隐私政策

谁负责

微墨（Ouimot）由一位独立开发者制作和运营，背后没有公司。关于隐私的任何问题或要求，请写信到 ouimot@9nal.xyz。

不登录时

• 你的学习记录、笔记和设置都存在手机上，在 App 自己的存储空间里，并随手机本身的备份一起备份：iPhone 上是 iCloud 或电脑备份；安卓手机上是手机自己的备份和换机迁移（例如谷歌账号的备份），要你开着才有。我们看不到这些数据。
• App 只从 ouimot.9nal.xyz 下载图片和声音（词卡、封面和「发现」里的图片，发音和听力录音）。和任何网络请求一样，服务器会看到这次请求，以及发出请求的 IP 地址。安卓版闪退以后，下次打开时还会发一份崩溃报告（开关默认打开，可以关掉，见下面「崩溃报告」）。
• 安卓版不经过应用商店，安装包从 ouimot.9nal.xyz/android 下载。App 每次打开或回到前台时，从同一台服务器读一个很小的文件，看有没有新版本；有新版本时先问你，你同意了才下载，由安卓系统自己安装。
• 删除 App，就删除了它在这台手机上的数据。

登录（可选）

登录有两种方式，用哪一种都行，也可以两种都用（在「账号」里给用 Apple 登录的账号加上邮箱）。「通过 Apple 登录」在 iPhone 和网页版上有；邮箱登录安卓版和网页版现在就有，iPhone 版在下一版加上。在 App 里登录是可选的；网页版要登录才能用（见下文「网页版」）。

通过 Apple 登录。 App 不向 Apple 要你的名字，也不要邮箱。服务器保存：

• Apple 给你的一个固定编号（只对这位开发者的 App 有效，在别处没有意义），以及用密钥由它算出的一串摘要；
• Apple 的一个刷新令牌，加密保存，只在你删除账号时用来到 Apple 那里撤销这次登录授权。

即使 Apple 发来了邮箱，服务器也不存。

用邮箱登录。 你输入邮箱，我们发一封带 6 位验证码的邮件，验证码 10 分钟内有效，只能用一次。

• 账号里不保存你的邮箱地址。 服务器只保存用密钥由地址算出的一串摘要，用来认出下次登录的还是这个账号；没有服务器的密钥，从这串摘要得不出地址。地址只用来发验证码，我们不会给你发别的邮件。
• 验证码也只保存它的摘要。用过、输错 5 次或者过期，它就作废；作废的验证码最多一天后删除。
• 你可以在「账号」里另设一个密码，以后用邮箱加密码登录。密码只以加盐的 scrypt 摘要保存，我们看不到密码本身。
• App 在你的手机上记着你登录用的邮箱，只用来在「账号」里显示、下次登录时填好；它和其他设置一样随手机备份，退出登录或删除账号时清除。
• 验证码邮件由我们自己的邮件服务器（9nal.xyz）发出，不经过别的公司的发信服务。现在发信的是香港的服务器（它出问题时，德国的备用服务器可能接手）。它的投递日志记下收件地址、时间和投递结果，只存在那台服务器上，写满 30 MB 就从最旧的开始覆盖（按现在的量大约三个星期）。
• 一封邮件在送出之前（通常几秒钟）存在邮件服务器的数据库里，包括收件地址和验证码。这个数据库同步到德国的备用服务器，并加密备份到美国的一台服务器；这些备份大约五个星期后自动删除。
• 邮件没送到时（例如地址写错了），对方退回的通知一到就被丢弃，不会存进任何信箱。

登录后同步的学习数据

只有登录后，下面这些才会保存到服务器，用来在你的设备之间同步，并计算每个词什么时候该复习。它们一直保存到你删除账号为止。

• 每一次作答：哪个词，练的是哪一项（认、写、填空或说），题目给的是什么，怎样作答（选择、打字、在心里想好后自己判断，或者放弃），对还是错，你自己标出的错处（例如阴阳性、拼写），用了什么提示，打字题里你打出的答案，用的是哪个例句，题目出现的时间和你用了多长时间，作答的日期（手机上的当地日期），以及这是哪一次学习；你把判错的答案改成「我的答案也正确」，也会记下。
• 哪些新词已经学过，哪些标成了「已认识」。
• 你在词条页或「发现」里看过哪些词。
• 你给词写的笔记（你写的原文）。
• App 的设置，例如每天学多少、考试日期。
• 重置学习进度的记录。
• App 为每条记录、每一串记录生成的随机编号。

