中文版

Quriov 隐私政策

生效日期:{{RELEASE_DATE}} 适用范围:Quriov iOS 应用(「小艾」)及其可选配件 Quriov 智能眼镜

一句话概括

Quriov 把你的对话内容、记忆和任务尽量留在你自己的手机上。我们自己的服务器只转发加密后的信令和六个字段的匿名使用计数,不保存你的对话内容、不保存录音、不保存你的记忆条目。 这一版还有一条同样重要:去模型那一侧用的是你自己的账号和密钥 —— 语音走你自己的 Codex 账号(会话由你 Mac 上运行的 Quriov 发起),记忆提炼走你自己填的 API 密钥(不填就不启用)。

1. 我们收集什么、为什么收集

1.1 语音与对话

• 你按下「唤醒小艾」之后,手机麦克风(或已连接的眼镜麦克风)采集的音频,通过一条加密的实时音频通道传给语音模型服务商完成识别与应答。这条音频通道不经过 Quriov 的服务器。
• 为了让手机找到你自己电脑上运行的 Quriov,手机会经由 Quriov 的连接服务(voice-relay.quriov.com)交换信令 —— 就是两边为了对上而互相报的那点连接信息,不是你说的话。信令内容在你的手机和你的电脑这两端加密(HKDF-SHA256 派生密钥 + AES-256-GCM),连接服务只负责把这段加密内容转过去,我们打不开,也不保存。你的音频不走这条路,它是手机和语音模型服务商之间的另一条通道。
• 我们不在服务器上保存音频文件、不保存转写文本、不用你的语音训练模型。
• 会话的转写与摘要保存在你手机本地,可在应用内删除。

✅ 已拍(#4429 2026-09-08T05:46Z):1.0 就是这个形态 —— 语音会话由你自己电脑上运行的 Quriov用你自己的 Codex 账号发起(前台语音走 GPT Voice),模型侧是 OpenAI 的实时语音服务。Quriov 不代你向模型服务商付费、也不经手这条音频。以后若提供由 Quriov 自建服务端发起的选项,那会是可选的,届时本节另写。

1.2 「小艾记得」(长期记忆)

• 这个功能默认不启用,而且用的是你自己的密钥(BYOK)。 在应用内「我 → 高级」填入你自己的模型 API 密钥,功能才启用;不填就不启用,应用的其他部分照常。
• 密钥只保存在这台设备的系统钥匙串里,不上传 Quriov、不进备份给我们、不与他人共享。你可以随时在同一个地方清掉它,清掉即从钥匙串移除。
• 「小艾记得」保存的是提炼后的一句话(不超过 30 字),例如「主人不吃香菜」。你说过的原句不入库。
• 记忆库只存在你的手机本地,不上传到 Quriov 服务器,也不写入 iCloud。
• 提炼这一步会把当次对话的转写片段发给你那把密钥所对应的服务商(目前是 DeepSeek)做一次处理,拿回提炼结果后即结束;这是记忆功能中唯一离开手机的一步,而且它去的是你自己选的服务,不经过 Quriov 的服务器。提炼失败就放弃这一次,不重试、不囤积。
• 删除:应用内可以逐条删除,也可以一次清空。逐条删除会额外记一枚「删除指纹」,防止同一句话被后续提炼重新写回来——删除按钮不是假的。清空则连指纹一起清掉(你要的是「从头再来」,不是「永远禁止」)。
• 卸载应用即删除全部本地记忆。

✅ 已拍(#4429 2026-09-08T05:46Z):1.0 就是 BYOK —— 「直接放『高级』里填 API key,填了启用、不填不启用,不藏」。以后若提供由 Quriov 统一承担提炼的选项,那会是可选的,届时本节与第 5 节一起改。

1.3 使用情况统计(遥测)

我们记录极少量的匿名使用计数,用来知道「功能有没有在正常工作」。每条记录只有六个字段:

