OKSPEAK 隐私政策

生效日期：2026年7月20日 最近更新：2026年7月21日 适用版本：OKSPEAK 桌面客户端 0.2.6 及以上；www.okspeakai.com

1. 引言

本隐私政策说明武汉山河世纪科技有限公司（以下简称"我们"）在您使用 OKSPEAK 桌面客户端、官方网站及相关服务（合称"本服务"）时，如何收集、使用、存储、共享和保护您的个人信息。

OKSPEAK 是一款语音输入工具：您按下快捷键说话，我们把语音转成文字并整理后写入您当前正在使用的输入框。要实现这件事，语音和少量输入框周边上下文必须离开您的电脑、经由我们的服务器发送给语音识别和大模型服务商。这是本产品的核心工作方式，无法在保留功能的前提下关闭。 本政策的目的，是把"到底有哪些数据、去了哪里、留了多久"讲清楚。

请您在使用本服务前仔细阅读本政策。如您不同意本政策的任何内容，请停止使用本服务。

2. 我们是谁

本政策项下的一切请求、问询与投诉，均可发送至 developer@okspeakai.com。

关于欧盟／英国代表： 我们尚未指定 GDPR 第 27 条项下的欧盟或英国代表。若您位于欧洲经济区或英国，请先仔细阅读第 8 节（跨境数据传输）再决定是否使用本服务。

3. 关于"区"的说明

OKSPEAK 分为国内区（连接 okspeakai.com，服务器位于中国大陆，阿里云）和国际区（连接 okspeak-intl.acctoken.com，服务器位于德国，Netcup）。您安装的客户端在打包时即确定所属区。

请特别注意：账号上的"区"标记只用于展示和用量统计，它不决定您的数据发给哪家服务商。 无论您属于哪个区，语音识别与文本整理目前都由位于中国境内的服务商处理（详见第 8 节）。

4. 我们收集的信息

4.1 账户信息

国内区（当前已上线） 支持邮箱与密码、手机号短信验证码、微信扫码三种独立的注册／登录方式。我们存储：

• 邮箱地址（明文存储，用于登录标识）。请注意：注册时我们不会验证该邮箱的所有权，不会发送验证邮件。

• 密码的 scrypt 加盐哈希值（我们不存储、也无法还原您的明文密码）

• 套餐等级（plan）、区标记（region）

• 注册时间、更新时间、最近活跃时间（last_seen_at）

• 活跃事件记录：当您携带有效登录凭证调用我们的语音或助手接口时，我们会记录一行"活跃事件"（事件类型 + 时间戳 + 您的用户 ID）。我们不单独记录登录事件。

• 手机号短信验证码登录：您的手机号会明文发送给阿里云短信服务用于下发验证码，这是短信送达的必要条件。在我们自己的身份库中，手机号以带密钥的 HMAC 形式存储，不存明文。验证码仅存在于服务进程内存中，5 分钟后失效，不落库。

• 微信扫码登录：我们通过微信开放平台换取您的 openid，并以带密钥的 HMAC 形式存储 openid。扫码登录流程在服务进程内存中保存，5 分钟后失效。微信返回的 access_token 仅在服务端用于一次经授权的昵称和头像读取，读取后立即丢弃，不做存储；refresh_token、unionid 同样不存储。我们保存经您授权的微信昵称和头像来源地址，仅用于账户展示。头像来源地址不会发送给客户端；客户端通过登录鉴权后的头像代理读取，代理只接受微信头像域名并限制图片类型和大小，代理副本仅在服务进程内存中短期缓存。资料读取失败不影响登录。

账号独立性： 邮箱、手机号和微信三种方式分别创建独立账号，当前不会自动识别或合并为同一账号，也暂不支持把手机号或微信绑定到已有邮箱账号。即使由同一人使用，不同方式登录时也可能看到彼此独立的历史、用量和账号数据。

国际区 账号系统由 Supabase 提供。Supabase 存储您的邮箱、密码凭据、用户 ID、注册时间、最近登录时间及套餐/区字段。国际区客户端直接与 Supabase 通信，不经过我们的服务器，因此 Supabase 会在每次认证请求时看到您的 IP 地址。

国际区界面上提供 Google 账号登录按钮。该功能当前处于未完成状态：Google 授权页仍为测试配置，仅允许少量白名单账号，且该流程尚未在真机上完整验证。若您使用该按钮，Google 会在授权过程中看到您的 IP 与浏览器信息。

4.2 语音音频

当您按下录音键时，客户端采集麦克风音频，实时编码（默认 Opus）后通过加密连接发送至我们的服务器，再转发给语音识别服务商。

• 单次录音上限 600 秒，超时自动停止。
• 音频不会写入您电脑的硬盘，仅存在于进程内存，任务结束即释放。
• 音频不会存储在我们的服务器上，转发后即丢弃，我们不留副本。
• 设置页的"麦克风测试"功能也会开启麦克风，但该音频完全不离开您的设备，仅用于显示音量条。
• 您自定义的词典／热词条目会随音频一并发送给语音识别服务商，用于提升这些词的识别准确率。

我们对"本地不落盘、服务端不留存"两点做了专门的代码核查。但请注意：音频在语音识别服务商侧的留存策略，由该服务商的政策决定，不在我们的控制范围内，我们无法代其作出承诺。

4.3 输入上下文

为了让整理结果符合您当前的写作场景（例如在代码编辑器里说话不该被整理成散文），客户端会采集当前输入环境的少量信息，随语音识别结果一起发送给我们的服务器和大模型服务商：

关于敏感场景抑制的边界（请注意实际边界在哪里）： 该机制分两层。客户端层——命中敏感应用或敏感窗口标题时，客户端不会读取光标上下文与选中文本，这些内容根本不会离开您的电脑。服务端层——前台应用名与窗口标题本身仍会随请求上传到我们的服务器，由服务器判定后丢弃；丢弃后不会发送给大模型服务商，也不会写入日志。也就是说，敏感窗口标题本身仍然会到达我们的服务器，只是不会转发给第三方。我们已将"把标题敏感判定前移到客户端"列为待改进项。

