PageNote turns a PDF of lecture slides into page-by-page study notes, and matches a problem set against how far your course has got. This page describes exactly what leaves your device, where it goes, and what is kept.

1. Who we are

PageNote is published by an individual developer. Contact: terrygao907@gmail.com.

2. What stays on your device (or in your own iCloud)

• The PDFs you import, and every page image rendered from them — except the page image sent with a notes, question or explanation request, and the one-problem cut-out sent when you mark it (see section 3)
• All generated notes, your own typed notes, and Apple Pencil handwriting — except what you choose to send for a specific feature, such as the working for a single problem at the moment you ask us to mark it (see section 3)
• Problem sets, your answers, your mistake book, and your marking records (the image of each marking) — except what is sent for a single problem when you ask for its explanation or mark it, and the text of a problem set at the moment you import it, which is sent so it can be matched to your slides (see section 3)
• Class recordings (the audio), their transcripts and translations, and the times at which you turned each page while recording — except the transcript excerpts sent with notes, follow-up questions, class summaries and Class notes, as listed in section 3, and the short excerpt saved with each question you ask during class, which syncs with your notes if iCloud sync is on (below)
• Your cheat sheets — their items (including ones you add yourself, for example with Add to Cheat Sheet in your notes), layout settings and Teacher's rules, and the questions of past papers you import — except what is sent when you collect a cheat sheet or match a past paper (see section 3). Cheat sheets are kept only on the device that made them and are not included in iCloud sync
• Any API key you enter yourself, which is held in the iOS Keychain

None of this is uploaded to us, backed up to us, or readable by us. If you have not switched on iCloud sync, deleting the app deletes it. If you have, a copy stays in your own iCloud account until you delete it there (below).

iCloud sync (optional, beta)

iCloud sync is off by default. You can switch it on in Settings (iCloud Sync (Beta)) or from a one-time suggestion on the home screen. While it is on, the app stores the following in the private database of your own iCloud account, so it appears on your other iPads, iPhones and Macs signed in to the same Apple Account: your PDFs with their page text and outline; document titles (often the PDF's file name) and course names; generated notes and answers to your follow-up questions; your typed notes, text notes and image notes; Apple Pencil handwriting; problem sets and their problems, reference solutions, your results, review schedule and AI marking feedback; term-review progress; what was written from your recordings (What the lecturer taught, exam points and Class notes), and the short transcript excerpt (up to about the last 90 seconds) saved with each question you asked during class (but not the recordings or full transcripts); page display settings; your reading position; and a list of documents you deleted, so they are deleted on your other devices too.

It does not upload class audio, full transcripts or translations, the images in your marking records, or your cheat sheets — those stay on the device that made them.

This storage is provided by Apple under your Apple Account and Apple's terms. It does not pass through PageNote Cloud, and we as the developer cannot read it. Note and problem text is stored in CloudKit encrypted fields, which Apple encrypts on your device before upload. PDFs, page text, handwriting and images use Apple's standard iCloud data protection, and are end-to-end encrypted only if you turn on Advanced Data Protection for iCloud. For Apple Accounts in mainland China, iCloud is operated by Guizhou-Cloud Big Data (GCBD).

Turning sync off or signing out of iCloud does not delete anything on your device. Deleting the app does not delete the iCloud copy. To delete it while sync is on, tap Delete PageNote Data in iCloud in PageNote's Settings (this deletes only the iCloud copy and turns sync off). If sync is already off, remove PageNote under your device's Settings → [your name] → iCloud → Manage Storage (switching sync back on just to delete would upload this device's copy again first). Items removed by sync are kept in a local "recently deleted" folder on that device for 30 days, then deleted.

