ENPrivacy Policy — Kenotex

Last updated: 2026-10-28 · Effective with the launch of Kenotex Pro.

Kenotex (the "App") is published by Kai XU as an independent developer. This Privacy Policy explains what information the App collects, how we use it, and the choices available to you.

1. Information We Collect

1.1 Locally on Your Device

• Your content: todos, calendar events, Ideas drafts, habits, themes, and preferences are stored locally in a SQLite database on your device; images you insert into your notes are stored as files in the App's data directory. The App reads this data only to provide its features.
• Images and camera: when you insert an image in Ideas (by taking a photo, choosing one from your photo library or Files, pasting, or dragging it in), the App re-encodes it as a JPEG and stores it on your device; re-encoding removes metadata such as location (GPS), camera make and model, and capture time. Choosing from your photo library uses the system photo picker, so the App receives only the images you select and does not read the rest of your library. The camera is used only when you take a photo to insert, and requires your permission (iOS). Screenshots taken with screenshot capture (selecting a screen region with the macOS shortcut, or cropping a screenshot from the iOS Shortcut) are saved as images in the same way; screenshot capture on macOS requires Screen Recording permission and captures the screen only when you press the shortcut.
• Apple Calendar / Reminders metadata (if you grant access): event titles, dates, and reminder times so the App can integrate with the system Calendar app. This data is read into local memory; the App does not transmit it to a server.
• Voice input (if you grant microphone and speech-recognition access): when you dictate in Ideas, the App captures audio from the microphone and transcribes it with Apple's Speech framework. Depending on your device and language, Apple may process the audio on its servers under Apple's privacy policy. Kenotex does not save the audio or send it to our servers; only the resulting transcript becomes editable text.

1.2 iCloud Sync (private database)

• If you enable iCloud sync, your todos / events / notes (including their images) / settings are synchronized across your devices via Apple's private iCloud database tied to your Apple ID. We do not have access to the contents — Apple stores and transmits them under your Apple ID's encryption.
• iCloud sync is opt-in and can be disabled at any time in Settings → iCloud.

1.3 LLM Proxy Service (api.kenx.me)

• When you use the AI features in Ideas (AI parsing and Spark idea breakdown, including the capture sheet and text submitted through Shortcuts, deep links, or the local HTTP API), the draft suggestion on the Organize page, the auto-add suggestion in Todos, or AI compression of your profile notes in Settings, the text you submit is sent to our proxy server at api.kenx.me, which relays it to a large language model provider for processing. The draft suggestion is available to Kenotex Pro users: when you open the Organize page, the text of your captured cards is sent in the same way so that the App can suggest which draft each card belongs in. See Section 1.4 below for how models are selected and where processing takes place. When you use AI parsing or Spark idea breakdown, images inserted in the relevant paragraphs (including screenshots from screenshot capture) are sent along with the text to our proxy server and relayed to the model provider for processing: before sending, images are compressed and stripped of metadata such as location, with at most 10 images per request; our proxy server does not store images. You can turn off “Send Images When Parsing” under AI Service in Settings, after which only text is sent. The draft suggestion, the auto-add suggestion, and profile-notes compression never send images.
• Besides the text itself, an AI request may also include: (a) your optional personalization profile (e.g., working hours, workdays, deadline habits, and any free-form notes you enter in Settings); (b) the names of your categories so results reuse them; (c) for AI parsing and the auto-add suggestion, a small sample of your recent todos (title, dates, priority, category, recurrence) as context; (d) for Spark rework of an existing todo, that todo's title, dates, priority and category; (e) the current date, time, time zone and app language, to resolve dates in your text and determine the output language; (f) for the auto-add suggestion, the titles, categories, priorities and start state of your candidate todos, plus counts of today's overdue and due todos; and (g) for the draft suggestion on the Organize page, the text of each card (up to about 500 characters per card), the kinds of items already parsed from it and their todo category names, and, for each candidate draft, its title, a short summary and per-category counts of the items it contains (category name, kind and count). These are sent only as part of the request and are subject to the same transient-processing and data-residency terms described here and in Section 1.4.
• The proxy server processes input transiently and does not retain prompt content after returning the response. We log only:
  • An anonymized iCloud user ID hash (for quota enforcement and JWT issuance).
  • Daily call counts (for rate limiting; reset every 24h UTC).
  • HTTP request metadata required for security (timestamp, response status).
• We do not associate the iCloud user ID hash with your real identity, name, or email.

