Privacy Policy (macOS)

1. Scope and operator

Operator

Shenyang Tdx Network Technology Co., Ltd.

Unified Social Credit Code

91210124088957535L

Contact email

tdxkefu@foxmail.com

This policy applies to the Tdx Teleprompter macOS app and our account services that you choose to use through it. Another platform's policy does not replace this version. Independent third-party services have their own privacy rules.

Personal information excludes anonymized information.

The app does not request all permissions at first launch. It requests access only when you start the related feature. Permissions and access are explained below:

• - Microphone: explicit tests or offline following, without saving/uploading audio.
• Files: read your selected model folder, SRT or TXT/Markdown/DOCX document for script import, risk detection or script cleanup, or images for local text recognition in the editor or standalone script import, and export TXT only to the destination you choose in the Save panel.
• - Account: necessary phone/authentication data and random installation ID on your request.
• - Private sync: Professional accounts sync text, formatting, outlines, hotwords and groups while the script list is active. You can pause it; cloud scripts are subject to content checks. Audio, video, reading positions and display settings are excluded. No analytics or replay.
• - Media to Script: read only your selected file, recognize ordered segments offline in a private temporary directory, then explicitly save/export corrections; audio and hotwords are not uploaded.

Granting access does not itself cause audio, images, or scripts to be uploaded. Refusing or disabling a permission affects only its related feature; other features remain available.

2. How we process information

We process information necessary for features you choose under lawful, fair, necessary and transparent principles. Basic local editing and constant-speed prompting require neither registration nor network access. Local restoration reads this app's container and Keychain without server authentication. Online account requests require purpose disclosure, necessary consent and your explicit action.

The local encrypted database stores script content and structure. Display/reading preferences contain no full script text or account tokens. Model sources are read only within the selected scope and are not deleted by import. There is no current product analytics, replay or automatic content upload.

3. Local content and speech-follow

Local content resides in this app's container. Pre-migration encrypted backups also remain there and need the original key; they are not external backups. The app does not automatically send scripts to iCloud. macOS or your backup/migration tools may process data according to their settings, which this app cannot control.

Speech-follow uses fixed, signed, bundled offline engines and verified model data on this Mac. Microphone capture starts only on your action; the current app does not save/upload audio or automatically retain session evidence. Import copies fixed model data, not new programs.

When script sync is available and your Professional membership is valid, scripts owned by your account sync automatically while Home is in the foreground, and active scripts without an account owner are enrolled. Sync includes text, titles, formatting, annotations, hotwords, and groups. Scripts and related text are uploaded to the account service and sent to Alibaba Cloud content moderation for risk checks. Approved documents are stored privately in mainland China for syncing between devices signed in to the same account; they are not published as public content. You can pause sync on this device without affecting local editing. Audio, video, reading progress, and display settings are excluded. Sync preserves outlines and supported ruby formatting. Moderation-provider calls depend on the current cloud-review setting; disabling cloud review does not bypass identity, eligibility, format validation or local preflight. No new sync is dispatched while editing, in another section, when the app is inactive, asleep, or after online consent is withdrawn. Accepted requests retain receipts for their original account and finish safely.

After you choose an SRT, the subtitle toolbox reads its bytes, file name, cues and timeline locally to produce a cleaned-script or original-text preview. The source is not modified or automatically uploaded. Input and results remain only in the current account workspace memory and are cleared on explicit discard, app exit or workspace replacement; a saved or exported preview may remain in that workspace for further processing. Copy writes to the system clipboard only on your action; other apps may read it under system rules, and this app does not poll it in the background. Export writes the displayed preview as TXT through the system Save panel. Saving a new script writes only to the local encrypted library, may use the source file name as its title, and follows local script deletion rules. Unsaved results require saving or explicit discard before leaving the section. Completed file or script writes are not undone by cancellation. No cloud subtitle recognition or automatic sync is performed.

Content risk detection runs locally after you type or paste text, select a local script, use the current editor draft, or choose a TXT, Markdown or DOCX file. It processes the selected file display name, extracted text, chosen scope, source positions and risk report. Source files are unchanged; this feature does not automatically create or overwrite scripts, upload content or write it to ordinary logs. Input, reports, filters and report-only ignores remain in current workspace memory. Editing input or starting a new scan invalidates the old report; closing an editor detection sheet, clearing input, exiting the app or replacing the workspace clears the corresponding state. The standalone tool may retain its result while navigating within the same workspace. Report-only ignores are not persistent whitelists and grant no future sync permission. Copy writes the report to the system clipboard only on your action, where other apps may read it under system rules. File access is released after the actual read/parse stack ends; no persistent file grant is stored. No online content detection is provided. Rule prompts and alternative wording require contextual human review and are not legal determinations or platform review guarantees.

