字由 隱私權政策
生效日期：2026 年 10 月 29 日
「字由」（英文名稱 Ziyou，舊名「九格輸入法」）由個人開發者 CHUN HAN HUANG（以下稱「我們」）開發，包含「字由」App 與它內建的 iOS 鍵盤。這份政策說明字由會處理哪些資料、存在哪裡、會不會離開你的手機，以及你可以怎麼控制。
重點摘要
- 鍵盤不記錄、不上傳你打的字。 選字學習、自訂詞、匯入的字根表都只存在你的手機上。只有你開啟「雲端 AI（測試）」並使用語音、翻譯或 ✦ 修正時，相關內容才會送出處理。
- 內建 AI 在手機上執行。 語音辨識和 AI 整理、翻譯、修正使用 Apple 的裝置端功能，不連網。
- 雲端語音只用來產生文字、不保留。 雲端 AI 預設關閉；開啟後，錄音經字由的中繼伺服器送去轉成文字，轉完就丟棄，中繼伺服器和我們都不保存錄音、逐字稿或 AI 的結果。
- 快捷鍵存在 iOS 鑰匙圈；你可以選擇用 iCloud 鑰匙圈在自己的裝置間同步（端對端加密，我們看不到）。
- 測試版使用統計只在 TestFlight 測試版，只有每天的次數和分鐘數，可以隨時關閉；App Store 正式版沒有這段程式。
- 沒有廣告、沒有追蹤、不販售任何資料。
1. 你打的字
- 字由鍵盤不會收集、記錄到伺服器或傳送你打的字，也不會把打字內容寫進診斷紀錄。
- 學習紀錄（選過的詞、常接在一起的詞、字根選字等）存在鍵盤自己的儲存空間；開啟「允許完整取用」時會複製一份到 App 與鍵盤共用的 App Group 空間，讓 App 能顯示與清除，也讓語音辨識更認得你常用的詞。這些資料都留在手機上。
- 自訂詞與匯入的字根表（.cin） 存在手機的 App Group 空間，不會上傳。
- iOS 在密碼等安全輸入欄位不允許第三方鍵盤，所以字由碰不到這些欄位。
- 這些資料可能包含在你自己的 iPhone 備份裡（由 Apple 或你的電腦處理）。
- 唯一的例外是你開啟「雲端 AI（測試）」時，詳見第 5 節。
2. 「允許完整取用」
iOS 規定鍵盤要開啟「允許完整取用」才能使用以下功能，字由只把它用在這些地方：
- App Group 共用空間：讀取你在 App 裡設定的主題、預設值、自訂詞、字根表，並同步學習紀錄。
- 快捷鍵：讀取你存在鑰匙圈裡的快捷鍵（第 4 節）。
- 語音輸入：鍵盤和字由 App 交換語音辨識的結果。
- 雲端 AI（測試）：只有你開啟並同意後，才會連到字由的中繼伺服器。
- 按鍵聲音與震動回饋。
開啟時 iOS 會顯示「完整取用可讓開發者傳送你輸入的內容」，這是 iOS 對所有第三方鍵盤的統一提醒。除了第 5 節所說送給雲端 AI 處理的內容，字由不會傳送你打的字。不開完整取用，字由也能正常打字、選字和學習。
3. 語音輸入與內建 AI
- 只有按下鍵盤上的 🎤 後才會錄音；語音待命時狀態列或動態島會顯示麥克風圖示。
- 語音辨識使用 Apple 的裝置端語音辨識，並要求在裝置上完成。
- AI 整理、✦ 修正、翻譯和智慧排序使用 Apple Foundation Models（Apple Intelligence 的裝置端模型），在手機上處理、不連網。
- 字由不保存錄音。
- 語音歷史紀錄（預設關閉）：只有你自己開啟後，才會把辨識和整理後的文字存在這支手機（iOS 檔案加密保護），不會上傳；超過你選的保留天數（1、7 或 30 天）自動刪除，可以單筆或全部刪除，關閉時立刻全部刪除。
4. 快捷鍵與 iCloud 鑰匙圈
- 你建立的快捷鍵（常用語、地址等）存在 iOS 鑰匙圈，App 與鍵盤共用；打開快捷鍵選單或編輯頁前要先用 Face ID／Touch ID 或密碼驗證。
- 「iCloud 同步」預設開啟：快捷鍵透過 Apple 的 iCloud 鑰匙圈在你登入同一個 Apple 帳號的裝置間同步，由 Apple 端對端加密，我們沒有辦法讀取。
- 關閉同步後，快捷鍵改存為「只限這支手機」，不會離開這台裝置。
5. 雲端 AI（測試）
雲端 AI 是給受邀使用者的功能，預設關閉。只有同時符合以下條件才會使用：已輸入邀請碼（或未來的訂閱）、你在同意畫面按下「同意並開啟」、手機有網路、當天額度還沒用完。任何一項不符合，字由都會自動改用手機上的內建 AI。
會送出什麼
