Offego（破圈）隐私政策 / Privacy Policy
Core summary: Offego provides profiles, Coffee Chat, messaging, events, search, and the personal 小O social assistant. We process information needed for the features you use. Details marked “native iOS” are based on version 1.0.2 (107); the separate Public Opportunities disclosure in section 4 applies to newer native iOS versions that support the feature, when it is enabled. This does not mean that older versions, Android, or the mini program have the same features. Other clients process information according to their actual features and permissions.
中文
欢迎使用 Offego（破圈）。本政策说明我们如何收集、使用、存储、共享和保护个人信息，以及你可以如何管理这些信息。
1. 我们收集哪些信息
- 账号与资料：手机号、昵称、头像、用户 ID、登录凭据、主动绑定的邮箱，以及你主动填写的职业、公司、学校、城市、兴趣标签和个人介绍。名片还可包含你填写的常驻地址（包括具体地址）、对外展示的手机号或邮箱、微信号和小红书账号等联系方式；提交后会按名片功能展示。
- 内容与互动：你发布或发送的文字、照片、视频、语音、附件，以及 Coffee Chat、关注和粉丝等连接关系、点赞、收藏、评论、浏览记录、活动报名、消息已读、举报申诉及反馈记录。公开内容会向其他用户展示；私信内容按会话功能传递给相应接收方。
- 搜索与小O输入：你主动提交的查询、筛选条件和任务内容，以及完成请求所必需的上下文。原生 iOS 的普通搜索历史列表存放在本机，不会作为整份历史自动同步到 Offego 服务器；发起搜索时，当前查询仍会提交给相应搜索服务。小O搜索任务的输入会按第 6 节的网关任务规则临时保存，云端模型处理范围见第 4 节。
- 位置：授权定位后，用于确定城市或使用相关位置功能；原生 iOS 中，你明确选择活动地点或发送聊天位置时，相应坐标会随该内容提交。你也可以手动选择城市，而不授权设备定位。
- 设备与安全日志：客户端和服务端可能处理设备型号、系统及 App 版本、IP 地址、请求状态、访问时间、网络状态及故障信息，用于请求处理、安全和排障。具体范围随版本及功能而异。原生 iOS 的 MetricKit 性能和崩溃报告仅保存在本机，见第 8 节，不会因为本条的一般说明而自动上传。
2. 处理目的与广告追踪
- 完成注册、身份校验、登录、账号管理和安全风控。
- 展示资料和公开内容，提供聊天、Coffee Chat、活动、搜索、推荐和小O功能。
- 提供客服，处理投诉举报，维护服务稳定与安全，履行适用的法律义务。
- 在取得所需权限或同意后发送服务通知。
原生 iOS 1.0.2（107）不使用 IDFA，不集成广告追踪 SDK，也不将 App 数据与其他公司 App 或网站的数据结合，用于定向广告或广告效果衡量。站内推荐和 AI 请求服务于上述产品功能，不等同于跨公司广告追踪。实际收集的账号、消息、位置等信息仍按本政策说明处理。
3. 共享、第三方服务与外部链接
我们不出售你的个人信息。我们在实现短信登录、托管存储、消息传递、位置或 AI 等相应功能所必需的范围内使用技术服务提供方；AI 与语音处理方及数据范围详见下文。你主动公开的资料、动态和活动按产品功能向其他用户展示。
原生 iOS 1.0.2（107）未集成微信 OpenSDK，未开放微信登录或绑定，不通过该 SDK 收集信息；会员购买与支付尚未开放，不处理支付信息。未来开放相关功能前会更新说明。其他客户端或旧版本是否提供第三方登录、支付等功能，以其实际入口和相应说明为准。
