SKY 隐私政策 / Privacy policy
GLOBAL / Play · L.Inov · 生效日期 / Effective date：2026-10-14
中文
SKY 由 L.Inov 运营，日常管理地点为上海、中国大陆。隐私、支持和删除请求请联系 linovlianbiz@gmail.com。本人在收到申请后 5 个工作日内回复，必要身份核验后 30 天内处理账号注销并说明结果。
本政策适用于 SKY GLOBAL／Play，不替代 CN 版政策。目前为内部测试阶段；正式区普通登录、付款和网页自助注销尚未开放。Google／＋86登录和两种原身份的自助注销已在隔离测试区验收，测试结果不代表正式区已经开放。
信息与用途
| 信息 | 用途和范围 |
|---|---|
| 本机创作与偏好 | 心情、日历记录、收藏、贴纸位置、画报方案、草稿和偏好用于显示及继续编辑。0.8.x 不提供个人云同步，不自动上传这些作品。 |
| 手机号与验证码 | 仅中国大陆＋86。向阿里云 PNVS 发送手机号、验证码、挑战及发送参数以确认身份；SKY 保存身份／代码安全摘要、验证结果和尝试次数。摘要存储不表示发送过程不处理明文。 |
| Google 身份 | 验证完整 ID token，可能含邮箱和显示名。身份表保存稳定 Google subject 的派生摘要；本机保存选定邮箱／显示名用于展示。未申请通讯录、Drive 或 Gmail 邮件读取权限。 |
| 账号与安全 | 区域、内部账号 ID、创建／删除状态、登录方式、会话、验证挑战和来源相关安全摘要用于登录、防冒用及限流。 |
| 购买（开放后） | 商品、原 SKY 账号归属、订单号、加密核验凭据、核验／权益及到期状态用于购买、恢复、续期与退款。当地价格由 Play 显示；SKY 不收银行卡号或支付密码。 |
| 网络及使用统计 | IP、资源请求、时间、应用版本；随机安装 ID、首次／最近访问、服务摄影浏览／下载及估计数据量、放空开始／自然结束、随机会话 ID 和计划时长用于运行、安全、资源及质量统计。 |
| 联系我们 | 来信联系资料、问题、版本、必要订单号和自选附件用于处理请求。不要发送密码、验证码、登录／购买 token 或备份密码。 |
安装 ID 可关联同一安装的事件，不是完全匿名；它与 SKY 账号分开记录。统计不录音、不上传相册、不记录所选音源 ID。当前没有独立统计退出开关，账号注销、卸载或清数据不会自动删除已收到的独立统计。离线最多排队 256 项，联网重试；这不是服务器保留期限。
Google 和＋86分别创建独立 SKY 账号，不绑定或合并；CN 与 GLOBAL 的账号、作品及权益不互通。登录不自动导入游客作品。退出或切换账号不转移购买。
供应商、地点和安全
腾讯云香港的 API、数据库及当前私有内容空间用于托管和下载；L.Inov 从上海管理服务并处理必要申请。阿里云 PNVS 用于＋86短信验证；Google 用于身份与 Play 支付；支持邮件由 Gmail 处理。Google、阿里云及供应商的安全／运维处理可能在用户所在地以外进行，不保证所有信息只在香港。当前未从公开资料确定 PNVS API 业务记录的精确处理地区或统一删除天数；其验证码有效期不是供应商保留期。
应用与 SKY API 采用 HTTPS。登录和购买凭据受访问限制，购买核验凭据在服务端加密。私有内容桶的加密不代表全部数据库、日志、备份或供应商内部处理均以同一方式加密。我们不提供广告或广告画像，也不出售用户资料。
供应商说明：腾讯云隐私、阿里云隐私、Google 隐私、Google 支付隐私。供应商自身安全、运维及必要交易记录按其适用规则处理；注销 SKY 不删除外部 Google／手机号身份。
本机、权限与分享
当前功能使用网络、通知及实际音频播放所需的后台媒体权限，不要求相机、麦克风、定位或通讯录权限，不扫描整个相册。用户选择的系统文件／分享应用按其自身政策处理。
.skybackup 由用户密码加密，仅同区导入；不含登录／支付凭据、下载声音或完整摄影文件，不转移 Plus。密码无法找回。选择云盘保存文件不等于 SKY 云同步。
保留与删除
| 记录 | 当前保存与删除安排 |
|---|---|
| 身份与会话 | 有效账号期间保存必要身份。注销立即移除该区域身份和会话、停用账号，并保留必要删除标记。普通会话逻辑有效期 14 天；网页注销专用会话最多 10 分钟。 |
| 验证挑战与过期会话 | 挑战通常 5 分钟有效；失效即不可再用。已选定失效满 24 小时的清理阈值，日常物理清理尚未运行，不把有效期当删除完成时间。 |
| 安装与使用事件 | 已选定事件 90 天、安装最近访问 90 天且无剩余事件的清理阈值；日常物理清理尚未运行。独立统计不会随账号级联注销。 |
| 限流、删除标记及必要交易 | 为防滥用、保留原购买归属、核验／退款或处理未决请求保存最少必要记录，不恢复已注销身份。目前尚未为所有类别落实统一固定物理删除期限；收费仍未开放。 |
| 网关与运行日志 | 包含 IP、请求 URL（可能含 query）、时间、状态／大小、referer 和 user agent，用于安全及排障。GLOBAL 与 CN 目前共享日志；网关按日轮转、保留 14 份非空历史文件，这不保证 14 天全部删除。共享主机 journal 的最大保存期尚未核实。账号注销不会即时清除全部日志。 |
| 支持、请求与备份 | 本人按解决问题、核验及记录处理结果的必要范围复核邮件／附件和最少回执。固定期限和基础设施备份生命周期仍在完善，不承诺已有自动到期清除或已运行完整 GLOBAL 备份。 |
| 本机及已分享文件 | 用户自行管理本机作品、下载、导出备份、相册和接收应用中的文件。网页注销不替用户保存或清除设备文件。 |
期限和清理改进会在政策更新时说明；不会用未部署的任务声称资料已自动删除。供应商独立记录不等同于 SKY 自有期限。必要保留限定具体目的、最少资料及未决事项，不以“以后可能有用”保留所有资料。
提出请求
您无需安装或登录 SKY 即可通过 账号与数据删除 申请；目前可用的外部受理渠道是邮件，自助网站未向正式用户开放。请写明 GLOBAL、是否测试版、原登录方式、回复联系方式及访问／更正／删除范围。本人会说明适用的官方身份核验步骤，只收最少资料；密码、验证码和 token 不通过邮件提供。邮箱、知道号码、截图、安装 ID 或订单号不能单独证明归属。
原身份无法控制，或请求与账号独立的安装统计时，我们说明可以安全定位及处理的范围。当前没有公开的安装归属证明入口，不能凭邮箱／手机号定位全部安装；无法核验时不披露或删除他人的资料，并说明原因及继续联系渠道。您可按适用地区规则提出访问、更正、删除或其他隐私要求，本政策不要求放弃消费者／隐私权利。
应用内注销需先确认保留本机副本，副本保存成功后才请求服务端注销；拒绝保留则取消当前流程。网页／邮件申请不强制保留手机副本。本机私有数据可在确认备份后通过 Android 清除数据或卸载删除；导出的文件和其他应用副本需另行处理。注销、卸载或清数据不会取消 Google Play 自动续订，请在 Play 订阅 单独操作。