备考练习的记录（做过的题、自评、模拟考成绩）只留在手机上，不同步。

设备信息

登录后，每台设备会告诉服务器：App 自己生成的一个随机安装编号、平台、App 版本和系统版本。服务器还记着你的登录会话：什么时候开始，什么时候续期。这些都和账号存在一起，随账号一起删除。一个会话 180 天不用就结束，结束的会话 30 天后删除。

报告问题

你在词条页用「报告这个词条的问题」发来的报告包括：哪个词、词库的版本、问题的类型和你写的文字。报告和账号存在一起，随账号一起删除，只用来改正词库。

IP 地址和日志

• 数据库里的 IP 地址、邮箱地址的摘要和收件邮箱的域名（@ 后面的部分）只用来限制请求的频率（防止滥用），2 天后删除。
• 服务器的访问日志只记缩短的地址，最后一段被遮去。
• 错误日志保留 7 天。

数据存在哪里，保留多久

• 服务器在香港。
• 数据库每天做一次加密备份，在这台服务器上保留 14 天。
• 另有一份加密副本，在中国大陆（福州）的第二台服务器上保留 30 天。两台服务器上都没有解密的钥匙，所以它们都打不开这些备份。
• 账号删除以后，它的数据会随着备份到期而消失，最多 30 天。
• 账号删除以后，它的账号编号（一个随机编号，不含个人信息）会在「已删除账号」名单上保留 90 天。这样万一要从备份恢复，这个账号会被再删一次。

删除账号

在 App 里，点「今日」页右上角的人像按钮打开设置，进入「账号」，点「删除账号」，再点「删除账号和全部学习记录」确认。

服务器上这个账号的全部数据会立刻删除，包括邮箱的摘要和密码的摘要；用 Apple 登录过的，同时到 Apple 撤销「通过 Apple 登录」的授权。只有一样东西会多留一会儿：撤销要用的那个 Apple 令牌（加密的）和那串摘要，留到 Apple 接受撤销为止。通常当场就完成；Apple 一直不接受的话，每天再试一次，大约一个月后放弃并删除。

这台手机上这个账号的记录也一起清除，其他设备下次联网时同样清除。删除不能撤销。

不和任何人分享

• 没有统计分析，没有广告，没有追踪，不卖也不分享你的数据。
• 图片、发音和例句等内容都是事先做好的（部分借助 AI 工具）。你的学习数据不会发给任何 AI 服务。
• 「通过 Apple 登录」本身由 Apple 处理，适用 Apple 的隐私政策。

崩溃报告（只有安卓版）

安卓版闪退以后，下次打开时会把一份崩溃报告发到服务器，帮我们找到并改正出错的地方。

• 报告里只有：程序在哪里出的错（出错的类型，代码的类名、方法名、文件名、行号和线程名），App 的版本（以及是不是开发用的测试版），安卓的版本，手机的品牌和型号，出错的时间（精确到分钟），出错时 App 打开了多久。
• 报告里没有学习记录，没有账号，没有邮箱地址，也没有错误信息的文字（那里面可能带着你输入或看到的内容）。
• 报告里没有 IP 地址，数据库里也没有：为了限制发送的频率，地址先用一个只在内存里、每天更换的密钥变成一串认不出原地址的编号，再拿这串编号计数。和其他请求一样，访问日志里只有缩短的地址。服务器收到报告的时间只记到哪一天。
• 服务器保存报告 30 天，然后删除；数据库备份里的副本最多再留 30 天。
• iPhone 版不发崩溃报告。iPhone 上的崩溃数据由 Apple 收集，只有你在 iPhone 的设置里同意「与 App 开发者共享」，Apple 才会转给我们。
• 不想发，可以在 App 的「设置」里关掉「崩溃时发送报告」：之后什么都不记、不发，还没发出的报告也删掉。

网页版

网页版在 ouimot.9nal.xyz/app/，和 App 是同一个服务器、同一套账号。

• 要登录才能用。 不登录可以先试学 10 个词；继续学、查词库、看「发现」和备考都要先登录（邮箱，或「通过 Apple 登录」）。
• 试学时，学习记录只存在你的浏览器里，我们看不到；登录时你可以把它们并进账号，也可以丢掉。