3. What is sent, and where

Background course generation

If you approve background generation (this is how Turn materials into a learning path works: it takes every readable page of the document and splits it into chapters), the readable text of those pages, page numbers, the learning concepts the AI extracts from them automatically and the practice generated so far are temporarily stored by PageNote so the task can continue while your app is closed. Your complete PDF file, recordings, handwriting and personal notes are not uploaded by this feature. Each task is linked to your verified subscription identifier or an explicitly authorized test installation, so other users cannot retrieve it. We do not store your signed purchase receipt in the task. Content is deleted after a successful sync, when you stop the task and delete its cloud copy, or automatically within seven days of task creation. If you request deletion while a step is running, that step must finish before the task can be deleted. An expired task stops processing. Quota records remain separate and contain no course text. The AI provider named on the consent screen (see the Learning rows in the table below) receives the necessary text to generate the practice; its retention practices are described in the provider section below. Mainland and global services keep their queues separate. On our mainland server, the database that holds these tasks is backed up daily and each backup is kept for 14 days, so a deleted task's content can remain in a backup for up to 14 more days. This storage is used to provide the feature, not for advertising or model training.

If you use your own API key

Not available in the current version. If bring-your-own-key is offered in a future version, requests would go directly from your device to that provider, would not pass through PageNote Cloud, and we would never see the key or the content.

What runs on the device

Speech recognition and translation of a class recording always run on the device, using iOS system frameworks; the audio is not sent to us or to any AI provider. On iPads where Apple's on-device model is available, Class notes and after-class summaries may be produced entirely on the device as well, in which case nothing leaves it for those features. Mind maps and the images in your marking records are built and kept on the device. Cheat sheet layout, export and printing also happen on the device, as does reading the text of a past paper you import (from the PDF's text layer, or by on-device text recognition when a page has none). The cheat sheet shown in the app is marked Contains AI-compiled content, and the PDF file information of every exported or printed cheat sheet records that it contains AI-generated content.

4. AI providers

Depending on your tier and the model you pick, page content may be processed by one of these four companies, and no others:

• Anthropic (Claude models)
• OpenAI (GPT models)
• DeepSeek
• Zhipu AI (GLM models)

What is sent to them: the text of the one page you asked for notes on, and — only if the model you picked can read images — that page's rendered image, together with the document's outline (the opening words of each page) and, if you recorded that class, the transcript of what the lecturer said on that page. Follow-up questions send the same page text and image, your question and that transcript (I don't get this also sends the sentence you tapped and the earlier answers in that thread). When you import a problem set, its text and the document's outline are sent as well. When you ask for a problem's explanation, that problem's text is sent with the slide it was matched to. When you tap Mark it (or Grade selected in the grading desk) on a problem, one image of that problem — the problem as cut from your problem-set page (for problems written by Practice, its typeset statement) with your handwritten working on it — is sent so the AI can mark it, together with the problem text, its reference solution and, for problems written by Practice, their marking points — only that problem, only when you tap the button, and never automatically. From version 1.4, marking goes to the provider our server uses for marking — currently OpenAI; Zhipu AI when you use the app from mainland China, Hong Kong or Macau, or with an App Store account in one of those regions — regardless of which model you picked for notes, and the consent screen names it. Earlier versions send it to the provider of the model you picked for notes. Nothing else: not your other handwriting, not your own typed notes, not your other documents, not any identifier that names you.

If you switch on Class notes while recording a class, the text of what the lecturer said in roughly the last one to two minutes is sent as well, together with the text of the slide you are on and the headings already in that page's notes, so the AI can write down what the lecturer added beyond the slide. It goes to the same provider you approved for notes (our server may pick a different model from that provider for live use). The audio itself is never sent, and neither are your own notes or handwriting. Whether or not Class notes are on, a page's transcript is also sent whenever you generate or regenerate notes for that page or ask a follow-up question about it, during class as well as after, and when you ask for that page or class to be summarised after class (see the first row of the table in section 3); during class, I don't get this and the questions under Ask something send roughly the last 90 seconds. Regenerate (without class content) sends none.

If you use Practice, the inputs listed in section 3 are sent to OpenAI, which writes the problems, re-solves each one and reviews its worked solution line by line, and rewrites any that fail before you see them. Practice is not currently offered in mainland China, Hong Kong or Macau, or with an App Store account in those regions. If it is offered there later, it would use Zhipu AI and the consent screen would name it before anything is sent.