- 你按 🎤 之後說的話（錄音檔）、辨識語言、錄音秒數。
- 轉文字用的提示詞：字由固定的用語，以及從游標前後文字挑出的最多 20 個詞。
- 整理用的內容：轉出來的文字、游標前最多 300 字與游標後最多 100 字（只當參考），以及整理指示（包含你自己寫的自訂指示）。
- 翻譯與 ✦ 修正：你要翻譯或修正的文字、目標語言和固定的任務指示；語音與 ✦ 修正時也會送出判斷同音字和改口用的簡短問題。平常打字和智慧排序不會送出。
- 你的邀請碼（用來確認身分和計算額度）和每次請求的隨機編號。
送到哪裡、怎麼處理
- 以 HTTPS 送到字由在 Cloudflare Workers 上的中繼伺服器，再轉送到 OpenAI 的 API 處理。App 裡沒有 OpenAI 金鑰。
- 錄音只用來產生文字、不保留：中繼伺服器不保存錄音、逐字稿、前後文或 AI 的輸出；App 上傳用的暫存音檔上傳後就刪除。依 OpenAI 的 API 資料說明，語音轉文字不保留內容。
- 整理、翻譯和修正的文字：送出時設定不儲存（
store: false）；OpenAI 為了防止濫用，可能把請求與回覆保留最多 30 天後刪除，且不會用來訓練模型。OpenAI 的處理以 OpenAI 政策為準。
- Cloudflare 為了傳送網路流量會處理你的 IP 位址；中繼伺服器不保存 IP。
中繼伺服器保存什麼
- 邀請碼紀錄：只存邀請碼的 SHA-256 雜湊值，以及發碼時取的名稱、每日額度、建立時間和是否停用。
- 每日用量：每個邀請碼每天的次數、秒數、字數和音檔大小（只有數字），用來計算額度，保留 31 天後自動刪除。
- 運作紀錄：只有數字和短編號，存在 Cloudflare Workers Logs，最多 7 天。
撤回同意：在 App 的「語音輸入」設定頁進入「雲端 AI（測試）」，關閉「使用雲端 AI」即可，之後全部只在手機上處理；也可以選「撤回同意並移除邀請碼」。邀請碼存在這支手機的鑰匙圈。
6. 測試版使用統計（只在 TestFlight 測試版）
這個功能只編譯進 TestFlight 測試版，執行時也會再確認是 TestFlight 安裝；App Store 正式版完全不包含這段程式。
- 會送出：隨機安裝編號（不是裝置識別碼，重裝就換新）、App 建置編號、最近最多 7 天每天的語音輸入秒數與次數、✦ 修正與翻譯次數；最多每小時送一次。
- 不會送出：任何你說的話、打的字或其他內容。
- 有用雲端 AI 時，統計會連到邀請碼的名稱。伺服器保留 31 天。
- 可以在第一次的說明畫面或「設定」裡隨時關閉，關閉後手機上的次數也會刪除。
7. 購買與訂閱
- 字由的所有輸入方式和內建 AI 目前都免費、不限次數。未來可能提供以下付費項目，都透過 Apple 的 App 內購買（App Store）：
- 快捷鍵買斷：一次購買，永久解鎖快捷鍵相關的進階功能。
- 雲端語音／AI 訂閱：使用雲端 AI（語音轉文字、整理、翻譯、✦ 修正）的訂閱方案。
- 付款全部由 Apple 處理，我們不會取得你的姓名、電子郵件、信用卡或其他付款資料。App 在手機上透過 Apple 的 StoreKit 確認購買與訂閱狀態。
- 雲端 AI 訂閱上線後，中繼伺服器需要確認訂閱是否有效，只會使用 Apple 提供的交易識別資訊（不含個人身分）來對應額度與用量。實際做法上線前會更新在這份政策裡。
8. 我們不做的事
- 不放廣告、不使用第三方分析或追蹤 SDK、不跨 App 或網站追蹤你。
- 不販售、出租或交換任何資料。
- 除了上面寫到的 Apple、Cloudflare 和 OpenAI，不會把資料交給其他人，除非法律要求。
9. 資料保存一覽
| 資料 |
存在哪裡 |
保留多久 |
| 學習紀錄、自訂詞、字根表、設定 |
你的手機 |
直到你清除或刪除 App |
| 快捷鍵 |
你的手機鑰匙圈（開同步時也在你的 iCloud 鑰匙圈） |
直到你刪除 |
| 語音歷史紀錄（預設關閉） |
你的手機（加密保護） |
你選的 1／7／30 天 |
| 錄音、逐字稿、AI 結果 |
不保存 |
— |
| 邀請碼（雜湊值與名稱） |
字由中繼伺服器 |
直到停用或移除 |
| 雲端 AI 每日用量（只有數字） |
字由中繼伺服器 |
31 天 |