After you explicitly choose TXT, Markdown or DOCX, editor document import processes its display name, text, supported formatting and outline locally and first shows a read-only preview. You may review heading identities and explicitly insert or replace the original selection, append, or replace all content. The current script stays unchanged before Apply and the source file remains read-only. Replacing all may remove hotwords no longer present in speakable text; the preview shows the count. Confirmed content enters the current draft, unified undo and existing automatic/manual save. Saved content follows local script retention rules and is not uploaded automatically. A suggested file name is used only in preview and does not automatically change the original title or group. Preview and review state remain in current-workspace memory and are cleared when the import sheet closes, the app exits or the workspace is replaced. Cancellation waits for actual reading and access release, stores no persistent file grant and scans no other files. It does not undo an already applied draft change or completed save; editor Undo can restore content. Annotation presets are stored separately in the local encrypted database for workspaces on this Mac. Custom items can be removed in preset management. They use no script quota, are not synced with scripts, and management does not rewrite previously inserted cues.

Image text import reads only image bytes and display names you explicitly choose in the system panel. ImageIO and Vision process dimensions, orientation and text locally. A batch is limited to 10 images, 30 MiB per image and 120 MiB in total. Oversized dimensions are rejected, long images may be scaled and tiled, and only the first frame of animated or multi-page images is recognized. Recognition may omit or misread text. You may reorder images, choose smart layout or original lines, and edit the result. Partial failures require explicit permission to use successful results only. Source images are unchanged; other images are not scanned. Images and recognized text are not uploaded or written to ordinary logs. Images, results and edits remain only in current-workspace memory. Unapplied results require explicit Apply or discard and are cleared when the import sheet closes, the app exits or the workspace is replaced. Cancellation waits for actual reading, recognition and file-access release and does not retry automatically. After explicit Apply, text enters the original script draft, unified undo and automatic/manual save. Saved content follows local script retention rules. The original title and group are not changed automatically; source images and persistent file grants are not saved. Replacing text may require manual hotword repair and may remove implied heading identities; a warning appears before Apply. Cancellation does not undo applied edits or completed saves; editor Undo can restore content.

After you explicitly choose a document, the standalone Import Script tool processes its display name, extracted text, supported formatting and outline on this Mac. You may edit the title and text, switch whitespace-cleanup variants that retain separate corrections, and choose a save group. The file name may be the default script title; you can edit it or leave it blank for a generated title. A title may reveal source information, so review it before saving. Source files are read-only. Document images and links are not loaded, and content is not uploaded or written to ordinary logs. Explicit Save, or a subsequent flow that requires saving first, writes the current correction snapshot as a new script in the local encrypted library, retaining its title, text, supported formatting, outline and group under local script retention/deletion rules. It does not overwrite the source or an existing script and does not sync automatically. An unknown save is reconciled using its original ID without automatically generating a new ID. Parsed input, the title and correction variants remain only in current-workspace memory. A saved preview may remain available in that workspace. Unsaved corrections require Save, explicit discard or cancelling departure; account operations require saving first. App exit, explicit discard, source replacement or workspace replacement clears the corresponding memory state. Cancelling a read waits for actual parsing and access release. Saves and reconciliation wait for actual results; completed script writes are not undone by cancellation or discard. Copy writes the current text to the system clipboard only on your action, where other apps may read it under system rules.

In standalone Import Script, Image Text reads only image bytes and display names you explicitly choose in the system panel. Dimensions, orientation and Vision text recognition are processed locally. A batch is limited to 10 images, 30 MiB each and 120 MiB in total. Long images may be scaled/tiled; only the first frame of animated or multi-page images is processed, and recognition may omit or misread text. You can reorder/remove images, review each failure and low-confidence result, and switch smart paragraphs, original lines and whitespace cleanup. Each combination retains separate corrections without recognizing again when switched. Reordering invalidates the old draft and partial-use permission. Partial failure requires explicit permission for this batch to use successful text only; total failure creates no empty script. The default title is 图片文稿 (Image Script), which can be edited or left blank for a generated title. Explicit Save, or a subsequent flow requiring saving first, retains only the current text, title and group as a new local script, without image attachments, image/text uploads or ordinary-log content. Unknown saves are reconciled by their original ID without automatically creating a different ID. Selected images remain only in current-workspace memory and may remain for recognition after page navigation or discarding the correction preview. Removing sources, switching source type, app exit or workspace replacement clears the corresponding image bytes. Correction and save retention follows standalone document import. Stop waits for actual recognition and task completion before releasing processing occupancy and does not retry automatically. Completed script saves are not undone by cancellation. Copy writes to the system clipboard only on your action.