If you use the Cheat sheet, the inputs listed in section 3 go to OpenAI, which picks the formulas, definitions and exam points for that course's sheet, or works out which of your basket items each past-paper question uses; this adds no provider to the list above. The cheat sheet is for subscribers only and is not currently offered in mainland China, Hong Kong or Macau, or with an App Store account in those regions. If it is offered there later, it would use Zhipu AI and the consent screen would name it before anything is sent.

Learning features send the inputs listed in section 3: the course text you selected, the subtitle or transcript text you provided, or the topic you typed — each only after you have approved that feature for the provider it names. For practice from your slides or a video, that is the provider our server uses for learning practice (currently OpenAI, except from networks or App Store accounts in mainland China, Hong Kong or Macau), not necessarily the provider of your notes model.

If your App Store account is in mainland China, requests do not go through Cloudflare. They go to a server we operate ourselves in Hangzhou (Alibaba Cloud) at api.pagenote.com.cn, and from there only to DeepSeek and Zhipu AI — the requests stay inside mainland China. That server relays and meters exactly as described above. It keeps no page content other than background generation tasks (section 3, up to seven days, plus up to 14 days in its daily backups). Instead of Cloudflare Analytics Engine, it writes the same content-free usage record to its own system log (it does not log AI output), and its web server keeps an access log (IP address, time, request line, response status and size, user-agent) for about 10 days. The same routing applies to class transcripts.

If you use the app from a network in mainland China, Hong Kong or Macau (with an App Store account outside mainland China), or with a Hong Kong or Macau App Store account from any network, requests still go through Cloudflare, but only to DeepSeek and Zhipu AI, both based in mainland China. This applies to notes, follow-up questions, marking, learning practice and Class notes alike, so this content is processed in mainland China.

We have confirmed that each of these four providers offers data protection equal to what this policy promises. All four are used through their paid API tiers, where the provider's own terms state that submitted content is not used to train their models and is retained only briefly for abuse monitoring before deletion (at most 30 days across the four, and zero-retention where the provider offers it). We do not use any provider that trains on API content. If a provider ever changed those terms, we would drop that provider rather than weaken this policy — the app's model list is served from our server, so a provider can be removed for everyone without an app update. Our hosting providers, Cloudflare (PageNote Cloud) and Alibaba Cloud (our Hangzhou server), process this data only on our instructions, under their data processing terms, and provide the same level of protection.

If a request cannot be served by your chosen model, it may be retried with the backup model you selected — that model's provider is named in the consent screen too.

The app names the specific company before you consent, and asks again if you switch to a model from a provider you have not yet approved. You can withdraw consent at any time in Settings, or for learning features from the More menu at the top right of Learning adventures — this device stops sending immediately. A background generation task already uploaded keeps its cloud copy until you stop it in the course, or it expires.

5. What we do not do

• No accounts, no sign-in, no password
• No analytics, telemetry, crash-reporting or advertising SDKs in the app — nothing on your device reports what you do. Our own server records which features were called and what they cost (section 3); that record never contains your content
• No tracking as defined by Apple's App Tracking Transparency — we do not link data to third-party data for advertising, and we do not share data with data brokers
• No selling of data, ever
• No reading of your notes, handwriting or documents, including anything you sync to your own iCloud

6. Payments

Subscriptions are handled entirely by Apple. We never see your card details, billing address or Apple ID. We only receive the signed receipt that says which product is active, and keep its transaction identifier as described in section 3.