| 中繼伺服器運作紀錄（只有數字） |
Cloudflare Workers Logs |
最多 7 天 |
| 雲端整理、翻譯、修正的文字 |
OpenAI 濫用監控紀錄 |
最多 30 天（依 OpenAI 政策） |
| 測試版使用統計（只限 TestFlight） |
字由中繼伺服器 |
31 天 |
要求提早刪除：來信附上你的邀請碼或測試版的安裝編號，我們會刪除伺服器上對應的紀錄。OpenAI 保留的資料依 OpenAI 的政策處理。
10. 兒童
字由不是為 13 歲以下兒童設計的服務，我們不會刻意收集兒童的個人資料。如果你認為孩子透過字由提供了個人資料，請和我們聯絡。
11. 資料安全與跨境傳輸
- 所有連線都使用 HTTPS；OpenAI 金鑰只存在伺服器。
- Cloudflare 和 OpenAI 可能在你所在國家以外（包含美國）處理資料。
12. 政策變更
功能調整時我們會更新這份政策和上方的生效日期。如果雲端 AI 送出的內容有重大改變，App 會請你重新同意。
13. 聯絡我們
對這份政策或你的資料有任何問題，請來信：ziyoukeyboard@gmail.com
開發者：CHUN HAN HUANG（個人開發者）
Ziyou Privacy Policy
Effective date: October 29, 2026
Ziyou (字由, formerly “NineGrid / 九格輸入法”) is developed by independent developer CHUN HAN HUANG (“we”). It consists of the Ziyou app and its built-in iOS keyboard. This policy explains what data Ziyou handles, where it is stored, whether it leaves your phone, and how you control it.
Summary
- The keyboard does not log or upload what you type. Learning data, custom words and imported input tables stay on your phone. Content is sent for processing only when you turn on “Cloud AI (beta)” and use voice input, translation or ✦ Fix.
- Built-in AI runs on your phone. Speech recognition and AI cleanup, translation and fixes use Apple's on-device features and work offline.
- Cloud voice is used only to produce text and is not kept. Cloud AI is off by default. When on, your recording goes through Ziyou's relay server to be transcribed and is discarded right after; neither the relay nor we keep recordings, transcripts or AI output.
- Shortcuts are stored in the iOS Keychain; you can sync them between your own devices with iCloud Keychain (end-to-end encrypted — we cannot see them).
- Beta usage stats exist only in TestFlight builds, contain only daily counts and minutes, and can be turned off. The App Store version does not contain this code.
