Version 2026-08-24
Privacy Policy
This Privacy Policy explains how SecondTry accesses, uses, stores, shares and deletes personal data, including Google user data.
1. Scope and controller
This policy applies to the SecondTry Android, iOS and Web applications and the related API. “SecondTry,” “we,” and “us” refer to 合肥市知识流动人工智能应用软件有限责任公司, the developer and operator of SecondTry in China.
2. Data we process
| Category | Examples | Purpose |
|---|---|---|
| Account and authentication | SecondTry account and identity IDs, email address for email or Google login, provider identifier, password hash for email accounts, session and verification records | Create and protect the account, sign in, synchronize devices, prevent abuse and recover access |
| Learning content | Question photos, cropped images, question and answer text, subject, knowledge points, explanations, edits, mistake cards and practice-sheet selections | Generate, edit, store, synchronize and print the learning materials requested by you |
| Subscription data | Product and base-plan identifier, entitlement state, billing period, expiry, cancellation state, sandbox status and pseudonymous purchase/customer identifiers | Sell, restore and manage SecondTry Pro, grant quota, prevent duplicate grants and support deletion |
| Technical and security data | Request IDs, timestamps, network-derived rate-limit keys, app/browser state, error codes and security events | Operate the service, diagnose failures, enforce limits and protect accounts. SecondTry does not ship advertising analytics in this release. |
Camera and photo-library access is used only when you choose an image. A selected image is not uploaded until you confirm the crop and start processing.
3. Google user data
Google sign-in provides a stable Google account identifier and, when available, a verified email address. We use this Google user data only to authenticate you, keep the same SecondTry account across devices, display the signed-in identity, and perform a fresh identity check before sensitive privacy actions. We do not request or access Gmail, Google Drive, contacts, calendars or advertising profiles. We do not sell Google user data or use it for advertising.
4. AI processing
When you request AI card creation, the confirmed question image and limited learning context are sent to an Alibaba Cloud visual-language model endpoint for that request. The response is validated and stored as an editable draft. AI output can be wrong; you control whether and how it is corrected and used.
5. Service providers and disclosures
- Google provides Google sign-in and Google Play billing.
- RevenueCat processes pseudonymous subscription and purchase lifecycle metadata. Automatic device-identifier collection and RevenueCat diagnostics are disabled in the app configuration.
- Resend delivers email verification and password-reset messages for email accounts.
- Alibaba Cloud processes the submitted question image for visual-language-model inference when AI processing is requested.
- Infrastructure providers host the API, PostgreSQL database, private RustFS object storage, TLS and operational backups.
These providers process data to deliver their contracted service. Data may be processed outside your country. We may also disclose data when required by applicable law, or when necessary to protect users, the service or legal rights. We do not sell personal data.
6. Storage and security
Production traffic uses HTTPS. Account data is separated by server-enforced account boundaries; uploaded objects are private; passwords are stored as one-way hashes; provider tokens and server secrets are not returned in normal API responses. No system is completely secure, so please protect your account and contact us if you suspect unauthorized access.
7. Retention
- Confirmed learning content and account records remain while your account is active, unless you delete individual content earlier.
- Abandoned browser-upload objects under the temporary upload prefix expire after approximately one day.
- Authentication challenges are short-lived, generally up to 10 minutes. Refresh sessions normally expire within 7 days and can be revoked earlier.
- Live subscription, quota and security records associated with the account are removed during account deletion, except information a store or processor must retain under its own legal obligations.
- Encrypted or access-controlled pre-migration database backups are retained for no more than 30 days. Deleted data is not restored to active use except when strictly necessary for disaster recovery, and ages out with backup rotation.
8. Export, correction and deletion
You can edit mistake-card content, export your account data, and permanently delete the account from Account → Privacy & data. Sensitive actions require a fresh email-password, Google or Apple verification. An external deletion path is available at /account-deletion/.
Account deletion removes login identifiers, sessions, cards, photos, practice sheets, generated files, entitlements and remaining quota from live SecondTry systems. If a Google Play subscription is active, the server attempts to cancel renewal before deleting RevenueCat and local account data. Google Play and payment processors may retain transaction records under their own policies.
9. Children and learners
Users who have not reached the age at which they can consent to data processing in their jurisdiction must use SecondTry only with authorization and supervision from a parent or legal guardian. A guardian may contact us to request access or deletion. Do not upload identity documents, health records or other unnecessary sensitive information as question content.
10. Changes and contact
We will update the version and effective date when this policy materially changes. If a change materially affects how Google user data or learning content is used, we will provide an appropriate in-product notice where required.
Privacy questions and requests: privacy@knowflowchat.cn.