7. Retention

Page content and class transcripts are never written to disk on our side, with two exceptions: background course generation tasks you approve are stored for at most seven days (plus up to 14 days in the mainland server's daily backups), as described in section 3, and you can delete them yourself from the course at any time; and a set of problems generated by Practice is held for up to 15 minutes so it can be collected again without a second charge. Recordings, full transcripts and translations are stored only on your device, inside the document they belong to; deleting the recording or the document deletes them. (The short excerpt saved with a question you asked during class stays with that question in your notes, and syncs to your own iCloud if sync is on.) Cheat sheets, including the questions of past papers you import, are stored only on the device that made them and are not synced. You can remove items and past papers in the app (a normalised copy of a removed item's formula, term or exam-point wording is kept so that collecting again does not bring it back); deleting a course's documents does not delete its cheat sheet; deleting the app deletes all of it. If you use iCloud sync, the synced copy stays in your own iCloud account until you delete it (section 2). The list of document fingerprints used to count the free trial is deleted twelve months after it is created (copies in the mainland server's daily backups expire within a further 14 days). Per-day counters — those filed under a keyed hash of your IP address, and subscribers' per-day counts of class features, filed under a one-way hash of the subscription receipt or transaction identifier (or of a class's random ID) — hold only a count and are deleted two days after they were last updated (copies in the mainland server's daily backups expire within a further 14 days). Counters made on Cloudflare before 5 October 2026 hold only a count under a one-way identifier and are not deleted; those on the mainland server have been deleted. Quota balances — keyed by the install identifier, or by your subscription's transaction identifier — are kept until you ask us to delete them, because they are what stops the same trial or purchase being counted twice. Usage records (section 3) are kept for about 90 days in Cloudflare and then fall out of the analytics store automatically; on the mainland server they are kept in its system log, which is rotated automatically. The mainland server's web-server access log (section 3) is deleted after about 10 days. The install identifier is stored in the iOS Keychain, which means it survives deleting and reinstalling the app — that is deliberate, and it is the only thing that stops one device from claiming the free trial over and over. Erasing the device clears it. It is a random value, not derived from your device, your Apple ID, or anything about you, and we do not use it to find out who you are. Under Apple's App Privacy definitions this data is still shown as "linked to you", because our quota and usage records are keyed by this identifier and by your subscription's transaction identifier — even though we do not know who you are. If you email us (section 9), we will delete your quota balance, your free-trial fingerprint list and any background task. Usage records cannot be deleted individually: they expire on their own (about 90 days in Cloudflare, and on the log rotation schedule on the mainland server), and copies in the mainland server's daily backups expire within 14 days.

8. Children

PageNote is intended for students in higher and senior secondary education and is not directed at children under 13 (under 14 in mainland China). We do not knowingly collect personal information from children.

9. Your rights

We hold no account, name or email address for you, unless you email us. What we hold is keyed by a random install identifier or by your subscription's transaction identifier: quota balances, the free-trial fingerprint list and usage records (section 3); and, for two days (plus the mainland backups), per-day counters filed under a keyed hash of your IP address or of your subscription receipt (older counters on Cloudflare hold only a count and are not deleted). The places we hold your content are a background generation task you approved, for at most seven days (plus the mainland backups), which you can delete yourself in the app (Stop task and delete cloud copy), and a Practice set for up to 15 minutes. Your iCloud copy is under your control, not ours: while sync is on, delete it in PageNote's Settings (Delete PageNote Data in iCloud); if sync is already off, remove PageNote under your device's Settings → [your name] → iCloud → Manage Storage. If you want any server-side record deleted (usage records excepted, see section 7), or believe we hold other data relating to you, email terrygao907@gmail.com and we will respond within 30 days. Depending on where you live you may have rights under the GDPR, the UK GDPR, the CCPA or the Australian Privacy Act.

10. Changes

If this policy changes materially, the updated date at the top will change and the new version will be published here before the change takes effect in the app.