- No ads, no tracking, and we never sell data.
1. What you type
- The Ziyou keyboard does not collect, log to a server, or transmit what you type, and does not write typed text into diagnostic logs.
- Learning data (words you picked, words you often type together, table selections, etc.) is stored in the keyboard's own storage. With Full Access on, a copy is kept in the App Group shared by the app and keyboard so the app can show and clear it and voice recognition can recognize your common words. It all stays on your phone.
- Custom words and imported input tables (.cin) are stored in the App Group on your phone and are never uploaded.
- iOS does not allow third-party keyboards in secure fields such as passwords, so Ziyou never sees them.
- This data may be included in your own iPhone backups (handled by Apple or your computer).
- The only exception is when you turn on Cloud AI (beta); see Section 5.
2. “Allow Full Access”
iOS requires Full Access for the following features. Ziyou uses it only for:
- App Group storage: reading themes, defaults, custom words and input tables you set in the app, and syncing learning data.
- Shortcuts: reading the shortcuts you stored in the Keychain (Section 4).
- Voice input: exchanging recognition results between the keyboard and the Ziyou app.
- Cloud AI (beta): connecting to Ziyou's relay server, only after you turn it on and agree.
- Key sounds and haptic feedback.
iOS shows the message that Full Access “allows the developer to transmit anything you type” for every third-party keyboard. Apart from content sent to Cloud AI as described in Section 5, Ziyou never transmits what you type. Ziyou works for typing, candidates and learning without Full Access.
3. Voice input and built-in AI
- Recording only starts after you tap 🎤 on the keyboard; a microphone indicator is shown while voice is on standby.
- Speech recognition uses Apple's on-device recognizer and is required to run on device.
- AI cleanup, ✦ Fix, translation and smart ranking use Apple Foundation Models (Apple Intelligence's on-device model) and run offline on your phone.
- Ziyou does not store recordings.
- Voice history (off by default): only if you turn it on, recognized and cleaned-up text is stored on this phone (protected by iOS file encryption) and never uploaded. It is deleted automatically after the period you choose (1, 7 or 30 days); you can delete single entries or everything, and turning it off deletes everything immediately.
4. Shortcuts and iCloud Keychain
- Shortcuts you create (phrases, addresses, etc.) are stored in the iOS Keychain, shared by the app and keyboard. Opening the shortcut menu or editor requires Face ID / Touch ID or your passcode.
- “iCloud Sync” is on by default: shortcuts sync through Apple's iCloud Keychain to devices signed in to the same Apple Account, end-to-end encrypted by Apple. We cannot read them.
- With sync off, shortcuts are stored “this device only” and never leave the phone.
5. Cloud AI (beta)
Cloud AI is for invited users and is off by default. It is used only when all of these are true: you entered an invite code (or, in the future, have a subscription), you tapped “Agree and turn on” on the consent screen, you are online, and you have quota left for the day. Otherwise Ziyou automatically uses the built-in AI on your phone.
What is sent
- What you say after tapping 🎤 (the recording), the recognition language and the recording length.
- Transcription hints: fixed app terms and up to 20 words picked from the text around the cursor.
- For cleanup: the transcribed text, up to 300 characters before and 100 after the cursor (as reference only), and cleanup instructions (including your own custom instructions).
- For translation and ✦ Fix: the text you choose to translate or fix, the target language and fixed task instructions; voice input and ✦ Fix may also send short questions used to resolve homophones and self-corrections. Normal typing and smart ranking are never sent.
- Your invite code (to verify access and count quota) and a random ID for each request.
Where it goes and how it is handled
- Data is sent over HTTPS to Ziyou's relay on Cloudflare Workers, which forwards it to the OpenAI API. The app contains no OpenAI key.
- Recordings are used only to produce text and are not kept: the relay does not store recordings, transcripts, context or AI output, and the app deletes its temporary upload file right after uploading. According to OpenAI's API data controls, transcription content is not retained.
