光轴脚本 LCT 应用隐私政策

应用名称 / App: LensCript（光轴脚本 LCT）；开发者 / Developer: 光子方程。

版本 2.0 · 生效日期：2026-09-22 · 本页最后更新：2026-10-24

本政策适用于光轴脚本 LCT（应用显示名 Lenscript / 光轴脚本，包名 com.lenscript.lenscript，下称「本应用」），一款本地优先的摄影工作流应用。本应用由光子方程 Lenscript（独立开发者团队，下称「我们」）开发与运营；我们是本政策所述个人信息的处理者，联系邮箱：donaldkuke@gmail.com。本政策说明本应用与配套服务（域名 lenscript.cn 下的后端）在什么情况下处理哪些信息、为什么，以及你可以如何控制它们。适用范围：光轴脚本 LCT 的 Android 应用与 lenscript.cn 网站。

一、默认立场：数据只在你的设备上

你的拍摄记录、机位、器材、作品、拍摄计划等内容默认只保存在设备本地数据库，不上传任何服务器。
本应用无广告，不含任何广告 SDK，不收集广告标识符（广告 ID）。
本应用不内置任何第三方分析、埋点或崩溃收集 SDK，不统计你的使用行为。
照片与视频文件默认不会离开你的设备；只有在你主动分享或导出时才会离开，发送目标由你选择。社区发布会上传你选中的图片，但当前版本未开放社区功能，见第 10 节。
相机与提醒：相机仅在你使用取景相关功能时调用，画面只在设备上实时分析，不保存、不上传；拍摄提醒是设备上的本地通知，不经过推送服务。
提醒相关的系统权限：拍摄提醒使用 Android 的精确闹钟（SCHEDULE_EXACT_ALARM）以便在你设定的时刻准时触发，使用开机启动（RECEIVE_BOOT_COMPLETED）在设备重启后重建尚未触发的提醒，并使用震动（VIBRATE）产生通知提示。这三项只服务于设备本地的提醒，不读取你的内容、不产生网络请求、不上报任何信息。

二、联网功能会处理哪些信息

以下功能才会产生网络请求；除标注外均为可选，不使用即不产生对应数据。

1. 账号（可选）

邮箱地址：用于邮箱＋密码注册与登录。服务器保存你的邮箱、加密处理的凭据信息与登录会话记录，仅用于账号识别与登录安全，不用于营销。
不注册账号也可以使用本应用的本地功能。

2. 位置（可选，两级隐私网格）

设备定位：仅当你主动点按「使用我的位置」时，应用才请求系统「大致位置」权限（应用只声明粗略定位权限，从不请求精确定位或后台定位）。读取到的位置先在设备上吸附到约 0.1°（约 11 公里，城市级）的网格，精确读数不出定位模块、不存盘、不外发。
天气查询：向天气服务发送的坐标（无论来自定位还是你选择的机位）会先吸附到 0.01°（约 1.1 公里）的网格再发出——服务器与上游天气源只能看到网格中心点，看不到你的精确机位。未登录时天气为匿名查询，服务端不写匿名使用记录。
天气数据来源：天气与空气质量数据主要由和风天气（QWeather）提供，天气预报必要时使用 MET Norway 后备源；我们的服务器以网格中心点查询，不向这些供应商提供你的账号信息。
机位坐标：你手动录入的机位坐标属于你的内容，默认仅在本地；登录账号不会自动上传这些坐标。

3. 自动云同步（当前版本不提供）

当前版本不提供自动云同步；登录账号不会自动上传你的本地内容。
拍摄记录、器材、机位、作品（含作品元数据与 EXIF 快照，可能包含拍摄位置）、拍摄计划、今晚评估快照均不会因登录账号而自动上传。
照片、视频等原始文件不会因登录或同步而上传；当前版本未开放社区功能，社区功能开放后也只有你主动发布时才会上传你选中的图片，见第 10 节。