PageNote 把一份 PDF 课件变成逐页的学习笔记，并把习题册按授课进度对到具体页上。 这一页说清楚：什么东西会离开你的设备、去了哪儿、留没留下。

1. 我们是谁

PageNote 由个人开发者发布。联系方式： terrygao907@gmail.com。

2. 只留在你设备上（或你自己 iCloud 里）的

• 你导入的 PDF，以及由它渲染出的每一页图片——生成笔记、追问或看解析时发出的那一页图，以及批改时发出的那一道题的裁图除外（见第 3 节）
• 全部生成的笔记、你自己敲的笔记、Apple Pencil 手写——只有你为某个功能主动发出的那部分例外， 比如点「批改」的那一道题的手写作答（见第 3 节）
• 习题册、你的作答、错题本，以及批改记录（每次批改的图片）——你点「看解析」或「批改」时为那一道题发出去的内容、以及导入习题册时为了对到课件页码而发出去的那份文字除外（见第 3 节）
• 课堂录音（音频）、它的转写和翻译、以及录音时你每次翻页的时刻——第 3 节所列、随笔记、追问、课后整理和课堂要点发出的转写片段除外；课上每次提问时随问题存下的那一小段转写跟着笔记走，开了 iCloud 同步就会同步（见下）
• 速查表：里面的条目（包括你自己加的，比如在笔记里点「加到速查表」加进来的）、排版设置和「老师的要求」，以及你导入的往年试卷的题目——整理速查表或匹配往年试卷时发出去的那部分除外（见第 3 节）。 速查表只存在做它的那台设备上，不进 iCloud 同步
• 你自己填的 API Key，存在 iOS 钥匙串里

这些都不会上传给我们、不会备份到我们这里，我们也读不到。没开 iCloud 同步的话，删掉 App 就一起删了； 开了的话，你自己的 iCloud 里会留一份副本，要在那边删（见下）。

iCloud 同步（可选，测试版）

iCloud 同步默认关着。你可以在设置里打开（「iCloud 同步（测试版）」）， 或者在首页那张只出现一次的提议卡上打开。打开后，App 会把下面这些存进你自己 iCloud 账户的私有数据库， 让登录同一个 Apple 账户的其他 iPad、iPhone 和 Mac 上也能看到：课件 PDF 及其各页文字和大纲； 文档标题（常常就是 PDF 的文件名）和课程名； AI 笔记和追问的回答；你自己写的笔记、文字便签和图片便签；Apple Pencil 手写；习题册和其中的题目、参考解析、 你的对错、复习排期和 AI 批改评语；术语复习进度；由课堂录音整理出的「老师讲的」、考点和课堂要点，以及课上每次提问时随问题存下的那一小段转写（最多约最近 90 秒）（不含录音和完整转写）； 页面显示设置；阅读位置；以及你删过哪些文档（好让其他设备上也删掉）。

不会上传课堂录音、完整转写、译文，也不上传批改记录里的图片和速查表——这些只留在产生它们的那台设备上。

这份存储由 Apple 按你的 Apple 账户和 Apple 的条款提供，不经过 PageNote 云端，我们作为开发者读不到。 笔记和题目文字放在 CloudKit 的加密字段里，由 Apple 在你设备上加密后再上传；PDF、页面文字、手写和图片 用的是 Apple 标准的 iCloud 数据保护，只有你开了 iCloud「高级数据保护」才是端到端加密。 中国大陆的 Apple 账户，其 iCloud 由云上贵州（GCBD）运营。

关掉同步或退出 iCloud，设备上的东西一份都不删。删掉 App 不会删掉 iCloud 里的副本。 要删的话：同步开着时，在 PageNote 的设置里点「删除 iCloud 里的 PageNote 数据」（只删 iCloud 里的副本，删完同步会关掉）； 同步已经关了的话，到系统设置 →（你的名字）→ iCloud → 管理储存空间里删除 PageNote （别为了删而重新打开同步——那样会先把这台设备上的东西再传一遍上去）。同步时被删掉的内容会在那台设备上的本地「最近删除」里留 30 天，然后清掉。

3. 会发出去的，以及发去哪

后台课件生成

你同意后台生成后（「课件变闯关」就是这样工作的：它取这份课件的全部可读页、自动分章），PageNote 会暂存这些页的可读文字、 页码、AI 从中自动提取的知识点和已经生成的练习，让任务能在 App 关闭后继续。此功能不会上传完整 PDF 文件、录音、手写或个人笔记。 任务关联到通过验证的订阅标识或明确授权的测试安装标识，其他用户无法读取；任务中不保存签名购买凭证。 内容会在成功同步后删除；你也可以停止任务并删除云端副本；未同步的任务会在创建后最多 7 天自动清理并停止。 若当前步骤正在处理，需等该步骤结束后才能删除任务。额度账本与内容分开，不包含课件文字。 同意页点名的那家 AI 服务商（见下表「学习」几行）会收到生成练习所需的文字，其保留规则见下方服务商说明。 大陆和全球服务的任务队列相互独立。大陆服务器上存放这些任务的数据库每天备份一次、每份备份留 14 天， 所以已删除任务的内容在备份里最多还会再留 14 天。这些暂存内容用于提供功能，不用于广告或训练模型。