关于"自动词典"功能的重要说明： 为了学习您对识别结果的修改习惯（例如把某个专有名词固定改成某种写法），当您修改了插入的文本并发送时，客户端会把当前输入框的全文（最多 5000 字符）、光标前后文本以及我们此前插入的原始文本发送到我们的服务器，交由大模型分析差异。该功能在生产环境默认开启，且当前版本没有提供关闭开关。 这是本产品中范围最广的一项上下文采集，我们在此明确披露，并已将"增加独立开关"列为待改进项。

关于剪贴板（重要，请仔细阅读——这里有两条完全不同的路径）：

路径一：插入时的"备份—恢复"（Windows 与 macOS 都有） OKSPEAK 通过把文本写入剪贴板并模拟粘贴（Windows 为 Ctrl+V，macOS 为 Cmd+V）来插入文本。因此客户端会在每一次插入前读取您剪贴板中已有的内容，以便随后将其恢复原状。

• 仅就这一条路径而言，剪贴板内容只驻留于内存，不会上传至我们的服务器，也不会写入日志或历史记录。
• Windows 与 macOS 都是如此：最常见的语音插入路径只备份纯文本。受当前已知限制：若插入时您的剪贴板中是非文本内容（图片或文件），该内容会被覆盖且无法恢复。
• 仅在 Windows 上，另外两条较少见的插入路径（结果卡手动插入、问问助手插入）会额外尝试多格式备份（文本、文件、图片）；该备份对部分图片格式仍会降级为纯文本。

⚠️ 路径二：问问助手的剪贴板上下文（仅 Windows）——剪贴板内容会上传 在 Windows 版本上，"问问助手"可能把您剪贴板中的内容（最多 8000 字符）上传至我们的服务器，并转发给大模型服务商 DeepSeek（位于中国）。 触发条件有两种：

1. 您的指令中提到了剪贴板（例如"刚复制的那段"）；以及
2. 在录音期间您的剪贴板发生过任何变化——即使您的指令完全没有提到剪贴板。

请特别注意第 2 种情况： 它的判定依据是录音开始到指令发出之间剪贴板序号是否变化，任何应用在此期间写入剪贴板都会触发。这意味着您因为无关原因复制的内容（包括密码、令牌、验证码）也可能被上传。这一行为不符合用户的合理预期，我们已将"仅在您明确要求时才附带剪贴板内容"列为高优先级整改项。在修复上线前，请避免在复制敏感内容后紧接着使用问问助手。

macOS 版本完全不执行上述路径二，也不执行"问问助手"选区采集。

在 Windows 上，当您对选中内容使用"问问助手"时，客户端还会通过模拟复制读取当前选中文本，上限同为 8000 字符（高于上表语音链路的 2000 字符）。

4.4 问问助手（Ask AI）

当您使用"问问助手"时，您的指令与相关上下文会发送给大模型服务商，助手会调用联网搜索，并可能抓取网页。客户端还会把您的本地时区（IANA 名称，例如 Asia/Shanghai）随请求发送，用于让助手正确理解"今天""明天"等表述。语音输入链路不发送时区。

文件上传： 问问助手支持通过"+"按钮或拖拽一次最多附加 5 个本地文件（md / txt / pdf / xlsx / pptx / docx）。这些文件的字节内容会上传到我们的服务器，在运行期间临时写入服务器临时目录，运行结束后删除，其文本内容会发送给大模型服务商。

⚠️ 请特别注意本项与语音链路的两处根本差异：

（一）运行记录保存在我们的服务器上。 保存内容包括：

• 您的指令——经空白字符归一化并截断至前 80 个字符后保存。请注意：这不是脱敏，前 80 个字符是原文，其中若包含个人信息也会被原样保存。
• 模型的完整回答正文
• 每一步的工具调用摘要、模型的思考文本、报错信息
• 搜索引用（标题、URL、摘要片段）
• 生成的文档产物（.md / .docx / .pdf / .xlsx / .html 文件本体）

（二）运行记录按已验证的用户身份隔离。 访问问问助手接口时，服务端除校验客户端机器凭证外，还要求有效的用户登录凭证。运行记录在写入时关联用户标识，列表与详情读取均按该标识过滤；生成文件写入按用户分隔的目录，下载及后续转换时再次校验归属。整改前产生、没有用户归属的旧运行记录不会向任何用户返回。

跨会话记忆工具目前已停用，不再写入或读取新的跨会话偏好记录。整改前的历史记忆数据不再通过问问助手提供给用户，其后续清理期限仍待确定。

留存机制： 当前是每个用户保留最近 50 条运行记录，超出后按时间淘汰该用户最旧的记录。这是一个数量上限，不是时间上限——如果使用量低，一条记录可能保留很久。生成的文件当前没有保留期限，也没有清理机制。

4.5 意见反馈

当您主动提交意见反馈时，我们收集：

• 您填写的反馈正文
• 您的用户 ID、邮箱、套餐、区（仅在您已登录时，且身份信息来自经验证的登录凭证）
• 客户端版本、界面语言、反馈分类，以及我们团队记录的处理状态与回复

反馈表采用固定字段设计，因此我们不会自动附带您的语音转写内容、剪贴板、选中文本或代码差异。但请注意：反馈正文是自由文本框，您自己粘贴进去的任何内容都会被原样保存。

4.6 服务端日志

我们的服务器会记录运行日志，用于排障与用量统计。日志中包含：

• 您的用户 ID（伪名化标识）与访问的接口路径
• 请求耗时、状态码、追踪 ID、文本长度等技术指标
• Web 服务器访问日志中包含您的 IP 地址

我们已通过代码核查与生产日志抽查确认，应用日志中不包含语音转写正文、搜索词原文、大模型提示词与响应正文、邮箱、手机号、密码或 API 密钥。

保留方式： 国内区 Nginx 访问日志按日轮转；OKSPEAK 应用日志按日或达到 100 MB 时提前轮转。两者均最多保留 14 份历史日志，旧日志自动删除；若某日无日志则不会产生该日归档。国际区 OKSPEAK 应用使用 Docker json-file 日志，每个日志文件达到 100 MB 时自动轮转，最多保留 14 个日志文件，超出后自动删除最旧文件。

