河狸帮 隐私政策

我们不收集的

• 找服务不需要注册账号，不收集姓名、通讯录。照片只在两种情况下发送：用“拍照问”时临时发送、不保存；给房源或店铺主动加照片时上传，审核通过后公开（见下文）。
• 没有广告，不做跨 App 追踪，没有第三方统计或广告 SDK，不出售任何数据。

麦克风和语音识别

• 只在你按住麦克风说话时使用麦克风。
• 手机支持时，语音在手机上转成文字（iOS 本机语音识别）。少数机型或系统版本不支持本机识别时，iOS 会交给苹果的语音识别服务处理，受苹果隐私政策约束；我们收不到录音。
• 录音不保存、不上传到我们的服务器。

位置

• 只有你允许后才使用，用来按离你的距离排列结果。
• 距离在手机上计算，位置不会发给我们的服务器。

发给服务器的内容

• 你问的那句话的文字（语音转好的文字或你打的字）：手机自己判断不了类别时，会发给我们的服务器，由服务器交给 AI 分类服务（Anthropic 的 Claude API）判断属于哪个服务类别，只返回类别。我们不会把这句话和你的身份关联。按 Anthropic 的商业条款，这些内容不会用来训练模型，只按其政策短期保留。
• “拍照问”的照片：只在你点“就问这张照片”后发送。发送前在手机上缩小（长边约 1000 像素），去掉拍摄地点、时间、机型等信息，连同你另外说的那句话（如果有）发给我们的服务器，由服务器交给 AI 分类服务（Anthropic 的 Claude API）判断属于哪个服务类别，只返回类别。照片不保存在我们的服务器上、不写进日志，判断完就丢弃；App 也不会把照片存进你的相册。按 Anthropic 的商业条款，照片不会用来训练模型。AI 还会返回一句对照片内容的简短文字描述（如“漏水的水龙头，想找人修”，不含照片上的姓名、号码、地址、金额等文字）；开着“帮助改进”时，匿名使用记录里只记这句 AI 生成的描述和你说的那句话，不保存照片。
• 查不到的问句：如果某句话查不到结果，或你点了“不是这个”，App 会匿名记录这句话的文字和原因，用来补充内容。记录里没有设备 ID，也没有 IP 地址。
• 匿名使用记录（“帮助改进”，默认打开）：每次提问记一条——问句文字（里面的数字，比如电话号码、门牌号，发送前会去掉）、是说的、打字还是拍照问的、是手机自己认出的还是 AI 分类的、分到哪一类、有没有反问、有几条结果；以及之后的操作，比如点开了哪家、打了电话、导航、复制、要求修改信息，或者马上换个说法重问。用来找出答不好的问题、改进分类和内容。
  • 使用情况：页面浏览和按钮点击（匿名）——每次打开 App、看了哪些页面（首页、结果、商家详情、指南、设置等）、点了哪些主要按钮（麦克风、打字、拍照、筛选、放宽条件、要求修改、分享），以及 App 里出的错（比如网络请求失败、数据下载失败、语音识别不可用，只记错误类别和简短的技术说明，不含你说的话）。
  • 随机匿名 ID：会用一个随机的匿名 ID 统计使用情况（比如有几台手机在用、同一台手机打开了几次）。这个 ID 是 App 第一次使用时在手机上随机生成的，和你的身份、手机序列号、广告标识（IDFA）都无关，不用于跨 App 或跨网站跟踪；可以在“设置 → 重置匿名 ID”换一个新的，也可以关掉“帮助改进”不再发送；删除 App 后也会重新生成。
  • 不包含账号、姓名、联系方式、广告标识（IDFA），不发手机定位——只记录你在问句里说到的地名（城市级），以及结果是不是按“你附近”排的。
  • 记录里不存 IP 地址，也不存下面那个用来限流的设备 ID；只存上面说的随机匿名 ID 和一个每天都会变的随机编号，都无法对应到你本人。
  • 原始记录（含问句文字）保存 90 天后自动删除，之后只保留不含文字的统计数字（比如每天每类问了多少次）。
  • 不用于广告或追踪，不出售，不和其他公司的数据合并。
  • 可以随时在 App 的“设置 → 帮助改进”里关掉；关掉后不再发送使用记录和查不到的问句，手机里还没发出的记录也会删除。
• 随机设备 ID：App 第一次打开时在手机上随机生成，和你的身份、手机序列号、广告标识都无关。只用来限制每台手机每天的查询次数，防止滥用；计数大约 26 小时后自动删除。
• 服务器运行在 Cloudflare 上，出错时的技术日志会短期保留，用于排查问题。