4. AI 拍摄助手（可选）

默认路径：你的提问文本与参数经我们的服务器网关转发给模型供应商处理，请求附带你的登录凭证用于配额控制；供应商密钥只在服务端，不在客户端。
模型服务商：默认路径目前唯一接入的外部模型服务商是 DeepSeek，它收到你的提问文本与相关参数；请求不会额外附带账号邮箱、照片或设备定位，但你主动写入提问的信息会随文本发送。回答由模型生成，可能不准确；如发现不当回答，请通过应用内「反馈」或支持页面告诉我们。
自备服务（BYOK）路径：若你自行填写第三方 AI 服务地址与密钥，请求直接发往你填写的服务，不经过我们的服务器；密钥仅保存在你设备的系统安全区。该第三方如何处理数据以其自身条款为准。

5. 反馈（可选）

你提交的反馈类别与正文会发送到我们的服务器，仅用于改进产品。请勿在反馈中填写敏感个人信息。

6. 网页支持请求（可选）

你可在支持页面选择提供联系邮箱、问题类别、问题说明、语言和同意记录。我们仅将这些信息用于分流、处理和回复该支持请求。
支持请求的内容、联系邮箱及关联处理元数据最长保留 90 天；工单关闭后可提前删除，账号删除完成后会清除可归因于该账号的工单。请勿在正文填写密码、验证码、访问令牌、银行卡或支付信息。

7. 其它服务请求

地点搜索关键词、地点数据包与运营配置的下载请求等，只包含完成该功能所需的最小参数；未登录时为匿名请求。
全部后端通信强制使用 HTTPS 加密；登录令牌只保存在系统安全存储区（Android Keystore 加密）。
短期防滥用计数：为保护注册、登录、同步和服务请求，服务器会保存固定时间窗、请求计数和由 IP、账号 ID 或规范化邮箱单向散列得到的主体值；这不是行为分析。当前生产配置为 7 天，到期后自动删除；若该配置变更，会先同步更新本页。账号注销完成时，会立即删除可归因于该账号或邮箱的此类计数；共享 IP 计数无法可靠归因于一个账号，仍按该短期自动删除。
用量记录：登录状态下的天气与 AI 请求，服务器会记录账号 ID、功能类型、结果与时间，用于配额与防滥用；这些记录在账号注销完成时删除。

8. 地点投稿（可选）

只有你主动提交并确认贡献声明后，才会发送地点名称、经公里级网格模糊并量化的坐标，以及你选择提供的朝向、题材和到达方式。此流程不上传照片、EXIF 或本地私人备注；登录本身不会触发投稿。
服务器将投稿内容与你的账号标识、提交时间和同意回执关联，用于审核、处理争议和维护地点目录；经审核的贡献可能用于公开地点目录。
账号注销期满后，你的地点投稿、账号关联、同意回执及仅源自本人投稿的独占衍生记录会进入自动清理任务；故障会持久记录并自动重试，账号注销完成不代表这些独立记录已同时清完。涉及他人共同内容、共用对象或外部留存材料时，任务会保持待处理，需人工核验与拆分；不会为删除你的数据而删除他人的独立内容。未注销且未申请移除的投稿用于维护目录，不设固定保留期限。也可通过支持页面提供投稿编号申请移除；申请受理不等于清理完成。

9. 网站访问

本网站使用 Cloudflare 提供内容分发和安全防护。访问网站时，该服务会处理连接 IP 地址、请求网址和浏览器信息。本站的多数网页还会向我们自建的第一方计数服务 markstats.lenscript.cn（GoatCounter）上报「哪个路径被打开了」、页面标题与来源页；它不设 cookie、不生成设备标识、不读取页面内容，也不交给任何第三方分析或广告服务商。不想被计数，在浏览器控制台执行 localStorage.setItem('lens_telemetry','0') 即可永久退出。本页与 /account-deletion、/support 三个商店合规页不加载任何统计脚本。本条说明网站访问及性能统计的数据处理，App 本身不内置第三方分析或崩溃收集 SDK。

