Tenon 账号隐私说明Tenon Account Privacy Notice

处理哪些信息Information we process

Tenon 账号处理邮箱、称呼、邮箱验证状态、密码凭据、登录会话（包括登录时的 IP 地址和浏览器信息）及登录安全所需的记录。密码由认证库哈希处理。使用 GitHub、Google 或 Apple 登录时，我们请求基本身份信息（标识、邮箱、提供商返回的姓名，以及 GitHub、Google 返回的头像链接），不请求邮件、云盘或通讯录的访问权限。

Tenon Account processes your email, display name, verification status, password credentials, sessions (including the IP address and browser information recorded at sign-in) and records needed for sign-in security. Passwords are hashed by the authentication library. GitHub, Google and Apple sign-in request basic identity information: identifiers, email, the name returned by the provider and the profile picture link returned by GitHub or Google. We do not request access to your inbox, cloud drive or contacts.

如何使用How we use it

这些信息用于注册、身份验证、账号恢复、明确授权的身份绑定和安全管理。验证及密码重置邮件通过腾讯云 SES 发送。我们不会因为邮箱相同而自动合并账号；绑定其他登录方式需要验证双方身份。

We use this information for registration, authentication, recovery, explicitly requested identity linking and security. Verification and password reset messages are sent through Tencent Cloud SES. Matching email addresses do not automatically merge accounts. Linking requires proof of both identities.

子产品获取什么What products receive

在登录授权过程中，Tenon 子产品可获得稳定的用户标识、称呼、头像链接（如有）、邮箱及其验证状态，以及适用的中央权限声明。产品自行管理业务数据和本地会话。统一身份不会赋予 Tenon 管理员读取用户密码本或解密私有数据的能力。

During an authorized sign-in, Tenon products can receive your stable user identifier, display name, profile picture link (if any), email address and its verification status, and applicable central role claims. Each product manages its own business data and local session. A shared identity does not give Tenon administrators access to your password notebook or the ability to decrypt private data.

存储与安全Storage and security

账号服务部署在我们管理的、位于中国境内的腾讯云服务器上，使用 HTTPS 和仅限账号域名的安全 Cookie。账号和绑定记录保存到你删除账号为止；登录会话 30 天不使用即失效，失效的会话记录和登录频率限制记录保存 6 个月后删除。提供商令牌采用认证库的加密存储。密码本、CloudKit 与产品数据不存储在中央账号数据库中。

The account service runs on Tencent Cloud servers in mainland China that we manage, and uses HTTPS and secure cookies restricted to the account domain. Account and linking records are kept until you delete your account. A session expires after 30 days without use; expired session records and sign-in rate-limit records are deleted after 6 months. Provider tokens use encrypted storage provided by the authentication library. Notebooks, CloudKit and product data are not stored in the central account database.

为保障网络安全，服务器会记录访问日志和安全日志，包括访问时间、IP 地址和访问的页面，不含网址中的参数；这些日志保存 6 个月后自动删除。

To keep our network secure, our servers record access and security logs: the time, IP address and page requested, without URL parameters. These logs are deleted automatically after 6 months.

删除账号Account deletion

你可以直接进入删除 Tenon 账号页面，重新确认身份并二次确认后自助删除，无需发送邮件。删除会移除运行中的中央身份、密码和已绑定的登录凭据、Tenon 登录会话，以及该身份的产品授权。此身份之后无法再用于任何 Tenon 产品登录。各产品的独立会话和业务数据由产品管理，不会因中央网页操作而保证同时退出或全部删除。

Open Delete your Tenon Account directly, verify your identity again and explicitly confirm deletion. No email request is required. Deletion removes the active central identity, password and linked sign-in credentials, Tenon sessions and product authorizations for that identity. It can no longer sign in to Tenon products. Each product manages its own sessions and business data; the central web action does not guarantee that all products sign out or delete their data simultaneously.

绑定 Apple 登录时，服务会撤销已保存的 Apple 令牌；如果缺少可撤销的令牌，仍会删除中央账号，并提示你在 Apple 账号中手动撤销授权。Tenon 不存储或解密你的密码本、恢复密钥或 CloudKit 私有数据，也不会代替你删除这些内容。请在相应产品中管理或删除产品数据。

For linked Apple sign-in, the service revokes stored Apple tokens. If no revocable token is available, the central account is still deleted and you are shown how to revoke access in your Apple Account. Tenon does not store or decrypt your notebook, recovery keys or private CloudKit data, and does not delete them on your behalf. Manage or delete product data in the relevant product.

删除运行中的账号不代表历史灾备副本立即全部擦除。账号数据库备份采用 30 天保留策略，由受限维护任务按小时清理过期副本；未解决事故所需的恢复点可能暂时保留。恢复备份前必须重新应用删除记录，不得恢复已删除的身份。

Deleting an active account does not immediately erase every historical backup. Account database backups follow a 30-day retention policy, with a restricted hourly task removing expired snapshots. A recovery point required for an unresolved incident may be retained temporarily. Deletion records must be reapplied before any backup is restored to service, so deleted identities are not restored.

管理与联系Controls and contact

你可以在账号页管理称呼、密码、登录设备，以及已启用的第三方登录方式。至少保留一种可用的登录方式。其他隐私请求可联系 support@tenonai.cn。我们会在 15 个工作日内答复。本说明没有写到的事项，例如未成年人保护和本说明的更新，适用《隐私政策》。

You can manage your display name, password, sessions and enabled linked sign-in methods in Account. Keep at least one usable sign-in method. For other privacy requests, contact support@tenonai.cn. We will reply within 15 business days. Matters this notice does not cover, such as children's privacy and updates to this notice, are governed by our Privacy Policy.