“对我们说”（出租、招人、合作、信息更正、意见）

• 你说的内容：你在“联系我们”或首页说要出租、招人、合作、更正商家信息或提意见时，你说的话（转成的文字）会发给我们的服务器，由 AI（Anthropic 的 Claude API）整理成一张确认单给你看。你确认发送后，原话和单子会保存在我们的服务器上，用来核实、上线和回复你。
• 电话或邮箱：发房源、招聘、商家合作、信息更正时必须留联系方式，意见建议可以不留。按“确定发送”时，我们会发一条 6 位验证码到你的手机（短信）或邮箱，确认是你本人。验证后，这个号码就是你的账户：用来核实信息、回拨商家、回复你，以及换手机时找回你的留言。我们不用它发广告，也不卖给任何人。
• 公开显示：房源和招聘审核通过后会在 App 里显示，单子上的联系电话会公开，方便租客、应聘的人联系你。商家合作、信息更正、意见里的联系方式不会公开。
• 房源、店铺照片（选填，最多 6 张，商家另加 1 张 Logo）：只在你按“确定发送”后上传。上传前在手机上缩小，并去掉拍摄地点、时间、机型等信息。照片存在我们的服务器（Cloudflare）上，先由 AI（Anthropic 的 Claude API）初筛有没有不合适的内容，再由我们人工审核，审核通过后才会和房源或店铺一起公开显示。请不要拍到人脸、证件、车牌等个人信息。不通过的照片会删除；房源、店铺下线或你删除账户时，照片一起删除。
• 发短信、发邮件的服务商：验证码通过短信服务商（Twilio）或邮件服务商（Resend）发送，它们只收到号码或邮箱和验证码短信内容。
• 登录凭证：验证后服务器发一个随机凭证，存在你手机的钥匙串里；服务器只存它的加密摘要。
• 没留联系方式的意见：会和随机设备 ID 的加密摘要一起保存，只用来让这台手机看到处理状态和我们的回复。
• 删除：在 App 的“设置 → 我的留言 → 删除账户和所有留言”里可以随时删除账户，服务器上的电话/邮箱和留言会一起删除；已经上线的房源、招聘会在下次更新数据时下线。也可以发邮件给我们要求删除。

只存在你手机上的

• 搜索记录、字体大小、简繁体等设置只存在手机上，可以在 App 里清除，删除 App 后也会一起删除。
• “我的留言”在手机上也存一份；没有网络时，留言先存在手机上，有网后自动发送。

打电话、地图和网站

你点“打电话”“导航”或网站链接时，会打开手机的电话、地图 App 或浏览器，之后由这些服务按它们自己的隐私政策处理。

商家信息

App 里的商家和机构信息来自公开来源（如政府公开名录、商家官网、OpenStreetMap）。部分地点数据 © OpenStreetMap contributors，按 ODbL 许可使用。商家如果要修改或删除自己的信息，可以在商家详情页点“电话打不通 / 信息有误”，或发邮件到 panglaochen@gmail.com，写明商家名称和需要修改的内容。

儿童

本 App 不面向 13 岁以下儿童，也不会有意收集儿童的个人信息。

政策变更和联系方式

政策有变化时会更新本页面和上面的日期。有任何问题请联系 panglaochen@gmail.com。

Beaver Buddy Privacy Policy (English)

What we don't collect

• No account is needed to look things up. We don't collect your name or contacts. Photos are sent only when you use “Ask with a photo” (not kept) or when you choose to add photos to a rental or business listing (shown publicly after review; see below).
• No ads, no cross-app tracking, no third-party analytics or advertising SDKs. We never sell data.

Microphone and speech recognition

• The microphone is used only while you hold the microphone button.
• When your phone supports it, speech is turned into text on the phone (iOS on-device recognition). On some devices or iOS versions without on-device support, iOS sends the audio to Apple's speech service, governed by Apple's Privacy Policy. We never receive your audio.
• Recordings are not saved and are not sent to our server.

Location

• Used only if you allow it, to sort results by distance from you.
• Distances are calculated on your phone. Your location is never sent to our server.