10. 社区（当前版本未开放社区功能）

当前版本未开放社区功能。你安装的这一版没有社区入口，也不会因社区向我们的服务器上传任何照片。下面各条说明的是社区功能开放后的数据处理，届时适用；在开放之前，本节描述的收集一项都不会发生。开放时我们会按「七、政策变更」一节提前通知并更新本页。

只有你主动发布时才会上传。社区功能开放后，如你选择在「更多 → 社区」里发布作品或评论，只有在你确认发布后，你所选照片的原始字节才会通过 HTTPS 上传到我们的服务器（https://lenscript.cn/api/）。浏览社区不上传照片；未发布的照片不会上传。
数量与大小：应用端在发布前限制单张不超过 10 MiB、每帖最多 9 张；服务器侧只接受 JPEG，并限制最长边 2048 像素、单张不超过约 1.5 MB。
会一并保存：帖子正文、你选择关联的器材与地点、评论、点赞、收藏、关注关系、举报内容，以及与你账号的关联和提交时间。用途是展示社区内容、处理举报与争议。
保留期：发布流程中的临时上传按 24 小时有效期设计；已发布内容保留到你删除该帖或注销账号为止，社区帖子与评论没有固定保留期限。注销时的处理与地点投稿同一条清理任务：本人投稿、同意回执与可归因的私有记录自动清理并在故障时自动重试，涉及他人共同内容、共用对象或外部留存材料的部分需人工核验，在此之前保持待处理。详见账号删除说明。
社区内容对其他用户可见。请不要发布你不愿公开的照片或信息；社区的具体行为规则以应用内展示的社区规范为准，使用规则见服务条款。

11. Google Play 订阅（如使用）

订阅为可选项：不订阅也可以使用本应用；订阅是否在你的版本中可用由应用与 Google Play 的商品配置决定。订阅的使用规则见服务条款，本节只说明相关的数据处理。
如通过 Google Play 订阅，我们会将购买令牌、商品与基础方案标识、订阅状态、有效期、续费状态及核验时间与你的 Lenscript 账号关联，用于向 Google 核验购买、恢复购买、防止重复或跨账号冒领，以及管理订阅权益。向 Google 发起购买时使用经混淆处理的账号标识，不以邮箱作为购买绑定标识。
支付资料由 Google Play 处理；Lenscript 不接收或保存你的银行卡号等付款工具资料。Google 对交易记录和支付资料的处理适用其自身政策。
如订阅功能可用，月度自动续费价格以 Google Play 显示的当地价格与最终确认页面为准。可在Google Play 订阅中心管理或取消续费；卸载应用或注销 Lenscript 账号不会自动取消 Google Play 订阅。账号删除范围见账号删除说明。

三、我们不做什么

不出售你的任何数据；不将你的数据用于广告或画像。
不收集广告 ID、不接入第三方分析/崩溃 SDK。
不在你未主动触发的情况下读取或上传位置。

四、备份与换机（刻意的隐私设计）

本应用显式关闭了 Android 系统云备份与换机迁移（allowBackup=false，且备份/迁移规则全域排除应用数据）：换新手机或从系统备份还原时，Lenscript 的数据与登录状态不会自动跟随过去。这是为了防止整库数据经系统备份通道离开你的控制，不是数据丢失。迁移数据请使用 App 内「备份」页的导出/导入。

五、你的权利与数据控制

导出：在 App 内备份页可将全部本地数据导出为文件，存放位置由你选择。
删除本地数据：在系统设置中清除本应用数据，或直接卸载应用，应用私有存储中的本地数据会被删除；你另行保存的备份、导出或分享文件需自行删除。
注销账号（删除服务器数据）：在 App 内「我的 → 账号 → 申请注销」发起；注销设有 15 天冷静期，期间可随时取消；冷静期结束后服务器将删除登录会话和账号相关私有记录（以及若有的历史云同步数据），并匿名化邮箱与登录凭据。相关审核私有备注会删除；独立投稿按上述清理流程处理，公开讨论及最小安全记录按下述范围保留。详见账号删除说明。
为安全、防滥用、争议处理和法定义务，安全审计事件和删除账本可保留不可登录的稳定技术账号标识；其中没有有效邮箱或凭据，且没有固定的自动删除期限。用户自行填写的正文仍可能识别本人；公开社区投影会隐藏原账号 UUID。

