适用于含可选 iCloud 同步、附件按需下载和可选本地 AI 的 WorkList 版本。iCloud 同步与本地 AI 均默认关闭，由用户主动开启。
1. 说明范围
本说明用于解释 WorkList 在用户使用项目管理、工作记录、成果附件、导出、备份和恢复等功能时如何处理数据。用户通过微信、邮件、隔空投送、系统文件、云盘或其他第三方服务处理数据时，还受对应服务的隐私政策与条款约束。
2. 基本原则
WorkList 采用本地优先设计，不要求注册 WorkList 账户。iCloud 同步默认关闭，用户可在设置中主动选择手动或自动同步。开启后，已保存工作、项目组、分类和附件通过 Apple CloudKit 在同一 Apple 账户的设备间同步；不上传到开发者服务器。不包含广告 SDK、第三方行为统计 SDK 或跨 App 追踪。
3. 用户创建的数据
用户可保存项目名称、工作对象、备注、标识颜色、置顶状态、工作名称、分类、内容、起止时间、工时设置、成果文件名、主动添加的文件和图片，以及从其他 App 分享的待归档文件。这些数据用于本地记录、搜索、统计、归档、导出、备份和恢复。
4. 设置与文件属性
WorkList 会保存界面风格、分类和首次使用状态等必要设置。为执行附件导入、整理、备份和导出，App 可能读取用户所选文件的名称、格式、大小、路径关系和文件时间等必要属性。
5. 数据存储位置
工作记录与附件名称保存在本机，可离线查看。导入或下载的文件保存在 App 沙盒中。开启 iCloud 后，同步内容及用于合并恢复的版本历史存入 Apple CloudKit 私有数据库，占用该 Apple 账户的 iCloud 空间。按需模式在其他设备仅保存附件信息，点击下载后才保存文件；自动下载模式会在同步时下载当前工作缺少的附件。本机已有文件不会因开启同步或改为按需下载而自动删除。草稿、待归档文件、导出文件、本地备份、主题及下载偏好不参与 WorkList 的 iCloud 同步；系统整机备份或用户另存至云盘属于另外的服务。
6. 系统权限
使用系统文件选择器时，WorkList 仅按系统授权访问用户主动选择的文件；使用照片选择器时，仅处理用户选择并确认导入的图片；通过系统分享时，App 仅接收或传递用户主动指定的文件。
7. 数据使用目的
数据用于记录、搜索、工时汇总、附件整理、导出、备份和恢复。用户开启同步后，还用于跨设备更新、识别重复上传、处理并行修改和保留恢复版本。App 保存必要的账户关联标识、设备同步标识、文件校验值与同步状态。手动模式由用户触发同步；自动模式在保存、回到前台及前台约每分钟尝试检查，不保证后台或实时完成。每台设备可独立设置同步方式及附件下载方式。关闭同步停止后续同步，不撤回已上传内容。
8. 不主动收集的信息
WorkList 不主动收集账号密码、精确位置、通讯录、广告标识符或跨 App 行为。关闭同步时，工作数据默认保存在本机。用户开启 iCloud 后，工作数据、附件及用于合并和恢复的版本记录会上传至其 iCloud 私有数据库。App 仅保存必要的账户关联标识和同步状态，不读取 Apple 账户密码。
9A. 可选本地 AI
本地 AI 默认关闭，使用 Qwen3-1.7B 4-bit 文字模型，不具备图像生成能力。用户主动下载约 1 GB 模型文件时，App 可按设备地区选择腾讯云 model.hlplan.cn 或 Hugging Face，用户也可手动指定来源。文件提供方可能依其政策处理 IP 地址、请求时间、设备或网络类型等常规连接与日志信息；工作记录、对话内容和成果附件不会随模型下载请求上传。模型保存在 App 本机存储中，文字推理在设备内完成；预加载只改变内存占用，不改变数据去向。AI 对话记录保存在本机，不参与 WorkList iCloud 同步，可单条、批量删除或清空。卸载 App 通常会删除本机模型和对话记录。用户主动分享生成文件后，接收服务按其政策处理文件。
10. 备份与恢复
完整备份可能包含个人、客户、商业信息及全部关联附件，备份包没有额外的密码加密功能，应保存到可信且受保护的位置。本机恢复备份可能只保存尚未下载附件的云端引用，依赖原 Apple 账户取回文件；异常附件修复快照仅保存索引。备份与快照保存在本机，不通过 WorkList 同步上传；用户另行分享或系统备份的处理受对应服务规则约束。
11. 数据删除
用户可删除项目组、工作、附件关联和分类。为支持恢复，本地完整备份、已保留附件和同步版本可能继续存在；开启同步后删除标记也会同步，遇到并行修改会保留版本供恢复。关闭同步不删除本地或云端内容。卸载 App 通常删除本机沙盒，但不等于删除 iCloud 数据；云端数据可通过系统 iCloud 储存空间管理，外部备份和导出副本需单独管理。
12. 数据安全
WorkList 使用系统沙盒与文件访问机制，并对传输附件进行文件校验。保护设备、Apple 账户和外部备份仍很重要；同步或校验不保证数据永不损坏或丢失。网络中断、空间不足、账户变化及文件不可读可能暂停操作。当前没有自动清理本机附件缓存或一键清空全部同步历史的功能。涉及敏感资料时，请先确认你有权进行本地处理、云端存储和分享。
13. 保留期限
工作数据不保存在开发者服务器。开启同步后，iCloud 私有数据库会保留工作数据及恢复历史，关闭同步不会自动清空。为避免历史设备重新连接造成数据损失，当前版本不会自动清理同步版本历史。独立备份与导出文件由用户自行保管和管理。
14. 未成年人
WorkList 是通用工作效率工具，不以未成年人为主要服务对象，也不主动收集用于识别未成年人的账号信息。未成年人如需使用，应在监护人指导下进行，并避免保存无权处理的个人信息或敏感资料。