1.4 AI Model Selection and Data Residency

• Kenotex does not build its own models. AI requests are processed by third-party large language models that Kenotex has evaluated for capability and response quality and that meet the standard we set for parsing and idea breakdown. We may switch or add models as better options become available, so this policy does not name a specific model or provider.
• The models currently in use are operated by providers located in the People's Republic of China that have completed the generative-AI large-model filing with the Cyberspace Administration of China (CAC) under the Interim Measures for the Administration of Generative Artificial Intelligence Services (《生成式人工智能服务管理暂行办法》).
• All AI processing for Kenotex occurs within the People's Republic of China. For users in mainland China, no cross-border data transfer takes place as part of the AI pipeline; if you use the AI features from outside mainland China, the text and context described in Section 1.3 are transmitted to and processed in the People's Republic of China.

1.5 In-App Purchase Information

• When you purchase Kenotex Pro, Apple sends a signed transaction (JWS) to our proxy server at api.kenx.me/v1/subscription/verify to validate your Pro entitlement (subscription or one-time purchase).
• We store: subscription tier (free / pro), product identifier, expiration date (one-time purchases have no expiration date), environment (Sandbox / Production), and an Apple-provided original transaction ID. We do not receive your credit card, billing address, or Apple ID password — Apple handles all payment.
• To calculate the subscriber credit for upgrading to a one-time purchase (Terms of Service, Section 3.6), our server retrieves from Apple the App Store transaction history associated with your subscription. For these transactions and for purchases you make in the App, we store each transaction's price, currency, offer type, refund status, and whether it was obtained through Family Sharing.
• Apple's App Store & Privacy applies to the purchase itself.

1.6 Diagnostics & Usage Data (Optional — Requires Your Consent)

• Kenotex can collect diagnostics and usage data to help us fix crashes and improve the App. This collection is off by default and only begins after you explicitly opt in via the consent prompt (or Settings → Diagnostics & Improvement in the App). You may withdraw consent at any time: collection on that device stops immediately, and data not yet uploaded is deleted from the device. Your choice may also sync through iCloud to your other devices signed in to the same iCloud account. When enabled, we collect the three kinds of data below.
• Usage events: feature-interaction signals such as which tab you switch to, which sheets you open, when a parse is triggered (with input length bucketed, never the content), whether a sync succeeded, and the category of errors the App runs into (never the error message). We never collect the text of your todos, events, notes, or anything you type.
• Diagnostics: summary figures from Apple's MetricKit: app launch time, peak memory use, and the number of crashes, hangs, and CPU exceptions. We do not upload crash logs or stack traces, and reports covering any time before you opted in are discarded. MetricKit is an Apple system service; Apple collects this data under your device's analytics settings and Apple's own policy.
• Device context: a randomly generated installation identifier hashed into a 16-character device fingerprint, plus your app version, OS version, and device model (e.g., iPhone15,2). The fingerprint is not your Apple ID, advertising identifier (IDFA), name, or email, is not used to track you across other apps, and is reset when you withdraw consent. Our server hashes it again before storing it.
• This data is sent to our own server (api.kenx.me) and stored with the internal identifier of your Kenotex account, which we use to authenticate uploads and apply rate limits. It is retained for 90 days, then deleted by a daily cleanup. It is never sold and never used for advertising.

2. How We Use Your Information

• To provide the App's features (parsing input, syncing across devices, sending notifications).
• To enforce daily quota limits for free-tier users.
• To verify and apply your Pro entitlement (subscription or one-time purchase).
• To diagnose service issues using anonymized server logs.
• If you opt in, to diagnose crashes and improve the App using the diagnostics & usage data described in Section 1.6.

3. Data Sharing

• We do not sell your data.
• We share submitted text, and the related context described in Section 1.3, with the AI provider routed by our proxy strictly for the purpose of generating the AI result you requested (for example a parsing result or a draft suggestion on the Organize page). The provider is contractually obligated not to retain or use prompts for model training (per their published policies).
• We share transaction information for Pro purchases (subscriptions and one-time purchases) with Apple (as required to validate purchases).
• Apple's MetricKit diagnostics are collected by Apple through its own system, under your device's analytics settings and Apple's diagnostics policy. We do not use any third-party advertising or analytics SDKs.

