Wanderobe（"本应用"）由其开发者（以下称"我们"）开发并运营。本政策说明我们如何收集、 使用、存储、共享和保护你的个人信息，以及你享有的权利。请在使用前仔细阅读。 本应用可选择通过 Apple 登录（仅用于行程协作身份识别），不收集姓名、手机号、邮箱等身份信息，不接入任何广告或追踪 SDK，不会出售你的个人信息。
我们仅为实现以下业务功能、在你授权的范围内处理对应信息：
| 业务功能 | 处理的信息 | 说明 |
|---|---|---|
| 形象照 / 虚拟试穿 | 你拍摄或选取的人物照片（含人脸）、衣物照片 | 见第 2 节敏感信息特别说明 |
| 行程生成 / 穿搭推荐 | 目的地、日期、旅行风格、衣物名称与类别 | 文本，用于生成行程与推荐 |
| 当地天气 | 精确位置（经纬度，需授权） | 见第 2 节；见第 4 节出境说明 |
| 景点配图 | 地点名称 | 用于检索景点图片 |
| 防滥用与安全 | 设备标识（本机随机 UUID，非 IDFA）、IP 地址 | 仅用于服务端限流与安全，不关联身份、不用于广告 |
| 产品改进分析 | 匿名安装 ID、会话 ID、App 版本、系统版本、语言地区、页面访问与功能事件 | 用于统计激活安装、活跃、留存与功能漏斗；可在设置中关闭，不包含照片、姓名、prompt、精确位置或详细地址 |
| 订阅会员 | Apple 内购的订阅有效状态 | 支付由 Apple 处理，我们不接触你的支付信息 |
| 行程协作 | Apple 用户标识（匿名 sub，Apple 生成）；行程快照与操作日志 | 仅用于共享行程同步；可选，不使用则不收集；注销账号时从服务器删除；解散行程（停止共享）后其他成员不再可访问 |
以下属于敏感个人信息，我们会在收集前以单独同意的方式取得你的授权，你可随时拒绝 或撤回（拒绝后仅影响相应功能，不影响其他功能使用）：
为实现功能，部分信息会委托以下第三方处理（仅限实现对应功能所必需，受协议约束）：
| 接收方 | 处理的信息 | 目的 | 隐私政策 |
|---|---|---|---|
| 火山引擎（北京火山引擎科技） | 人物/衣物照片 | 形象照、虚拟试穿图像生成 | 链接 |
| 深度求索 DeepSeek | 行程/衣橱文本、地点名称 | 行程生成、穿搭推荐、地名解析 | 链接 |
| Apple 天气（WeatherKit） | 精确经纬度 | 获取当地天气 | 链接 |
| 维基共享资源 Wikimedia Commons | 地点名称 | 检索景点图片 | 链接 |
| Apple | 内购交易 | 处理订阅与支付 | 链接 |
| 我们自建的埋点服务 | 匿名安装 ID、会话 ID、版本/系统信息、页面访问与功能事件 | 产品统计、留存与漏斗分析 | 本政策 |
我们的服务器对发往火山引擎、DeepSeek 的请求仅做转发，不存储你的照片；开启协作的行程，其行程内容（快照与编辑操作日志）会保存在我们的服务器，用于多设备/多成员同步；注销账号时删除；解散行程（停止共享）后行程回归创建者个人同步，其他成员不再可访问。服务端日志仅记录请求的时间、路径、状态码与 IP（用于运维与限流），不记录请求内容。产品分析事件仅记录匿名事件名与非敏感属性，不记录照片、prompt 原文、姓名、精确位置或详细地址。我们不会转让或公开披露你的个人信息，法律法规另有规定或经你单独同意的除外。
当地天气由 Apple 天气（WeatherKit）提供。为获取天气，精确位置（经纬度）会发送给 Apple；Apple 不会将其与你的身份关联，仅用于返回天气。该处理可能涉及个人信息出境，我们 会在收集精确位置时一并取得你对此的单独同意。火山引擎、DeepSeek 均在中国境内，不涉及 出境。
依据《个人信息保护法》，你享有对个人信息的查阅、复制、更正、补充、删除以及撤回同意的权利：
本应用不面向不满 14 周岁的儿童，也不会有意收集儿童个人信息。若你为未成年人，请在 监护人同意并指导下使用。
本应用不使用 Cookie，也不接入任何第三方分析、追踪或广告类 SDK。本应用会使用自建的一方产品分析服务统计匿名使用情况，帮助我们改进功能；你可在应用设置中关闭。
我们可能适时更新本政策，更新后修订上方"更新日期"。涉及敏感信息或共享等重大变更时， 我们会在应用内显著告知并在必要时重新征得你的同意。
Wanderobe ("the App") is developed and operated by its developer ("we"). This policy explains how we collect, use, store, share, and protect your personal information, and your rights. The App optionally uses Sign in with Apple for trip-collaboration identity only; it does not collect your name, phone, or email, integrates no advertising or tracking SDK, and does not sell your personal information.
