隐私政策
生效日期：2026 年 9 月 8 日 · 适用于 iOS 与 Android 版 Nexora Explorer
- 你的文件不会被上传给我们。我们没有为这个应用运行任何后端。文件只在你的设备、以及你自己填进去的 NAS / WebDAV 服务器之间流动。
- 没有账号系统。不需要注册、不需要登录，我们不收集你的姓名、邮箱、手机号、通讯录或位置。
- AI 字幕、文字识别、字幕翻译、Python 沙盒全部在设备本机运行。音频、画面和代码都不出设备。
- 没有广告，不使用广告标识符，不出售数据。
- 两个平台都会通过 Google Firebase 收集匿名的使用统计与崩溃报告，用来知道哪些功能真的被用到、哪里会出错。收集的是哪些，下面逐条说明。
一、两个平台收集的是同一套东西
iOS 版和 Android 版使用同一套埋点：同样的事件名、同样的字段名，发往同一个 Google Firebase 项目。下表列出全部差异——差异都在系统能力上，不在收集的数据上。
| | iOS（App Store） | Android（Google Play） |
|---|
| 使用统计 | Firebase Analytics | 相同 |
|---|
| 崩溃报告 | Firebase Crashlytics | 相同 |
|---|
| 我们自己的服务器 | 无 | 无 |
|---|
| 广告标识符 | 不取（从不请求跟踪授权） | 不取（见 1.1） |
|---|
| 语音识别 | 系统识别（本机）为默认，Whisper 可选 | 仅 Whisper（本机） |
|---|
| 字幕翻译 | 系统翻译框架，语言包由系统下载 | 尚未提供 |
|---|
| 文字识别（OCR） | 系统框架，本机 | 随安装包内置的离线模型，本机 |
|---|
| 存储访问 | 应用沙盒 + 系统「文件」 | 全盘访问权限（可以拒绝，见第六节） |
|---|
1.1 关于广告标识符
这一点值得单独说，因为它不是默认状态：Android 上的 Firebase Analytics 默认会采集广告 ID，还会带上安装归因。我们把这些全部关掉了——从安装包里移除了相关权限，并在启动时显式拒绝广告类的数据用途。
这么做是为了和 iOS 一致：iOS 上取广告标识符需要弹出「允许跟踪」授权，而这个应用从来没有集成那套东西。既然一端不取，另一端也不该取。
二、具体收集什么
2.1 使用统计（Firebase Analytics）
为了知道哪些功能真的被用到、哪些流程会失败，应用记录播放与文件操作中的关键动作与结果——进入播放器、开始播放、拖动进度、缓冲、播放成功或失败之类——以及随之而来的技术信息：本次操作耗时、结果是成功还是失败、失败时的错误类型与错误域、这次操作是不是用户主动触发的。
Firebase 自身还会自动采集一个匿名的应用实例标识、设备型号、系统版本、系统语言，以及由 IP 地址推断出的大致国家或地区。
2.2 崩溃报告（Firebase Crashlytics）
应用崩溃或遇到可恢复的错误时，会上报崩溃堆栈、当时的设备状态、一个匿名的安装标识，以及我们附加的少量诊断上下文（例如崩溃时播放器处于哪个状态）。
2.3 这些数据里没有你的文件
这个应用是文件管理器和播放器，文件名和路径本身就是隐私。所以决定"什么会离开设备"的地方只有一处，字段逐个显式列出，而不是把内部日志整包转发出去。以下几类是刻意不上报的：
- 文件内容、文件名、文件路径、服务器地址。一条都不上报。
- 自由文本的错误描述。错误信息里可能夹带文件名、路径或 URL，所以整类不发。
- 能标识"你看了哪个文件"的稳定标识。本地用来串联一次播放没问题，送给第三方就越界了。
- 播放位置与时长。产品分析用不到，而时长加时间点足以指认具体影片。
- 姓名、邮箱、手机号、通讯录、日历、健康数据、位置、广告标识符。
上面这份「不上报」的清单在两个平台上是同一份——不是两边各写一遍碰巧一致，而是两端各有一处唯一的出口，字段逐个显式列出。
2.4 关于关闭统计
坦白说：两个平台目前都没有提供应用内的统计开关。如果你不希望这些数据被收集，可以卸载应用，或通过下方邮箱联系我们。我们正在考虑在后续版本中加入开关。
三、你的文件是怎么被处理的
- 设备上的文件：浏览、复制、移动、重命名、删除、预览与播放全部在你的设备上发生。
- NAS（SMB）与 WebDAV：应用直接连接你自己填写的服务器地址，中间没有我们的服务器。
- 服务器凭据：存在设备本地——iOS 存进系统钥匙串（Keychain），Android 用系统密钥库里一把不可导出的密钥加密后存放。凭据不上传、不同步。