15. 更新与联系
如功能、数据处理方式或适用要求发生变化，本说明可能更新，并在 App、产品页面或其他适当位置公布更新日期。如有疑问，请通过 App Store 产品页面公布的开发者联系方式反馈，并避免直接发送未脱敏的完整备份或成果附件。
94213208@qq.com
更新日期：2026年9月16日
Applies to WorkList versions offering optional iCloud sync, on-demand attachments, and optional on-device AI. iCloud sync and on-device AI are off by default and enabled by the user.
1. Scope
This notice explains how WorkList processes data used for projects, records, attachments, exports, backups, and restoration. Data handled through WeChat, Mail, AirDrop, Files, cloud drives, or other services is also governed by those services' terms and privacy policies.
2. Principles
WorkList is local-first and requires no WorkList account. iCloud sync is off by default and can be enabled in manual or automatic mode. Saved records, projects, categories, and attachments then sync through Apple CloudKit between devices using the same Apple Account, without upload to developer servers. There are no advertising SDKs, third-party behavior analytics, or cross-app tracking.
3. User-Created Data
Users may store project names, work subjects, notes, colors, pin status, record titles, categories, details, times, duration preferences, deliverable names, selected files and photos, and pending files shared from other apps. This data supports local recording, search, reporting, archiving, export, backup, and restore.
4. Settings and File Metadata
WorkList stores necessary preferences such as appearance, categories, and onboarding status. To import, organize, back up, and export attachments, it may read necessary metadata from selected files, including names, formats, sizes, path relationships, and timestamps.
5. Local and Cloud Storage
Work records and attachment names remain locally available offline. Imported and downloaded files reside in the app sandbox. Enabling iCloud stores synced content and recovery versions in an Apple CloudKit private database, using that Apple Account’s iCloud storage. On-demand mode retains attachment information on other devices until download is requested; automatic mode downloads missing current-work attachments during sync. Existing local files are not deleted when either setting changes. Drafts, pending files, exports, local backups, themes, and download preferences do not participate in WorkList sync. System device backups and user-selected cloud drives are separate services.
