RooQi 隐私政策
更新日期：2026 年 11 月 2 日
本政策适用于 RooQi 的 iPhone、iPad 与 Mac 应用（以下简称“RooQi”）。RooQi 由 Shenzhen Jinji Digital Technology Co.,Ltd 提供。隐私问题与请求请联系 hello@rooqi.ai。本政策不适用于另行提供的 RooQi Keyboard，后者请参阅 RooQi Keyboard 隐私政策。
1. 概览
RooQi 用于记录、阅读和整理笔记、手写内容、文件与录音。你的资料默认保存在设备上。iCloud 同步与云端 AI 是两项独立的选择：开启同步不等于同意把资料发送给 AI，订阅 AI 也不会自动把整个资料库发送给 AI 服务。
使用 RooQi 不需要注册 RooQi 账号。订阅通过 App Store 完成；用于订阅的 App Store 购买账号与用于同步笔记的 iCloud 账号分别管理。
2. 设备上的资料与权限
笔记正文、手写、导入的 PDF 或其他文件、照片、录音及整理结果会按你执行的操作保存在 RooQi 的本机资料中。你选择分享或导出的内容会交给你指定的位置或接收应用，随后由接收方处理。导出包可能包含原始录音、附件和历史内容。
- 麦克风：录音时需要。你可以在系统设置中撤销，其余功能仍可使用。
- 相机与照片：拍摄补充资料时需要相机权限；选择已有照片使用系统选择器。自定义背景照片只用于本机界面，删除自定义背景会移除 RooQi 保存的副本，不会删除照片图库中的原件。
- 语音识别：录音的“本机转写”要求在设备上识别。“纪要后语音输入”使用 Apple 语音识别，设备支持时在本机完成；设备不支持本机识别时，语音可能由 Apple 的在线服务处理。因此 RooQi 不承诺所有语音始终只在本机处理。
- 蓝牙电容笔与定位：使用兼容电容笔时，RooQi 通过蓝牙读取连接、电量、按键、型号及设备设置。可选的“断连定位”默认关闭；开启并授予定位权限后，电容笔意外断连时会请求一次位置；根据系统定位权限，结果可能包含精确坐标。RooQi 在本机保存最近一次记录，包括设备名称与标识、时间、经纬度、精度和地址。地址解析由 Apple 定位服务完成。关闭该功能会停止新的定位，但不会自动清除已有记录。
系统备份可能按你的 Apple 设置保留 App 数据，这与 RooQi 的同步开关是两回事。
3. iCloud 同步
新安装时，首次启动页面会显示初始为开启的 iCloud 开关，点“继续”后才应用你的选择；你也可以关闭后只在本机使用。已有用户的设置和内容不会因首次启动页面而被重置。
开启同步后，参与同步的 RooQi 资料以及同步所需的文档标识、版本和设备状态，会通过 Apple CloudKit 存入你的 iCloud 私有数据库，并在你的设备之间传输。同步内容可能包括笔记、手写、导图、录音及相关附件和整理结果。停止同步、移除本机下载、移到废纸篓和删除云端数据是不同的操作；关闭同步不会自动删除已有的本机或 iCloud 副本。Apple 服务按 Apple 隐私政策 处理相关信息。本政策不把 iCloud 私有数据库描述为 RooQi 提供的端到端加密。
4. 云端 AI 与联网查询
只有在你主动提交 AI 请求、选择资料或确认云端语音处理时，RooQi 才会把完成该请求所需的内容经由 RooQi 服务端发送给相应服务商。根据功能不同，内容可能包括你的问题、所选文字、对话上下文、逐字稿、页面或 PDF 区域图像（其中可能含手写）、导入的图片以及你选入的补充资料。具体发送范围以当次功能提示为准；普通的文字提问不会上传整段原始录音。
AI 可能按需联网查询公开信息。搜索请求发送的是生成的查询词，而不是整份笔记或图片；但查询词由你的问题、所选资料或对话上下文生成，仍可能包含其中的人名、地点或其他个人信息。打开外部来源链接时，你的浏览器和目标网站会收到正常的网页请求。
云端语音优化会上传一份为转写准备的音频副本，临时存放在阿里云 OSS（中国杭州区域），再通过有时效的下载地址交给语音识别服务。新录音的自动云端处理需要你单独同意，开启后也不会自动上传全部历史录音。你可以随时关闭自动处理或改用本机转写。已经提交的任务可能已到达服务商，取消操作无法撤回已经发生的处理。
当前使用的服务如下：
- RooQi 服务端（中国杭州区域）：转发并处理 AI 请求、临时音频与结果；校验订阅与设备授权、计算用量、防止重复扣费及排查故障。