- 播放远端视频：由应用内的本机回环代理边下边播，数据从你的服务器直接到你的设备，不经过任何第三方。
- 连接配置、传输记录、播放历史、字幕缓存：只存在设备本地。
- 卸载应用即清除这些本地数据。
四、应用会连接哪些地方
把出网的地方一次列全：
| 连接对象 | 什么时候 | 发送了什么 |
|---|
| 你配置的 NAS / WebDAV 服务器 | 你连接、浏览、传输、播放时 | 你自己的凭据与文件操作。地址是你填的 |
|---|
| Hugging Face | 你选择下载 AI 字幕的高精度模型时 | 只是下载模型文件。不上传音频、不上传文件、不上传任何你的数据 |
|---|
| Google Firebase | 使用应用时 | 第二节所述的统计与崩溃数据 |
|---|
除此之外没有别的出网目的地。
五、AI 功能全部在设备上
- AI 字幕：音频在设备本机被识别成文字。iOS 默认用系统的本机语音识别，也可以下载 Whisper 模型换取更高精度；Android 只有 Whisper 这一条路。音频不出设备，识别结果缓存在本地。
- 字幕翻译（目前仅 iOS）：用系统提供的翻译框架，语言包由系统按需下载，翻译在设备上进行。
- PDF 文字识别（OCR）：iOS 用系统框架，Android 用随安装包内置的离线模型，都在设备本机完成——识别本身不联网，画面不出设备。
- Python 沙盒：内置解释器在本机运行你写的代码，运行环境受限、没有网络访问。
六、权限，以及为什么需要它
| 权限 | 平台 | 用途 |
|---|
| 全盘文件访问 | 仅 Android | 这是文件管理器的核心：你要在哪个目录里操作是你决定的，应用必须能列出、读写不是它自己创建的目录，并完成跨目录的批量复制/移动/删除与整个文件夹的上传下载 |
|---|
| 照片和媒体 | iOS、Android | 导入图片与视频；iOS 上通过系统选择器，只把你挑中的那些交给应用 |
|---|
| 网络访问 | iOS、Android | 连接你自己的服务器、下载 AI 字幕模型，以及上报第二节所述的统计与崩溃数据 |
|---|
| 通知 | Android | 显示后台传输与后台播放的进行状态 |
|---|
Android 上的全盘访问可以拒绝。拒绝之后应用不会崩，也不会不停地再问——它会降级到只使用自己的私有目录，NAS / WebDAV、播放器、PDF 与 Python 这些功能照常可用，只是不能再浏览设备上的其它目录。
为什么不用系统的文件选择器代替：选择器每次只交出你当次挑中的东西，撑不起一个常驻的整机目录树，也没法在不逐次打扰你的前提下完成批量与递归操作；而系统媒体库只认图片、音频、视频，看不见文件管理器必须处理的文档、压缩包与字幕文件。
七、第三方
两个平台都没有集成任何广告或归因组件。
八、数据保留与删除
- 你的文件、连接配置与缓存都在你的设备上，卸载应用即清除；服务器上的文件由你自己掌握。
- 卸载后，我们不再收到你设备的任何新数据。
- 已收集的统计与崩溃数据，按我们在 Firebase 控制台设置的保留期限自动删除。
- 如果你希望我们删除与你的设备相关的数据，请通过下方邮箱联系。由于没有账号体系，这些数据只能通过匿名的设备标识定位，我们可能需要你配合提供必要信息。
九、儿童
Nexora Explorer 不面向 13 岁以下儿童，我们不会有意收集儿童的个人信息。如果你认为孩子向我们提供了信息，请联系我们。
十、你的权利
根据你所在地区的法律，你可能享有访问、更正、删除或反对处理个人数据的权利。请通过下方邮箱提出，我们会在合理时间内答复。
十一、本政策的变更
本政策更新时，我们会修改页面顶部的生效日期。涉及数据收集方式的实质性变更，会在应用更新说明中一并告知。
十二、联系我们
爻爻科技（YaoyaoLabs）
电子邮件：1569485690@qq.com
Privacy Policy
Effective 8 September 2026 · Applies to Nexora Explorer for iOS and Android
- Your files are never uploaded to us. We run no backend for this app. Files move between your device and the NAS / WebDAV servers you enter yourself — nothing else.