4. Data Retention

• Local data: stored on your device until you delete the App or clear its data.
• iCloud data: stored under your Apple ID until you remove it from System Settings → Apple ID → iCloud.
• Server records (Pro entitlement state, transaction records kept to calculate the subscriber credit, and anonymized usage counters): retained while the corresponding entitlement is active (one-time purchases do not expire); after the entitlement expires or ends, retained only for as long as needed to handle refunds and disputes and to meet legal obligations, then deleted.
• Diagnostics & usage data (only if you opted in): retained on our server for 90 days, then deleted by a daily cleanup.

5. Your Choices

• Disable iCloud sync at any time in the App's Settings.
• Delete your local data by uninstalling the App.
• Cancel your subscription via Settings → Subscription → Manage Subscription (deep link to Apple's subscription manager).
• Turn diagnostics & usage data collection on or off at any time in the App's Settings (Diagnostics & Improvement) — it stays off until you opt in, and withdrawing consent stops collection immediately.
• Request deletion of your server-side records by emailing us (see Contact below). We will delete within 30 days, retaining only what is necessary for tax and billing compliance.

6. Children's Privacy

Kenotex is not directed to children under 13. We do not knowingly collect personal information from children.

7. Security

The App uses HTTPS for all server communication. JWT tokens are stored in the iOS / macOS Keychain. We follow industry-standard practices but cannot guarantee absolute security.

8. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the latest revision. Material changes will be surfaced inside the App.

9. Contact

For privacy questions or data deletion requests:

Kai XU
Email: kenneth.xukai@icloud.com

This Privacy Policy is provided as-is. The App is offered without warranty; see Terms of Service for details.

中文隐私政策 — Kenotex

最近更新:2026-10-28 · 与 Kenotex Pro 一同生效。

Kenotex(以下简称"本应用")由 Kai XU 作为独立开发者发行。本隐私政策说明本应用收集哪些信息、如何使用、以及您可以做出的选择。

1. 我们收集的信息

1.1 本地存储在您的设备上

• 您的内容:待办、日历事件、想法页草稿、习惯打卡、主题、偏好等数据存储在设备上的 SQLite 数据库中;您在笔记中插入的图片以文件形式保存在本应用的数据目录中。本应用仅在为您提供功能时读取这些数据。
• 图片与相机:您在想法页插入图片(拍照、从照片图库或文件选取、粘贴或拖入)时,本应用会把图片重新编码为 JPEG 后保存在设备上;重新编码会去除位置(GPS)、拍摄设备与拍摄时间等元数据。从照片图库选取使用系统照片选择器,本应用只获得您选中的图片,不读取您的整个图库;相机仅在您主动拍照插入时使用,需要您授予相机权限(iOS)。通过截图捕获(macOS 快捷键框选屏幕区域,或 iOS 快捷指令截屏后裁剪)得到的截图同样按上述方式保存为图片;macOS 截图捕获需要屏幕录制权限,仅在您按下快捷键时截取屏幕。
• Apple 日历 / 提醒事项元数据(如果您授予权限):事件标题、日期、提醒时间,用于让本应用与系统日历集成。这些数据仅在内存中处理,不会上传到服务器。
• 语音输入(如果您授予麦克风与语音识别权限):当您在想法页中口述时,本应用会通过麦克风采集音频,并使用 Apple 的 Speech 框架转写。视您的设备与语言而定,Apple 可能在其服务器上处理该音频(适用 Apple 隐私政策)。Kenotex 不保存音频,也不会把音频发送到我们的服务器;只有转写出的文本会成为可编辑文本。

1.2 iCloud 同步(私有数据库)

• 如果您开启 iCloud 同步,您的待办 / 事件 / 笔记(含其中的图片)/ 设置会通过 Apple 的私有 iCloud 数据库(绑定您的 Apple ID)在多台设备之间同步。我们无法访问其内容 —— Apple 在您的 Apple ID 加密下存储和传输这些数据。
• iCloud 同步默认关闭,可随时在设置 → iCloud 中开启或关闭。