如果你用自己的 API Key

当前版本不提供。将来如果开放自带 Key，请求会从你的设备直接发给那家服务商， 不经过 PageNote 云端，我们既看不到 Key 也看不到内容。

哪些在设备上跑

课堂录音的语音识别和翻译一律在设备上跑，用的是 iOS 系统框架；录音不会发给我们， 也不会发给任何 AI 服务商。在支持苹果设备端模型的 iPad 上，课堂要点和课后整理也可能完全在 设备上生成——那时这些功能一个字都不会离开设备。思维导图和批改记录里的图片也都在设备上生成、只存在设备上。 速查表的排版、导出和打印也都在设备上完成；导入往年试卷时读题目文字（从 PDF 的文字层读，没有文字层的页在设备上识别）也在设备上。 App 里显示的速查表标着「含 AI 整理内容」；导出或打印出来的速查表，PDF 文件信息里写明含 AI 生成内容。

4. AI 服务商

按你所在的档位和你选的模型，页面内容可能由下面四家之一处理，没有别家：

• Anthropic（Claude 系列）
• OpenAI（GPT 系列）
• DeepSeek
• 智谱 AI（GLM 系列）

发出去的是什么：你点了生成的那一页的文字，以及——只有在你选的模型能看图时——那一页的 渲染图，连同这份课件的大纲（每页开头的几句），以及录过课时老师讲这一页的转写文字。追问发的是同一页的文字和图片、 你的问题和那段转写（「没懂这条」还会带上你点中的那一句和这一串之前的回答）。导入习题册时会再发习题册的文字和这份课件的大纲。 你点某道题的「看解析」时，会发这道题的文字和它对上的那页课件。你在某道题上点「批改」时，会发出那一道题的一张图—— 从习题册那一页上裁下来的原题（「练习」出的题是排好版的题干），上面带着你的手写作答——连同题目文字、参考解析， 以及「练习」出的题自带的评分要点，好让 AI 看见你怎么写的—— 只发那一道，只在你按下按钮时发，绝不自动发。从 1.4 起，批改固定交给我们服务器指定的批改服务商——目前是 OpenAI； 在中国大陆、香港、澳门使用，或用这三地区的 App Store 账号时是智谱 AI——不随你选的笔记模型变，同意页会点名。 更早的版本发给你所选笔记模型的那家。 除此之外什么都不发：不发你其它的手写笔迹、不发你自己打的笔记、不发你其它的文档、 不发任何能指认到你本人的标识。

录课时如果你打开了「课堂要点」，老师最近一两分钟说的话的文字也会发出去， 连同你正停在的那页课件的文字和这页笔记里已有的小标题，好让 AI 记下老师比课件多讲的东西。 它发给你为笔记同意过的同一家服务商（课上我们的服务器可能换用这家的另一个模型）。 录音本身永远不发，你自己的笔记和手写也不发。不论「课堂要点」开没开，录过课的页在你生成或重新生成笔记、对这页追问时 （课上课下都是），以及下课后点「整理这页的课堂内容」或「整理这节课」时，也会带上那段转写（见第 3 节表格第一行）；课上点「没懂这条」或「问一句」里的提问， 带的是最近约 90 秒。选「重新生成（不带课堂内容）」就不带。

用「练习」出题时，第 3 节表里列的那些内容会发给 OpenAI，由它出题，并把每道题重解一遍、逐句审一遍解答，没过的重写之后才交给你。 「练习」目前在中国大陆、香港、澳门，以及这三地区的 App Store 账号下不提供；以后如果开放，会改用智谱 AI，并且在发送任何内容之前由同意页点名。