版本 2026-08-24
隐私政策
本政策说明 SecondTry 如何访问、使用、存储、共享和删除个人信息，包括 Google 用户数据。
1. 适用范围与处理者
本政策适用于 SecondTry Android、iOS、Web 应用及相关 API。“SecondTry”“我们”指 SecondTry 的开发和运营者合肥市知识流动人工智能应用软件有限责任公司。
2. 我们处理的信息
- 账户与认证信息：SecondTry 账户和身份 ID、邮箱、登录渠道标识、邮箱账户密码哈希、会话及验证码记录，用于登录、同步、安全和账户恢复。
- 学习内容：题目照片、裁剪图片、题目与答案文本、学科、知识点、解析、编辑记录、错题卡和练习卷选择，用于生成、编辑、存储、同步和打印。
- 订阅信息：商品和基础方案 ID、权益状态、账期、到期及取消状态、沙箱标记和假名化购买标识，用于购买、恢复、配额发放和删除。
- 技术与安全信息：请求 ID、时间戳、由网络信息派生的限流键、应用或浏览器状态、错误码及安全事件，用于运行、诊断、限流和保护账户。本版本不包含广告分析。
只有在你主动选择图片时才会使用相机或相册；确认裁剪并发起处理前，图片不会上传。
3. Google 用户数据
Google 登录会提供稳定的 Google 账户标识，以及在可用时提供已验证邮箱。我们仅将这些数据用于身份验证、跨设备保持同一 SecondTry 账户、显示登录身份，以及在敏感隐私操作前重新验证。我们不请求或访问 Gmail、Google Drive、联系人、日历或广告画像，不出售 Google 用户数据，也不用于广告。
4. AI 处理
当你请求 AI 成卡时，确认后的题目图片及有限的学习上下文会发送到阿里云视觉语言模型接口完成本次推理。响应经过校验后保存为可编辑草稿。AI 可能出错，你可以决定是否以及如何修改和使用结果。
5. 服务提供商与跨境处理
- Google：提供 Google 登录和 Google Play 计费。
- RevenueCat：处理假名化订阅与购买生命周期信息；应用配置已关闭自动设备标识收集和 RevenueCat 诊断。
- Resend：为邮箱账户发送验证及密码重置邮件。
- 阿里云：在用户请求 AI 处理时接收题目图片并执行视觉语言模型推理。
- 基础设施提供商：托管 API、PostgreSQL、私有 RustFS 对象存储、TLS 与运维备份。
上述提供商仅为交付对应服务而处理信息，数据可能在你所在国家或地区以外处理。法律要求或保护用户、服务及合法权益所必需时，我们也可能披露信息。我们不出售个人信息。
6. 存储与安全
正式流量使用 HTTPS；服务端通过账户边界隔离数据；上传对象保持私有；密码以单向哈希保存；渠道 Token 和服务端密钥不会通过正常 API 响应返回。任何系统都无法保证绝对安全，请妥善保护账户，发现异常时及时联系我们。
7. 保存期限
- 账户有效期间保存已确认的学习内容和账户记录，用户可以提前删除单项内容。
- 临时上传路径中未完成的浏览器上传对象通常在约 1 天后过期。
- 认证挑战通常最长 10 分钟；刷新会话通常在 7 天内过期，也可以提前撤销。
- 删除账户时会移除与账户关联的在线订阅、配额和安全记录，但应用商店或处理方依法必须保留的信息除外。
- 受访问控制的迁移前数据库备份最长保存 30 天。已删除数据不会恢复为日常在线数据，仅在严格必要的灾难恢复场景使用，并随备份轮换自然清除。
8. 导出、更正与删除
你可以编辑错题卡，在账户 → 隐私与数据中导出数据或永久删除账户。敏感操作需要重新验证邮箱密码、Google 或 Apple 身份。卸载应用后也可通过 /account-deletion/ 发起删除。
删除账户会从 SecondTry 在线系统移除登录标识、会话、卡片、照片、练习卷、生成文件、权益和剩余额度。如果存在 Google Play 订阅，服务端会在删除 RevenueCat 和本地账户数据前尝试取消续订。Google Play 和支付处理方可能依据其政策继续保存交易记录。
9. 未成年人
未达到所在地区独立同意数据处理年龄的用户，应当在父母或法定监护人授权和监督下使用 SecondTry。监护人可以联系我们请求访问或删除。请勿把身份证件、健康记录或其他不必要的敏感信息作为题目上传。
10. 更新与联系
政策发生实质变化时，我们会更新版本和生效日期；如果变化实质影响 Google 用户数据或学习内容的使用方式，将在适用情况下提供产品内提示。
隐私问题与请求：privacy@knowflowchat.cn。