未成年人和更新
SKY Play 面向 13 岁及以上，不面向 13 岁以下儿童；未成年人购买应取得监护人许可。当前没有年龄／监护人身份核验。相关隐私或购买问题请联系上述邮箱。更新在本网站公布版本和生效日，需要另外通知或同意的变更按适用规则处理。
English
L.Inov operates SKY from Shanghai, mainland China. Email linovlianbiz@gmail.com for privacy, support or deletion. The operator personally responds within five business days and handles account deletion within 30 days after necessary ownership verification, explaining the result.
This policy covers SKY GLOBAL/Play, not the CN service. SKY is currently in internal testing; normal production sign-in, charging and web self-service deletion are not open. Google/+86 sign-in and deletion using both original identities passed in isolated staging, which does not establish availability in production.
Information and purposes
| Information | Purpose and scope |
|---|---|
| Local creations and preferences | Moods, calendar records, favorites, sticker placement, card recipes, drafts and preferences support display/editing. The 0.8.x launch has no personal cloud sync and does not automatically upload these works. |
| Phone number and code | Mainland China +86 only. Alibaba Cloud PNVS receives the number, code, challenge and delivery parameters. SKY retains identity/code security digests, verification results and attempts. Digest storage does not mean delivery never processes the number/code in plaintext. |
| Google identity | SKY verifies the full ID token, which may contain email/name. The identity table retains a digest derived from the stable Google subject; the device stores the chosen email/name for display. Contacts, Drive or Gmail reading permissions are not requested. |
| Account/security | Region, internal account ID, creation/deletion state, sign-in method, sessions, challenges and source-related security digests support sign-in, anti-impersonation and rate limits. |
| Purchases, when enabled | Product, original SKY account ownership, order ID, encrypted verification credentials and verification/access/expiry status support purchases, restoration, renewal and refunds. Play displays local prices. SKY does not collect card numbers or payment passwords. |
| Requests/statistics | IP, requested resources, time and app version; random installation ID, first/last access, service-photo views/downloads and estimated bytes, Unwind starts/natural endings, random session IDs and planned duration support operation, security, resource and quality measurement. |
| Contact requests | Reply details, problem, version, necessary order IDs and chosen attachments help handle requests. Do not send passwords, codes, sign-in/purchase tokens or backup passwords. |
An installation ID links events from one installation and is not fully anonymous. Statistics are independent of SKY accounts, do not record audio, upload your gallery or record the selected audio ID. There is no separate statistics opt-out. Account deletion, uninstalling or clearing local data does not automatically erase independent events already received. Up to 256 offline events can queue and retry; this is not server retention.