外部网页和服务由其各自的隐私政策管理。发生合并、收购或资产转让等需要转移个人信息的情形，或依法必须披露时，我们会履行相应的通知和保护义务。
4. 小O与云端 AI
原生 iOS 中，小O的访谈、画像整理、任务规划、开场建议和帮聊由 Offego 服务端统一提供，并按功能需要调用云端模型生成内容。AI 输出可能有误，请核对后使用。
处理一次请求时，会发送你主动提交的文字、必要的近期对话、此次任务涉及的公开人物或动态信息，以及你允许使用的已确认画像、记忆和社交设置，以理解意图和生成回复。普通站内搜索不调用模型；智能站外查询会将查询文字交给模型拆解条件。
登录凭据、本机私密备忘和未选择的相册内容不作为模型上下文发送。你可在小O设置中关闭“对话时使用人物画像与记忆”，或修改、删除这些资料；关闭后，后续请求不再附带画像与记忆。该设置不能撤回已经发送的内容。
开场、邀约和活动草稿需要你核对后发送或发布。只有在你为特定会话明确启用自动帮聊后，小O才按该授权自动回复，可随时暂停、结束或接手。官方小O是独立的 AI 社区账号，依据社区公开内容及可核对的公开来源发布或评论，不使用你的私人小O资料或私信来生成社区内容。
使用云端功能时，Offego 服务端会将本节列明且你允许使用的必要内容传输给外部云端模型服务，用于完成本次请求。你可以选择不使用小O的云端功能；相关数据范围、用途和控制方式以上述说明为准。
公开机会：单次分析与可选画像
公开机会功能开放后，普通机会列表按发布时间展示，列表和检索不调用模型。你主动选择“小O整理问题”时，本次条件和所选公开线索会发送至上述模型服务，用于整理依据、待核实事项和可以询问的问题。
相关画像默认不附带。只有在“个性化推荐”和小O“对话时使用人物画像与记忆”均允许使用资料、画像已由你确认，并且你在本次分析中明确选择后，才附带页面展示的“最近在做”和“经历与长处”片段；该功能不读取私人记忆。关闭相关授权、删除相关资料或退出账号后，当前页面会取消分析并清除已有结果；这不能撤回已经发送给模型服务的内容。
Offego 不持久保存这次分析的输入和结果，页面关闭或清除后不再展示。服务端仅为当日防重复请求和额度控制，保存上海时区的日期、计数以及经 HMAC 哈希保护的账号和请求标识，不含查询、画像或分析正文。云端服务提供方按其隐私政策处理已经收到的请求；Offego 的上述保存方式不代表该提供方不保存数据。
这些结果是你的私人参考草稿，官方小O不接收这些私人分析资料，也不会替你联系、报名或发布。你主动复制、保存或发送的副本由你自行管理。公开线索保留原作者、来源链接和可核对的原文依据；外部作者不因此成为 Offego 用户。查看原帖后，外部网站按其自身政策处理相应访问。
5. 语音输入与语音消息
原生 iOS 的语音输入在你点击麦克风并授权后使用 Apple Speech 语音识别。设备支持时优先本机识别，否则音频可能发送至 Apple 处理。识别结果先进入输入框，不自动发送；你点击发送后，文字才会提交到相应会话或小O。Offego 不保存语音输入的原始音频。
聊天中主动录制并发送的语音消息是另一项功能，该音频会上传到 Offego 以供接收方播放。你可在 iOS 设置中撤回麦克风或语音识别权限，仍可使用文字输入。另见 Apple 语音识别与隐私说明。
6. 小O本地资料、备份、任务与导出
原生 iOS 中，小O的画像、记忆、设置和对话存放于按环境及 Offego 账号隔离的受保护本地文件；画像、记忆及设置另有本机钥匙串恢复副本。登录凭据另存于钥匙串。使用云端功能时仍会发送第 4 节所述的必要上下文，本地保存不代表全部处理均在本机完成。
本地文件可能随你启用的设备备份或换机迁移带到新设备。iCloud 设备备份由 Apple 和你的 Apple 账号设置控制；当前未启用 CloudKit 实时同步，多设备间不会自动合并小O资料。
本机私密备忘仅保留在本机，不加入小O上下文，也不包含在小O资料导出中。导出文件是明文，可选择包含对话记录，已导出的副本由你自行保管和删除。
为使任务在 App 切到后台后继续运行，Offego 网关会临时保存加密的任务输入与处理状态，并按从任务创建起 24 小时的窗口清理。帮聊授权及必要的会话处理记录保存在 Offego 服务端；清除本机对话不等于撤销帮聊，请在帮聊管理中暂停或结束。24 小时窗口是 Offego 网关任务记录的保留规则，不代表模型服务提供方的保留期限。公开机会的单次分析不采用此任务保存方式，适用第 4 节的单独说明。
7. 你的权利与个性化控制
- 访问、更正或删除个人资料及内容，申请注销账号，或就个人信息处理提出咨询、投诉和依法适用的复制、导出或限制处理请求。
- 通过系统设置撤回定位、通知、麦克风及语音识别等权限；撤回不影响之前依法进行的处理，部分依赖权限的功能将无法使用。
- 原生 iOS 可在“我的 → 设置 → 隐私设置 → 个性化推荐”关闭开关，关闭即时生效。此后不基于个人特征或浏览记录进行推荐，改为按发布时间、你明确选择的城市等非个性化条件展示；你主动发起的搜索或小O任务仍可使用。
- 在小O设置中查阅、更正、删除、导出或导入资料，也可重新访谈并审阅画像。相关设置对后续请求生效，不能撤回已发送的内容；已经导出的外部副本需要你自行管理。
8. 本机性能诊断
原生 iOS 使用 Apple MetricKit 接收系统性能及崩溃报告，可能包括设备型号、系统及 App 版本、耗电、启动、卡顿统计和技术调用堆栈，不附加账号、聊天内容或搜索词。
这些报告仅保存在本机受保护目录，不自动上传、不随设备备份保存，保留最近 7 天，最多 20 份、总量不超过 10 MB。你可在“帮助与客服 → 诊断与性能”导出或清除；导出副本由你管理，分享前请确认接收方。你主动向客服提供诊断文件时，我们会为处理该问题读取相应文件。
8.1 自愿帮助改进 Offego（新增原生 iOS 功能）
“我的 → 设置 → 隐私设置 → 帮助改进 Offego”默认关闭，与个性化推荐及小O记忆分别控制。只有你主动开启后，App才汇总功能使用情况，用于发现常用功能与操作困难；不影响正常使用，也不用于广告或跨App跟踪。
汇总内容为固定功能模块的进入次数、前台有效使用时长，以及聊天发送和内容发布的尝试、成功与失败次数。时长按5秒粗化，后台及超过30秒没有交互的闲置时间不计入。不上报聊天或发布正文、搜索词、所查看的人或内容ID、页面顺序、位置、链接、账号ID、设备或安装标识。
本机仅保存最近7个自然日的受保护汇总，不随设备备份保存。服务开放后通过独立无登录凭据、无Cookie的连接向Offego发送汇总，至多每天成功上传一次，失败时退避重试。仅附带粗化App版本及随机批次标识以防重复计数，不调用AI或第三方统计SDK。网络传输需要服务器短暂处理IP用于限流，汇总接收服务不持久保存IP、User-Agent或请求正文。
服务端将数据合并为日期、版本与功能模块的统计，保存90个自然日；随机批次标识与校验摘要仅保留7个自然日用于去重。统计不建立个人行为档案，也不加入私人小O记忆。
你可以随时关闭以停止之后的采集和上传，并清除本机未上传汇总。退出或切换账号时清空当前待上传数据，另一个账号需独立选择。已经合并且没有账号关联的统计无法按个人找回或撤销；你主动导出的汇总副本由你自行保管。
9. 存储、安全与保留
我们采用访问控制、加密传输、最小权限和日志审计等合理措施保护信息。账号、公开内容、聊天及必要的安全日志按实现服务、安全及适用法律要求所必需的期限保留；小O任务和本机诊断的具体窗口见第 6、8 节。互联网环境并非绝对安全。
申请注销或删除后，我们在符合法律义务的前提下删除或匿名化相关信息。已发送给其他用户、由你导出或保存于外部服务的副本，可能需要向相应接收方或服务分别处理。
10. 未成年人、政策更新与联系
Offego 不面向未满 13 岁的儿童提供服务。其他未成年人应在监护人阅读并同意本政策后使用；对依法需要监护人同意处理的信息，我们会给予特别保护。如果你认为儿童或未成年人未经所需同意向我们提供了信息，请联系我们。
政策会随实际功能或适用要求更新。重大变化将通过 App 内提示、站内通知或其他合理方式告知。关于本政策、个人信息更正或删除等请求，请通过 App“帮助与客服”或邮件联系：bailu@offego.cn。
English
Welcome to Offego. This policy explains how we collect, use, store, share, and protect personal information, and how you can manage it.
1. Information we collect
- Account and profile information: phone number, nickname, avatar, user ID, login credentials, an email address you choose to bind, and the role, company, school, city, interests, or bio you provide. Your profile card may also include an address you enter (including a full address), a publicly displayed phone number or email, and WeChat or Xiaohongshu account handles. Submitted details are displayed through profile-card features.
- Content and interactions: text, photos, videos, voice messages, and attachments you publish or send, together with Coffee Chat, following and follower relationships, likes, saves, comments, browsing records, event registrations, message-read status, reports, appeals, and feedback. Public content is shown to other users; private messages are delivered to the relevant recipients.
- Search and 小O inputs: queries, filters, tasks, and the context needed to fulfill your requests. In native iOS, the ordinary search-history list stays on the device and is not automatically synchronized as a complete history to Offego servers. The current query is still submitted to the relevant search service when you search. Inputs to 小O search tasks are temporarily stored under the gateway task rules in section 6; section 4 describes cloud-model processing.
- Location: with permission, location is used to determine a city or provide relevant location features. In native iOS, coordinates are submitted with an event location or a chat location that you explicitly choose to share. You can also choose a city manually without granting device location access.
- Device and security logs: clients and servers may process device model, OS and app version, IP address, request status, access time, network status, and fault information for request handling, security, and troubleshooting. The scope depends on the version and feature. Native iOS MetricKit performance and crash reports stay on the device as described in section 8; this general description does not cause them to be uploaded automatically.
2. Purposes and advertising tracking
- Registration, identity verification, sign-in, account management, and security.
- Profiles, public content, messaging, Coffee Chat, events, search, recommendations, and 小O features.
- Support, reports and complaints, service stability, security, and applicable legal obligations.
- Service notifications after obtaining any required permission or consent.
Native iOS 1.0.2 (107) does not access IDFA, include advertising-tracking SDKs, or combine app data with data from other companies’ apps or websites for targeted advertising or advertising measurement. In-app recommendations and AI requests support the product functions above and are not cross-company advertising tracking. Account, message, location, and other information actually collected is still processed as described in this policy.
3. Sharing, third-party services, and external links
We do not sell your personal information. We use technology providers as necessary for the features you use, including SMS sign-in, hosting and storage, message delivery, location, or AI. AI and speech providers and the relevant data are described below. Profiles, posts, and events you make public are shown to other users through the product.
Native iOS 1.0.2 (107) does not include WeChat OpenSDK or offer WeChat sign-in or account binding, and does not collect data through that SDK. Membership purchases and payments are not enabled and payment information is not processed. We will update this explanation before introducing those features. Third-party sign-in or payments in other clients or older versions depend on their actual features and corresponding notices.
External websites and services have their own privacy policies. If a merger, acquisition, or asset transfer requires a transfer of personal information, or disclosure is required by law, we will fulfill applicable notification and protection obligations.
4. 小O and cloud AI
In native iOS, 小O interviews, portrait summaries, task planning, conversation starters, and chat assistance are provided through Offego servers, which call cloud models as needed to generate content. AI output may be inaccurate; review it before use.
A request sends the text you submit, necessary recent conversation, relevant public profile or post information, and confirmed portrait, memories, and social settings you allow to be used, for understanding intent and generating a response. Ordinary in-app search does not call the model; intelligent external search sends query text to the model to interpret search conditions.
Login credentials, device-only private notes, and unselected photo-library content are not sent as model context. In 小O settings, you can turn off the use of portrait and memories in conversations, or edit or delete those records. Subsequent requests then omit the portrait and memories. This setting cannot recall information already sent.
Conversation starters, invitations, and event drafts require your review before sending or publishing. 小O automatically replies only after you explicitly enable automatic chat assistance for a particular conversation; you can pause, end, or take over it. Official 小O is a separate AI community account that posts or comments using public community content and verifiable public sources, without using your private 小O records or direct messages to generate community content.
When you use cloud features, Offego servers transmit the necessary information described in this section, within the permissions you have granted, to external cloud-model services to fulfill your request. You can choose not to use 小O cloud features. The information involved, purposes, and controls are described above.
Public Opportunities: one-time analysis and optional portrait excerpts
When Public Opportunities is enabled, its ordinary list is ordered by publication time, and listing and search do not call the model. When you choose “Ask 小O to prepare questions,” your criteria for that request and the selected public opportunity are sent to the model service above to organize supporting evidence, points to verify, and questions you could ask.
Portrait information is omitted by default. It is included only when Personalized Recommendations and 小O’s use-of-portrait-and-memories setting both permit it, you have confirmed your portrait, and you explicitly opt in for this analysis. Only the displayed “Recent focus” and “Experience and strengths” excerpts are included; this feature does not read private memories. Revoking the relevant permission, deleting relevant records, or signing out cancels the analysis and clears existing results from the current page. This cannot recall content already sent to the model service.
Offego does not persist the input or output of this analysis, and results are no longer displayed after you close the page or clear them. For daily duplicate-request prevention and quota control, the server stores only the date in the Asia/Shanghai time zone, counts, and HMAC-protected account and request identifiers, without query text, portrait text, or analysis content. The cloud provider handles requests it has already received under its own privacy policy; Offego’s storage practices above do not mean that the provider retains no data.
Results are private reference drafts. Official 小O does not receive these private analysis records, and the feature does not contact anyone, register, or publish on your behalf. You control copies you choose to copy, save, or send. Public opportunities retain attribution, source links, and verifiable source excerpts; external authors do not thereby become Offego users. When you open the original source, the external website handles the visit under its own policy.
5. Dictation and voice messages
In native iOS, dictation uses Apple Speech after you tap the microphone and grant permission. On-device recognition is preferred when supported; otherwise audio may be sent to Apple. Recognized text first appears in the input field and is not sent automatically. It is submitted to the relevant conversation or 小O only when you tap send. Offego does not retain the raw audio used for dictation.
Voice messages you record and send in chat are a separate feature: that audio is uploaded to Offego so the recipient can play it. You can revoke microphone or speech-recognition permission in iOS settings and continue typing. See Apple’s speech and privacy information.
6. Local 小O records, backup, tasks, and exports
In native iOS, 小O portraits, memories, settings, and conversations are stored in protected local files separated by environment and Offego account. Portraits, memories, and settings also have a device-local Keychain recovery copy. Login credentials are stored separately in Keychain. Cloud features still send the necessary context described in section 4; local storage does not mean that all processing stays on the device.
Local files may move to another device through device backup or migration you enable. iCloud device backup is controlled by Apple and your Apple account settings. CloudKit live synchronization is not enabled, and 小O records are not automatically merged between devices.
Device-only private notes stay on the device, are not included in 小O context, and are excluded from 小O exports. Export files are unencrypted and can optionally include conversations. You are responsible for keeping and deleting exported copies.
To continue tasks after the app moves to the background, the Offego gateway temporarily stores encrypted task input and processing status and cleans it up using a 24-hour retention window measured from task creation. Chat-assistance authorizations and necessary conversation-processing records are stored on Offego servers. Clearing local conversations does not revoke chat assistance; pause or end it in its management screen. The 24-hour window applies to Offego gateway task records, not to the model provider’s retention practices. One-time Public Opportunities analysis does not use this task-storage mechanism and follows the separate explanation in section 4.
7. Your rights and personalization controls
- Access, correct, or delete profile information and content, request account deletion, and make inquiries, complaints, or legally applicable requests for copies, exports, or processing restrictions.
- Revoke location, notifications, microphone, or speech-recognition permissions in system settings. Revocation does not affect prior lawful processing; dependent features may no longer work.
- In native iOS, turn off “Personalized Recommendations” under Me → Settings → Privacy Settings. The change takes effect immediately. Recommendations then stop using personal characteristics or browsing history and instead use non-personalized criteria such as publication time or a city you explicitly select. Searches or 小O tasks you initiate remain available.
- View, correct, delete, export, or import records in 小O settings, or repeat the interview and review your portrait. Settings affect subsequent requests and cannot recall information already sent. You must manage copies already exported outside the app.
8. On-device performance diagnostics
Native iOS uses Apple MetricKit to receive system performance and crash reports, which may include device model, OS and app version, energy use, launch and hang statistics, and technical call stacks. We do not add account details, chat content, or search terms.
These reports stay in a protected directory on the device, are not uploaded automatically, and are excluded from device backup. They are retained for up to 7 days, with limits of 20 reports and 10 MB in total. You can export or clear them under Help and Support → Diagnostics and Performance. You control exported copies and should check the recipient before sharing. If you voluntarily send a diagnostic file to support, we will read it to address the issue.
8.1 Optional product improvement (new native iOS feature)
“Help Improve Offego” under Me → Settings → Privacy Settings is off by default. It is separate from personalized recommendations and 小O memory. Only after you opt in does the app aggregate feature usage to understand useful features and difficulties. Opting out does not restrict normal use. The data is not used for advertising or cross-app tracking.
We aggregate visits to fixed feature categories, active foreground time rounded to five seconds, and attempts, successes, and failures for sending chats and publishing content. Background time and idle time after 30 seconds without interaction are excluded. No chat or post text, search terms, viewed person or content IDs, page sequence, location, URLs, account ID, device ID, or installation ID is uploaded.
Protected on-device aggregates are retained for seven calendar days and excluded from device backup. When the collection service is available, a separate connection without login credentials or cookies uploads aggregates to Offego at most once successfully per day, with delayed retries on failure. The upload includes only a coarse app version and a random batch identifier for deduplication. No AI or third-party analytics SDK is involved. Transmission requires temporary processing of network IP for rate limiting; the aggregate receiver does not persist IP, User-Agent, or request bodies.
The server combines counts by server date, app version, and feature category for 90 calendar days. Random batch identifiers and checksums are retained for seven calendar days to prevent duplicate counts. These aggregates do not create an individual activity profile or become part of private 小O memory.
You can turn the option off at any time to stop subsequent collection and uploads and clear unsent local aggregates. Signing out or changing accounts clears pending data, and each account chooses separately. Once combined without an account association, previously uploaded statistics cannot be retrieved or withdrawn for an individual. You control any copies you explicitly export.
9. Storage, security, and retention
We use reasonable measures such as access controls, encrypted transmission, least privilege, and log auditing. Account records, public content, chats, and necessary security logs are retained as needed for service, security, and applicable legal obligations. Sections 6 and 8 specify the windows for 小O tasks and on-device diagnostics. Internet systems cannot be guaranteed absolutely secure.
Following an account or data deletion request, we delete or anonymize relevant information subject to legal obligations. Copies already sent to other users, exported by you, or stored with external services may need to be handled separately with the relevant recipient or service.
10. Minors, policy changes, and contact
Offego is not intended for children under 13. Other minors should use it only after a guardian has read and agreed to this policy. Information legally requiring guardian consent receives special protection. Please contact us if you believe a child or minor has provided information without required consent.
We update this policy as features or applicable requirements change. Material changes will be communicated through in-app notices, messages, or other reasonable means. For questions about this policy or requests to correct or delete personal information, use Help and Support in the app or email bailu@offego.cn.