数据边界，写在使用之前。Data boundaries, before you use the product.

产品用途Product purpose

签绪用于在桌面 Chrome 中按任务整理、查找、切换、恢复和管理浏览器页签。数据只用于这一单一用途及其安全、稳定运行。签绪不替换主页、默认搜索引擎或地址栏行为。TabToTask helps users organize, find, switch, restore, and manage browser tabs by task in desktop Chrome. Data is used only for this single purpose and its secure, reliable operation. TabToTask does not replace the home page, default search engine, or address-bar behavior.

本机处理的数据Data processed on-device

短期页签预览截图不会发送给云端 AI。签绪不以读取页面正文、表单输入、Cookie、密码、账号令牌或支付信息作为产品功能。Short-term tab preview screenshots are never sent to cloud AI. Reading page bodies, form input, cookies, passwords, account tokens, or payment information is not part of TabToTask’s product function.

官网访问分析Website analytics

官网匿名统计默认关闭，只有你在隐私设置中主动开启后才会发送。开启后，本机会按自然日生成不可跨日关联的随机批次 ID，并只上传官网统计版本和四项绝对计数：页面打开、Chrome 商店入口、离线下载入口、预约提交。它不读取扩展中的页签、浏览历史或页面正文。Website analytics are off by default and are sent only after you enable them in Privacy Settings. Once enabled, the browser creates a random daily batch ID that cannot be linked across days and sends only the analytics version plus four absolute counters: page views, Chrome Web Store entry clicks, offline-download entry clicks, and reservation submissions. It never reads extension tabs, browsing history, or page content.

• 不上传网址、站内路径、来源、搜索词、逐次时间、会话 ID、邮箱、IP、Cookie、账号或跨站指纹。No URL, on-site path, referrer, search term, per-event timestamp, session ID, email address, IP, cookie, account data, or cross-site fingerprint is uploaded.
• Do Not Track 或 Global Privacy Control 开启时，官网不发送统计事件。No analytics event is sent when Do Not Track or Global Privacy Control is enabled.
• 同一天重试复用同一个批次 ID；跨日更换，后台不能用它识别同一浏览器。Retries within one day reuse the same batch ID. It changes across days, so the backend cannot use it to recognize the same browser.
• 关闭统计后立即停止后续请求，并清除本机待上传批次和日批次秘密。Turning analytics off stops future requests immediately and clears the pending local batch and daily-batch secret.
• 原始匿名日批次最多保留 30 天；不含批次身份的月度汇总最多保留 12 个月。Raw anonymous daily batches are retained for up to 30 days. Monthly totals without batch identity are retained for up to 12 months.
• 匿名统计只在香港后端管理面板中汇总展示，公开访客无法读取。Anonymous totals are visible only in the Hong Kong backend admin panel and are not publicly readable.

当你主动提交上线预约时，我们会在香港后端保存你填写的邮箱、触发预约的安装入口、提交时间和语言，用于发送上线通知和兑现预约会员赠送。预约不会附带统计会话、页面路径或日批次 ID，邮箱也不会用于个性化广告或出现在公开页面。When you submit a launch reservation, the Hong Kong backend stores the email you provide, the install entry that opened the reservation, submission time, and language. We use it to send the launch notice and fulfill the membership offer. A reservation is never linked to an analytics session, page path, or daily batch ID, and your email is never used for personalized advertising or shown publicly.

存储位置与保留时间Storage and retention

• 行为事件保存在本机 IndexedDB，滚动保留 30 天；用户可在隐私与数据设置中清除。Behavior events are stored in local IndexedDB on a rolling 30-day basis and can be cleared in Privacy & Data settings.
• 虚拟任务、页面关系与手动纠错保留到用户删除任务或清除全部本地数据。Virtual tasks, page relationships, and manual corrections remain until the user deletes them or clears all local data.
• 少量偏好可进入浏览器同步或本地存储；真实上游 AI 密钥、许可证签名私钥和备份密钥只由香港服务器 Secret 注入，不进入扩展、官网、后台页面或浏览器同步。A small set of preferences may use browser sync or local storage. Real upstream AI keys, license-signing private keys, and backup keys are injected only as Hong Kong server secrets and never enter the extension, website, admin pages, or browser sync.
• 预览截图为短期会话缓存，最多 40 项，在会话结束、清除数据或缓存淘汰时删除。Preview screenshots are short-term session cache items, capped at 40 and removed on session end, data clearing, or cache eviction.
• 许可证、随机安装凭据、设备绑定、租约和 AI 额度属于提供已购权益所必需的业务记录；后端不建立用户账号，也不采集硬件指纹。扩展只保留当前设备凭据、可公开验签材料和最小权益状态。Licenses, random installation credentials, device bindings, leases, and AI quota are necessary business records used to deliver purchased entitlements. The backend creates no user account and collects no hardware fingerprint. The extension keeps only the current device credential, public verification material, and minimum entitlement state.
• 官网原始匿名日批次最多保留 30 天，月度汇总最多保留 12 个月；预约邮箱及其提交记录在最后一次提交后最多保留 90 天，或收到你的删除请求时提前删除。Raw anonymous website daily batches are retained for up to 30 days and monthly totals for up to 12 months. Reservation emails and submission records are retained for up to 90 days after the latest submission, or deleted earlier on request.