Script Cleanup starts on your action with entered or pasted text, a selected TXT/Markdown/DOCX, a saved local script or the built-in example. It reads that input title, text and supported styles, outline and static cues. Hotwords are not copied from a library script, and source files/scripts are unchanged. Input titles and text can be corrected; a file name can provide a suggested title. After you choose Teleprompter or Standard cleanup, the fixed bundled CT-Transformer supplies local punctuation candidates while shared rules handle whitespace, broken line breaks, paragraphs and structure protection. Model output must pass insert-only punctuation checks and cannot delete or rewrite text. Model failure or invalid candidates restart basic rules from the same original input, with an explicit notice. If content or structure cannot be retained completely, the whole original or safe formatting is retained with a warning. Punctuation may be incorrect; review the original, organized text and comparison. Input, title, source display name, preset and result remain only in current-workspace memory and may remain after saving for review. Replacing the source, clearing, explicitly discarding on departure, app exit or workspace replacement clears the corresponding content. Explicit Save, or a subsequent flow requiring saving first, organizes unprocessed input locally with the current preset, then retains only the organized title, text, structure and selected group as one new local script. It creates no separate original-input copy and copies no file attachments or hotwords. Unknown saves reconcile the original ID without automatically generating a different one; quota or known failure retains input/results for an explicit retry. Copy writes organized text to the system clipboard only on your action. TXT export atomically writes only organized text as UTF-8 to your chosen system Save-panel destination, regardless of the Original/Comparison tab, without retaining its path or lasting file authorization. Stop/close waits for actual model chunk calls, file work and authorization release; late cancellation does not undo completed script saves or exports. Processing uploads no title, text, source file or result, writes none to ordinary logs, and does not automatically retry online or download executable code.

Media to Script starts only after you select a file and explicitly start. It processes source bytes, the display name, necessary audio/video and track-count facts, the first audio track, entered hotwords and the natural-paragraph option. Sources are read-only. A file name may suggest the new title; you can correct title/text and choose a group. Multiple tracks are reported and only the first is processed, without automatically mixing other tracks. Sources are limited to 4 GiB. Audio becomes ordered local 24 kHz mono PCM/WAV segments for the fixed offline Vibe model. Over-limit, missing-track, unsupported or incomplete results fail explicitly rather than being silently truncated into success. Hotwords are local context only, not uploaded or automatically added to script hotword settings. A private temporary directory holds the source snapshot and audio segments, outside the encrypted script database. The snapshot is removed after decoding and WAV files after the native transcription process actually exits. Normal Stop/Close waits for processing and cleanup. Audio, titles, hotwords and text are not uploaded or written to ordinary logs, and no online retry starts automatically. Text playlists and external media references are rejected, without automatically reading referenced files or downloading referenced audio. Abnormal system/app exit, disk failure or unknown temporary contents may prevent cleanup and leave files behind; observable failures are reported instead of claiming cancellation cleared everything. Selected-file access, display name and parameters may remain in the current workspace for an explicit rerun. Source replacement, app exit or workspace replacement releases/clears them without persistent source paths or bookmarks. Complete original recognition, titles, corrections, undo history and results stay only in current-workspace memory and may remain after saving for review. Explicitly discarding a result clears its corrections but may retain source access and parameters. Unsaved results require Save, explicit Discard or cancelling departure; account operations require saving first. Explicit Save, or a subsequent flow requiring saving first, retains only the current corrected title/text, supported structure and group as one new local script, without media attachments or automatic sync. Unknown saves reconcile the original ID without replaying a new one. Copy writes corrected text to the system clipboard only on your action, where other apps may read it under system rules. TXT export writes current corrections as UTF-8 only to your system Save-panel destination, regardless of the Original Recognition tab, without retaining the target path or lasting authorization. Late cancellation or discard does not undo completed script or file writes. Recognition can be wrong; review it before saving/exporting.

Extract Audio runs only after you select local media and explicitly start. It processes file bytes, the display name, necessary track-count facts and the first audio track. Sources are limited to 4 GiB and audio to two hours. A read-only snapshot is processed with Apple system codecs: M4A reuses AAC compressed samples when possible or encodes AAC; MP3 uses the bundled LAME encoder. Media is not uploaded, sent to open-source maintainers or written to ordinary logs. Private temporary snapshots and outputs are outside the encrypted script database. The snapshot is removed after processing; an unexported output may remain in the current workspace for explicit saving or reprocessing and is cleared on source replacement, account change or app exit. Stop waits for actual encoding, copying and cleanup stacks. Abnormal exit, disk failure or unknown temporary contents may leave files behind; observable cleanup failures are reported. Tool business code does not deliberately persist source/destination paths or authorization bookmarks; system panels may retain recent directories under operating-system rules. Only your explicit Save action copies to the system Save-panel destination, verifies the complete digest and performs an atomic commit without overwriting the source. Cancelling the panel writes nothing. Late cancellation does not undo a completed file commit. Only the first audio track is included, without mixing other audio or video; multiple tracks are reported.

Video Transform reads necessary video frames, audio, track, orientation, color, timing and container metadata only after you select a local video and explicitly start. It creates a new MP4 locally, supporting one video and at most one mono/stereo audio track. Over-limit, complex-track, HDR or unsupported input fails explicitly instead of silently dropping tracks or degrading color into success. Metadata mode keeps original compressed samples and existing container information, which may include location, and adds a random file marker. It is not anonymization and does not guarantee platform duplicate-detection outcomes. Horizontal/vertical mirroring processes the upright picture frame by frame while preserving actual timing and audio. Source and complete output are decoded locally for validation; processing data is not uploaded or written to ordinary logs. Private snapshots, results and access follow the audio-export workspace, actual-stop and cleanup rules; unexported results do not enter the script database or sync automatically. Your explicit result-preview action lets a native local player read the current private file, initially paused. Extra frame analysis, external playback, picture-in-picture and sharing branches are not enabled by the tool. Closing or stopping the window releases the player before result cleanup. Previewing does not save a file. Explicit Save still verifies and atomically commits only to the system Save-panel destination without overwriting the source; late cancellation does not undo a completed write. Tool business code does not deliberately persist paths or lasting authorization bookmarks. System panels/players may retain recent directories, caches or media state under operating-system rules.