• 浏览器里存的东西都在浏览器给这个网站单独划出的存储空间里，别的网站读不到：

  • 你的学习记录、笔记和设置（登录后，和 App 一样同步到服务器，见上文）；
  • 备考的练习记录（只在这个浏览器里，不上传）；
  • 「日常」的口味（喜欢、收藏、关注、看过什么），只在这个浏览器里；
  • 你登录用的邮箱地址，只用来在「账号」里显示、下次登录时填好；
  • 词库和题库的内容包（试学时是只含几十个词的试用包，登录后是完整的内容包）；
  • 看过的图片和声音的缓存。

  退出登录时，这个账号的学习记录、备考记录、「日常」的口味、记着的邮箱和完整内容包都从浏览器里删掉（完整内容包要在能连上服务器、换回试用包之后才删；断网时，下次打开再删）。清除浏览器的网站数据会删掉全部；用无痕窗口时，关掉窗口就全部没了。

• Cookie：只有一个，用来保持登录（一个续期令牌）。只有 ouimot.9nal.xyz 自己能设它；网页本身的脚本读不到；服务器只在续期登录时读它，而且只认网页自己发出的请求；打开首页时，只看有没有它，有就直接进网页版。180 天不用，登录就结束。退出登录时，服务器上的这次登录同时结束；断网时退出，下次打开网页时先把它结束。没有任何统计、广告或追踪用的 Cookie。
• 「通过 Apple 登录」时，网页会转到 Apple 的网站，登录完再回来。我们不向 Apple 要你的名字和邮箱。登录过程中，这个标签页会临时记一个随机值，用来确认回来的是这次登录，登录完就删掉。
• 每个浏览器登录时告诉服务器的设备信息：网页版自己生成的一个随机编号、平台（网页）、网页的版本号，以及浏览器的名称和版本。
• 下载完整内容包时，服务器记下这个账号当天下载了几次，只用来限制次数（防止有人整份复制词库），2 到 3 天后删除。

儿童

微墨面向一般大众，不是专为儿童设计的。我们不会有意收集儿童的数据。如果你认为孩子通过微墨给了我们数据，请写信告诉我们，我们会删除。

你的权利

• 删除：随时在 App 里删除账号（见上面）。
• 查看和其他要求：想要一份服务器上你的全部数据，或者有别的要求，请写信到 ouimot@9nal.xyz。

这份政策的改动

政策有改动时，我们会更新顶部的日期，并在这里写明改了什么。

• 2026 年 11 月 1 日：加上网页版：浏览器里存的数据、登录用的 Cookie、内容包下载次数。
• 2026 年 11 月 1 日：加上安卓版的崩溃报告。
• 2026 年 11 月 1 日：加上邮箱登录（安卓版现在就有，iPhone 版在下一版加上）。
• 2026 年 11 月 1 日：加上安卓版：手机备份、检查新版本。
• 2026 年 10 月 31 日：联系邮箱改为 ouimot@9nal.xyz。
• 2026 年 10 月 31 日：第一版。

Privacy Policy

Last updated November 1, 2026

Who is responsible

Ouimot (微墨) is made and run by an independent developer; there is no company behind it. For any question or request about privacy, write to ouimot@9nal.xyz.

Without signing in

• Your study records, notes and settings are stored on your phone, in the app's own storage, and are included in your phone's own backups: iCloud or computer backups on iPhone; on Android, the phone's own backup and device-to-device transfer (for example a Google account backup), when you have them turned on. We cannot see them.
• The app only downloads pictures and sound from ouimot.9nal.xyz (the pictures on word cards, pack covers and in the 发现 feed; pronunciations and listening recordings). As with any web request, the server sees the request and the IP address it comes from. After a crash, the Android app also sends a crash report the next time it opens (on unless you turn it off; see Crash reports below).
• The Android app does not come from an app store: it is downloaded from ouimot.9nal.xyz/android. Each time the app opens or comes back to the foreground, it reads a small file from the same server to see whether there is a new version. If there is, it asks you first; only when you agree does it download it, and Android itself installs it.
• Deleting the app deletes its data on that phone.

Signing in (optional)

There are two ways to sign in. Use either, or both (add an email address to an account made with Apple, under Account). Sign in with Apple is available on iPhone and in the web version; email sign-in is in the Android app and the web version now, and comes to iPhone in the next version. In the apps, signing in is optional; the web version needs it (see The web version below).

Sign in with Apple. The app asks Apple for neither your name nor your email. The server stores:

• a stable identifier Apple gives you (valid only for this developer's apps, meaningless anywhere else), and a digest of it computed with a secret key;
• a refresh token from Apple, encrypted, used only to revoke the sign-in at Apple when you delete your account.