• 没有内容:不含对话文本、任务标题、转写、附件、位置、设备标识符或任何自定义属性。服务端会拒收清单外的字段。
• 不关联身份:遥测里不带任何账号 ID(本版本也没有 Quriov 账号)——这是我们代码里钉死的规则,有自动化测试守着。
• 不用于追踪:我们不做跨应用/跨网站追踪,不接入广告 SDK、不接入第三方分析 SDK,不把这些数据卖给或分享给数据经纪商。
• 保留期:原始事件行保留 30 天,到期自动删除。
• 那个匿名标识只存在这台设备上;卸载重装会生成一个新的,我们无法把两者对应起来。

1.4 账号

• 本版本没有 Quriov 账号:应用里没有注册,也没有登录。我们不收集用户名、昵称、邮箱、密码,你这边也没有需要删除的 Quriov 账号。
• 唤醒小艾、提醒、任务、「小艾记得」都不需要向我们注册。(唤醒小艾另有前提 —— 你自己的 Codex 账号,以及在你 Mac 上运行的 Quriov,见 1.1;那是别人的账号,不是我们的。)

1.5 智能眼镜(可选配件)

• 应用通过蓝牙搜索并连接 Quriov 智能眼镜,用于:传输眼镜麦克风采集的音频、控制眼镜发声、读写眼镜的音量与语言等设置。
• 蓝牙只用于连接你的眼镜,不用于定位、不用于接近度广告、不扫描周边用户。
• 没有眼镜也可以正常使用应用;蓝牙权限可以拒绝。

1.6 手机上的其他权限

说明:早先的构建里声明过「语音识别」权限,但代码中已不再使用语音识别框架(手机端唤醒词识别已退役)。该声明已判定删除(usage-descriptions.md U6),所以本表没有「语音识别」一行。

2. 我们不做什么

• 不出售个人数据。
• 不做广告投放,不接入广告或归因 SDK。
• 不做跨应用/跨网站追踪,不请求 App Tracking Transparency 授权。
• 不上传你的通讯录、相册全库、剪贴板。
• 不在服务器上保存你的对话内容或录音。

3. 数据存储在哪里

• 本地:对话记录、记忆条目、任务与附件、本地诊断日志,均在你手机的应用沙盒内。
• 服务器:只有上面第 1.3 节那六个字段的遥测行。遥测服务器位于美国。
• 本版本没有 Quriov 账号 ⇒ 我们的服务器上没有任何与你身份相关的账号信息。

4. 你的选择与权利

• 不启用记忆:不填 API 密钥即可,「小艾记得」不会启用,也不会有任何转写离开手机。
• 删除记忆:应用内逐条删除或一次清空。
• 删除你的 API 密钥:在「我 → 高级」清掉,即从系统钥匙串移除。
• 删除全部本地数据:卸载应用。
• 关闭权限:在系统「设置 → Quriov」里随时撤销麦克风、通知、蓝牙、位置、日历、相机、照片权限;应用会降级而不是崩溃。
• 账号数据:本版本没有 Quriov 账号,我们这边没有你的账号数据(见 1.4)。
• 遥测:本版本没有「关闭使用情况统计」的开关。它只有 1.3 里那六个匿名字段,不含任何内容;卸载应用即停止发送,本机那个匿名标识也随之删除。
• 你可以随时通过下方邮箱要求访问、更正或删除我们持有的与你相关的任何数据。

5. 第三方服务(按当前代码事实列出,不美化)

⭐ 这一版的关键事实:下面这些服务用的是你自己的账号或你自己的密钥,不是 Quriov 的。

我们不控制这些服务商对数据的处理,请另行参阅它们各自的隐私政策。 ✅ 已拍(#4429 2026-09-08T05:46Z):1.0 不把这两处换成 Quriov 自建服务端 —— 对外口径是「第一版相当于测试版本,纯粹免费,你们用你们自己的 API key 和 Codex 账号;后续可能再用我们自己的,做一个 Optional」。

6. 儿童

Quriov 不面向 13 周岁以下儿童,我们不会有意收集他们的个人信息。若你认为孩子向我们提供了个人信息,请通过下方邮箱联系我们,我们会删除。

7. 安全

传输一律走 HTTPS 或加密通道;语音信令在你的手机与你的电脑两端加密,Quriov 的连接服务只转发加密内容;第三方密钥保存在系统钥匙串;客户端安装包里不携带任何服务端凭据。

