一句话概括：通知内容只存在你自己的手机里，不上传云端、不做备份、不用于画像。 唯一的例外是——为了判断「这条通知是不是你要做的事」，需要把通知的文字交给 AI 服务处理一次， 处理完即丢弃。除此之外不收集你的任何信息。
验证码、银行账户类通知永远不离开你的设备。 含验证码/动态密码、银行卡交易、完整卡号或证件号的通知，会在手机本地被直接拦截， 不会发送任何网络请求（详见下文第 2 节）。
Notistant 是一个独立的待办整理工具，没有账号体系，不需要注册，不要求你提供姓名、手机号或邮箱。
| 信息 | 是否离开你的设备 | 用途 |
|---|---|---|
| 通知的标题、正文、来源应用包名 | 是（仅用于 AI 分类，处理后不保存） | 判断这条通知是否构成你本人需要完成的待办，并提取其中的时间 |
| 匿名设备标识（系统提供，经不可逆哈希） | 是 | 服务端按设备计算每日免费额度，防止接口被滥用 |
| 你整理出的待办、提醒时间、应用白名单与屏蔽设置 | 否，仅存本机 | App 的运行数据 |
| 系统日历事件 | 否，仅在你的设备上读写 | 在你主动选择时，把待办写入系统日历 |
我们不收集：你的姓名、手机号、邮箱、账号密码；精确或粗略位置；通讯录；照片与文件； 短信与通话记录；设备通讯标识（IMEI、MAC 等硬件标识）；广告标识符；你的浏览记录； 你安装了哪些其他应用。App 内没有接入任何广告 SDK 或第三方统计 SDK。
这是本政策最需要你了解的部分，请务必读完。
敏感内容本地截留。通过初筛后，App 会在本机再做一次敏感内容检测。 凡命中以下特征的通知，只保存在你的手机里，不会发送任何网络请求：
这类通知会在 App 内标记为「本地保留」，供你查看与检索，但它的文字内容永远不会离开你的设备。
换句话说：普通通知的文字会离开你的设备一次，用于一次性的判断，不会被留存； 而验证码和银行账户类内容，在任何环节都不会离开你的设备。
自带密钥（可选）：如果你在设置中填入自己的 AI 服务密钥（支持 OpenAI 兼容接口）， 通知文字将由你的设备直接发往你选择的服务商，不再经过我们的中转服务器。 此时密钥只保存在本机加密存储中，不会上传给我们；我们既不接触你的通知内容，也不再限制调用次数， 额度由该服务商按你的账号计费。你可以随时清除密钥，切回默认模式。
为完成上述处理，我们使用以下服务商，它们仅作为受托处理方接触数据，不得将数据用于自身目的：
| 服务商 | 作用 | 接触的数据 |
|---|---|---|
| Cloudflare, Inc.（美国） | 中转服务托管，负责转发请求与额度计数 | 通知文本（瞬时转发）、匿名设备标识 |
| 杭州深度求索（DeepSeek） | 提供 AI 模型推理 | 通知文本（瞬时处理） |
除上述情形及法律强制要求外，我们不会向任何第三方出售、出租或披露你的信息。 我们不进行用户画像，不做广告定向，不将数据用于任何与提供本服务无关的目的。
本应用可能通过 Google Play 提供付费下载、一次性解锁或订阅。无论采用哪种形式， 所有支付都由 Google Play 结算系统处理：我们不会收到、也不会存储你的银行卡号、账单地址或完整支付凭证。 我们只会拿到一个 Google 签发的购买凭据（purchase token），用于判断你的付费权益当前是否有效。
所有网络传输均使用 HTTPS 加密。服务端不存储用户内容，因此不存在「用户内容数据库泄露」的风险面。 设备标识取自系统提供的应用级匿名标识（按应用签名隔离，不同应用拿到不同值）， 并经不可逆哈希后才用于计数——它不含姓名、手机号等任何个人信息， 无法反推到具体的人，也无法与你在其他应用中的活动关联。
本应用不面向 13 周岁以下儿童，也不会有意收集儿童的个人信息。若你是不满 13 周岁的用户，请在监护人指导下使用或停止使用本应用。
若本政策发生实质性变更，我们会在本页面更新版本并修改顶部生效日期；涉及数据处理方式的重大变更， 会在 App 内以显著方式提示。继续使用即表示你接受更新后的政策。
对本政策有疑问、或希望行使上述任何权利，请联系：
我们会在收到请求后的合理期限内回复。
Last updated: October 27, 2026
In short: notification content stays on your device. It is never uploaded to a cloud, never backed up, and never used to build a profile. The single exception is that the text of a notification is sent once to an AI service so the app can decide whether it is something you need to do, and it is discarded immediately after processing. Nothing else is collected.
Sensitive content never leaves your device. Before anything is sent, the app runs an on-device check. Notifications that match any of the following are kept locally only, and no network request is made for them: (1) verification codes / one-time passwords, from any app; (2) bank or payment account activity — balances, statements, incoming/outgoing transfers, repayments, purchases; (3) content containing a full bank card number or national ID number. Such notifications are marked "kept on device" in the app, but their text is never transmitted anywhere.
What leaves your device. (1) The title, body, and package name of a notification that passed both on-device checks, sent over HTTPS to our relay, then to the AI model, for one-time classification only — not stored, not logged, not used for training. (2) An anonymous device identifier, derived from the system-provided app-scoped identifier and hashed irreversibly, used solely to enforce daily and monthly usage quotas; only two counters (used today / used this month) are kept, and they expire 40 days after the last call. The app also downloads a generic classification-rule template (which contains no user data) and caches it locally, at most 4 times per day.
What never leaves your device. Your tasks, reminders, whitelist settings, and calendar events are read and written locally only. We do not collect your name, phone number, email, account credentials, location, contacts, photos, files, SMS, call logs, hardware identifiers (IMEI/MAC), advertising ID, or browsing history. The app contains no advertising or analytics SDKs.
Service providers. Cloudflare, Inc. (relay and quota counting) and DeepSeek (model inference). They act only as processors on our behalf and may not use the data for their own purposes.
Bring your own key (optional). If you enter your own AI service key in Settings (any OpenAI-compatible endpoint), notification text is sent directly from your device to the provider you chose and does not pass through our relay. The key is stored only in encrypted storage on your device and is never uploaded to us. In that mode we neither receive your notification content nor apply any usage limit — your provider bills your own account. You can remove the key at any time to return to the default mode.
Payments. If you buy the app, an unlock, or a subscription, the entire transaction is handled by Google Play Billing. We never receive or store your card number, billing address, or full payment credentials; we only receive a purchase token that tells us whether your purchase is currently valid. Subscriptions can be cancelled at any time under "Payments & subscriptions" in Google Play, and refunds follow Google Play's refund policy. Paying does not change how your notification content is handled: free and paid versions process data identically.
Retention. Notification text is not retained server-side. Quota counters hold only two numbers (used today / used this month) and expire automatically 40 days after the last call. All app data persists locally until you delete it or uninstall the app.
Your rights. You can delete individual tasks in the app, clear all app data through system settings, revoke notification access at any time, or uninstall the app to erase everything locally. The server keeps only an irreversible quota key that is not linked to any identity and expires within 40 days; to have it removed earlier, email [email protected] and we will clear it within 7 days. There is no account to delete.
Children. The app is not directed to children under 13.
Contact. [email protected]