4.7 客户端本地存储

以下数据保存在您自己的电脑上，不会自动上传：

• 历史记录文本（语音原文与整理结果）：默认不保存。仅当您在设置中主动开启"保存历史文本"后才会写入本地。开启后，超过保留期限（默认 24 小时；可选 1 小时 / 24 小时 / 7 天 / 手动）的文本会在您下次使用本应用时被清除——清理发生在您启动应用、完成一次语音任务或打开历史面板时，不是定时器。如果您长期不打开本应用，超期文本会一直留在您的电脑上，直到您下次启动或手动清空。 选择"手动"则完全不自动清理。
• 应用名与可执行文件名：写入本地历史记录，不受上述开关和自动清除的约束，会一直保留至您点击"清空全部历史"。
• 本地诊断记录：客户端会在本地应用数据目录下的 telemetry 文件夹写入性能追踪与错误记录（JSON Lines 格式），并写入本地数据库的诊断表。内容包括任务结果、错误码、处理阶段、追踪与任务 ID、时间戳、本次由哪家语音／大模型服务商处理、任务的粗分类（例如代码或散文）——不含您的转写正文、剪贴板、选中文本或窗口标题（写入前已在代码中过滤）。这些记录不会自动上传，但也不会被"清空全部历史"清理——当前版本没有在应用内清除它们的入口，它们会持续累积（待改进）。
• 登录凭证与 API 密钥：保存在操作系统的凭据管理器（Windows 凭据管理器 / macOS 钥匙串）中。

5. 我们不收集的信息

以下否定事项中，标注"（代码核查）"的经代码审计确认，标注"（服务器核查）"的经我们于 2026-07-15 对生产服务器的直接检查确认：

• ❌ 我们不做屏幕截图，也不读取屏幕画面。（代码核查）
• ❌ 我们不记录您按键的内容。为了识别触发录音的快捷键，以及察觉您对插入文本的修改（自动词典功能，见 4.3），客户端会安装一个系统级键盘观察器（Windows 为 WH_KEYBOARD_LL 低级钩子，macOS 为 CGEventTap），它会接收您在所有应用中的键盘事件。该观察器始终开启，当前版本没有关闭开关。 客户端仅从每个事件中提取一个抽象类别（触发键 / 删除 / 粘贴 / 普通字符 / 发送），您所按键的具体身份与内容不会被记录、存储或传输。（代码核查）
• ❌ 我们没有集成任何崩溃上报 / 崩溃转储 SDK（无 Sentry、Bugsnag、Crashpad 等）。（代码核查）
• ❌ 我们的官方网站没有部署任何统计分析或广告追踪代码（无 Google Analytics、百度统计、Facebook Pixel 等），也不使用 Cookie 进行追踪。（服务器核查；官网源码不在产品代码库内，该结论基于对服务器上已部署站点文件的直接检查）
• ❌ 我们不收集您的出生日期或年龄。（代码核查）
• ❌ 我们不出售您的个人信息，不将您的数据用于第三方广告定向。
• ❌ 我们不收集任何支付信息——本服务当前未接入任何支付渠道。（代码核查）
• ❌ 我们不使用您的语音或文本内容训练我们自己的模型。

6. 我们如何使用信息

关于敏感个人信息： 我们不主动索取敏感个人信息，但您口述的内容原则上可能包含此类信息。我们不将您的语音用于身份识别，不建立声纹模型，因此不处理《个人信息保护法》意义上的生物识别信息。

7. 第三方服务提供者

为提供本服务，我们将必要数据共享给下列服务提供者。除下列主体、以及您在 BYOK 设置中自行指定的接入地址外，我们不向任何第三方提供您的个人信息。

我们目前主要通过各服务商平台注册并接受其在线服务协议来使用相关服务，没有另行签署纸质合同或单独的数据处理协议。各服务商对其系统内数据的处理仍受其在线条款、隐私规则与适用法律约束。AnySearch 的特殊情况见第 7.3 节。

7.1 语音识别

火山引擎是国内区与国际区共同的默认语音识别服务商，流式识别链路硬编码为火山引擎，不经过任何路由选择，没有备选实现。Deepgram 仅作为内部开发实验通道存在，需显式配置才启用，生产环境未启用。

7.2 大模型

DeepSeek 是我们当前唯一实现的通用大模型服务商，国内区与国际区均使用。

关于代码审查功能： 该功能当前在生产环境未启用——/code-review 接口返回不可用，您的代码差异不会离开您的电脑。若我们启用它，会先更新本政策。

启用后的数据流向为：默认发往 DeepSeek（使用我们自己的密钥）；即使您从未配置 BYOK，代码差异也会发送给 DeepSeek。仅当您在设置中自行填写了自己的 API Key 与自定义接入地址（BYOK）时，代码差异才会连同您的密钥经我们的服务器转发至您所填写的接入地址。您填写的模型 ID 只决定我们使用哪种 API 协议格式（gpt-5* 用 OpenAI Responses 格式，claude-* 用 Anthropic Messages 格式），并不限定数据的实际去向。我们不限制您可填写的主机，因此代码差异与您的密钥可能被发送至任何国家的任何运营方——可能是美国的 OpenAI 或 Anthropic，也可能是其他网关。该去向由您自行选择，我们无法对其留存策略或所在司法辖区作出任何保证。

7.3 联网搜索

当前生产配置下，搜索服务商的选择依据是搜索词所用的文字，而非您所属的区：含中文、日文（含假名）或韩文（含谚文）字符的搜索词默认走智谱 GLM（中国），其余搜索词默认走 Tavily（美国）。当其中一方不可用时会自动切换到另一方。