What is sent to our server

• The text of your question (the transcribed speech or what you typed): when the phone can't categorize it by itself, it is sent to our server, which asks an AI classification service (Anthropic's Claude API) which service category it belongs to. Only the category comes back. We don't link the text to your identity. Under Anthropic's commercial terms this content is not used to train models and is kept only briefly under their policies.
• Photos for “Ask with a photo”: sent only after you tap “Ask with this photo”. Before sending, the phone shrinks the photo (about 1000 pixels on the long side) and removes location, time and camera details. It goes to our server, together with anything you said, and the server asks an AI classification service (Anthropic's Claude API) which service category it belongs to. Only the category comes back. Photos are not stored on our server or written to logs; they are discarded once categorized, and the app does not save them to your photo library. Under Anthropic's commercial terms, photos are not used to train models. The AI also returns a short text description of what the photo shows (e.g. “a leaking faucet, needs a plumber”; never names, numbers, addresses or amounts from the photo). If “Help improve” is on, the anonymous usage record keeps only this AI-written description and anything you said — never the photo.
• Questions with no answer: if a question returns no results, or you tap “Not this”, the app anonymously records the question text and the reason so we can add missing content. These records contain no device ID and no IP address.
• Anonymous usage records (“Help improve”, on by default): one record per question — the question text (with any digits, such as phone or street numbers, removed before sending), whether it was spoken, typed or asked with a photo, whether it was recognized on the phone or by the AI classifier, the category, whether a follow-up question was asked, and how many results were shown — plus what you did next, such as opening a listing, calling, getting directions, copying, asking to correct a listing, or quickly rephrasing the question. We use this to find questions we answer poorly and to improve categories and content.
  • Usage: screen views and button taps (anonymous) — each time the app is opened, which screens you view (home, results, business details, guides, settings, etc.), which main buttons you tap (microphone, typing, photo, filters, widening a search, correction requests, sharing), and errors in the app (such as a failed network request, a failed data download, or speech recognition being unavailable — only the error type and a short technical note, never what you said).
  • Random anonymous ID: usage is counted with a random anonymous ID (for example, how many phones use the app and how many times the same phone opened it). The ID is generated randomly on your phone the first time you use the app. It is not tied to your identity, serial number or advertising identifier (IDFA), and it is not used to track you across apps or websites. You can replace it any time under Settings → Reset anonymous ID, or turn off “Help improve” to stop sending; deleting the app also resets it.
  • No account, name, contact details or advertising identifier (IDFA), and no phone location — only a place name you said in the question (city level), and whether results were sorted by “near you”.
  • The records contain no IP address and not the rate-limiting device ID described below — only the random anonymous ID above and a random code that changes every day. Neither can be matched to you.
  • Raw records (including question text) are deleted after 90 days; after that we keep only counts without any text (for example, questions per category per day).
  • Not used for advertising or tracking, never sold, never combined with data from other companies.
  • You can turn it off any time in the app under Settings → Help improve. When it is off, no usage records or unanswered questions are sent, and records not yet sent are deleted from the phone.
• Random device ID: generated randomly on your phone the first time you open the app. It is not tied to your identity, serial number or advertising identifier. It is used only to limit how many questions each phone can ask per day, to prevent abuse; the counter is deleted automatically after about 26 hours.
• Our server runs on Cloudflare. Technical error logs are kept briefly for troubleshooting.

“Talk to us” (rentals, jobs, partnerships, corrections, feedback)

• What you say: when you tell us you want to rent out a place, hire, partner with us, correct a listing or give feedback, the text of what you said is sent to our server, where AI (Anthropic's Claude API) organizes it into a form for you to review. After you confirm, the original text and the form are stored on our server so we can verify, publish and reply.
• Phone number or email: required for rentals, jobs, partnerships and corrections; optional for feedback. When you tap Send, we text or email you a 6-digit code to confirm it's you. The verified contact becomes your account. We use it only to verify information, call businesses back, reply to you, and restore your messages on a new phone. We never use it for marketing or sell it.
• Shown publicly: once approved, rental and job posts appear in the app including the contact phone on the post, so people can reach you. Contact details on partnerships, corrections and feedback are never shown.
• Delivery providers: codes are sent through an SMS provider (Twilio) or an email provider (Resend), which receive only the number or address and the code message.
• Sign-in token: after verification the server issues a random token stored in your phone's Keychain; the server keeps only a hash of it.
• Feedback without contact details is stored with a hash of the random device ID, only so this phone can see its status and our reply.
• Listing photos (optional, up to 6, plus 1 logo for businesses): uploaded only after you tap “Send”. Before upload the phone shrinks them and removes location, time and camera details. Photos are stored on our server (Cloudflare), pre-checked by AI (Anthropic's Claude API) for inappropriate content, then reviewed by us; they are shown publicly with the rental or business only after approval. Please avoid faces, IDs, license plates and other personal details. Rejected photos are deleted, and photos are deleted when the listing is taken down or you delete your account.
• Deletion: delete your account any time in Settings → My Messages → Delete account and all messages. Your phone/email and messages are deleted from our server; published rentals and jobs are taken down at the next data update. You can also email us to request deletion.

Stored only on your phone

• Search history and settings (text size, Simplified/Traditional Chinese) stay on your phone. You can clear them in the app, and they are removed when you delete the app.
• A copy of “My Messages” is kept on your phone. Without a connection, messages wait on the phone and are sent automatically when you're back online.

Calls, maps and websites

When you tap Call, Directions or a website link, the app opens your phone's dialer, a maps app or the browser. Those services handle your data under their own privacy policies.

Business listings

Business and organization listings come from public sources such as government directories, business websites and OpenStreetMap. Some place data © OpenStreetMap contributors, used under the ODbL. Businesses can ask us to correct or remove their listing by tapping “电话打不通 / 信息有误” (wrong info) on the listing, or by emailing panglaochen@gmail.com with the business name and the change needed.

Children

The app is not directed at children under 13, and we do not knowingly collect personal information from children.

Changes and contact

If this policy changes we will update this page and the date above. Questions: panglaochen@gmail.com.