六、儿童

本应用面向成年摄影用户（18 岁及以上），不面向儿童设计，也不有意收集儿童个人信息。

七、政策变更

政策更新会直接修改本页面并更新页首日期；重大变更会在应用内提示。

八、联系我们

隐私相关问题请使用支持页面，选择「隐私」类别，或发送邮件至 donaldkuke@gmail.com。可选联系邮箱仅用于回复；请勿在正文填写密码、验证码或令牌。

本应用的使用规则见服务条款。

LCT Privacy Policy

App: LensCript (光轴脚本 LCT); Developer: 光子方程 (LensCript).

Version 2.0 · Effective date: 2026-09-22 · Last updated: 2026-10-24

This policy covers LCT (listed as Lenscript / 光轴脚本, package com.lenscript.lenscript, “the app”), a local-first photography workflow app. The app is developed and operated by Lenscript (光子方程), an independent developer team (“we”, “us”). We are the controller of the personal information described in this policy. Contact: donaldkuke@gmail.com. This policy explains what information the app and its backend services (under the domain lenscript.cn) process, when, why, and how you stay in control. Scope: the LCT Android app and the lenscript.cn website.

1. Default posture: your data stays on your device

Your shooting records, spots, gear, works, and plans are stored only in the on-device database by default and are not uploaded anywhere.
The app has no ads, contains no ad SDK, and does not collect the advertising ID.
The app ships no third-party analytics, tracking, or crash-reporting SDKs.
Photo and video files stay on your device by default. They leave it only when you explicitly share or export them to a destination you choose. Publishing in the community would upload the images you select, but the community feature is not available in the current version — see 2.10.
Camera and reminders: the camera is used only when you open a viewfinder-based feature; frames are analysed on the device in real time and never saved or uploaded. Shooting reminders are local notifications on the device and use no push service.
Permissions used by reminders: shooting reminders use Android exact alarms (SCHEDULE_EXACT_ALARM) so a reminder fires at the time you set, the boot-completed permission (RECEIVE_BOOT_COMPLETED) to re-create pending reminders after the device restarts, and vibration (VIBRATE) for the notification cue. All three serve on-device reminders only: they read none of your content, make no network request and report nothing.

2. What networked features process

Only the features below make network requests. All are optional unless noted; if you do not use a feature, no corresponding data exists.

2.1 Account (optional)

Email address: used for email-and-password sign-up and sign-in. The server stores your email, cryptographically processed credentials, and sign-in session records — for account identification and sign-in security only, never for marketing.
You can use the app’s local features without creating an account.

2.2 Location (optional, two privacy grids)

Device location: requested only after you tap “Use my location”, and only as the system’s approximate-location permission (the app declares coarse location only — never fine or background location). The reading is snapped on-device to a ~0.1° grid (~11 km, city level); the precise reading is never stored or transmitted.
Weather queries: any coordinate sent to the weather service (from location or from a spot you picked) is first snapped to a 0.01° grid (~1.1 km) — the server and upstream weather providers only ever see a grid center, not your precise spot. Signed-out weather queries are anonymous, and the server does not keep anonymous usage records.
Weather source: weather and air-quality data primarily come from QWeather, with MET Norway as a fallback for weather forecasts when needed. Our server sends the grid centre and does not pass on your account details to these providers.
Spot coordinates you enter by hand are your content and stay local by default; signing in does not automatically upload these coordinates.

2.3 Automatic cloud sync (unavailable in this version)

This version does not provide automatic cloud sync. Signing in does not automatically upload your local content.
Shooting records, gear, spots, works (including work metadata and EXIF snapshots, which may contain capture location), shooting plans, and tonight-assessment snapshots are not automatically uploaded when you sign in.
Original photo/video files are never uploaded by sign-in or sync. The community feature is not available in the current version; once it opens, the images you select are uploaded only when you publish them — see 2.10.