请日语／韩语用户特别注意： 判定依据是 CJK 字符范围，因此纯假名的日语查询与纯谚文的韩语查询也会被发送到位于中国的智谱 GLM，而不是美国的 Tavily。

关于 AnySearch 的重要披露： AnySearch 是一个无需 API Key 的匿名搜索接口，在问问助手的搜索链路中始终作为兜底环节存在。由于不存在账号或密钥关系，我们无法与其签订数据处理协议，也无法对其留存策略作出任何保证。我们如实披露这一事实，并已将其列为待评估项。

另有一条通过系统浏览器抓取 Bing 的兜底搜索路径已在代码中实现，但生产环境未启用；若我们启用它，会先更新本政策。

问问助手在抓取网页时，由我们的服务器（而非您的设备）访问模型选定的网页。目标网站看到的是我们服务器的 IP，不是您的 IP。

7.4 身份认证

7.5 基础设施

客户端会定期检查更新，更新服务器会看到您的 IP、客户端版本与 User-Agent。

8. 跨境数据传输

我们如实披露以下跨境传输情形：

国际区用户 → 中国 国际区用户的语音音频会发送给位于中国的火山引擎；语音转写正文与输入上下文会发送给位于中国的 DeepSeek。这不是可选项——流式语音识别链路硬编码为火山引擎，通用大模型也只有 DeepSeek 一家实现，且三个服务商路由器中都没有任何按区分流的逻辑。如果您位于欧洲经济区、英国或其他对跨境传输有严格要求的司法辖区，请在使用前认真考虑这一点。

国内区用户 → 境外 当您的搜索词不含中日韩字符时，该搜索词会发送给位于美国的 Tavily。搜索词还可能发送给运营方不明的 AnySearch。（代码审查功能生产环境未启用，因此当前不产生代码差异出境；一旦启用且您配置了 BYOK，代码差异与您的密钥会发往您自行填写的接入地址，该地址可能位于任何国家，我们不限制、也不核验该去向。）

日语／韩语用户 → 中国 含假名或谚文的搜索词会发送给位于中国的智谱 GLM（见 7.3）。

国际区 → 国内区 我们的运营管理后台部署在国内区服务器上，在查看用户名单时会从 Supabase 拉取国际区用户的邮箱与登录时间等信息。

关于传输保障措施的现状：

• 中国法项下： 我们当前用户数量低于 1,000，且不属于关键信息基础设施运营者。根据现行数据出境规则，若自当年 1 月 1 日起累计向境外提供不满 10 万人的非敏感个人信息，可能无需申报出境安全评估、订立个人信息出境标准合同或通过个人信息保护认证；但这不免除告知、最小必要、安全保护、个人权利保障等其他义务。我们尚未完成专门的个人信息保护影响评估，并将持续核对实际出境数量及数据类别。
• 欧盟／英国法项下： 我们尚未签署欧盟标准合同条款（SCC），中国亦未获得欧盟充分性认定。这意味着国际区用户数据流入中国目前缺乏 GDPR 第五章要求的传输保障机制。

我们不会在每次因搜索路由或网络环境变化发生数据跨境时重复弹窗。首次注册／登录页提供一个统一的必选框及本政策与服务条款两个可点击链接，用户只需勾选一次。该低摩擦方式是否足以满足所有适用场景下的“单独同意”要求，仍需法律专业人士结合最终界面确认，因此我们不把它描述成已经完全解决跨境合规风险。对数据出境有严格要求的用户，应审慎评估是否使用本服务。

9. 数据保留

除法律法规另有要求外，我们执行经核验的账号删除请求时，会删除该账号、活跃事件、意见反馈、问问助手运行记录及生成文档等可关联数据。依法必须保留的信息将隔离保存、限制访问，不再用于日常业务，并在法定期限届满后删除。我们选择如实标注仍待改进的项目，而不写一个目前做不到的期限。

10. 您的权利

根据《个人信息保护法》，您对您的个人信息享有知情权、决定权、查阅复制权、可携带权、更正补充权、删除权，以及要求解释说明的权利。

请注意：本服务当前没有提供自助的账号注销、数据导出或数据删除入口。 这是当前产品的真实状态，我们不隐瞒。

在此期间，如需行使上述任何权利，请发送邮件至 developer@okspeakai.com。我们将在收到请求后 15 个工作日内响应，并通过人工流程提供可合理导出的账号及关联数据，或执行更正、删除与注销。

身份核验： 为防止他人冒用，您需要先通过创建该账号时所用的当前登录方式完成核验：邮箱账号重新验证密码，手机号账号重新验证短信验证码，微信账号重新完成微信授权。仅凭来信邮箱或陈述账号信息不足以执行删除等不可逆操作。若标准核验暂时无法完成，售后服务部会采用与风险相匹配的人工核验方式。

我们正在开发自助的账号注销与数据导出功能。

退出说明：

• 您可以在客户端设置中关闭"保存历史文本"，或随时清空本地历史。
• 您可以在操作系统设置中撤销 OKSPEAK 的麦克风权限与辅助功能权限，但这会使产品无法工作。
• 如需完全停止数据处理，请卸载客户端并来信要求删除账号。

11. 未成年人

本服务仅面向 18 周岁及以上的成年人，不允许未满 18 周岁的人员注册或使用。我们当前没有设置年龄验证机制，也不收集出生日期，因此在技术上可能无法主动识别未成年用户。

我们尚未制定面向未成年人的专门个人信息处理规则。如您是未成年人的父母或监护人，且发现其使用了本服务，请联系 developer@okspeakai.com；完成必要核验后，我们将删除相关账号及个人信息。