- Text for cleanup, translation and fixes is sent with storage disabled (
store: false). For abuse monitoring, OpenAI may keep requests and responses for up to 30 days before deletion and does not use them for training. OpenAI's handling is governed by OpenAI's policies.
- Cloudflare processes your IP address to deliver traffic; the relay does not store IP addresses.
What the relay stores
- Invite code records: only a SHA-256 hash of the code, plus the label given when it was issued, the daily quota, creation time and whether it is disabled.
- Daily usage: per code per day, counts, seconds, character counts and audio sizes (numbers only), used for quota and deleted automatically after 31 days.
- Operational logs: numbers and short IDs only, in Cloudflare Workers Logs, kept up to 7 days.
Withdrawing consent: open “Cloud AI (beta)” from the app's Voice Input settings and turn off “Use cloud AI”; everything then stays on your phone. You can also choose “Withdraw consent and remove invite code”. The invite code is stored in this phone's Keychain.
6. Beta usage stats (TestFlight builds only)
This feature is compiled only into TestFlight builds and also checks at runtime that the app was installed from TestFlight. The App Store version does not contain this code at all.
- Sent: a random install ID (not a device identifier; it changes when you reinstall), the build number, and for up to the last 7 days the daily voice input seconds and counts and ✦ Fix / translation counts; at most once an hour.
- Never sent: anything you said, typed or other content.
- If you use Cloud AI, stats are linked to your invite code's label. The server keeps them for 31 days.
- You can turn this off on the first-run notice or anytime in Settings; turning it off also deletes the counts stored on your phone.
7. Purchases and subscriptions
- All input methods and the built-in AI in Ziyou are currently free and unlimited. In the future we may offer the following paid options, all through Apple In-App Purchase (App Store):
- Shortcuts lifetime unlock: a one-time purchase that permanently unlocks advanced shortcut features.
- Cloud voice / AI subscription: a subscription for Cloud AI (transcription, cleanup, translation and ✦ Fix).
- All payments are handled by Apple. We never receive your name, email, card or other payment details. The app checks purchase and subscription status on your phone with Apple's StoreKit.
- Once the Cloud AI subscription launches, the relay will need to check that a subscription is active. It will only use transaction identifiers provided by Apple (which do not identify you personally) to match quota and usage. We will update this policy with the details before launch.
8. What we don't do
- No ads, no third-party analytics or tracking SDKs, no tracking across apps or websites.
- We never sell, rent or trade any data.
- We share data with no one other than Apple, Cloudflare and OpenAI as described above, unless required by law.
9. Data retention at a glance
| Data |
Where |
How long |
| Learning data, custom words, input tables, settings |
Your phone |
Until you clear them or delete the app |
| Shortcuts |
Your phone's Keychain (and your iCloud Keychain if sync is on) |
Until you delete them |
| Voice history (off by default) |
Your phone (encrypted) |
1 / 7 / 30 days, your choice |
| Recordings, transcripts, AI output |
Not stored |
— |
| Invite codes (hash and label) |
Ziyou relay |
Until disabled or removed |
| Cloud AI daily usage (numbers only) |
Ziyou relay |
31 days |
| Relay operational logs (numbers only) |
Cloudflare Workers Logs |
Up to 7 days |
| Cloud cleanup / translation / fix text |
OpenAI abuse-monitoring logs |
Up to 30 days (per OpenAI policy) |
| Beta usage stats (TestFlight only) |
Ziyou relay |
31 days |
Early deletion: email us with your invite code or your beta install ID and we will delete the matching records on the server. Data kept by OpenAI is handled under OpenAI's policies.
10. Children
Ziyou is not designed for children under 13, and we do not knowingly collect children's personal information. If you believe a child has provided personal information through Ziyou, please contact us.
11. Security and international transfers
- All connections use HTTPS; the OpenAI key exists only on the server.
- Cloudflare and OpenAI may process data outside your country, including in the United States.
12. Changes to this policy
We will update this policy and the effective date above when features change. If what Cloud AI sends changes significantly, the app will ask for your consent again.
13. Contact
Questions about this policy or your data: ziyoukeyboard@gmail.com
Developer: CHUN HAN HUANG (independent developer)