2.4 AI shooting assistant (optional)

Default path: your prompt text and parameters are relayed through our server gateway to a model provider, with your sign-in credential attached for quota control. Provider keys live only on the server.
Model provider: the only external model provider currently wired to the default path is DeepSeek, which receives your prompt text and parameters. Requests do not additionally attach your account email, photos, or device location, but information you choose to include in your prompt is sent with that text. Answers are model-generated and may be wrong; to report an inappropriate answer, use in-app Feedback or the support page.
Bring-your-own-key path: if you configure a third-party AI endpoint and key, requests go directly to the endpoint you configured and never through our servers; the key is kept only in your device’s secure storage. That third party’s own terms govern its processing.

2.5 Feedback (optional)

The feedback category and text you submit are sent to our server and used solely to improve the product. Please do not include sensitive personal information.

2.6 Web support requests (optional)

On the support page, you may choose to provide a contact email, category, message, language, and consent record. We use this information only to route, handle, and reply to that support request.
A support request’s content, contact email, and associated processing metadata are retained for no more than 90 days and may be deleted sooner after the request is closed; after account deletion completes, requests attributable to that account are cleared. Do not include passwords, verification codes, access tokens, card, or payment information in the message.

2.7 Other service requests

Place-search keywords and download requests for place-data packs or signed remote configuration carry only the minimal parameters needed; they are anonymous when you are signed out.
All backend traffic is HTTPS-only; sign-in tokens are stored exclusively in the system secure storage (encrypted by the Android Keystore).
Short-lived abuse-control counters: to protect sign-up, sign-in, sync, and service requests, the server stores a fixed time window, a request count, and a one-way hash derived from an IP address, account ID, or normalized email. This is not behavioural analytics. The current production configuration is 7 days and expired rows are deleted automatically; this page will be updated before that configuration changes. On completed account deletion, counters attributable to that account or email are deleted immediately. Shared IP counters cannot be reliably attributed to one account and still expire on that short schedule.
Usage records: for signed-in weather and AI requests the server records your account ID, the feature, the outcome and the time, for quota and abuse control; these records are deleted when account deletion completes.

2.8 Place submissions (optional)

Only after you choose to submit and confirm the contribution statement do we receive the place name, coordinates blurred to a kilometre-level grid and quantized, and any heading, subjects, or access directions you choose to provide. This flow does not upload photos, EXIF, or private local notes. Signing in alone does not submit a place.
The server links the contribution to your account identifier, submission time, and consent receipt for review, dispute handling, and maintaining the place catalog. Reviewed contributions may be used in the public place catalog.
After the account-deletion cooling-off period, your place submissions, account associations, consent receipts and derived records sourced only from your submissions enter automatic cleanup. Failures are recorded durably and retried automatically; account deletion can finish before these independent records are fully cleared. Content or objects shared with others, and externally retained materials, remain pending for manual review and separation; other people’s independent content is not deleted to remove yours. Submissions retained for the catalog before account deletion or a removal request have no fixed retention period. You may also request removal through the support page with the submission ID; acceptance of a request does not mean cleanup has completed.

2.9 Website visits

This website uses Cloudflare for content delivery and security. When you visit, that service processes your connection IP address, requested URL, and browser information. Most pages on this site also load a first-party script for website usage and performance statistics: it reports which path was opened, the page title and the referrer to our own counter at markstats.lenscript.cn (GoatCounter), which sets no cookie, creates no device identifier and never reads page content, and is not shared with any third-party analytics or advertising provider. To opt out permanently, run localStorage.setItem('lens_telemetry','0') in your browser console. This page and the other two store-compliance pages (/account-deletion, /support) load no statistics script at all. This section describes website visits. The app itself does not include third-party analytics or crash-reporting SDKs.

2.10 Community (not available in the current version)

The community feature is not available in the current version. The build you installed has no community entry point and uploads no photo to our servers for it. Everything below describes the processing that applies once the community opens; until then none of it happens. We will give notice before it opens and update this page, as described in section 7 (Changes).