1.3 LLM 代理服务(api.kenx.me)

• 当您在想法页中使用 AI 功能(AI 解析与 Spark 想法拆解,含捕获页以及经快捷指令、深链或本地 HTTP API 提交的文本)、在整理页使用草稿页建议、在待办页使用自动添加建议,或在设置中对画像备注使用 AI 压缩时,您提交的文本会发送到我们位于 api.kenx.me 的代理服务器,由其转发给大型语言模型提供商进行处理。草稿页建议面向 Kenotex Pro 用户:当您打开整理页时,您已捕获卡片的文本会以同样方式发送,以便本应用为每张卡片建议应投递的草稿页。模型的选择方式与处理地点见下文 1.4 节。当您使用 AI 解析或 Spark 想法拆解时,相关段落中插入的图片(包括截图捕获的截图)会随文本一同发送到代理服务器,并转发给模型提供商处理:发送前图片会被压缩并去除位置等元数据,每次请求最多 10 张;代理服务器不存储图片。您可以在设置的「AI 服务」中关闭「解析时发送图片」,关闭后只发送文本。草稿页建议、自动添加建议与画像备注压缩不发送图片。
• 除文本本身外,AI 请求还可能包含:(a) 您可选的个性化画像(例如工作时段、工作日、deadline 习惯,以及您在设置中填写的任意自由文本备注);(b) 您的分类名称,以便结果复用既有分类;(c) AI 解析与自动添加建议时,少量您近期待办(标题、日期、优先级、分类、重复规则)作为上下文;(d) 对既有待办发起 Spark 返工时,该待办的标题、日期、优先级与分类;(e) 当前日期、时间、时区与应用语言,用于解析文本中的日期并确定输出语言;(f) 使用自动添加建议时,候选待办的标题、分类、优先级与是否已开始,以及今日逾期与到期待办的数量;(g) 在整理页使用草稿页建议时,每张卡片的文本(每张约 500 字以内)、已从中解析出的条目类型及其待办分类名称,以及每个候选草稿页的标题、简短摘要和按分类统计的条目数量(分类名称、类型与数量)。它们仅作为请求的一部分发送,并适用本节及第 1.4 节所述的瞬时处理与数据驻留条款。
• 代理服务器仅瞬时处理输入,不会在响应返回后保留提示内容。我们仅记录:
  • 匿名化的 iCloud 用户 ID 哈希(用于额度执行与 JWT 颁发)。
  • 每日调用次数(用于速率限制;每 24 小时 UTC 重置)。
  • 安全所需的 HTTP 请求元数据(时间戳、响应状态)。
• 我们不会将 iCloud 用户 ID 哈希与您的真实身份、姓名或邮箱关联。

1.4 AI 模型选择与数据驻留

• Kenotex 不自研模型。AI 请求由第三方大语言模型处理;这些模型经 Kenotex 对能力与响应质量评估,达到我们为解析与想法拆解设定的标准。当出现更优选择时我们可能更换或新增模型,因此本政策不指明具体模型或供应商。
• 当前使用的模型由位于中华人民共和国境内、且已根据《生成式人工智能服务管理暂行办法》在国家互联网信息办公室(网信办)完成生成式人工智能大模型备案的服务商运营。
• 本应用涉及的所有 AI 数据处理均在中华人民共和国境内进行。对于中国大陆用户,AI 管道不发生数据跨境传输;若您在中国大陆以外使用 AI 功能,第 1.3 节所述的文本与上下文会被传输至中华人民共和国境内处理。

1.5 应用内购买信息

• 当您购买 Kenotex Pro 时,Apple 会向我们位于 api.kenx.me/v1/subscription/verify 的代理服务器发送一份签名交易凭证(JWS),用于验证 Pro 权益(订阅或一次性买断)。
• 我们存储:订阅等级(free / pro)、产品标识符、过期日期(一次性买断不设过期日期)、环境(Sandbox / Production)、以及 Apple 提供的原始交易 ID。我们不会收到您的信用卡、账单地址或 Apple ID 密码 —— 所有支付由 Apple 处理。
• 为计算升级为一次性买断时的「老订阅抵扣」(服务条款第 3.6 节),我们的服务器会从 Apple 获取与您的订阅关联的 App Store 交易记录。对于这些交易以及您在本应用中完成的购买,我们会存储每笔交易的价格、币种、优惠类型、退款状态,以及是否经家庭共享获得。
• 购买行为本身适用 Apple 的 App Store 与隐私条款。

1.6 诊断与使用数据(可选 —— 需经您同意)