可选第三方 AIOptional third-party AI

只有用户主动开启 AI、查看发送范围、拥有有效试用或付费额度并触发分析后，扩展才会通过香港后端实时转发请求。可能发送：脱敏标题、注册域、路径类型、候选任务 ID/名称、少量聚合证据与风险代码。真实上游密钥不会下发到扩展。TabToTask sends an AI request through the Hong Kong backend only after the user enables AI, reviews the data scope, has valid trial or paid quota, and starts analysis. Possible fields include redacted titles, registered domains, path types, candidate task IDs/names, limited aggregate evidence, and risk codes. The real upstream key is never sent to the extension.

不会发送完整 URL、查询参数、哈希、页面正文、表单输入、Cookie、截图、书签、完整历史或原始行为事件流。AI 提示词和输出只在请求期间实时转发，不写入数据库、日志、统计或诊断。敏感站点默认排除；AI 只调整虚拟任务关系，不移动、关闭、固定、分组或重排真实页签。TabToTask does not send full URLs, query parameters, hashes, page bodies, form input, cookies, screenshots, bookmarks, complete history, or raw behavior streams. AI prompts and outputs are relayed only while the request is active and are not written to databases, logs, analytics, or diagnostics. Sensitive sites are excluded by default. AI adjusts virtual task relationships only and never moves, closes, pins, groups, or reorders real tabs.

权限与触发方式Permissions and triggers

分享与有限使用Sharing and Limited Use

除用户主动配置并触发的第三方 AI 外，签绪不出售、出租或将用户数据用于个性化广告，也不允许人工阅读浏览数据。必要数据只会在提供页签管理单一用途、遵守法律或处理安全滥用所需的范围内使用。Except for third-party AI explicitly configured and triggered by the user, TabToTask does not sell, rent, or use user data for personalized advertising, and does not permit human reading of browsing data. Necessary data is used only to provide the single tab-management purpose, comply with law, or address security abuse.

用户控制与删除User control and deletion

• 拒绝或撤销可选的书签、历史与 AI 访问。Deny or revoke optional bookmark, history, and AI access.
• 清除 AI 密钥、行为事件或全部本地数据。Clear the AI key, behavior events, or all local data.
• 删除任务、关系、回收站内容并注销本地激活状态。Delete tasks, relationships, recycle-bin items, and deactivate local activation.
• 卸载扩展以删除扩展拥有的本地存储；同步数据由浏览器账户机制管理。Uninstall to remove extension-owned local storage; browser-account mechanisms control synced data.
• 单独开启或关闭官网匿名统计；关闭会清除本机待上传批次。Enable or disable anonymous website analytics separately; turning it off clears the pending local batch.
• 通过支持与数据请求渠道申请删除预约邮箱及其提交记录。Request deletion of a reservation email and its submission record through the support and data-request channel.

关闭 AI 或清除本机密钥不会自动删除第三方已经处理的数据；第三方删除渠道将在正式接收方披露中写明。Disabling AI or clearing a local key does not automatically delete data already processed by a third party; the applicable deletion channel will be disclosed with the confirmed recipient.

如果未来版本改变收集字段、用途、保留周期或第三方接收方，签绪会在变更生效前通过产品内醒目提示主动说明，并同步更新本政策与商店隐私披露。If a future version changes collected fields, purposes, retention, or third-party recipients, TabToTask will provide a prominent in-product notice before the change takes effect and will update this policy and the store privacy disclosures.