隐私政策 · 中国大陆
Reply 隐私政策
生效日期：2026 年 7 月 6 日 · 版本 2026.07
个人信息处理者：北京索菲亚飞轮科技有限公司（统一社会信用代码 91110108MAER0JMW0P）
本政策适用于中国大陆用户。Reply 是一款本地优先的 macOS 回复助手：它在你触发时读取当前对话，用你的语气生成可直接发送的回复。请特别注意：Reply 的模型推理、身份认证与部分连接器由位于中国境外的服务商提供，因此使用 Reply 会涉及个人信息向境外传输。我们在下文列明境外接收方清单，并就跨境传输、敏感个人信息处理、向第三方提供及自动化处理，单独征求你的同意。
1. 我们处理哪些个人信息
Reply 以「尽量少离开你的 Mac」为设计原则。我们处理的个人信息分为以下几类：
1.1 你主动提供的信息
- 账户信息：你登录时使用的邮箱地址、第三方账号标识、鉴权令牌。
- 连接器授权：你选择连接 Gmail、Slack 等渠道时的 OAuth 授权令牌与连接状态。
- 付款信息：购买或订阅时，由支付渠道处理的必要交易信息（我们不存储你的完整银行卡号）。
1.2 为生成回复而临时处理的信息
- 对话上下文：你触发时当前窗口中可见的对话文字、你输入的指令，以及为写好这条回复所需的本地语气与人物档案。
- 截图（兜底）：当辅助功能读不到内容时，在内存中截取并裁剪的当前会话区域图像（本机 OCR 后丢弃，不建相册）。
- 语音：你按住说话时的音频（用于本机语音识别，Reply 不保存原始录音）。
1.3 自动采集的匿名信息
用于产品改进的匿名指标：事件名、枚举值、计数、应用版本、系统版本、匿名安装标识，以及可选的登录用户标识。不包含消息正文、草稿、收件人姓名、截图或原始音频。
1.4 敏感个人信息
Reply 本身不主动索取敏感个人信息。但你的对话内容可能包含敏感个人信息（如行踪轨迹、健康、财务信息等，取决于你与他人的对话）。当你使用托管模型路径生成回复时，这些内容会作为对话上下文被处理并传输至境外模型服务商。我们就此在第 6 节单独征求你的同意。
2. 哪些信息留在你的本机
Reply 的实时读取流程从本机开始：辅助功能读取当前窗口可见文字；截图只在内存中处理；OCR 优先使用 Apple Vision 在本机识别。
你的语气档案、个人资料、人物卡、回复事件、学习到的修正与用量计数，保存在本机的 Application Support 目录。你可以随时在设置中查看、打开数据文件夹或清空这些内容。Reply 不会把你看到、输入或浏览的所有内容远程复制一份留存。
3. 哪些信息会发送给 AI 模型（含出境）
当你要求 Reply 起草、改写、总结、蒸馏记忆、识别待办，或用视觉模型转写本机 OCR 无法可靠识别的截图时，Reply 会把完成该任务所需的上下文发送给所选模型。
- 托管代理路径（默认）：你登录后未配置自有 Key 时，请求经 Reply 的模型代理转发至上游模型服务商。代理按无状态转发设计，不记录请求或响应正文，但内容仍会到达境外的上游模型服务商。
- 自带 Key 直连路径（推荐）：你在设置中填入自己的 API Key 后，模型请求从你的 Mac 直接发往你选择的模型服务商，Reply 服务器不在这条链路中。这是我们最推荐的隐私路径；此路径下，出境行为由你自主发起并直接指向你选择的服务商。
无论哪条路径，模型服务商自身的留存与使用政策仍然适用。
4. 截图、OCR 与语音
截图仅用于辅助功能难以读取的应用。Reply 会裁剪到当前会话区域，优先在本机运行 OCR，并在使用后丢弃图像。仅当 OCR 不足时，具备视觉能力的模型才可能收到该截图用于转写。
按住说话的原始音频不会被 Reply 保存。Reply 使用 Apple Speech，并在当前语言环境支持时要求本机识别。如果 Apple 框架因语言环境不支持而回落到云端识别，则该处理受 Apple 自身政策约束。
5. 境外接收方清单
由于下列服务商位于中国境外，使用 Reply 相应功能会导致你的个人信息向境外提供。我们向你说明每一境外接收方的名称、所在地、处理目的与涉及的信息种类：
| 境外接收方 | 所在地 | 处理目的 | 涉及的信息种类 |
|---|
| Clerk, Inc. | 美国 | 账户登录与身份认证 | 邮箱、登录标识、鉴权令牌 |
Reply 模型代理
（部署于 Cloudflare / Vercel 边缘） | 美国及全球边缘节点 | 转发模型请求、额度控制 | 当前对话上下文、你的指令（按转发设计不留存正文） |
| 模型服务商：Anthropic、Google（Gemini）、OpenRouter 及你另行选择的服务商 | 美国等 | 生成 / 改写回复、蒸馏记忆、视觉转写 | 完成任务所需的对话上下文与指令 |
| Composio, Inc. | 美国 | 托管连接器（Gmail / Slack）的授权、状态与读写 | 连接器 OAuth 令牌、你请求处理的消息载荷 |
| Apple Inc. | 美国 | 语音识别在本机不支持该语言时的云端回落 | 语音音频（Reply 不留存） |
| Google LLC / Slack Technologies | 美国 | 你主动连接并请求的邮件 / 消息读写 | 相应渠道的消息与元数据 |
| 匿名产品指标后端 | 美国 | 产品改进的匿名统计 | 事件名、枚举、计数、版本号、匿名安装 id（不含正文 / 草稿 / 截图 / 音频） |
行使你对境外接收方的相关权利，或了解上述服务商的隐私政策，可通过第 9 节的联系方式与我们联系。
6. 需要你单独同意的事项
根据《个人信息保护法》，下列处理需要取得你的单独同意。你可在应用引导（onboarding）中逐项勾选，也可随时在设置中撤回；撤回不影响撤回前已进行的处理。
6.1 个人信息出境（跨境传输）
同意 Reply 依第 5 节的境外接收方清单，为实现回复生成、身份认证与连接器功能，向境外接收方提供你的相关个人信息。若你不同意出境，将无法使用依赖境外模型的托管代理路径；你仍可选择自带 Key 直连路径（该路径下出境由你直接发起）。