Nothing is uploaded until you publish. Once the community opens, publishing a post or comment under More → Community uploads the raw bytes of the photos you selected to our server (https://lenscript.cn/api/) over HTTPS — and only after you confirm publication. Browsing the community uploads no photo; photos you do not publish are never uploaded.
Count and size: before publishing, the app limits each image to 10 MiB and each post to 9 images; the server accepts JPEG only, limited to 2048 px on the long edge and roughly 1.5 MB per image.
Also stored: the post text, any gear and place you attach, comments, likes, favourites, follows and reports, together with the link to your account and the submission time. These are used to display community content and to handle reports and disputes.
Retention: a temporary upload inside the publishing flow is designed to be valid for 24 hours; published content is kept until you delete the post or your account, and community posts and comments have no fixed retention period. On account deletion they follow the same cleanup task as place submissions: your own submissions, consent receipts and attributable private records are cleaned up automatically with automatic retries on failure, while anything involving content shared with others, shared objects or externally retained materials stays pending for manual review. See Account deletion.
Community content is visible to other users. Do not post photos or information you would not want to be public. The community's conduct rules are those shown in the app; the rules for using the app are in the terms of service.

2.11 Google Play subscriptions (if used)

The subscription is optional: you can use the app without subscribing, and whether a subscription is available in your build depends on the app and the Google Play product configuration. The rules for using a subscription are in the terms of service; this section covers only the data processing involved.
If you subscribe through Google Play, we associate the purchase token, product and base-plan identifiers, subscription status, expiry, renewal status, and verification time with your Lenscript account. These records support verification with Google, purchase restoration, prevention of duplicate or cross-account claims, and subscription access management. Purchases use an obfuscated account identifier rather than your email as the account binding sent to Google.
Google Play handles payment details; Lenscript does not receive or store your card number or other payment-method details. Google's own policies govern its handling of transaction records and payment details.
When subscriptions are available, monthly renewal uses the local price and final confirmation shown by Google Play. Manage or cancel renewal in the Google Play subscription center. Uninstalling the app or deleting your Lenscript account does not automatically cancel a Google Play subscription. See the account-deletion scope.

3. What we do not do

We never sell your data and never use it for advertising or profiling.
No advertising ID, no third-party analytics or crash SDKs.
No location reads or uploads without an explicit action from you.

4. Backup and moving to a new phone (a deliberate privacy choice)

The app explicitly opts out of Android system cloud backup and device-to-device transfer (allowBackup=false, with backup/transfer rules excluding all app data). When you switch phones or restore from a system backup, Lenscript data and sign-in state do not follow automatically. This prevents your entire database from leaving your control through the system backup channel — it is not data loss. To migrate, use Export/Import on the in-app Backup page.

5. Your rights and controls

Export: the in-app Backup page exports all local data to a file at a location you choose.
Delete local data: clear the app’s data in system settings, or uninstall the app — data in the app’s private storage is removed; separately saved backups, exports, or shared files must be deleted separately.
Delete your account (server data): request deletion in the app (Me → Account → Request deletion). Deletion has a 15-day cooling-off period during which you can cancel; afterwards the server deletes sessions and account-private records, including any historical synced data, and anonymizes your email and login credentials. Related private review notes are deleted; independent submissions follow the cleanup process above, while public discussion and minimal security records follow the retention scope below. See Account deletion.
For security, abuse prevention, dispute handling, and legal duties, security audit events and the deletion ledger may retain a stable technical account identifier that cannot sign in; it has no valid email or credential and no fixed automatic deletion period. User-entered text may still identify its author; public community projections hide the original account UUID.

6. Children

The app targets adult photographers (18+), is not designed for children, and does not knowingly collect children’s personal information.

7. Changes

Updates are made on this page with the date above revised; material changes will be announced in the app.

8. Contact

For privacy questions, use the support page and choose “Privacy”, or email donaldkuke@gmail.com. A contact email is optional and used only for a reply; do not put passwords, verification codes, or tokens in the message.

The rules for using the app are in the terms of service.