• Kenotex 可以收集诊断与使用数据,帮助我们修复崩溃、改进应用。该收集默认关闭,仅在您通过同意弹窗(或应用设置中的「诊断与改进」)明确开启后才开始。根据《中华人民共和国个人信息保护法》,此属于单独同意事项;您可随时撤回同意,撤回后该设备立即停止收集,并删除设备上尚未上传的数据。您的选择也可能通过 iCloud 同步到登录同一 iCloud 账号的其他设备。开启后,我们收集以下三类数据。
• 使用事件:功能交互信号,例如切换到哪个标签页、打开哪个面板、何时触发解析(仅记录输入长度的区间,绝不记录内容)、同步是否成功,以及应用遇到的错误类别(不含错误信息原文)。我们绝不收集您待办、事件、笔记的文本,或您输入的任何内容。
• 诊断:来自 Apple MetricKit 的汇总数据:应用启动耗时、内存峰值,以及崩溃、卡顿与 CPU 异常的次数。我们不上传崩溃日志或调用栈;覆盖您开启同意之前任何时段的报告会被丢弃。MetricKit 是 Apple 的系统服务,Apple 会按您设备的分析设置与 Apple 自身政策收集这些数据。
• 设备上下文:由随机生成的安装标识符哈希而成的 16 位设备指纹,以及应用版本、系统版本、设备型号(例如 iPhone15,2)。该指纹不是您的 Apple ID、广告标识符(IDFA)、姓名或邮箱,不用于跨其他应用追踪您,并会在您撤回同意后重置。我们的服务器在存储前会对它再做一次哈希。
• 这些数据发送到我们自己的服务器(api.kenx.me),并与您 Kenotex 账号的内部标识一同存储,用于验证上传请求和执行速率限制。数据保留 90 天,之后由每日清理任务删除。绝不出售,绝不用于广告。

2. 我们如何使用您的信息

• 提供本应用的功能(解析输入、跨设备同步、发送通知)。
• 对免费用户执行每日额度限制。
• 验证并启用您的 Pro 权益(订阅或一次性买断)。
• 使用匿名化的服务器日志诊断服务问题。
• 若您选择开启,使用第 1.6 节所述的诊断与使用数据来排查崩溃、改进应用。

3. 数据共享

• 我们不会出售您的数据。
• 我们会将您提交的文本及第 1.3 节所述的相关内容通过代理转发给 AI 提供商,仅用于生成您所请求的 AI 结果(例如解析结果或整理页的草稿页建议)。该提供商在合同义务上不得保留或使用提示用于模型训练(详见其公开政策)。
• 我们会与 Apple 共享 Pro 购买(订阅与一次性买断)的交易信息(用于验证购买,这是必需的)。
• Apple MetricKit 的诊断数据由 Apple 通过其自身系统、按您设备的分析设置与 Apple 的诊断政策收集。我们不使用任何第三方广告或分析 SDK。

4. 数据保留

• 本地数据:存储在您的设备上,直到您删除本应用或清空数据。
• iCloud 数据:存储在您的 Apple ID 下,直到您从系统设置 → Apple ID → iCloud 中移除。
• 服务器记录(Pro 权益状态、为计算老订阅抵扣保存的交易记录、匿名化使用计数):在相应权益有效期间保留(一次性买断不设到期);权益到期或失效后,仅在处理退款、争议及履行法律义务所需的期间内保留,随后删除。
• 诊断与使用数据(仅在您开启时):在我们的服务器上保留 90 天,之后由每日清理任务删除。

5. 您的选择

• 随时在本应用设置中关闭 iCloud 同步。
• 卸载本应用以删除本地数据。
• 通过设置 → 订阅 → 管理订阅(深度链接到 Apple 订阅管理页)取消订阅。
• 随时在应用设置中的「诊断与改进」开启或关闭诊断与使用数据收集 —— 未经您开启始终关闭,撤回同意后立即停止收集。
• 通过下方联系方式邮件请求删除服务器端记录。我们将在 30 天内删除,仅保留税务与账单合规所必需的内容。

6. 儿童隐私

Kenotex 不面向 13 岁以下儿童。我们不会有意识地收集儿童的个人信息。

7. 安全

本应用所有与服务器的通信均使用 HTTPS。JWT 令牌存储在 iOS / macOS 钥匙串(Keychain)中。我们遵循行业标准做法,但无法保证绝对安全。

8. 政策变更

我们可能会不定期更新本隐私政策。文首的"最近更新"日期反映最新修订。重大变更会在应用内提示。

9. 联系我们

如有隐私问题或数据删除请求,请联系:

Kai XU
邮箱: kenneth.xukai@icloud.com

本隐私政策按"现状"提供。本应用不附带任何担保;详见服务条款。