Google and +86 create separate SKY accounts without linking/merging. CN and GLOBAL accounts, works and access do not transfer. Sign-in does not automatically import guest works; signing out or switching accounts does not transfer a purchase.
Providers, locations and security
Tencent Cloud APIs, databases and current private content spaces in Hong Kong provide hosting/downloads. L.Inov manages services and necessary requests from Shanghai. Alibaba Cloud PNVS handles +86 verification; Google provides identity/Play payments; Gmail handles support email. Their security/operational processing may occur outside your location; not all information stays in Hong Kong. Exact PNVS API-record locations and uniform final deletion periods have not been established from public sources. Code validity is not provider retention.
The app uses HTTPS to SKY APIs. Access to identity/purchase credentials is restricted; server purchase verification credentials are encrypted. Private-bucket encryption does not establish identical encryption across all databases, logs, backups or provider processing. SKY has no advertising or advertising profiles and does not sell user data.
Provider notices: Tencent Cloud, Alibaba Cloud, Google, Google Payments. Providers manage independent security, operational and necessary transaction records under their applicable rules. Deleting SKY does not delete an external Google/phone identity.
Devices, permissions and sharing
Current features use network, notification and actual background-media permissions, without requiring camera, microphone, location or contacts or scanning your entire gallery. A system destination/share app you select applies its own policy.
A .skybackup uses your password encryption and imports only within the same region. It excludes sign-in/payment credentials, downloaded audio and full photography files and does not transfer Plus. Passwords cannot be recovered. Choosing a cloud drive as its destination is not SKY cloud sync.
Retention and deletion
| Record | Current arrangement |
|---|---|
| Identity/session | Necessary identity remains while the account is active. Deletion immediately removes regional identities/sessions, deactivates the account and retains a necessary deleted marker. Normal sessions have a 14-day logical lifetime; deletion-only web sessions last at most ten minutes. |
| Challenges/expired sessions | Challenges normally last five minutes and cannot be reused after expiry. A cleanup threshold of 24 hours after expiry is selected, but routine physical cleanup is not running; validity is not physical deletion. |
| Installations/events | Selected thresholds are 90-day event age and 90 days after last installation access with no remaining events. Routine physical cleanup is not running. Account deletion does not cascade to independent statistics. |
| Rate limits, deleted markers, necessary purchases | Minimum records support anti-abuse, original purchase ownership, verification/refunds or unresolved requests without restoring deleted identities. Not every category has an implemented fixed physical-deletion deadline. Charging is not open. |
| Gateway/runtime logs | IP, request URLs including possible query parameters, time, status/size, referrers and user agents support safety/troubleshooting. GLOBAL/CN share logs. Daily rotation retains 14 non-empty historical files, not a guaranteed 14-day deletion period. The shared host journal's maximum period is unverified. Deletion does not immediately erase all logs. |
| Support, requests, backups | The operator reviews email/attachments and minimum receipts according to problem resolution, verification and proof of handling. Fixed periods and infrastructure backup lifecycle are being completed; no automatic expiry or complete running GLOBAL backup process is claimed. |
| Devices/shared files | You manage local works, downloads, exported backups, gallery and recipient-app files. A web request does not save or clear device files. |
Updates will explain retention/cleanup improvements, without claiming unimplemented jobs already erase data. Provider retention is separate. Necessary retention is restricted to a specific purpose, minimum records and unresolved matters, rather than keeping everything for possible future use.
Your requests
Use Account and data deletion without installing or signing into SKY. Email is the available external request channel; production self-service is not open. State GLOBAL, whether this is a test version, original sign-in method, reply contact and access/correction/deletion scope. The operator explains applicable official verification steps and requests only minimum information. Never email passwords, codes or tokens. An email, knowing a number, screenshot, installation ID or order ID alone does not establish ownership.
If the original identity is unavailable or you request independent installation statistics, we explain the safely identifiable scope. There is no public installation-ownership verification entry, and email/phone cannot identify every installation. Without verification, we do not disclose/delete someone else's records and explain the reason and follow-up contact. You may request access, correction, deletion or other rights under applicable regional rules; this policy does not waive consumer/privacy rights.
In-app deletion requires confirming a retained local copy; server deletion is requested only after the copy saves successfully. Declining retention cancels that flow. Web/email requests do not require retaining a device copy. After backing up what you need, Android clear-data/uninstall removes private app data; exported/recipient copies require separate removal. Account deletion, uninstalling or clearing data does not cancel Play renewal; manage Play subscriptions separately.
Minors and changes
SKY Play is intended for ages 13+, not children under 13. Minors should obtain guardian permission before purchasing. No age/guardian identity check is implemented. Email the operator about related privacy/purchase concerns. This site publishes policy versions/effective dates; separate notice/consent is provided where applicable rules require it.