Video Compression reads frames, audio, dimensions, orientation, duration, bitrates and byte counts locally only after you select a local video and explicitly start. Four presets or custom choices use the shared planning rules to estimate dimensions, bitrates and size; estimates do not guarantee actual savings. The new output is encoded as H.264 or device-supported HEVC with AAC audio where present. Complete decoding verifies dimensions, codecs, frames, timing, audio and the digest before comparing actual bytes. An equal or larger output requires another explicit confirmation before saving, without automatically overwriting or deleting the source. Input, plans, temporary results and native previews follow the media tools private-snapshot, actual-stop, account-scope and cleanup rules above. They are not uploaded or automatically added to scripts or sync, and private names, paths, pictures or processing facts are not put into ordinary logs. Saving atomically commits only to the destination explicitly selected in the current system panel; late cancellation does not undo a completed save.

Model data is downloaded only after you explicitly choose Download or Continue. The app requests fixed model revisions, files, necessary network addresses and byte ranges from our resource catalog and catalog-provided sources that pass the allowlist checks. Resource services receive IP and other network information necessary for the connection. Requests do not include account credentials, cookies, phone numbers, scripts, hotwords, audio or images. Sources may be in or outside China and process the network information required for the actual connection. Speech recognition and transcription continue to run locally.

Download staging stays in this app container and is separate from imported models. Fixed file identities, checksums, source identifiers and address fingerprints excluding query parameters support validation and resume. Temporary download addresses and fallback access tickets stay in memory for the current operation and are not written to ordinary logs. Pause keeps resumable data. Explicit cancellation with cache removal, or clearing the selected model cache, waits for the real operation to stop before deleting app-owned staging files. Completed downloads still require checksum and native-load validation; the previous valid model remains until the candidate is ready.

4. Feedback and diagnostics

The current macOS app has no online reward task or diagnostic ZIP upload entry. It does not automatically save microphone evidence or send us scripts, images or system diagnostics. Local error state serves the current operation. Any future explicit feedback feature will identify the material and recipient for your choice.

5. System access

The app uses the macOS sandbox for explicit microphone use, selected model folders or SRT files, and selected TXT export targets. User-selected read/write access serves these local actions, without Full Disk Access or standing folder grants. It requests no camera, screen recording, Accessibility or Input Monitoring permission; floating/external output is its own window. Microphone access can be revoked in system settings; denial affects only dependent features. Risk detection uses the same selected-file access to read TXT, Markdown or DOCX, with no added system permission. Editor document import reuses the same selected-file access to read only the TXT, Markdown or DOCX you explicitly choose. It never writes back to the source and requests no additional system permission. Image text import reuses user-selected file access to read only images explicitly chosen and recognize text locally with Vision. It requests no Photos library, camera or additional system permission. Standalone script import reuses the same user-selected file access to read only your explicitly chosen TXT, Markdown or DOCX. Correction and new-script saving occur inside the app without writing back to the source or requesting additional system permission. Standalone image import reads only images explicitly selected in the system panel, reusing existing local Vision and user-selected sandbox access. It scans no other files and requests no Photos library, camera or additional permission. Script Cleanup reuses existing read-only access to selected files, user-selected export destinations and bundled local models. It scans no folders and requests no camera, Photos library, microphone or additional permission.

6. Optional account and transaction services

Available phone-account flows send the phone number, SMS challenge/code or password for the authentication, random installation identifier, DESKTOP device type and display name Mac only on your action. The server may retain necessary authentication results, sessions, network and security audit information. Passwords/codes are not stored in local ordinary preferences or logs; the Keychain holds session material. When you explicitly update account details, the app also reads the public account number, display name, masked phone number, whether a password is configured, bound and device-available sign-in methods, deletion status and server deadlines. These are display values, not account or membership authorization. The shared account host caches necessary display details and any normalized avatar URL from the response with the session envelope in the local Keychain. The current Mac page does not automatically request avatar images or send account tokens to avatar hosts. Deletion requests and cancellation during the cooling-off period call the server only after your explicit action. Effective status and session outcomes follow the server response and local durable reconciliation; unknown write requests are not replayed automatically. When you explicitly update devices and membership, the app reads device identifiers, types, display names, states, the current-device marker, registration and last-active times, account membership summaries, server verification time, signed identity/professional deadlines and necessary reconciliation information. Device lists remain only in current-page memory and are cleared on account changes or leaving the page. Membership display summaries may be cached with the existing session in the Keychain; signed material stays in the account host. An account professional badge does not mean this device has professional or sync eligibility. Device removal requires explicit confirmation and may revoke that device session. Current-device reconciliation may return a replacement session. Server decisions and the original shared validation remain authoritative; local scripts are not deleted and unknown write requests are not replayed automatically. Purchases are not started, and historical baseline grants are not presented as a current purchase success.