The server does not store an email address, even if Apple sends one.

Email. You enter your address and we send a message with a 6-digit code, valid for 10 minutes and usable once.

• Your account does not store your email address. The server keeps only a digest computed from the address with a secret key, to recognise the same account next time; without the server's key the address cannot be recovered from it. The address is used only to send the code; we do not send you any other email.
• The code is kept only as a digest. Once used, after 5 wrong tries, or when it expires, it stops working; such a code is deleted within a day.
• You can set a password under Account and then sign in with your address and password. It is kept only as a salted scrypt digest; we never see the password itself.
• The app keeps the address you signed in with on your phone, only to show it under Account and fill it in next time; it is included in your phone's backups like the other settings, and cleared when you sign out or delete your account.
• Sign-in emails are sent by our own mail server (9nal.xyz), not by another company's sending service. Today that is our server in Hong Kong (if it fails, a standby server in Germany may take over). Its delivery log records the recipient address, time and delivery status; the log stays on that server and is overwritten, oldest first, once it reaches 30 MB (about three weeks at the current volume).
• While a message waits to be delivered (normally a few seconds), it is held in the mail server's database, recipient address and code included. That database is mirrored to the standby server in Germany and backed up, encrypted, to a server in the United States; these backups are deleted automatically after about five weeks.
• If a message cannot be delivered (for example a mistyped address), the bounce notice is discarded on arrival and never kept in a mailbox.

Study data synced when you are signed in

Only when you are signed in are the following kept on the server, to sync your devices and to work out when each word is due for review. They are kept until you delete your account.

• Each answer: which word, which skill was practiced (recognizing, writing, filling in a sentence, or saying), what the question showed, how you answered (choosing, typing, recalling in your head and judging yourself, or giving up), right or wrong, what you marked as wrong yourself (such as gender or spelling), any hints used, what you typed for a typed answer, which example sentence was used, when the question appeared and how long you took, the date of the answer (the local date on your phone), and which study session it belongs to. If you mark an answer judged wrong as "my answer is also correct", that is recorded too.
• Which new words you have been taught, and which you marked as "already known".
• Which words you looked at on a word page or in the 发现 (Discover) feed.
• The notes you write on words (the text as you wrote it).
• The app's settings, such as how much to study each day or your exam date.
• Records of progress resets.
• Random ids the app makes for each record and for each run of records.

Records of exam practice (the items you did, your self-assessments, mock-exam results) stay on your phone and are not synced.

Device information

Once you are signed in, each device tells the server a random installation id made by the app, the platform, the app version and the system version. The server also keeps your sign-in sessions: when each started and when it was last renewed. All of this is kept with your account and deleted with it. A session ends after 180 days without use; ended sessions are removed after 30 days.

Problem reports

A report you send from a word page with 报告这个词条的问题 ("report a problem with this entry") contains: which word, the version of the vocabulary, the kind of problem, and the text you write. Reports are kept with your account, deleted with it, and used only to fix the vocabulary.

IP addresses and logs

• In the database, IP addresses, digests of email addresses and the domains of recipient addresses (the part after @) are kept only to limit how often requests can be made (to protect against abuse), and are removed after 2 days.
• The server's access log keeps only a shortened address, with its last part masked.
• Error logs are kept for 7 days.

Where data is kept, and for how long

• The server is in Hong Kong.
• An encrypted backup of the database is made every day and kept for 14 days on that server.
• An encrypted copy is kept for 30 days on a second server, in mainland China (Fuzhou). The decryption key is on neither server, so neither can open the backups.
• After an account is deleted, its data leaves the backups as they expire, within 30 days.
• After an account is deleted, its account id (a random id with no personal information) stays on a list of deleted accounts for 90 days, so that if a backup ever has to be restored, the account is deleted again.

Deleting your account

In the app, tap the person button at the top right of 今日 (Today) to open the settings, go to 账号 (Account), tap 删除账号 (Delete account), and confirm with 删除账号和全部学习记录 (Delete the account and all study records).

All of the account's data on the server is deleted at once, the digests of your email address and password included; if you used Sign in with Apple, the authorization is revoked at Apple. Only one thing stays a little longer: the Apple token needed for the revocation (encrypted) and the digest, until Apple accepts the revocation. That usually happens right away; if Apple keeps refusing, it is tried again daily and given up and deleted after about a month.

The account's records on that phone are cleared too, and on your other devices the next time they go online. Deletion cannot be undone.

No sharing with anyone

• No analytics, no ads, no tracking; your data is not sold or shared.
• Content such as pictures, pronunciations and example sentences was made in advance (partly with AI tools). Your study data is never sent to any AI service.
• Sign in with Apple itself is handled by Apple, under Apple's privacy policy.

Crash reports (Android only)

When the Android app crashes, it sends a crash report to the server the next time it opens, so that we can find and fix what went wrong.

• A report holds only: where in the program it failed (the kind of error; the class and method names, file names, line numbers and the name of the thread), the app's version (and whether it is a test build made by the developer), the Android version, the phone's maker and model, when it happened (to the minute), and how long the app had been open.
• It holds no study records, no account, no email address, and no text of error messages (which could contain something you typed or saw).
• Neither the report nor the database holds your IP address: to limit how often reports can be sent, the address is first turned into a code by a key that exists only in memory and changes every day, and only that code is counted; the address cannot be recovered from it. As with any other request, the access log keeps only a shortened address. The server records only the day a report arrived.
• The server keeps a report for 30 days, then deletes it; copies in the database backups stay at most 30 days longer.
• The iPhone app sends no crash reports. On iPhone, crash data is collected by Apple, and passed on to us only if you agreed to share it with app developers in your iPhone's settings.
• If you would rather not send them, turn off 崩溃时发送报告 ("send a report when the app crashes") in the app's 设置 (Settings): from then on nothing is recorded or sent, and reports still waiting to be sent are deleted.

The web version

The web version is at ouimot.9nal.xyz/app/: the same server and the same accounts as the apps.

• It needs you to sign in. Without signing in you can try 10 words; to go on, and to use the word library, 发现 and exam practice, you sign in (with your email address, or with Sign in with Apple).
• While you try it, your study records stay in your browser only; we cannot see them. When you sign in you can add them to your account or drop them.

• What the browser keeps is in the storage the browser sets aside for this site, which no other site can read:

  • your study records, notes and settings (once you are signed in, synced to the server as in the apps, see above);
  • your exam practice records (in this browser only, never uploaded);
  • your 日常 preferences (likes, saves, follows, what you have seen), in this browser only;
  • the email address you signed in with, only to show it under Account and fill it in next time;
  • the content packs of the vocabulary and exam items (while you try it, a trial pack of a few dozen words; once signed in, the full pack);
  • a cache of the pictures and sounds you have seen.

  When you sign out, this account's study records, exam records, 日常 preferences, the remembered address and the full content pack are removed from the browser (the full pack once the trial pack has been fetched again; when you are offline, the next time the page opens). Clearing the browser's site data removes all of it; in a private window, all of it goes when the window closes.

• Cookies: just one, to keep you signed in (a renewal token). Only ouimot.9nal.xyz itself can set it; the page's own scripts cannot read it; the server reads it only to renew a sign-in, and only for requests from the page itself; when the home page is opened, the server only looks whether it is there, and if it is, goes straight to the web version. Unused for 180 days, the sign-in ends. When you sign out, that sign-in ends on the server too; if you sign out while offline, it is ended the next time the page opens. There are no cookies for analytics, ads or tracking.
• With Sign in with Apple, the page goes to Apple's website and comes back when you have signed in. We do not ask Apple for your name or email address. During the sign-in, the tab briefly keeps a random value to check that what comes back belongs to this sign-in; it is removed afterwards.
• The device information a browser gives the server when you sign in: a random number the web version makes, the platform (web), the web version's build number, and the browser's name and version.
• When the full content pack is downloaded, the server counts how many times this account downloaded it that day, only to limit it (so that nobody copies the whole vocabulary); the counts are deleted after 2 to 3 days.

Children

Ouimot is for a general audience and is not designed for children. We do not knowingly collect children's data. If you believe a child has given us data through Ouimot, write to us and we will delete it.

Your rights

• Deletion: delete your account in the app at any time (see above).
• Access and other requests: for a copy of all your data on the server, or any other request, write to ouimot@9nal.xyz.

Changes to this policy

When this policy changes, we update the date at the top and say here what changed.

• November 1, 2026: the web version: what the browser keeps, the sign-in cookie, counting content-pack downloads.
• November 1, 2026: crash reports from the Android app.
• November 1, 2026: email sign-in (in the Android app now, on iPhone from the next version).
• November 1, 2026: the Android app: phone backups, checking for a new version.
• October 31, 2026: the contact address is now ouimot@9nal.xyz.
• October 31, 2026: first version.