8. 政策变更

政策有实质变更时,我们会更新本页的生效日期,并在应用内提示。

9. 联系我们

• 隐私相关:privacy@quriov.com
• 一般支持:support@quriov.com
• 回复时间:1–2 个工作日
• 运营主体:杭州幻境求索科技有限公司

English version

Quriov Privacy Policy

Effective date: {{RELEASE_DATE}} Scope: the Quriov iOS app ("Xiao Ai") and the optional Quriov smart glasses accessory

In one sentence

Quriov keeps your conversations, memories and tasks on your own phone as much as possible. Our own servers carry only encrypted signalling and a six-field anonymous usage count. We do not store your conversation content, your recordings, or your memory entries. One more thing matters just as much in this release: the model side runs on your own account and your own key — voice goes through your own Codex account (the session is started by Quriov running on your Mac), and memory distillation goes through an API key you enter yourself (leave it blank and the feature stays off).

1. What we collect and why

1.1 Voice and conversation

• After you wake Xiao Ai, audio captured by your phone's microphone (or the connected glasses microphone) is sent over an encrypted real-time audio channel to a speech model provider for recognition and response. That audio channel does not pass through Quriov's servers.
• So that your phone can find Quriov running on your own computer, the phone exchanges signalling — the small amount of connection information the two sides give each other in order to meet, not anything you said — through Quriov's connection service (voice-relay.quriov.com). Signalling payloads are encrypted at both ends, on your phone and on your computer (HKDF-SHA256 key derivation + AES-256-GCM); the connection service only passes that encrypted content along and we can neither read nor retain it. Your audio does not travel this path — it runs on a separate channel between your phone and the voice model provider.
• We do not store audio files or transcripts on our servers, and we do not use your voice to train models.
• Session transcripts and summaries stay on your phone and can be deleted in the app.

✅ Settled (#4429, 2026-09-08T05:46Z): this is the shape of 1.0 — the voice session is started by Quriov running on your own Mac using your own Codex account (the assistant speaks through GPT Voice), and the model provider is OpenAI's realtime voice service. Quriov does not pay the model provider on your behalf and never handles that audio. If a Quriov-hosted option arrives later it will be optional, and this section will be updated then.

1.2 "Xiao Ai Remembers" (long-term memory)

• This feature is off by default and runs on your own key (BYOK). It turns on only after you enter your own model API key under Me → Advanced; leave it blank and the feature stays off while the rest of the app works normally.
• Your key is stored only in this device's system Keychain. It is never uploaded to Quriov, never shared, and you can clear it at any time in the same place, which removes it from the Keychain.
• Memory entries are a single distilled sentence (30 characters or fewer), e.g. "the owner does not eat coriander." Your original wording is never stored.
• The memory store lives only on your phone. It is not uploaded to Quriov servers and is not written to iCloud.
• The distillation step sends the transcript excerpt of that one session to the provider your key belongs to (today, DeepSeek) for a single call, and ends once the distilled result comes back. This is the only step in the memory feature that leaves your phone, and it goes to the service you chose — not through Quriov's servers. If it fails, that round is dropped — no retries, no queueing.
• Deletion: you can delete entries one by one or clear everything, in the app. Deleting a single entry also records a "deletion fingerprint" so that later distillation cannot write the same sentence back — the delete button is real. Clearing everything also clears those fingerprints (a fresh start, not a permanent ban).
• Uninstalling the app deletes all local memory.

✅ Settled (#4429, 2026-09-08T05:46Z): 1.0 ships as BYOK — the key field sits openly under Me → Advanced; enter a key and the feature is on, leave it blank and it is off. If a Quriov-managed distillation option arrives later it will be optional, and this section and the third-party list in section 5 will change together.