Third-party sign-in, purchases, redemption, referral and rewards are not currently available and do not process authorization codes, store transactions or reward material. Details will be shown before any future activation. Account deletion uses available account-service or support procedures; its existing seven-day cooling-off period and retention of local scripts still apply.

7. Sharing and service providers

We do not sell personal information. Available phone features use our account service and SMS provider for necessary processing; a phone number and required template information are provided only when you request a message. There is currently no third-party sign-in, payment or analytics SDK transmitting material to those platforms.

Bundled offline engines, database and follow runtime process data locally and do not send scripts/audio to open-source maintainers. Apple system frameworks provide windows, permissions, file selection and secure storage; operating-system rules govern system behavior.

When you request a model download, our catalog and the actual resource providers process only the network information needed for that request. Sources may be in or outside China. The app does not upload scripts, audio, images, account tokens or phone numbers to these sources, and merely viewing the model page does not start a download.

8. SDKs and open-source components

The current macOS app uses signed bundled offline components and Apple system frameworks, not Countly, Clarity, Tencent sign-in or Alipay client SDKs. See the local component list for purposes. Unreviewed programs are not loaded from model folders.

9. Referral and rewards

The current macOS app offers no referral/reward feature and collects no participation relationships, reward material or device anti-abuse digest for it. Any future feature will explain its scope/rules before you choose to participate.

10. Retention, security and transfers

Scripts, models, preferences and migration backups stay in this app's local container until deletion or system handling. Session credentials use local non-iCloud-synchronizing Keychain items. Uninstalling may leave the container, Keychain or system backups and does not guarantee complete erasure or recovery. Losing the database's sole key may prevent unlocking. Media to Script reuses the same user-selected file access: it only reads the explicitly selected source, prepares audio in private temporary storage and writes a chosen destination only on explicit TXT export. It scans no other media and requests no microphone or additional system permission. Source access may remain until source replacement, app exit or workspace replacement, without persistent bookmarks. Cloud scripts remain in the recycle bin for 30 days. After membership expires, cloud scripts are retained for 90 days and then become eligible for cleanup. Sync stops and cloud scripts are retained during the account-deletion cooling-off period; once deletion takes effect, cloud scripts are deleted asynchronously. Cloud cleanup does not remotely erase local scripts that must be retained.

Controls include the sandbox, encrypted database, Keychain, HTTPS for necessary online requests, log redaction and access controls. Account and necessary security records are held in China under service/applicable rules. Local scripts are not automatically transferred abroad. There is currently no analytics/replay delivery queue, online reward material or retained diagnostic audio.

Applicable disclosures will be updated if retention, material or providers change. Another platform's rules for an unavailable feature do not mean this version processes that material.

11. Your rights

Under applicable law, you may know, decide, restrict, or refuse processing and request access, copy, correction, supplementation, deletion, withdrawal, explanation, or account deletion. We generally respond within 15 working days after verification.

You can edit/delete local scripts and revoke microphone or selected file access in macOS settings. Account management depends on available features. If an entry is unavailable or you cannot access the app, use the policy email for access, correction, deletion, consent withdrawal or account deletion requests. Consent withdrawal does not itself delete local scripts.

You can cancel before sending material to us. Contact tdxkefu@foxmail.com; we may verify identity to protect accounts and information.

Agreeing to this policy does not activate unavailable feedback rewards or diagnostic uploads. Private sync follows the conditions and device pause choice described above.

You can pause or resume sync for this device from Home and restore or permanently delete scripts through the recycle bin under the applicable rules. Signing out or changing accounts does not force unsynced changes to upload.

12. Minors

The service is not specifically directed to children under 14. A minor should use it under parent or guardian guidance and avoid unnecessary personal information in scripts, images, or diagnostic packages.

Basic offline features do not require registration. An account or transaction feature that uploads personal information requires guardian guidance and any consent required by law; otherwise the online feature should not be used.

13. Policy updates

We may update this policy for changes in features, purposes, information types, third parties, or law and will show a new publication date. The updated policy takes effect on that date.

A material effect on personal-information rights is announced prominently, and renewed consent is obtained where required. An update cannot reduce statutory rights without express consent.

14. Contact us

Operator

Shenyang Tdx Network Technology Co., Ltd.

Unified Social Credit Code

91210124088957535L

Contact email

tdxkefu@foxmail.com

Website

https://teleprompter.yiroot.com/

Contact us with policy, processing, complaint, or rights questions.

Appendix 1: Personal Information Collected

1.1 Device and app information

The macOS app generates a random installation UUID in its app container for account authentication and device management that you choose to use. It does not infer account identity from hardware identifiers. Account requests use Mac as the device display name, not your local user or host name. Microphone device UIDs are used only to select a local input and are not sent as account or analytics identifiers.

The current macOS app does not initialize Countly, Microsoft Clarity, advertising or session replay SDKs. It does not automatically send page activity, screens, script titles or text, crash stacks or analytics installation identifiers. Any future optional product improvement feature will be explained and obtain necessary consent before activation.