We process information only to provide these features, within the scope you authorize:
| Feature | Information | Notes |
|---|---|---|
| Avatar / virtual try-on | Person photos (including faces), clothing photos | See §2 (sensitive) |
| Itinerary / outfit rec | Destinations, dates, travel styles, item names/categories | Text, for generation |
| Local weather | Precise location (with permission) | See §2 and §4 (cross-border) |
| Place photos | Place names | To retrieve images |
| Abuse prevention | Device ID (on-device random UUID, not IDFA), IP | Server-side rate-limiting/security only; not linked to identity, not for ads |
| Product analytics | Anonymous install ID, session ID, app version, OS version, locale, screen views and feature events | Activated installs, activity, retention, and funnels; can be disabled in Settings; excludes photos, names, prompts, precise location, and exact addresses |
| Subscription | Apple IAP entitlement status | Payment handled by Apple; we never see payment data |
| Trip collaboration | Apple user identifier (anonymous sub, Apple-generated); trip snapshots and operation logs | Used only for shared-trip sync; optional — not collected if you don't use collaboration; deleted from server on account deletion; on trip dissolution (stop sharing) other members lose access |
The following are sensitive personal information; we obtain your separate consent before collection, which you may decline or withdraw at any time (declining affects only the related feature):
To provide features, some information is entrusted to these third parties (only as necessary, under contract):
| Recipient | Information | Purpose | Privacy policy |
|---|---|---|---|
| Volcengine (Beijing Volcano Engine) | Person/clothing photos | Avatar, try-on image generation | link |
| DeepSeek | Trip/wardrobe text, place names | Itinerary, outfit rec, place resolution | link |
| Apple Weather (WeatherKit) | Precise coordinates | Local weather | link |
| Wikimedia Commons | Place names | Place photos | link |
| Apple | IAP transaction | Subscriptions & payment | link |
| Our first-party analytics service | Anonymous install ID, session ID, version/device context, screen views and feature events | Product analytics, retention, and funnels | This policy |
Our server only forwards requests to Volcengine and DeepSeek and does not store your photos; for trips with collaboration enabled, trip content (snapshots and the operation log) is stored on our server for multi-device/multi-member sync and is deleted on account deletion; trip dissolution (stop sharing) returns the trip to the owner for personal sync while other members lose access. Server logs record only request time, path, status, and IP (for ops and rate-limiting), never request bodies. Product analytics events record only anonymous event names and non-sensitive properties, not photos, prompt text, names, precise location, or exact addresses. We do not transfer or publicly disclose your personal information except as required by law or with your separate consent.
Local weather is provided by Apple Weather (WeatherKit). To fetch weather, precise location (coordinates) is sent to Apple; Apple does not associate it with your identity and uses it only to return weather. This processing may involve a cross-border transfer, and we obtain your separate consent for it when collecting precise location. Volcengine and DeepSeek are within China and involve no cross-border transfer.
Your photos, trips, and wardrobe data live primarily on your device and are removed when you delete in-app content or uninstall. Our server does not persist your photos; for trips with collaboration enabled, trip snapshots and operation logs are stored on our server for sync and deleted on account deletion; trip dissolution (stop sharing) returns the trip to the owner, revoking others' access. Operational logs (IP, etc.) are kept briefly for security and rate-limiting, then purged. All traffic uses HTTPS/TLS; provider API keys live only on the server and are never shipped to the client. No method is 100% secure.
Under China's PIPL you may access, copy, correct, supplement, delete, and withdraw consent for your personal information: delete in-app content or uninstall to clear local data; disable camera/photo/location permissions in Settings to withdraw consent; turn off "Help improve product" in the App's Settings to stop non-essential product analytics; contact us at the email below for other requests. Account deletion: if you signed in with Apple, go to Settings → Delete Account — the server will delete your shared trips (snapshots and operation logs) and remove your member records and display name from others' shared trips; your historical edits in those trips (linked by a pseudonymous Apple-assigned identifier) are retained with those trips and deleted when the trip is dissolved. Local data remains on your device after deletion; uninstalling removes it.
The App is not directed to children under 14 and does not knowingly collect their personal information.
The App uses no cookies and integrates no third-party analytics, tracking, or advertising SDK. It uses a first-party analytics service for anonymous product usage statistics, which you can disable in the App's Settings.
We may update this policy; the "Last updated" date will change. For material changes (e.g., sensitive data or sharing), we will prominently notify you in-app and re-obtain consent where required.