6. System Access
The file picker grants access only to files the user selects. The photo picker processes only confirmed selections. System sharing receives or sends only files the user actively designates.
7. Purposes and Sync Controls
Data supports recording, search, duration summaries, attachments, export, backup, and recovery. Optional sync also updates devices, identifies duplicate uploads, handles concurrent edits, and preserves recovery versions. Necessary account associations, device sync identifiers, file checksums, and sync state are stored. Manual sync is user-triggered; automatic mode attempts checks on save, foreground entry, and about once a minute while active, without guaranteed background or immediate completion. Sync and download preferences are per device. Turning sync off stops subsequent sync, without retracting uploaded content.
8. Data Not Proactively Collected
WorkList does not proactively collect passwords, precise location, contacts, advertising identifiers, or cross-app behavior. With sync off, work data stays local by default. Enabling iCloud uploads work data, attachments, and versions used for merging and recovery to the user’s private iCloud database. The app stores only necessary account association and sync state and does not read the Apple Account password.
9. Apple and Other Services
Apple provides iCloud; its accounts, storage, transmission, and service data handling are governed by Apple’s Privacy Policy and iCloud terms. WorkList does not read Apple Account passwords or upload work to developer-operated servers. System file and photo pickers provide selected-content access; cloud-file providers may download selections. Sharing passes files to the selected service. WorkList makes no claim of custom end-to-end encryption or a certified security level. Apple Privacy Policy: https://www.apple.com/legal/privacy/; iCloud terms: https://www.apple.com/legal/internet-services/icloud/.
9A. Optional On-Device AI
On-device AI is off by default and uses the Qwen3-1.7B 4-bit text model; it does not generate images. When the user requests the approximately 1 GB model download, the app can select Tencent Cloud at model.hlplan.cn or Hugging Face by device region, and the user can choose a source manually. The file provider may process ordinary connection and log data such as IP address, request time, and device or network type under its policy. Work records, chat content, and attachments are not sent with model-download requests. The model is stored in the app's local storage and inference runs on the device; preloading changes memory use only, not where content is processed. AI chat history stays local, is excluded from WorkList iCloud sync, and can be deleted individually, in batches, or cleared. Uninstalling the app normally removes the local model and chat history. Files the user shares are handled by the selected recipient service.
10. Backup Privacy
Full backups may contain personal, client, and business information and all linked attachments. Backup packages have no additional password-encryption feature; store them securely. Local recovery backups may contain only references for undownloaded files, requiring the original Apple Account. Attachment-repair snapshots contain indexes only. WorkList does not sync these backups or snapshots; user sharing and system backups are subject to their respective services.
11. Data Deletion
Users can delete projects, records, attachment associations, and categories. Full backups, retained attachments, and sync versions may remain for recovery. When sync is enabled, deletion markers also sync and conflicting versions remain recoverable. Turning sync off does not delete local or cloud data. Uninstalling normally removes the local sandbox but does not erase iCloud data. Manage cloud data through system iCloud storage settings and external backups and exports separately.
12. Security
WorkList uses system sandboxing and file access and checks attachment integrity. Protect devices, your Apple Account, and external backups; syncing and checksums do not guarantee against all loss or corruption. Network failures, storage limits, account changes, or unreadable files may pause operations. There is currently no automatic local attachment-cache eviction or one-click purge of all sync history. Confirm your authority to process, upload, and share sensitive material.
13. Retention
Work data is not stored on developer servers. When enabled, the private iCloud database retains work data and recovery history; turning sync off does not erase it. This version does not automatically prune sync history, protecting data when older devices reconnect. Users manage their independent backups and exports.
14. Minors
WorkList is a general productivity tool and is not directed primarily to minors. It does not proactively collect account data to identify minors. Minors should use it with guardian guidance and avoid storing personal or sensitive information they are not authorized to process.
15. Updates and Contact
This notice may be updated when functions, practices, or requirements change, with the date shown in the app or product page. Questions may be submitted through the developer contact listed on the App Store page. Avoid sending unredacted full backups or deliverables.
94213208@qq.com
Last updated: September 16, 2026