version update.

14. 联系我们14. Contact us

对本政策有任何疑问、意见或投诉，欢迎来信。我们通常在 3 个工作日内回复。 If you have questions, comments or complaints about this policy, please write to us. We usually reply within three working days.

• 隐私事宜：Privacy matters: [email protected]
• 产品支持：Product support: [email protected]
• 电话：Telephone: +852 2661 2188
• 邮寄地址：MNV LIMITED，香港元朗宏業南街 22 號虹方 8 樓 802 室 Postal address: MNV LIMITED, Flat 02, 8/F, The Rainbow, 22 Wang Yip Street South, Yuen Long, N.T., Hong Kong

若你认为我们未能妥善处理你的查询或投诉，你也可以向香港个人资料私隐专员公署提出投诉。 If you feel we have not handled your enquiry or complaint properly, you may also complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong.