KaidoPlan 隐私政策

最后更新：2026-11-06（新增「官网」一节）

KaidoPlan（下称「本应用」）不收集、不存储、不传输任何个人信息。

不收集数据：本应用不含账号系统、行为分析、崩溃上报、广告或第三方 SDK。
项目数据留在本地：你打开和保存的 .kaido 文件只存在你选择的位置。本应用不上传、不备份、不同步任何项目内容。
最近项目：为了在启动时重新打开上次的项目，本应用在你明确选择文件或文件夹后，会为该文件生成一个仅限本应用使用的 security-scoped bookmark，保存在本机偏好设置里。删除「最近项目」或移除授权目录即可清除。
MCP 服务（默认关闭）：你在「项目 ▸ MCP 服务…」中手动开启后，本应用会在 127.0.0.1 上监听本地端口，供本机运行的 AI 客户端读写同一份计划。
- 只监听回环地址，不接受来自局域网或互联网的连接；
- 每个请求必须携带本应用在本机生成、并显示在该面板中的访问令牌；
- 只有你在该面板中授权的文件夹可被访问，越界请求会被拒绝；
- 随时关闭开关或重置令牌即可立即中断访问。
无第三方共享：本应用不与任何第三方共享数据，因为不存在可共享的数据。

官网（与本应用无关的部分）

上面说的是「应用内」。这个官网不是应用的一部分，它有自己的两条规则，一并说清：

访问计数：本页会记一次「有人看过」和几次按钮点击（下载、购买、订阅），字段只有事件名、来源标识（例如你从哪篇文章点过来）、界面语言、粗粒度国家码和时间。不设 Cookie，不做跨站跟踪，不采设备指纹、不采 User-Agent，关联不到具体的人。服务端收到的 IP 只用于限流，落库前做不可逆哈希，不保存明文。
更新订阅：如果你主动填了邮箱，邮箱会存在邮件服务商（Resend）的订阅清单里，只用于发版本更新与工作流文章。不发促销，不卖给任何人；每封信底部都有一键退订，退订立即生效。发邮件给我也可以要求删除记录。
结账：点「购买」时页面才会加载 Paddle.js（Paddle 的结账脚本），由它完成支付、发票和税费计算。该脚本可能写入结账所需的最小 Cookie；本站在你点击购买之前不设置任何 Cookie。

如对本政策有疑问，请通过项目主页 github.com/cygnusyang/KaidoPlan 的 Issues 联系。

Last updated: 6 November 2026 (added the "Website" section)

KaidoPlan ("the app") does not collect, store or transmit any personal information.

No data collection: no accounts, no analytics, no crash reporting, no advertising, no third-party SDKs.
Project data stays local: the .kaido files you open and save live only where you put them. The app never uploads, backs up or syncs project content.
Recent projects: to reopen your last project on launch, the app creates a security-scoped bookmark for files or folders you explicitly chose, and keeps it in local preferences. Clearing "Recent projects" or removing an authorized folder deletes it.
MCP service (off by default): when you enable it under Project ▸ MCP Service…, the app listens on 127.0.0.1 so a locally running AI client can read and write the same plan.
- loopback only — never the LAN, never the internet;
- every request must carry a bearer token generated locally and shown in that panel;
- only folders you authorized in that panel are reachable; anything else is refused;
- turning the switch off or resetting the token cuts access immediately.
No third-party sharing: there is no data to share.

Everything above is about the app. This website has its own two rules, stated plainly:

Visit counting: this page records one "someone looked" event and a few button clicks (download, buy, subscribe). The fields are an event name, a source tag (e.g. which article you came from), the interface language, a coarse country code and a timestamp. No cookies, no cross-site tracking, no device fingerprint, no User-Agent — nothing that ties a row to a person. The server sees an IP only to rate-limit submissions and stores an irreversible hash, never the address itself.
Newsletter: if you enter your email, it is stored in our email provider (Resend) and used only for release notes and workflow write-ups. No promotions, never sold. Every email has a one-click unsubscribe that takes effect immediately, and you can email me to have the record deleted.