- There are no accounts. No sign-up, no login. We do not collect your name, email address, phone number, contacts or location.
- AI subtitles, text recognition, subtitle translation and the Python sandbox all run on your device. Audio, pixels and code never leave it.
- No ads, no advertising identifier, no data sales.
- Both platforms collect anonymous usage statistics and crash reports through Google Firebase, so we can tell which features are actually used and where things go wrong. What that covers is described below.
1. Both platforms collect the same things
iOS and Android use one shared set of instrumentation: the same event names, the same field names, sent to the same Google Firebase project. The table below lists every difference between them — and all of them are about platform capabilities, not about what is collected.
| | iOS (App Store) | Android (Google Play) |
|---|
| Usage analytics | Firebase Analytics | Same |
|---|
| Crash reporting | Firebase Crashlytics | Same |
|---|
| Servers of our own | None | None |
|---|
| Advertising ID | Not read (never asks for tracking permission) | Not read (see 1.1) |
|---|
| Speech recognition | System recognition (on-device) by default; Whisper optional | Whisper only (on-device) |
|---|
| Subtitle translation | System translation framework, language packs downloaded by the OS | Not available yet |
|---|
| Text recognition (OCR) | System framework, on-device | Offline model bundled in the app, on-device |
|---|
| Storage access | App sandbox + the system Files app | All files access (you may decline — see section 6) |
|---|
1.1 About the advertising identifier
This deserves its own note, because it is not the default state: Firebase Analytics on Android collects the advertising ID by default, and brings install attribution along with it. We turned all of that off — the relevant permission is stripped from the shipped package, and advertising-related data use is explicitly denied at startup.
We did this to match iOS: reading the advertising identifier there requires the "allow tracking" prompt, and this app has never integrated that. If one platform does not read it, neither should the other.
2. What is collected
2.1 Usage analytics (Firebase Analytics)
So we can tell which features are actually used and where things fail, the app records key actions and their outcomes during playback and file operations — opening the player, starting playback, seeking, buffering, a playback attempt succeeding or failing — along with the technical information that comes with them: how long the operation took, whether it succeeded, the error type and domain when it did not, and whether the user triggered it directly.
Firebase itself also collects an anonymous app-instance identifier, device model, OS version, system language, and the approximate country or region inferred from the IP address.
2.2 Crash reporting (Firebase Crashlytics)
When the app crashes or hits a recoverable error, it reports the stack trace, the device state at the time, an anonymous installation identifier, and a small amount of diagnostic context we attach (such as which state the player was in).
2.3 What is not in that data: your files
This app is a file manager and a media player, so file names and paths are themselves private. There is exactly one place that decides what leaves the device, and it lists every field explicitly rather than forwarding the internal log wholesale. These categories are deliberately never reported:
- File contents, file names, file paths and server addresses. None of them, ever.
- Free-text error descriptions. Error messages can carry a file name, a path or a URL, so the whole category is withheld.
- Any stable identifier for "which file you watched". Fine for stitching one playback together locally; out of bounds once it goes to a third party.
- Playback position and duration. Product analysis does not need them, and a duration plus a timestamp is enough to pin down a specific film.
- Name, email address, phone number, contacts, calendar, health data, location, advertising identifier.
That withheld list is the same list on both platforms — not two lists that happen to agree, but one explicit, field-by-field outlet on each side.
2.4 About turning analytics off
Honestly: neither platform has an in-app analytics switch today. If you would rather not have this data collected, you can uninstall the app, or contact us at the address below. We are considering a switch in a future release.