用「速查表」时，第 3 节表里列的那些内容会发给 OpenAI，由它挑出这门课要上速查表的公式、定义和考点，或找出往年试卷每道题用到了篮子里哪几条；上面的服务商名单不因此增加。 速查表只给订阅用户，目前在中国大陆、香港、澳门，以及这三地区的 App Store 账号下不提供；以后如果开放，会改用智谱 AI，并且在发送任何内容之前由同意页点名。

学习功能发出去的就是第 3 节表里列的那些：你选中的课件文字、你提供的字幕或讲稿文字、或你输入的主题—— 每一项都要你先为它点名的那家服务商同意过。用课件或视频出题时，这家是我们服务器指定的学习出题服务商 （中国大陆、香港、澳门的网络或 App Store 账号以外，目前是 OpenAI），不一定是你笔记模型的那家。

如果你的 App Store 账号在中国大陆，请求不走 Cloudflare，而是走我们自己 在杭州运营的一台服务器（阿里云，api.pagenote.com.cn），并且只转给 DeepSeek 和智谱 AI——请求全程留在中国大陆境内。那台服务器同样只做转发和计量，除后台生成任务（见第 3 节，最多 7 天， 每日备份里最多再留 14 天）外不保存页面内容。它不用 Cloudflare Analytics Engine，而是把同样不含内容的用量记录 写在自己的系统日志里（日志里不记 AI 的输出）；它的网页服务另有访问日志（IP、时间、请求行、响应状态和大小、User-Agent），约留 10 天。课堂转写的文字走同一条路。

如果你在中国大陆、香港或澳门的网络下使用（App Store 账号不在中国大陆），或者用香港、澳门区的 App Store 账号（不论人在哪里）， 请求仍经 Cloudflare 转发，但只会发给 DeepSeek 和智谱 AI（两家都在中国大陆）。笔记、追问、批改、学习出题和课堂要点都是这样，所以这些内容会在中国大陆处理。

我们已经确认这四家提供的数据保护不低于本政策的承诺。 四家全部走各自的付费 API 通道，服务商条款明确写明提交的内容不用于训练它们的模型， 只为滥用监测短暂留存后删除（四家里最长 30 天，能选零留存的就选零留存）。 我们不使用任何会拿 API 内容训练的服务商。哪一家改了这些条款，我们会把那一家下架， 而不是放宽这份政策——App 的模型表是从我们服务器下发的，撤掉一家不需要发新版本。 我们的托管服务商 Cloudflare（PageNote 云端）和阿里云（杭州服务器）只按我们的指示、依其数据处理条款处理这些数据， 提供同等的保护。

如果你选的模型处理不了某个请求，可能会改用你选的备用模型重试——备用模型的服务商同样会在同意页上点名。

App 会在你同意之前点名具体是哪一家，换到没同意过的服务商时会再问一次。 你随时可以在设置里撤回，学习功能也可以在学习页右上角「更多」菜单里撤回——这台设备会立即停止发送。 已经上传到云端的后台生成任务，要在课程里停止它或等它过期，云端副本才会删除。

5. 我们不做的事

• 没有账号、不用登录、没有密码
• App 里不接任何分析、埋点、崩溃上报或广告 SDK——你设备上没有任何东西在上报你的行为。 我们自己的服务器会记录调用了哪些功能、花了多少成本（见第 3 节），那份记录里没有你的内容
• 不做 Apple ATT 定义的「追踪」——不把数据与第三方数据关联用于广告，不与数据经纪商共享
• 永不出售数据
• 不读你的笔记、手写和文档，包括你同步到自己 iCloud 里的那些

6. 支付

订阅完全由 Apple 处理。我们看不到你的卡号、账单地址或 Apple ID， 只收到那份说明「哪个产品有效」的签名凭证，并按第 3 节所述保存其中的交易 ID。