6.2 敏感个人信息处理
同意 Reply 在你触发回复时，处理对话中可能包含的敏感个人信息（用于且仅用于为该次交互生成回复）。
6.3 向第三方提供
同意 Reply 为完成你请求的任务，向第 5 节所列模型服务商与连接器服务商提供必要信息。
6.4 自动化处理说明
Reply 使用 AI 对对话进行自动化处理以生成回复候选。这些候选仅是建议，是否采用、编辑或发送完全由你决定；Reply 不会据此作出对你权益有重大影响的自动化决策。
7. 保存期限与安全
本机数据保存在你的设备上，直至你删除或卸载应用。账户与连接状态等信息在你使用服务期间保存，账户注销后在合理期限内删除或匿名化，法律另有要求的除外。托管代理按无状态转发设计，不以存储正文为目的。
我们采用传输加密、访问控制、令牌加密存储（Keychain）等措施保护你的信息。但任何需要把上下文发送给外部 AI 模型的助手，都无法声称 100% 本地隐私。
8. 你的权利
在法律规定的范围内，你有权：查阅、复制你的个人信息；更正、补充不准确的信息；删除个人信息；撤回你已作出的同意；注销账户；要求解释我们的个人信息处理规则；在符合条件时要求转移。你可在应用内打开本地数据文件夹、清空回复历史与学到的记忆，或通过下方联系方式行使其余权利。我们将在法定期限内响应。
Reply 的服务不面向未满 18 周岁的未成年人，我们不会在明知的情况下收集未成年人的个人信息。
9. 联系与投诉
个人信息处理者：北京索菲亚飞轮科技有限公司
注册地址：北京市海淀区王庄路 18 号西郊宾馆北楼一层 201
办公地址：北京市海淀区王庄路 18 号学院路国际人才创新实验室北楼一层（100083）
个人信息保护相关事宜，请联系：support@amplift.ai。如你认为我们的处理侵害了你的权益，你也有权向有管辖权的监管部门投诉、举报。
10. 政策更新
我们可能不时更新本政策。重大变更将通过应用内或官网通知你；涉及新的单独同意事项时，会再次征求你的同意。本政策是《Reply 用户协议（中国大陆）》的一部分；如有冲突，以用户协议中关于争议与效力的条款为准。
Privacy Policy · Mainland China
Reply Privacy Policy
Effective: July 6, 2026 · Version 2026.07
Personal information handler: Beijing Suofeiya Feilun Technology Co., Ltd. (Unified Social Credit Code 91110108MAER0JMW0P)
This policy applies to users in mainland China. Reply is a local-first macOS reply assistant: on your trigger it reads the current conversation and drafts a send-ready reply in your voice. Please note: Reply's model inference, authentication, and some connectors are provided by vendors located outside mainland China, so using Reply involves transferring personal information abroad. We list every overseas recipient below and separately request your consent for cross-border transfer, sensitive personal information, sharing with third parties, and automated processing.
1. Personal information we process
Reply is designed to keep as little as possible off your Mac. We process the following categories:
1.1 Information you provide
- Account: the email address, third-party account identifier, and auth tokens used when you sign in.
- Connector authorization: OAuth tokens and connection status when you connect Gmail, Slack, and similar channels.
- Payment: transaction information handled by the payment provider when you buy or subscribe (we do not store full card numbers).
1.2 Information processed transiently to draft a reply
- Conversation context: the conversation text visible in the current window on your trigger, your instruction, and the local tone/profile memory needed for this reply.
- Screenshots (fallback): an in-memory, cropped image of the current conversation area when Accessibility cannot read it (discarded after local OCR; no gallery is kept).