- DeepSeek：处理文字、图像 AI 请求及联网查询。联网时，发送给 DeepSeek 的查询词可能包含从你所选资料中提取的文字。完成请求所需的其他内容，可能包括你的问题、所选文字、对话上下文、逐字稿，以及所选页面或 PDF 区域图像和你选入的图片。
- 阿里云百炼：处理云端语音转写所需的音频并返回转写结果。
- 阿里云 OSS（中国杭州区域）：临时存放待转写的音频副本。
- Apple：iCloud、系统权限与语音识别服务，以及 App Store 购买、订阅验证与 App 完整性验证。
各服务商按其适用的服务条款处理数据，其保存规则可能与 RooQi 自身的处理时限不同。参见阿里云百炼隐私说明与DeepSeek 隐私政策。
5. 订阅与设备授权
订阅购买与付款由 Apple 处理，RooQi 不会收到你的 Apple 账户密码、银行卡信息或验证码。RooQi 接收 Apple 签名的购买、商品、有效期及续订信息，用于确认 AI 权益；服务端保存用于关联同一订阅的标识或摘要、交易链标识、权益状态，以及云端语音额度、已用时长、任务预留与结算记录，用于跨设备共享额度并防止重复发放或扣费。
AI Pro 最多授权 6 个安装，AI Max 最多授权 9 个安装。服务端按 RooQi 在 iPhone、iPad 或 Mac 上的安装计数，而不是识别设备硬件；重新安装 App 或本机安装密钥丢失后，会被视为新的安装。每个安装在本机生成一组安装密钥：私钥保存在本机钥匙串中，设备支持时由安全隔区（Secure Enclave）保护，仅限本机使用，不会通过 iCloud 钥匙串同步。服务端在该订阅下保存公钥摘要、设备类型（iPhone、iPad 或 Mac）、首次授权时间、最近活动时间、是否已释放及原因，以及会话版本号。为防止请求重放，服务端会短期记录一次性请求标识，它们会在令牌有效时间窗口内失效，并在后续维护时清理。
这些摘要和标识可以把请求与同一订阅、同一设备关联起来，不是匿名信息。设备授权及其历史记录目前没有自动到期删除。
你可以在本机“订阅设备”中释放本机名额：iPhone、iPad 位于“设置 › AI 服务”，Mac 位于“设置 › AI 与订阅”。释放只会停止本机使用订阅 AI，不会删除笔记、不会取消 App Store 订阅，也不会清除服务端的设备与用量记录。已释放的安装只有在仍保留原来的安装密钥、有空余名额且订阅有效时，才能重新授权。
管理或取消自动续订请使用 Apple 订阅管理。取消订阅不会删除你的资料或服务记录。
6. 服务安全与日志
为核验订阅、关联购买与服务记录并防止重复请求，服务端会保存 Apple 交易与原始交易标识、设备公钥或摘要、订阅身份摘要、请求标识、校验摘要、一次性签名及相关时间。鉴权证据按 30 天保留期限设置，到期后在维护中分批清理。这类证据不保存请求正文、Apple 完整签名交易、会话令牌或设备私钥。
App 与服务端还会处理 App 身份、安装验证信息、请求标识、时间、状态、用量和错误信息，用于验证合法 App、防止滥用和排查故障。服务器及网络服务商会处理建立连接所需的 IP 地址。
7. 保存与删除
设备上的资料由你管理。移到废纸篓通常仍可恢复；永久删除、移除下载和导出的作用范围各不相同。你自行创建的备份、导出文件以及分享给他人的副本，需要在各自所在的位置处理。卸载 App 不会删除 iCloud 中的资料或服务端的订阅记录。
云端任务可能需要暂存输入、部分回答、结果和状态，以完成处理、在中断后恢复并让你取回结果。目前的服务时限包括：音频上传授权 10 分钟内有效，供语音服务读取的下载地址 30 分钟内有效，音频转写任务的处理期限为 24 小时，转写结果在 72 小时内可供取回。这些是访问与处理的时间窗口，并不表示每个对象、日志或备份都会在该时刻被物理删除。音频任务结束后系统会尝试删除临时音频；删除失败或结果不确定时，会在之后的维护中再次清理。
订阅、交易、用量及设备授权等记录用于提供订阅、跨设备共享额度、防止重复扣费和滥用，会在提供服务期间保存。
8. 你的请求
你可以发邮件至 hello@rooqi.ai，查询、更正或删除 RooQi 持有的你的个人信息，或询问关闭某项功能后仍保留哪些记录。为保护你的资料，我们可能需要核实请求，但不会要求你提供密码、验证码或密钥文件。对于法律要求或为交易、安全及争议处理必须保留的记录，我们会说明保留的理由和范围。
9. 联系支持
你主动联系支持时，我们会收到你提供的邮箱、说明和附件，仅用于回应请求和排查问题。请不要发送密码、验证码、密钥文件、完整资料库、原始录音或完整购买收据；截图请先遮盖无关的个人信息。