7. 保留期

页面内容和课堂转写在我们这边从不落盘，只有两个例外：一是你同意的后台课件生成任务，按第 3 节所述暂存最多 7 天 （大陆服务器的每日备份里最多再留 14 天），你随时可以在课程里自己删掉；二是「练习」出好的那组题，最多留 15 分钟， 好让 App 不重复扣费地取回。录音、完整转写和翻译只存在你设备上、放在它所属的那份文档里；删掉那条录音或那份文档就一起删了 （课上提问时随问题存下的那一小段转写跟着那条提问留在笔记里，开了同步就进你自己的 iCloud）。 速查表（包括导入的往年试卷题目）只存在做它的那台设备上、不同步。条目和往年试卷可以在 App 里删（删掉的条目会留下一份规整过的公式、术语名或考点原话，免得重新收集时又冒出来）； 删掉一门课的课件不会删它的速查表；删掉 App 就全删了。 用了 iCloud 同步的话，同步的副本留在你自己的 iCloud 里，直到你自己删掉（见第 2 节）。 免费试用用的文档指纹表在创建 12 个月后删除（大陆服务器每日备份里的副本最多再留 14 天）。按日计数——按你 IP 的加密哈希归档的，以及订阅用户课上功能的按日次数（以订阅凭证或交易 ID 的单向哈希、或某节课随机 ID 的哈希归档）——只有一个次数，最后一次更新两天后删除（大陆服务器每日备份里的副本最多再留 14 天）。2026 年 10 月 5 日以前在 Cloudflare 上记的计数只有次数、按单向标识归档，不会删除；大陆服务器上的已经删掉。额度余额——以安装标识或订阅交易 ID 为键——会一直保留，直到你来信要求删除， 因为同一份试用或同一笔购买不被重复计算就靠它。 用量记录（见第 3 节）在 Cloudflare 保留约 90 天，之后自动从统计库里滚出去；大陆服务器上的那份在系统日志里， 会自动轮换清理。大陆服务器的网页服务访问日志（见第 3 节）约 10 天后删除。 这个安装标识存在 iOS 钥匙串里，也就是说它删掉 App 再重装依然存在—— 这是故意的，也是唯一挡得住同一台设备反复领免费试用的东西。抹掉设备会清掉它。 它是一个随机值，不由你的设备、Apple ID 或任何和你有关的东西推导出来，我们也不会用它去查你是谁。 按 Apple「App 隐私」的定义，这些数据仍标为「与你关联」，因为我们的额度和用量记录以这个标识和你订阅的交易 ID 为键—— 虽然我们并不知道你是谁。 发邮件给我们（见第 9 节），我们会删掉你的额度余额、免费试用的文档指纹表和后台生成任务。 用量记录没法单条删除，只能等它自己过期（Cloudflare 约 90 天，大陆服务器按日志轮换周期）， 大陆服务器每日备份里的副本在 14 天内过期。

8. 儿童

PageNote 面向高等教育和高中阶段的学生，不面向 13 岁以下（中国大陆为 14 岁以下）儿童， 也不会有意收集儿童的个人信息。

9. 你的权利

我们没有你的账号、姓名或邮箱，除非你给我们写信。我们持有的东西以随机安装标识或订阅交易 ID 为键：额度余额、免费试用的文档指纹表和用量记录（见第 3 节）；另有按你 IP 的加密哈希或订阅凭证哈希归档、只留两天（另加大陆备份）的按日计数（Cloudflare 上更早的计数只有次数，不会删除）。 会保存你内容的只有两处：你同意过的后台生成任务（最多 7 天，另加大陆备份），你可以在 App 里自己删除（「停止任务并删除云端副本」）； 以及「练习」出好的题（最多 15 分钟）。你 iCloud 里的副本归你自己管，不在我们这儿：同步开着时，在 PageNote 的设置里点「删除 iCloud 里的 PageNote 数据」； 已经关了的话，到系统设置 →（你的名字）→ iCloud → 管理储存空间里删除 PageNote。 想删掉任何服务端记录（用量记录除外，见第 7 节），或者你认为我们还持有其他与你相关的数据，发邮件到 terrygao907@gmail.com，我们会在 30 天内回复。 视你所在地区，你可能享有 GDPR、英国 GDPR、CCPA 或澳大利亚隐私法下的权利。

10. 变更

本政策若有实质变更，顶部的更新日期会随之变化，且新版本会在 App 内相应改动生效前 先发布在这里。