12. 信息安全

• 客户端与服务器之间的全部通信均使用 HTTPS / WSS 加密传输。
• 密码使用 scrypt 算法加盐哈希存储，我们无法还原您的明文密码。
• 手机号与微信 openid（相应登录方式启用时）在身份库中以带密钥的 HMAC 形式存储。
• 登录凭证与 API 密钥在客户端保存于操作系统级凭据管理器中。
• 我们在代码层面设置了隐私边界：语音转写正文、提示词、模型响应正文、代码差异、API 密钥禁止写入服务端日志与诊断数据。（请注意：当您主动开启"保存历史文本"时，转写正文会按您的选择写入您本机的历史记录——这是您授权的本地功能，不属于上述禁止范围。）

尽管我们采取了上述措施，但请理解，没有任何一种互联网传输或电子存储方式是绝对安全的，我们无法保证信息的绝对安全。第 4.4 节说明了问问助手的身份隔离与仍待改进的数据留存机制。

13. 本政策的变更

我们可能不时更新本政策。更新时我们会修改顶部的"最近更新"日期。如果变更实质性削弱了您的权利，我们会通过客户端内显著提示或邮件通知您。变更不溯及既往。

14. 联系我们

如您对本政策有任何疑问、意见或投诉，或希望行使您的个人信息权利，请联系：

武汉山河世纪科技有限公司 统一社会信用代码：91420107MAKG4FED6X 联系部门：售后服务部 邮箱：developer@okspeakai.com 邮寄地址：湖北省武汉市青山区红钢城街道和平大道1540号钰龙时代中心第8、17-18、20-26层；23层B440（OKSPEAK 售后部收） 网站：https://www.okspeakai.com

如果您认为我们对您个人信息的处理侵害了您的权益，且我们的答复未能解决您的关切，您有权向履行个人信息保护职责的部门投诉举报。

OKSPEAK Privacy Policy

Effective date: 20 July 2026 Last updated: 21 July 2026 Applies to: OKSPEAK desktop client 0.2.6 and later; www.okspeakai.com

1. Introduction

This Privacy Policy explains how Wuhan Shanhe Century Technology Co., Ltd. (武汉山河世纪科技有限公司) ("OKSPEAK", "we", "us") collects, uses, stores, shares and protects your personal data when you use the OKSPEAK desktop application, our website, and related services (together, the "Services").

OKSPEAK is a voice input tool: you hold a hotkey and speak, and we turn your speech into polished text and type it into whatever field you are working in. To do that, your audio and a small amount of surrounding context must leave your computer, pass through our servers, and be sent to speech-recognition and language-model providers. This is how the product fundamentally works and cannot be switched off while keeping the product functional. The purpose of this policy is to tell you plainly what data that is, where it goes, and how long it is kept.

Please read this policy before using the Services. If you do not agree with it, please do not use the Services.

2. Who we are

All requests, questions and complaints under this policy can be sent to developer@okspeakai.com.

EU/UK representation: we have not appointed an Article 27 GDPR representative in the EU or UK. If you are in the EEA or UK, please read Section 8 (International Transfers) carefully before using the Services.

3. Regions

OKSPEAK ships in two builds: an International build (connects to okspeak-intl.acctoken.com, servers in Germany, hosted by Netcup) and a China build (connects to okspeakai.com, servers in mainland China, hosted by Alibaba Cloud). The region is fixed when the client is packaged.

Important: the "region" label on your account is used only for display and usage metering. It does not determine which providers your data is sent to. Regardless of your region, speech recognition and text processing are currently performed by providers located in mainland China. See Section 8.

4. What we collect

4.1 Account data

International region Accounts are provided by Supabase. Supabase stores your email address, password credential, user ID, sign-up time, last sign-in time, and plan/region fields. The desktop client talks to Supabase directly, not through our proxy, so Supabase receives your IP address on every authentication request.

A Google sign-in button appears in the International interface. This feature is currently unfinished: the Google consent screen is still in a test configuration limited to a small allowlist, and the flow has not been fully verified on real hardware. If you use it, Google will see your IP address and browser during the consent step.

China region (live) The China region supports three independent registration/sign-in methods: email and password, phone-number SMS code, and WeChat QR sign-in. We store:

• Your email address (in plaintext, as the login identifier). Note: we do not verify ownership of this address at registration and send no verification email.

• A salted scrypt hash of your password (we never store and cannot recover your plaintext password)

• Your plan and region

• Sign-up, update and last-seen timestamps

• Activity events: when you call our voice or assistant APIs with a valid session credential, we record an activity row (event type + timestamp + your user ID). We do not record separate sign-in events.

• Phone + SMS one-time code: your phone number is sent in plaintext to Alibaba Cloud SMS in order to deliver the code — unavoidable for delivery. In our own identity store the number is kept as a keyed HMAC, not in plaintext. The one-time code lives in server memory only, expires after five minutes, and is never written to a database.

• WeChat QR sign-in: we exchange an authorization code for your openid and store it as a keyed HMAC. The QR sign-in flow is kept in server memory and expires after five minutes. The access token returned by WeChat is used server-side only for one authorised retrieval of your nickname and avatar, then discarded without storage; the refresh token and unionid are not stored either. We retain the authorised nickname and avatar source address solely for account display. The source address is never sent to the client: the client retrieves the image through an authenticated avatar proxy that accepts only WeChat avatar hosts and restricts image type and size. A proxy copy is cached briefly in server-process memory. Profile retrieval failure does not prevent sign-in.

Independent accounts: email, phone and WeChat each create a separate account. We do not currently detect or merge them automatically, and you cannot yet bind a phone number or WeChat identity to an existing email account. The same person signing in by different methods may therefore see separate history, usage and account data.

4.2 Voice audio

When you start a recording, the client captures microphone audio, encodes it (Opus by default), and streams it over an encrypted connection to our server, which forwards it to a speech-recognition provider.

• A single recording is capped at 600 seconds.
• Audio is never written to disk on your computer — it exists only in process memory and is released when the task ends.
• Audio is not stored on our servers — it is discarded once forwarded. We keep no copy.
• The microphone test in Settings also opens the microphone, but that audio never leaves your device; it only drives the level meter.
• Your custom dictionary / hotword entries are sent to the speech provider along with your audio to improve recognition accuracy for those terms.