1.2 Account, free trial, transactions, and local content

When you choose an available account feature, the account service processes the phone number and SMS challenge/code or password for that authentication, the random installation identifier, desktop device type and necessary network information. Passwords and codes are not saved in local preferences or ordinary logs. Session credentials and signed identity material are stored in the local Keychain. WeChat, QQ or Apple sign-in, purchases, redemption, referral and reward tasks are not currently offered; reading this notice does not activate them. When you explicitly update account details, the app also reads the public account number, display name, masked phone number, whether a password is configured, bound and device-available sign-in methods, deletion status and server deadlines. These are display values, not account or membership authorization. The shared account host caches necessary display details and any normalized avatar URL from the response with the session envelope in the local Keychain. The current Mac page does not automatically request avatar images or send account tokens to avatar hosts. Deletion requests and cancellation during the cooling-off period call the server only after your explicit action. Effective status and session outcomes follow the server response and local durable reconciliation; unknown write requests are not replayed automatically. When you explicitly update devices and membership, the app reads device identifiers, types, display names, states, the current-device marker, registration and last-active times, account membership summaries, server verification time, signed identity/professional deadlines and necessary reconciliation information. Device lists remain only in current-page memory and are cleared on account changes or leaving the page. Membership display summaries may be cached with the existing session in the Keychain; signed material stays in the account host. An account professional badge does not mean this device has professional or sync eligibility. Device removal requires explicit confirmation and may revoke that device session. Current-device reconciliation may return a replacement session. Server decisions and the original shared validation remain authoritative; local scripts are not deleted and unknown write requests are not replayed automatically. Purchases are not started, and historical baseline grants are not presented as a current purchase success. Model data is downloaded only after you explicitly choose Download or Continue. The app requests fixed model revisions, files, necessary network addresses and byte ranges from our resource catalog and catalog-provided sources that pass the allowlist checks. Resource services receive IP and other network information necessary for the connection. Requests do not include account credentials, cookies, phone numbers, scripts, hotwords, audio or images. Sources may be in or outside China and process the network information required for the actual connection. Speech recognition and transcription continue to run locally. Download staging stays in this app container and is separate from imported models. Fixed file identities, checksums, source identifiers and address fingerprints excluding query parameters support validation and resume. Temporary download addresses and fallback access tickets stay in memory for the current operation and are not written to ordinary logs. Pause keeps resumable data. Explicit cancellation with cache removal, or clearing the selected model cache, waits for the real operation to stop before deleting app-owned staging files. Completed downloads still require checksum and native-load validation; the previous valid model remains until the candidate is ready.