10. 未成年人
如果你是未成年人，请在监护人指导下阅读本政策并使用 RooQi。监护人如需处理与未成年人个人信息有关的请求，可以通过 hello@rooqi.ai 联系我们。
11. 本网站
本网站不使用广告或行为分析脚本。网页托管服务可能为提供页面和安全防护处理 IP 地址、请求时间及浏览器信息。
12. 政策更新
政策更新后会在本页标注日期。涉及新的数据类型、用途或服务商时，我们会在相应功能中说明，并按适用要求取得必要的同意。不使用可选的云端功能时，你仍可使用其余本机功能。
RooQi Privacy Policy
Last updated: November 2, 2026
This policy covers RooQi for iPhone, iPad and Mac (“RooQi”). RooQi is provided by Shenzhen Jinji Digital Technology Co.,Ltd. Send privacy questions and requests to hello@rooqi.ai. This policy does not cover the separate RooQi Keyboard product; see the RooQi Keyboard Privacy Policy.
1. Overview
RooQi helps you record, read and organize notes, handwriting, files and recordings. Your library is stored on your device by default. iCloud sync and cloud AI are separate choices: turning on sync does not authorize sending your library to AI, and subscribing to AI does not automatically send your whole library to an AI service.
RooQi does not require a RooQi account. Subscriptions are purchased through the App Store; the App Store purchase account used for the subscription and the iCloud account used to sync your notes are managed separately.
2. Content on your device and permissions
Note text, handwriting, imported PDFs and other files, photos, recordings and generated results are stored in RooQi’s local data as you use the relevant features. When you share or export, the content you select goes to the destination or app you choose, which then handles it. Exported packages may contain original recordings, attachments and history.
- Microphone: required for recording. You can revoke it in system settings and keep using other features.
- Camera and photos: taking a supplementary photo requires camera access; choosing an existing photo uses the system picker. A custom background photo is used only for the local interface. Removing the custom background removes RooQi’s saved copy, not the original in your photo library.