We specifically audited the code for the "no local file write, no server-side persistence" claims and found no contradicting path. However: retention of audio on the speech provider's side is governed by that provider's own policy and is outside our control. We cannot make commitments on their behalf.

4.3 Input context

So that the output matches what you are actually writing (speech in a code editor should not be turned into prose), the client collects a small amount of information about your current input environment and sends it, along with the transcript, to our server and onward to the language-model provider:

Scope of the sensitive-context suppression — please note where the boundary actually sits. This mechanism operates at two layers. On the client: when a sensitive application or window title matches, the client does not read cursor context or selected text — that content never leaves your computer. On our server: the foreground application name and the window title themselves are still uploaded to us with the request; our server evaluates them and then discards them, so they are not forwarded to the language-model provider and not written to logs. In other words, a sensitive window title does still reach our servers; it is simply not passed on to a third party. Moving the sensitivity check onto the client is on our remediation list.

Important disclosure about the auto-dictionary feature. To learn how you correct our output (for example, always rewriting a particular proper noun a certain way), when you edit inserted text and then send it, the client sends the full contents of the focused input field (up to 5,000 characters), the surrounding cursor context, and the original text we inserted to our server for a language model to diff. This feature is on by default in production and the current version provides no setting to turn it off. It is the broadest context collection in the product; we disclose it explicitly and adding a dedicated toggle is on our remediation list.

About the clipboard — important, please read carefully. There are two entirely different paths here.

Path 1: backup-and-restore at insertion time (both Windows and macOS) OKSPEAK inserts text by writing it to your clipboard and simulating a paste (Ctrl+V on Windows, Cmd+V on macOS). The client therefore reads your existing clipboard contents immediately before every insertion so that it can restore them afterwards.

• For this path only, clipboard contents are held in memory and are not uploaded to our servers or written to logs or history.
• On both Windows and macOS, the ordinary dictation insertion path backs up plain text only. Due to a known current limitation: if your clipboard holds non-text content (an image or files) at the moment of insertion, that content is overwritten and cannot be restored.
• On Windows only, two less common insertion paths (inserting from the result card, and Ask-AI insertion) additionally attempt a multi-format backup covering text, files and images; that backup itself falls back to text-only for some image formats.

⚠️ Path 2: Ask-AI clipboard context (Windows only) — your clipboard IS uploaded On Windows builds, the Ask-AI assistant may upload your clipboard contents (up to 8,000 characters) to our servers and on to the language-model provider, DeepSeek, in China. This is triggered in either of two situations:

1. Your instruction refers to the clipboard (e.g. "the thing I just copied"); and also
2. whenever your clipboard changed at any point while a recording was active — even if your instruction never mentions the clipboard at all.

Please note situation 2 carefully: it triggers on a change to the clipboard sequence number between the start of recording and dispatch, so a write by any application during that window sets it off. This means content you copied for entirely unrelated reasons — including passwords, tokens and one-time codes — can be uploaded. This does not match what a user would reasonably expect, and changing it so clipboard content is sent only when you explicitly ask for it is a high-priority remediation item. Until that fix ships, avoid using Ask-AI immediately after copying sensitive content.

macOS builds do not do Path 2 at all, and do not perform Ask-AI selection capture.

On Windows, using the Ask-AI assistant on selected content also reads your current selection via a simulated copy, up to 8,000 characters (a higher limit than the 2,000-character cap for voice input context above).

4.4 Ask AI assistant

When you use the Ask-AI assistant, your instruction and relevant context are sent to a language-model provider; the assistant calls web search and may fetch web pages. The client also sends your local IANA timezone (e.g. Asia/Shanghai) with the request so the assistant interprets "today" and "tomorrow" correctly. The voice input pipeline does not send your timezone.

File uploads: the assistant lets you attach up to 5 local files per request (md / txt / pdf / xlsx / pptx / docx) via the "+" button or drag-and-drop. The file bytes are uploaded to our server, written to a temporary directory on the server for the duration of the run and deleted afterwards, and their text content is sent to the language-model provider.

⚠️ Two fundamental differences from the voice pipeline that you should know about:

(1) Run history is stored on our servers. What is stored includes:

• Your instruction — whitespace-normalised and truncated to the first 80 characters. Please note: this is not redaction. Those first 80 characters are your literal text, and any personal data within them is stored as-is.
• The model's full answer text
• Per-step tool-call summaries, the model's reasoning text, and error messages
• Search citations (title, URL, snippet)
• Generated documents (.md / .docx / .pdf / .xlsx / .html files themselves)

(2) Run history is partitioned by verified user identity. The server requires a valid user session credential in addition to the client machine credential before an Ask-AI endpoint can be used. Each run is associated with a user identifier when written, and list/detail reads are filtered by that identifier. Generated files are written under user-separated directories and ownership is checked again on download and conversion. Older runs created before this remediation and lacking an owner are not returned to any user.

Cross-session memory tools are currently disabled, so no new preference memories are written or read. Historical memory data created before the remediation is no longer exposed through Ask AI; its deletion schedule remains to be determined.

Retention: currently the 50 most recent runs per user are kept, evicting that user's oldest run. That is a count limit, not a time limit — with low usage a record may persist for a long time. Generated documents currently have no retention period and no cleanup mechanism.

4.5 Feedback

If you choose to submit feedback, we collect the message you write; your user ID, email, plan and region (only when signed in, and only from a verified session credential); your client version, interface language, category, and the status and any reply our team records against your message.

The feedback table uses a fixed column set, so we never automatically attach your transcripts, clipboard contents, selected text or code diffs. Please note that the message box is free-form text — anything you paste into it yourself will be stored exactly as you wrote it.

4.6 Server logs

Our servers keep operational logs for troubleshooting and usage metering. These contain your user ID (a pseudonymous identifier) and the API route you called, plus timings, status codes, trace IDs and text lengths. Our web server access logs contain your IP address.