Script text, titles, formatting, cues, hotwords and groups are stored in the local encrypted database. Reading positions and display settings stay local. Microphone audio, recognition, matching and scrolling are processed on this Mac; the current app does not save or upload microphone audio. Clipboard access is limited to explicit paste or text interactions, not background polling. After you choose an SRT, the subtitle toolbox reads its bytes, file name, cues and timeline locally to produce a cleaned-script or original-text preview. The source is not modified or automatically uploaded. Input and results remain only in the current account workspace memory and are cleared on explicit discard, app exit or workspace replacement; a saved or exported preview may remain in that workspace for further processing. Copy writes to the system clipboard only on your action; other apps may read it under system rules, and this app does not poll it in the background. Export writes the displayed preview as TXT through the system Save panel. Saving a new script writes only to the local encrypted library, may use the source file name as its title, and follows local script deletion rules. Unsaved results require saving or explicit discard before leaving the section. Completed file or script writes are not undone by cancellation. No cloud subtitle recognition or automatic sync is performed. Content risk detection runs locally after you type or paste text, select a local script, use the current editor draft, or choose a TXT, Markdown or DOCX file. It processes the selected file display name, extracted text, chosen scope, source positions and risk report. Source files are unchanged; this feature does not automatically create or overwrite scripts, upload content or write it to ordinary logs. Input, reports, filters and report-only ignores remain in current workspace memory. Editing input or starting a new scan invalidates the old report; closing an editor detection sheet, clearing input, exiting the app or replacing the workspace clears the corresponding state. The standalone tool may retain its result while navigating within the same workspace. Report-only ignores are not persistent whitelists and grant no future sync permission. Copy writes the report to the system clipboard only on your action, where other apps may read it under system rules. File access is released after the actual read/parse stack ends; no persistent file grant is stored. No online content detection is provided. Rule prompts and alternative wording require contextual human review and are not legal determinations or platform review guarantees. After you explicitly choose TXT, Markdown or DOCX, editor document import processes its display name, text, supported formatting and outline locally and first shows a read-only preview. You may review heading identities and explicitly insert or replace the original selection, append, or replace all content. The current script stays unchanged before Apply and the source file remains read-only. Replacing all may remove hotwords no longer present in speakable text; the preview shows the count. Confirmed content enters the current draft, unified undo and existing automatic/manual save. Saved content follows local script retention rules and is not uploaded automatically. A suggested file name is used only in preview and does not automatically change the original title or group. Preview and review state remain in current-workspace memory and are cleared when the import sheet closes, the app exits or the workspace is replaced. Cancellation waits for actual reading and access release, stores no persistent file grant and scans no other files. It does not undo an already applied draft change or completed save; editor Undo can restore content. Annotation presets are stored separately in the local encrypted database for workspaces on this Mac. Custom items can be removed in preset management. They use no script quota, are not synced with scripts, and management does not rewrite previously inserted cues. Image text import reads only image bytes and display names you explicitly choose in the system panel. ImageIO and Vision process dimensions, orientation and text locally. A batch is limited to 10 images, 30 MiB per image and 120 MiB in total. Oversized dimensions are rejected, long images may be scaled and tiled, and only the first frame of animated or multi-page images is recognized. Recognition may omit or misread text. You may reorder images, choose smart layout or original lines, and edit the result. Partial failures require explicit permission to use successful results only. Source images are unchanged; other images are not scanned. Images and recognized text are not uploaded or written to ordinary logs. Images, results and edits remain only in current-workspace memory. Unapplied results require explicit Apply or discard and are cleared when the import sheet closes, the app exits or the workspace is replaced. Cancellation waits for actual reading, recognition and file-access release and does not retry automatically. After explicit Apply, text enters the original script draft, unified undo and automatic/manual save. Saved content follows local script retention rules. The original title and group are not changed automatically; source images and persistent file grants are not saved. Replacing text may require manual hotword repair and may remove implied heading identities; a warning appears before Apply. Cancellation does not undo applied edits or completed saves; editor Undo can restore content. After you explicitly choose a document, the standalone Import Script tool processes its display name, extracted text, supported formatting and outline on this Mac. You may edit the title and text, switch whitespace-cleanup variants that retain separate corrections, and choose a save group. The file name may be the default script title; you can edit it or leave it blank for a generated title. A title may reveal source information, so review it before saving. Source files are read-only. Document images and links are not loaded, and content is not uploaded or written to ordinary logs. Explicit Save, or a subsequent flow that requires saving first, writes the current correction snapshot as a new script in the local encrypted library, retaining its title, text, supported formatting, outline and group under local script retention/deletion rules. It does not overwrite the source or an existing script and does not sync automatically. An unknown save is reconciled using its original ID without automatically generating a new ID. Parsed input, the title and correction variants remain only in current-workspace memory. A saved preview may remain available in that workspace. Unsaved corrections require Save, explicit discard or cancelling departure; account operations require saving first. App exit, explicit discard, source replacement or workspace replacement clears the corresponding memory state. Cancelling a read waits for actual parsing and access release. Saves and reconciliation wait for actual results; completed script writes are not undone by cancellation or discard. Copy writes the current text to the system clipboard only on your action, where other apps may read it under system rules. In standalone Import Script, Image Text reads only image bytes and display names you explicitly choose in the system panel. Dimensions, orientation and Vision text recognition are processed locally. A batch is limited to 10 images, 30 MiB each and 120 MiB in total. Long images may be scaled/tiled; only the first frame of animated or multi-page images is processed, and recognition may omit or misread text. You can reorder/remove images, review each failure and low-confidence result, and switch smart paragraphs, original lines and whitespace cleanup. Each combination retains separate corrections without recognizing again when switched. Reordering invalidates the old draft and partial-use permission. Partial failure requires explicit permission for this batch to use successful text only; total failure creates no empty script. The default title is 图片文稿 (Image Script), which can be edited or left blank for a generated title. Explicit Save, or a subsequent flow requiring saving first, retains only the current text, title and group as a new local script, without image attachments, image/text uploads or ordinary-log content. Unknown saves are reconciled by their original ID without automatically creating a different ID. Selected images remain only in current-workspace memory and may remain for recognition after page navigation or discarding the correction preview. Removing sources, switching source type, app exit or workspace replacement clears the corresponding image bytes. Correction and save retention follows standalone document import. Stop waits for actual recognition and task completion before releasing processing occupancy and does not retry automatically. Completed script saves are not undone by cancellation. Copy writes to the system clipboard only on your action. Script Cleanup starts on your action with entered or pasted text, a selected TXT/Markdown/DOCX, a saved local script or the built-in example. It reads that input title, text and supported styles, outline and static cues. Hotwords are not copied from a library script, and source files/scripts are unchanged. Input titles and text can be corrected; a file name can provide a suggested title. After you choose Teleprompter or Standard cleanup, the fixed bundled CT-Transformer supplies local punctuation candidates while shared rules handle whitespace, broken line breaks, paragraphs and structure protection. Model output must pass insert-only punctuation checks and cannot delete or rewrite text. Model failure or invalid candidates restart basic rules from the same original input, with an explicit notice. If content or structure cannot be retained completely, the whole original or safe formatting is retained with a warning. Punctuation may be incorrect; review the original, organized text and comparison. Input, title, source display name, preset and result remain only in current-workspace memory and may remain after saving for review. Replacing the source, clearing, explicitly discarding on departure, app exit or workspace replacement clears the corresponding content. Explicit Save, or a subsequent flow requiring saving first, organizes unprocessed input locally with the current preset, then retains only the organized title, text, structure and selected group as one new local script. It creates no separate original-input copy and copies no file attachments or hotwords. Unknown saves reconcile the original ID without automatically generating a different one; quota or known failure retains input/results for an explicit retry. Copy writes organized text to the system clipboard only on your action. TXT export atomically writes only organized text as UTF-8 to your chosen system Save-panel destination, regardless of the Original/Comparison tab, without retaining its path or lasting file authorization. Stop/close waits for actual model chunk calls, file work and authorization release; late cancellation does not undo completed script saves or exports. Processing uploads no title, text, source file or result, writes none to ordinary logs, and does not automatically retry online or download executable code. Media to Script processes only the audio/video bytes and display name you select, first audio track and local hotwords. It recognizes private temporary snapshots and PCM/WAV segments offline without uploading source media or transcripts. Temporary media is outside the encrypted script database and is cleaned after actual processing; abnormal exit or cleanup failure may leave it behind. Source authorization and parameters may remain in this workspace for an explicit rerun and are released/cleared on source replacement, app exit or workspace replacement. See Media to Script for correction, script, TXT and clipboard rules.