1.3 Usage statistics (telemetry)

We record a very small anonymous usage count so we can tell whether features are working. Each record contains six fields only:

• No content: no conversation text, task titles, transcripts, attachments, location, device identifiers, or custom properties. The server rejects any field outside the list.
• Not linked to your identity: telemetry carries no account ID of any kind (and this release has no Quriov account at all). This is enforced in our code and guarded by an automated test.
• Not used for tracking: no cross-app or cross-site tracking, no advertising SDKs, no third-party analytics SDKs, and no sale or sharing of this data with data brokers.
• Retention: raw event rows are deleted after 30 days.
• The anonymous identifier exists only on this device. Reinstalling generates a new one, and we cannot link the two.

1.4 Account

• This release has no Quriov account. There is no registration and no sign-in inside the app. We do not collect a username, display name, email address or password, and there is no Quriov account of yours for us to delete.
• Waking Xiao Ai, reminders, tasks and memory all work without registering with us. (Waking Xiao Ai does have other prerequisites — your own Codex account and Quriov running on your Mac, see 1.1 — but those are accounts with other providers, not with us.)

1.5 Smart glasses (optional accessory)

• The app uses Bluetooth to discover and connect Quriov smart glasses in order to stream microphone audio from the glasses, play audio through them, and read or write glasses settings such as volume and language.
• Bluetooth is used only to connect your glasses. It is not used for location, proximity advertising, or scanning nearby users.
• The app works without glasses; you may decline the Bluetooth permission.

1.6 Other permissions on your phone

Note: earlier builds declared a speech-recognition permission, but the code no longer uses the Speech framework (on-device wake-word recognition was retired). That declaration has been dropped (usage-descriptions.md U6), which is why this table has no speech-recognition row.

2. What we do not do

• We do not sell personal data.
• We do not serve ads and we integrate no advertising or attribution SDKs.
• We do not track you across apps or websites, and we do not request App Tracking Transparency permission.
• We do not upload your contacts, your whole photo library, or your clipboard.
• We do not store your conversation content or recordings on our servers.

3. Where data is stored

• On device: conversation history, memory entries, tasks and attachments, and local diagnostic logs, inside the app sandbox.
• On our servers: only the six-field telemetry rows described in 1.3. The telemetry server is located in the United States.
• This release has no Quriov account, so our servers hold no account information that identifies you.

4. Your choices

• Keep memory off: simply do not enter an API key. Nothing is distilled and no transcript leaves your phone.
• Delete memories: individually or all at once, in the app.
• Delete your API key: clear it under Me → Advanced, which removes it from the system Keychain.
• Delete all local data: uninstall the app.
• Revoke permissions: at any time in iOS Settings → Quriov. The app degrades gracefully rather than crashing.
• Account data: this release has no Quriov account, so we hold no account data of yours (see 1.4).
• Telemetry: this version has no opt-out switch. Telemetry is only the six anonymous fields listed in 1.3, with no content of any kind; uninstalling the app stops it, and the on-device anonymous identifier goes with it.
• You can ask us to access, correct, or delete any data we hold about you, using the contact below.

5. Third-party services (listed as the code actually is)

⭐ The key fact for this release: these services run on your own account or your own key, not ours.

We do not control how these providers process data; please consult their own privacy policies. ✅ Settled (#4429, 2026-09-08T05:46Z): neither is replaced by a Quriov-hosted step in 1.0 — the public position is that the first release is a free preview running on your own API key and Codex account, with a Quriov-hosted option possibly offered later as an option.

6. Children

Quriov is not directed to children under 13, and we do not knowingly collect their personal information. If you believe a child has provided us with personal information, contact us at the address below and we will delete it.

7. Security

All transport uses HTTPS or an encrypted channel; voice signalling is encrypted at both ends and Quriov's connection service only forwards that encrypted content; third-party keys are held in the system Keychain; the shipped app binary carries no server credentials.

8. Changes

If this policy changes materially, we will update the effective date on this page and notify you in the app.

9. Contact

• Privacy: privacy@quriov.com
• Support: support@quriov.com
• Response time: one to two business days
• Operated by: Hangzhou Huanjing Qiusuo Technology Co., Ltd.(杭州幻境求索科技有限公司)