We verified — in code and by sampling the live production logs — that our application logs do not contain transcript text, raw search queries, model prompts or responses, email addresses, phone numbers, passwords, or API keys.

Retention: China-region Nginx access logs rotate daily; OKSPEAK application logs rotate daily or earlier when they reach 100 MB. Both keep at most 14 historical files, and no archive is created for an empty day. The International-region OKSPEAK application uses Docker's json-file logging; each file rotates when it reaches 100 MB, at most 14 log files are kept, and the oldest file is automatically deleted when that limit is exceeded.

4.7 Local storage on your device

The following stays on your own computer and is not uploaded automatically:

• History text (raw transcript and polished result): not saved by default. Only written locally if you enable "save history text" in Settings. Once enabled, saved text older than your retention period (24 hours by default; options 1 hour / 24 hours / 7 days / manual) is cleared the next time you use the app — clearing runs when you launch the app, complete a voice task, or open the history panel, not on a timer. If you stop using the app, text older than the retention period stays on your computer until you next launch it or clear history manually. Setting retention to "manual" disables automatic clearing entirely.
• Application name and executable name: written to local history and not covered by the toggle or the automatic clearing sweep. These persist until you use "clear all history".
• Local diagnostic records: the client writes performance traces and error records to a telemetry folder in your local application-data directory (as JSON Lines files) and to diagnostic tables in its local database. These contain task outcomes, error codes, processing stages, trace and task identifiers, timestamps, which speech and language-model provider handled the task, and a coarse classification of the task (for example code vs. prose) — never your transcripts, clipboard, selected text or window titles, which are filtered out in code before writing. These records are not uploaded automatically, but they are also not removed by "clear all history" — the current version provides no way to clear them from within the app, and they accumulate indefinitely (to be improved).
• Session tokens and API keys: stored in your operating system credential store (Windows Credential Manager / macOS Keychain).

5. What we do not collect

For the negatives below, "(code audit)" means confirmed by source-code audit and "(server audit)" means confirmed by direct inspection of our production server on 15 July 2026:

• ❌ We do not take screenshots or read your screen. (code audit)
• ❌ We do not record the content of your keystrokes. To detect the hotkeys that trigger recording — and to notice when you edit and then send text we inserted (the auto-dictionary feature, §4.3) — the client installs a system-wide keyboard observer (a low-level WH_KEYBOARD_LL hook on Windows, a CGEventTap on macOS) that receives keyboard events across all your applications. It is always on and the current version provides no setting to disable it. From each event the client derives only an abstract category — trigger key, erase, paste, character, or send — and the identity and content of the keys you type are never recorded, stored, or transmitted. (code audit)
• ❌ We have no crash-reporting or crash-dump SDK (no Sentry, Bugsnag, Crashpad or similar). (code audit)
• ❌ Our website carries no analytics or advertising trackers (no Google Analytics, Baidu Tongji, Facebook Pixel, etc.) and sets no tracking cookies. (server audit; the website source is not part of the product codebase, so this is based on direct inspection of the deployed site files)
• ❌ We do not collect your date of birth or age. (code audit)
• ❌ We do not sell your personal data and do not use it for third-party ad targeting.
• ❌ We collect no payment information — no payment processor is integrated at all. (code audit)
• ❌ We do not use your voice or text to train our own models.

6. How we use data

Special category data. We do not seek special-category data, but anything you dictate could in principle contain it. Voice recordings are not used for biometric identification and we do not build voiceprints, so we do not process biometric data within the meaning of Art. 9 GDPR.

7. Service providers

We share data with the providers below to deliver the Services. We do not share your personal data with any third parties other than those listed here and any endpoint you yourself configure via BYOK.

We currently use these providers mainly by registering on their platforms and accepting their online service terms. We have not executed separate paper contracts or standalone data-processing agreements with them. Their processing remains subject to their online terms, privacy rules and applicable law. See §7.3 for the special limitations concerning AnySearch.

7.1 Speech recognition

Volcengine is the default speech provider for both regions. The streaming path is hard-wired to Volcengine with no provider routing at all and has no alternative implementation. Deepgram exists only as an internal development option requiring explicit configuration and is not enabled in production.

7.2 Language models

DeepSeek is the only general-purpose language-model provider we have implemented, and it serves both regions.

About Code Review: this feature is not enabled in production — the /code-review endpoint returns unavailable and your code diff does not leave your computer. If we enable it, we will update this policy first.

Once enabled, the data flow would be: by default the diff goes to DeepSeek (using our own key), so even if you never configure BYOK your diff would still go to DeepSeek. Only if you enter your own API key and a custom endpoint in Settings (BYOK) would your diff be forwarded, together with your key, through our server to the endpoint address you configured. The model id you enter selects only which API protocol we speak (OpenAI Responses format for gpt-5*, Anthropic Messages format for claude-*) — it does not constrain the destination. We do not restrict which host you may configure, so your code diff and your API key could be sent to any operator in any country — possibly OpenAI or Anthropic in the United States, possibly some other gateway. You would be choosing that destination; we cannot make any commitment about its retention or jurisdiction.

7.3 Web search

In the current production configuration, the search provider is chosen by the script of the query, not by your region: queries containing Chinese, Japanese (including kana) or Korean (including Hangul) characters default to Zhipu GLM (China), and all other queries default to Tavily (United States), with automatic failover between them if one is unreachable.

Note for Japanese and Korean users: the test is a CJK character range, so a pure-kana Japanese query or a pure-Hangul Korean query is also sent to Zhipu GLM in China, not to Tavily in the United States.

Important disclosure about AnySearch. AnySearch is a keyless, anonymous search endpoint that is always present as a fallback link in the assistant's search chain. Because there is no account or API key relationship, we cannot put a data processing agreement in place with them and cannot make any commitment about their retention. We disclose this plainly; it is on our list for review.

A last-resort search path that scrapes Bing using your system browser exists in the code but is not enabled in production; if we enable it, we will update this policy first.

When the assistant fetches web pages, the fetch is performed by our server, not your device. The destination site sees our server's IP address, not yours.