- Voice: audio while you hold to talk (for on-device speech recognition; Reply does not keep the raw recording).
1.3 Automatically collected anonymous data
Anonymous product metrics for improvement: event names, enums, counts, app version, OS version, an anonymous install id, and an optional signed-in user id. Excludes message bodies, drafts, recipient names, screenshots, and raw audio.
1.4 Sensitive personal information
Reply does not actively seek sensitive personal information. However, your conversation may contain it (e.g. location, health, financial data, depending on your chats). When you use the managed model path, that content is processed as conversation context and transferred to overseas model providers. We request separate consent for this in Section 6.
2. What stays on your Mac
Reply's live read starts locally: Accessibility reads the current window's visible text; screenshots are handled in memory; OCR runs first on-device via Apple Vision.
Your tone profile, personal profile, person cards, reply events, learned corrections, and usage counts are stored locally in Application Support. You can view them, open the data folder, or clear them any time in Settings. Reply does not keep a remote copy of everything you see, type, or browse.
3. What is sent to AI models (incl. abroad)
When you ask Reply to draft, rewrite, summarize, distill memory, detect to-dos, or use a vision model to transcribe a screenshot that on-device OCR cannot read reliably, Reply sends the context needed for that task to the selected model.
- Managed proxy path (default): when you are signed in without your own key, requests are forwarded through Reply's model proxy to the upstream provider. The proxy is designed as stateless forwarding and does not log request or response bodies, but the content still reaches the overseas upstream provider.
- Bring-your-own-key direct path (recommended): once you enter your own API key in Settings, model requests go straight from your Mac to the provider you chose, with Reply's servers out of the path. This is our most recommended privacy path; here the cross-border transfer is initiated by you, directed at the provider you chose.
In either path, the model provider's own retention and use policies still apply.
4. Screenshots, OCR & voice
Screenshots are only for apps Accessibility cannot read. Reply crops to the current conversation area, runs OCR on-device first, and discards the image after use. Only if OCR is insufficient may a vision-capable model receive the screenshot for transcription.