- Speech recognition: on-device transcription of recordings requires on-device recognition. Post-minutes dictation uses Apple speech recognition, on the device where supported; when on-device recognition is unavailable, Apple’s online service may process the speech. RooQi therefore does not claim that all speech is always processed only on your device.
- Bluetooth pen and location: with a compatible pen, RooQi reads connection, battery, button, model and device-setting information over Bluetooth. Optional disconnect location is off by default. When you enable it and grant location permission, an unexpected pen disconnection requests a one-time location, which may include precise coordinates depending on your system location permission. RooQi saves the latest record on your device, including the pen name and identifier, time, coordinates, accuracy and address. Apple’s location service resolves the address. Turning the feature off stops new requests but does not by itself erase existing records.
Apple device backups may retain app data according to your system settings, separately from RooQi’s sync switch.
3. iCloud sync
On a new installation, the first-launch screen shows an iCloud switch that is initially on; your choice applies when you tap Continue, and you can turn it off to use RooQi only on this device. The first-launch screen does not reset existing users’ settings or content.
With sync on, eligible RooQi content and the metadata needed for sync, such as document identifiers, versions and device state, are stored in your private iCloud database through Apple CloudKit and transferred between your devices. Synced content may include notes, handwriting, mind maps, recordings and related attachments and results. Stopping sync, removing a local download, moving to Trash and deleting cloud data are different actions; turning sync off does not automatically delete existing device or iCloud copies. Apple services are covered by Apple’s Privacy Policy. This policy does not describe the iCloud private database as end-to-end encryption provided by RooQi.
4. Cloud AI and web lookups
Only when you submit an AI request, select material or confirm cloud speech processing does RooQi send the content needed for that request through the RooQi service to the relevant provider. Depending on the feature, this may include your question, selected text, conversation context, transcripts, page or PDF-region images (which may contain handwriting), imported images and supplementary material you choose. The notice shown for each feature describes what is sent; an ordinary text question does not upload the original recording audio.
AI may look up public information when needed. Search requests carry generated queries rather than the whole note or image, but queries are derived from your question, selected materials or conversation context and may still contain names, places or other personal information from them. Opening a source link sends a normal web request from your browser to the destination site.
Cloud speech optimization uploads an audio copy prepared for transcription. It is stored temporarily in Alibaba Cloud OSS (China, Hangzhou region) and made available to the speech recognition service through a time-limited download URL. Automatic cloud processing of new recordings requires your separate consent, and turning it on does not upload your past recordings. You can turn automatic processing off or switch to on-device transcription at any time. A submitted task may already have reached the provider; cancelling cannot undo processing that has already happened.
Services currently used:
- RooQi service (China, Hangzhou region): relays and processes AI requests, temporary audio and results; verifies subscriptions and device authorization, accounts for usage, prevents duplicate charges and troubleshoots failures.
- DeepSeek: processes text and image AI requests and runs web searches. Search queries sent to DeepSeek may include text from materials you select. Other content needed for a request may include your question, selected text, conversation context, transcripts, selected page or PDF-region images and images you choose.
- Alibaba Cloud Model Studio (Bailian): processes audio for cloud speech transcription and returns the transcript.
- Alibaba Cloud OSS (China, Hangzhou region): temporarily stores audio copies awaiting transcription.
- Apple: iCloud, system permissions and speech recognition, plus App Store purchases, subscription validation and app-integrity verification.
Each provider handles data under its applicable terms, and its retention may differ from RooQi’s own processing windows. See the Alibaba Cloud Model Studio privacy notice and the DeepSeek privacy policy.
5. Subscriptions and device authorization
Apple handles subscription purchases and payment. RooQi does not receive your Apple Account password, payment-card details or verification codes. RooQi receives Apple-signed purchase, product, expiry and renewal information to confirm your AI access. The RooQi service keeps identifiers or digests that link to the same subscription, transaction-chain identifiers, entitlement status, and cloud speech allowances, usage, task reservations and settlements, so that allowances can be shared across devices and duplicate grants or charges are prevented.