3. How your files are handled
- Files on your device: browsing, copying, moving, renaming, deleting, previewing and playback all happen on your device.
- NAS (SMB) and WebDAV: the app connects directly to the server address you entered. There is no server of ours in between.
- Server credentials: stored on the device — in the system Keychain on iOS, and on Android encrypted with a non-exportable key held in the system keystore. Credentials are never uploaded or synced.
- Playing remote video: handled by a loopback proxy inside the app that streams while it downloads. Data goes straight from your server to your device, through no third party.
- Connection profiles, transfer records, playback history and subtitle caches: stored only on the device.
- Uninstalling the app removes this local data.
4. Where the app connects
Every outbound destination, in one list:
| Destination | When | What is sent |
|---|
| The NAS / WebDAV servers you configure | When you connect, browse, transfer or play | Your own credentials and file operations. You chose the address |
|---|
| Hugging Face | When you choose to download the high-accuracy AI subtitle model | A model file is downloaded. No audio, no files, no data of yours is uploaded |
|---|
| Google Firebase | While you use the app | The analytics and crash data described in section 2 |
|---|
There are no other outbound destinations.
5. The AI features all run on your device
- AI subtitles: audio is turned into text on your device. iOS uses the system's on-device speech recognition by default, with an optional Whisper model for higher accuracy; Android uses Whisper only. Audio never leaves the device, and results are cached locally.
- Subtitle translation (iOS only for now): uses the system translation framework. Language packs are downloaded by the OS and translation happens on the device.
- PDF text recognition (OCR): the system framework on iOS, a model bundled in the app package on Android. Both run on the device — recognition itself needs no network, and the page image never leaves.
- Python sandbox: a bundled interpreter runs your code locally, in a restricted environment with no network access.
6. Permissions, and why they are needed
| Permission | Platform | Purpose |
|---|
| All files access | Android only | This is what a file manager is: you decide which folder to work in, so the app must be able to list and modify directories it did not create, and to run cross-directory batch copy, move and delete as well as whole-folder upload and download |
|---|
| Photos and media | iOS, Android | Importing images and video; on iOS through the system picker, which hands over only what you selected |
|---|
| Network access | iOS, Android | Connecting to your own servers, downloading the AI subtitle model, and reporting the analytics and crash data described in section 2 |
|---|
| Notifications | Android | Showing the progress of background transfers and background playback |
|---|
All files access on Android can be declined. The app will not crash and will not keep asking. It falls back to its own private directory: NAS / WebDAV, the player, PDF and Python all keep working — you simply cannot browse the rest of the device from inside the app.
Why the system file picker is not a substitute: it hands over only what you picked that one time, which cannot back a persistent whole-device tree and cannot run batch or recursive operations without interrupting you each time. The system media store, meanwhile, only knows about images, audio and video — it cannot see the documents, archives and subtitle files a file manager has to handle.
7. Third parties
- Google Firebase (Analytics, Crashlytics) — both platforms. That data is processed by Google under its own terms; see the Google Privacy Policy and Firebase privacy and security.
- Hugging Face — both platforms. Contacted only when you choose to download an AI subtitle model; this is a file download. See the Hugging Face Privacy Policy.
- Google ML Kit text recognition — Android only. The model ships inside the app package and recognition runs on the device.
Neither platform includes any advertising or attribution component.
8. Retention and deletion
- Your files, connection profiles and caches live on your device and are removed when you uninstall. Files on your servers remain under your own control.
- After you uninstall, we receive no further data from your device.
- Analytics and crash data already collected is deleted automatically according to the retention period we set in the Firebase console.
- If you would like us to delete data associated with your device, contact us at the address below. Because there are no accounts, that data can only be located through an anonymous device identifier, so we may need your help to identify it.
9. Children
Nexora Explorer is not directed at children under 13, and we do not knowingly collect personal information from children. If you believe a child has provided us with information, please contact us.
10. Your rights
Depending on where you live, you may have the right to access, correct, delete or object to the processing of your personal data. Write to the address below and we will respond within a reasonable time.
11. Changes to this policy
When this policy is updated we change the effective date at the top of this page. Material changes to how data is collected will also be called out in the app's release notes.
12. Contact us
YaoyaoLabs (爻爻科技)
Email: 1569485690@qq.com