Raw hold-to-talk audio is not stored by Reply. Reply uses Apple Speech and requests on-device recognition when the locale supports it. If Apple's framework falls back to cloud recognition because the locale is unsupported, that processing is governed by Apple's own policy.
5. Overseas recipients
Because the following vendors are located outside mainland China, using the corresponding Reply features causes your personal information to be provided abroad. We disclose each overseas recipient's name, location, purpose, and the categories involved:
| Overseas recipient | Location | Purpose | Categories involved |
|---|
| Clerk, Inc. | United States | Account sign-in & authentication | Email, login identifier, auth tokens |
Reply model proxy
(on Cloudflare / Vercel edge) | U.S. & global edge | Forward model requests, quota control | Current conversation context, your instruction (forwarding-only by design) |
| Model providers: Anthropic, Google (Gemini), OpenRouter, and any you choose | United States, etc. | Draft / rewrite replies, distill memory, vision transcription | Conversation context & instruction needed for the task |
| Composio, Inc. | United States | Managed connector (Gmail / Slack) auth, status & read/write | Connector OAuth tokens, message payload you asked to process |
| Apple Inc. | United States | Cloud fallback when a locale is unsupported on-device | Voice audio (Reply does not retain it) |
| Google LLC / Slack Technologies | United States | Mail / message read-write you actively connect and request | Messages and metadata of that channel |
| Anonymous product-metrics backend | United States | Anonymous statistics for product improvement | Event names, enums, counts, versions, anonymous install id (no bodies / drafts / screenshots / audio) |
To exercise your rights regarding overseas recipients, or to learn about these vendors' privacy policies, contact us via Section 9.
6. Matters requiring your separate consent
Under the PIPL, the following require your separate consent. You can opt in item by item during onboarding and withdraw any time in Settings; withdrawal does not affect processing already carried out.
6.1 Cross-border transfer
Consent for Reply to provide your personal information to the overseas recipients in Section 5 to enable reply generation, authentication, and connectors. If you decline, you cannot use the managed proxy path that relies on overseas models; you may still use the bring-your-own-key direct path (where the transfer is initiated directly by you).
6.2 Sensitive personal information
Consent for Reply, on your trigger, to process sensitive personal information that a conversation may contain — used solely to draft the reply for that interaction.
6.3 Sharing with third parties
Consent for Reply to provide the necessary information to the model and connector providers listed in Section 5 to complete the task you requested.
6.4 Automated processing notice
Reply uses AI to automatically process the conversation and produce reply candidates. These are suggestions only; whether to adopt, edit, or send is entirely your decision. Reply makes no automated decision with a significant effect on your rights.
7. Retention & security
Local data stays on your device until you delete it or uninstall. Account and connection status are kept while you use the service and are deleted or anonymized within a reasonable period after account closure, unless the law requires otherwise. The managed proxy is designed as stateless forwarding, not to store bodies.
We use transport encryption, access controls, and encrypted token storage (Keychain). But no assistant that must send context to an external AI model can claim 100% local privacy.
8. Your rights
To the extent the law provides, you may access and copy your personal information; correct or supplement inaccurate data; delete it; withdraw consent; close your account; request an explanation of our processing rules; and, where eligible, request portability. In-app you can open the local data folder and clear reply history and learned memory; use the contact below for the rest. We respond within statutory timeframes.
Reply is not intended for anyone under 18, and we do not knowingly collect minors' personal information.
9. Contact & complaints
Personal information handler: Beijing Suofeiya Feilun Technology Co., Ltd.
Registered address: Rm 201, 1F North Bldg, Xijiao Hotel, 18 Wangzhuang Rd, Haidian District, Beijing
Office: 1F North Bldg, Xueyuan Rd International Talent Innovation Lab, 18 Wangzhuang Rd, Haidian District, Beijing (100083)
For personal-information matters, contact support@amplift.ai. If you believe our processing infringed your rights, you may also complain to the competent regulator.
10. Updates
We may update this policy from time to time. Material changes will be notified in-app or on the website; where a new separate-consent matter is involved, we will ask again. This policy is part of the Reply Terms of Service (Mainland China); in case of conflict, the Terms' provisions on disputes and validity control.