AI Pro can authorize up to 6 installations and AI Max up to 9. The RooQi service counts installations of RooQi on iPhone, iPad or Mac, not device hardware; reinstalling the app or losing the local installation key can be treated as a new installation. Each installation generates its own installation key pair. The private key stays in that device’s keychain, protected by the Secure Enclave where the device supports it, is usable only on that device and is not synced through iCloud Keychain. Under your subscription, the RooQi service stores the public-key digest, device type (iPhone, iPad or Mac), first authorization time, latest activity time, whether and why the device was released, and a session version number. To prevent replayed requests, the service briefly records one-time request identifiers; they expire within the token’s validity window and are cleaned up during later maintenance.
These digests and identifiers can link requests to the same subscription and device; they are not anonymous. Device authorization and its history currently have no automatic expiry.
You can release this device’s slot under Subscription Devices: on iPhone and iPad in Settings › AI Services, on Mac in Settings › AI and Subscription. Releasing only stops this device from using subscription AI. It does not delete notes, cancel your App Store subscription or erase device and usage records held by the RooQi service. A released installation can be reauthorized only if it still has its original installation key, a slot is free and the subscription is active.
Use Apple’s subscription management to manage or cancel automatic renewal. Cancelling does not delete your content or service records.
6. Service security and logs
To verify subscriptions, link purchases to service records and prevent replay, the service retains Apple transaction and original transaction identifiers, installation public keys or hashes, hashed subscription identities, request identifiers, verification digests, one-time signatures and relevant timestamps. Authentication evidence has a 30-day retention period and is cleared in batches during maintenance after expiration. These records do not store request bodies, full Apple signed transactions, session tokens or device private keys.
The app and the RooQi service also process app identity, installation verification information, request identifiers, timestamps, status, usage and error information to verify the genuine app, prevent abuse and troubleshoot. Servers and network providers process the IP address needed for a connection.
7. Retention and deletion
You manage the content on your device. Items in Trash can usually be restored; permanent deletion, removing downloads and exporting have different effects. Backups and exports you create, and copies shared with others, must be handled where they are stored. Uninstalling the app does not delete content in iCloud or subscription records held by the RooQi service.
Cloud tasks may temporarily keep input, partial responses, results and status to complete processing, recover from interruptions and let you retrieve results. Current service windows are: an audio upload authorization is valid for 10 minutes, the download URL used by the speech service is valid for 30 minutes, an audio transcription task has a 24-hour processing deadline, and transcription results remain retrievable for up to 72 hours. These are access and processing windows; they do not mean that every object, log or backup is physically erased at that time. After an audio task ends, the system attempts to delete the temporary audio; if deletion fails or the outcome is uncertain, cleanup is retried during later maintenance.
Subscription, transaction, usage and device authorization records are used to provide the subscription, share allowances across devices and prevent duplicate charges and abuse, and are kept while the service is provided.
8. Your requests
Email hello@rooqi.ai to access, correct or delete personal information RooQi holds about you, or to ask what remains after you turn a feature off. To protect your data we may need to verify a request, but we will never ask for your password, verification codes or key files. Where records must be kept by law or for transaction, security or dispute purposes, we will explain the reason and scope.
9. Contacting support
When you contact support, we receive the email address, description and attachments you choose to send, and use them only to respond and troubleshoot. Please do not send passwords, verification codes, key files, entire libraries, original recordings or full purchase receipts; redact unrelated personal information in screenshots.
10. Minors
If you are a minor, please read this policy and use RooQi with guidance from a parent or guardian. Parents or guardians can contact hello@rooqi.ai about requests concerning a minor’s personal information.
11. This website
This website uses no advertising or behavioral analytics scripts. Hosting services may process IP addresses, request times and browser information to serve and protect the website.
12. Changes
Updates to this policy will be dated on this page. New data types, purposes or providers will be explained in the relevant feature, with any required consent obtained. If you do not use optional cloud features, the remaining on-device features stay available.