7.4 Identity

7.5 Infrastructure

The client periodically checks for updates; the update server sees your IP address, client version and User-Agent.

8. International transfers

We disclose the following transfers honestly.

International users → China. International users' voice audio is sent to Volcengine in China, and transcript text plus input context is sent to DeepSeek in China. This is not optional: the streaming speech path is hard-wired to Volcengine, DeepSeek is the only general-purpose language model implemented, and none of the three provider routers contains any region-based routing logic whatsoever. If you are in the EEA, the UK, or another jurisdiction with strict transfer rules, please weigh this carefully before using the Services.

China users → outside China. Search queries containing no Chinese, Japanese or Korean characters are sent to Tavily in the United States. Search queries may also reach AnySearch, whose operator is unknown. (Code Review is not enabled in production, so no code diffs are transferred today. Once it is enabled, if you configure BYOK your code diffs and your API key would be sent to the endpoint you configured, which may be in any country — we neither restrict nor verify that destination.)

Japanese and Korean users → China. Search queries containing kana or Hangul are sent to Zhipu GLM in China (see §7.3).

International → China. Our operations dashboard runs on the China server and pulls the International user roster (including email addresses and sign-in times) from Supabase when an operator views it.

Transfer safeguards — current status:

• Under PRC law: we currently have fewer than 1,000 users and are not a critical information infrastructure operator. Under the current PRC cross-border-data rules, a non-CIIO that has exported the non-sensitive personal information of fewer than 100,000 individuals since 1 January of the current year may be exempt from a security assessment, standard-contract filing and personal-information-protection certification. This exemption does not remove the remaining duties of transparency, necessity, security and rights protection. We have not completed a dedicated personal-information-protection impact assessment and will continue to monitor actual transfer volumes and data categories.
• Under EU/UK law: we have not executed EU Standard Contractual Clauses, and China has not received an EU adequacy decision. This means International user data flowing to China currently lacks a Chapter V GDPR transfer mechanism.

We do not display another pop-up every time routing or network conditions cause a cross-border transfer. The first registration/sign-in screen provides one required checkbox and separate clickable links to these Terms and this Policy; the user checks only once. Whether this lower-friction design satisfies every applicable “separate consent” requirement must still be confirmed by qualified counsel against the final interface, so we do not describe the cross-border compliance risk as fully resolved. Users with strict transfer obligations should carefully assess whether to use the Services.

9. Retention

Unless law requires otherwise, when we carry out a verified account-deletion request we delete the account and linkable activity events, feedback, Ask-AI runs and generated documents. Information that must legally be retained is isolated, access-restricted, no longer used for ordinary business, and deleted when the legal period ends. We label the remaining gaps honestly rather than publish periods we do not enforce.

10. Your rights

Depending on where you live, you may have rights to access, rectify, erase, restrict or object to processing of your personal data, to data portability, and to withdraw consent. If you are in the EEA or UK, you also have the right to lodge a complaint with your local supervisory authority. If you are a California resident, you have rights under the CCPA/CPRA to know, delete, correct, and to opt out of sale or sharing — we do not sell or share personal information as those terms are defined.

Please note: the Services currently provide no self-service account deletion, data export, or data deletion. That is the honest state of the product today.

In the meantime, to exercise any of these rights please email developer@okspeakai.com. We will respond within 15 working days and use a manual process to provide account and linked data that can reasonably be exported, or to carry out correction, deletion and account closure.

Identity verification. To prevent impersonation, you must verify through the sign-in method that created the account: re-enter the password for an email account, complete another SMS code for a phone account, or complete WeChat authorization again for a WeChat account. An email or a statement of account details alone is not enough for irreversible actions such as deletion. If the standard method is temporarily unavailable, the After-sales Service Department will use a manual process proportionate to the risk.

Self-service account deletion and data export are in development.

Opting out:

• You can disable "save history text" in Settings and clear local history at any time.
• You can revoke OKSPEAK's microphone and accessibility permissions in your operating system, though the product will not function without them.
• To stop processing entirely, uninstall the client and email us to request account deletion.

11. Children

The Services are available only to adults aged 18 or older. Anyone under 18 must not register or use the Services. We currently operate no age-verification mechanism and collect no date of birth, so we may not be able to identify an underage user proactively.

We have not established dedicated processing rules for minors. If you are a parent or guardian and believe a minor has used the Services, please contact developer@okspeakai.com; after appropriate verification, we will delete the related account and personal data.

12. Security

• All traffic between the client and our servers uses HTTPS / WSS.
• Passwords are salted and hashed with scrypt; we cannot recover your plaintext password.
• Phone numbers and WeChat openids (when the corresponding sign-in method is enabled) are stored in the identity database as keyed HMACs.
• Session tokens and API keys are stored in your operating system's credential store.
• We enforce privacy boundaries in code: transcripts, prompts, model responses, code diffs and API keys are prohibited from being written to server logs and diagnostics. (Note: when you deliberately enable "save history text", transcripts are written to the history database on your own machine as you requested — that is a local feature you control and is outside this prohibition.)

Despite these measures, please understand that no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security. Section 4.4 describes the Ask-AI identity boundary and the retention mechanisms that still need improvement.

13. Changes to this policy

We may update this policy from time to time. When we do, we will change the "Last updated" date at the top. If a change materially reduces your rights, we will notify you by a prominent in-app notice or by email. Changes are not retroactive.

14. Contact us

For any question, concern or complaint about this policy, or to exercise your rights:

Wuhan Shanhe Century Technology Co., Ltd. Unified Social Credit Code: 91420107MAKG4FED6X Department: After-sales Service Department Email: developer@okspeakai.com Postal address: Floors 8, 17–18 and 20–26, Yulong Times Center, No. 1540 Heping Avenue, Honggangcheng Subdistrict, Qingshan District, Wuhan, Hubei, China; Room B440, Floor 23 (OKSPEAK After-sales Service Department) Web: https://www.okspeakai.com