When script sync is available and your Professional membership is valid, scripts owned by your account sync automatically while Home is in the foreground, and active scripts without an account owner are enrolled. Sync includes text, titles, formatting, annotations, hotwords, and groups. Scripts and related text are uploaded to the account service and sent to Alibaba Cloud content moderation for risk checks. Approved documents are stored privately in mainland China for syncing between devices signed in to the same account; they are not published as public content. You can pause sync on this device without affecting local editing. Audio, video, reading progress, and display settings are excluded. Sync preserves outlines and supported ruby formatting. Moderation-provider calls depend on the current cloud-review setting; disabling cloud review does not bypass identity, eligibility, format validation or local preflight. No new sync is dispatched while editing, in another section, when the app is inactive, asleep, or after online consent is withdrawn. Accepted requests retain receipts for their original account and finish safely.

1.3 Countly analytics data

The current macOS app sends no automatic product analytics, session replay or crash telemetry.

Using local scripts or prompting therefore does not create an anonymous activity trail in an analytics service.

1.4 Product-feedback reward task

The current macOS app offers no online feedback reward task or diagnostic package upload and does not automatically collect descriptions, screenshots or audio for those tasks.

If you separately contact us using the details in this notice, provide only material needed to investigate your issue and avoid unrelated personal information.

Appendix 2: Third-Party Sharing

Appendix 3: SDKs and Open-Source Components

3.1 Feature SDKs

3.2 Foundation components

Appendix 4: System Permissions

4.1 Network access (no separate system prompt)

Network access is used for model data downloads that you explicitly start and for available online account features that you agree to and choose to use. Local account restoration reads this app's container and Keychain without automatically sending a code or login request. Local editing and basic constant-speed prompting do not require a network connection. Unavailable online features send no requests.

4.2 Camera

The current macOS app does not request camera access, record camera video or scan another client's login code.

4.3 Microphone

Microphone access is requested only when you start a microphone test or local speech-follow prompting. Audio is used for local levels, offline recognition and following; it is not saved or uploaded. Capture stops when stopped, when leaving the relevant flow, on sleep or on exit. Denying access still permits local editing and constant-speed prompting.

4.4 Display over other apps

Floating prompting and external display output use this app's own windows. They do not request another platform's overlay permission, read an underlying app or capture/record another app's screen.

4.5 Accessibility service

The current macOS app does not request Accessibility or Input Monitoring permission and registers no service to read another app's text, passwords or keys.

4.6 System photo and file pickers

The app uses user-selected file read/write sandbox access. Model import code only reads the selected source folder and copies fixed data into the app container; subtitle code only reads the SRT you select; TXT export writes only to the target you choose in the system Save panel. Source models and subtitles are not modified. Access is released after the actual file stack ends on completion, cancellation or failure; no persistent bookmark is stored. The system panel may replace a target with your confirmation, and a completed export is not undone by cancellation. The app requests no Full Disk Access, scans no whole photo library or unrelated folders, and installs no executable code from a model folder. Risk import only reads your selected TXT, Markdown or DOCX document, without modifying it or scanning other files. Editor document import reuses the same selected-file access to read only the TXT, Markdown or DOCX you explicitly choose. It never writes back to the source and requests no additional system permission. Image text import reuses user-selected file access to read only images explicitly chosen and recognize text locally with Vision. It requests no Photos library, camera or additional system permission. Standalone script import reuses the same user-selected file access to read only your explicitly chosen TXT, Markdown or DOCX. Correction and new-script saving occur inside the app without writing back to the source or requesting additional system permission. Standalone image import reads only images explicitly selected in the system panel, reusing existing local Vision and user-selected sandbox access. It scans no other files and requests no Photos library, camera or additional permission. Script Cleanup reuses existing read-only access to selected files, user-selected export destinations and bundled local models. It scans no folders and requests no camera, Photos library, microphone or additional permission. Media to Script reuses the same user-selected file access: it only reads the explicitly selected source, prepares audio in private temporary storage and writes a chosen destination only on explicit TXT export. It scans no other media and requests no microphone or additional system permission. Source access may remain until source replacement, app exit or workspace replacement, without persistent bookmarks.