Ten-Shineandfanlusky
4eed9c8442
* fix(installer): 升级不再删除 custom_translations.txt custom_translations.txt 是用户手工放在数据目录根下的中英翻译覆盖表， 安装包不携带、引擎只读不写。覆盖安装时 CleanAppDataExceptUserFiles 会 清掉根下所有不在 IsPreservedAppDataItem 名单里的条目，换数据目录时 MigrateUserDataDir 的 robocopy 清单也不含它，于是升级会把它删掉，或留在 旧目录随 RemoveDataDir 一起消失。它没有 config.toml 那样的出厂副本可 回退，删掉即内容彻底丢失。 新增 IsUserTranslationFile 并接入 IsPreservedAppDataItem，覆盖安装时与 其他用户数据同等保留；MigrateUserDataDir 的 robocopy 文件清单补上它， 换数据目录时一并搬走。preserve-user-data.ps1 的 $required 同步更新。 同步 installer/README.md 的迁移清单与 PRIVACY.md 的升级保留说明，并订正 新增函数注释里引用的 README 章节名。 * fix(installer): 迁移 custom_translations.txt 时不覆盖、不静默丢失 换数据目录时 robocopy /MOVE 会用旧目录那份直接盖掉目标目录里已有的 custom_translations.txt，而冲突检查只管 config.toml。现在 ConfigMigrationProblem 对它做同样的检查：两份内容不同就拒绝这个目录，相同就删掉旧目录的残留再搬。 这也避免了 RemoveDataDir 在非独占目录里按名字删掉没搬走的那一份。 迁移失败时原先只有用户词库和 config.toml 会中止安装，custom_translations.txt 被当成皮肤一样可重建的东西只记日志。它没有出厂副本，新增 TranslationMigrationFailure，没搬成同样中止。 同步 PRIVACY.md 与 installer/README.md 的保留/迁移清单，补上此前就漏掉的 stats.db、helpcodes\custom、shuangpin、models。 --------- Co-authored-by: fanlusky <1730976608@qq.com>
50 lines
8.5 KiB
Markdown
50 lines
8.5 KiB
Markdown
# Privacy
|
|
|
|
Metasequoia IME for Windows converts keystrokes, composition text and candidates locally, using the shared C++ engine and the SQLite dictionaries installed under `%LOCALAPPDATA%\metasequoiaime\`. Local conversion never contacts the network. This document describes the optional online features that do, exactly what each one sends, and how to turn each one off.
|
|
|
|
Every claim below is checkable against this repository. Where a default matters, the file and key that set it are named.
|
|
|
|
## Network features
|
|
|
|
**Cloud candidates are enabled by default, and the installer asks before the first install.** `general.cloud_candidates` is `true` in the shipped `installer/default_config/config.default.toml`, and `server/src/config/ime_config.cpp` also defaults to `true` when the key is absent. A first install shows a wizard page naming this feature and its endpoint, with the box checked; clearing it writes `cloud_candidates = false` into the config that install creates. Upgrades skip that page, because by then the config belongs to the user. While a composition is active, the typed spelling is sent over HTTPS to Google's input-tools service (`https://inputtools.google.com/request`) to fetch one extra candidate. Google receives that spelling, the IP address and standard request metadata. No committed text, dictionary content, learned frequencies, settings or account data are sent. This is the one online feature that needs no credential, so it is the one that is actually live on a fresh install. Turn it off in 设置 → 输入 → 云候选, or set `cloud_candidates = false` under `[general]` in `%LOCALAPPDATA%\metasequoiaime\config.toml`.
|
|
|
|
**AI candidate suggestions require a token you supply.** `[ai_assistant] enabled` ships as `false`. When enabled and configured with a real token, the segmented spelling and the surrounding composition context are sent to the provider's Chat Completions endpoint — DeepSeek, OpenAI, SiliconFlow or Groq, per `[ai_assistant] provider`. That provider's own privacy terms then apply. Set `enabled = false` to disable it outright.
|
|
|
|
**Jev is an optional candidate-selection provider.** Selecting `jev` under `[ai_assistant]` uses TypeSafe's Choice endpoint (`https://api.typesafe.ai/v1/systemone`) instead of Chat Completions. Each request sends the segmented pinyin, recent committed context from the current focus session (up to 1024 UTF-8 bytes before credential-like text filtering), and up to 32 matching local candidates, including matching user-dictionary entries. The service selects one existing candidate or abstains; it does not generate new candidate text. Requests are disabled in fields reported as sensitive by the host. Ordinary composition context and candidate text are still sent to TypeSafe, whose privacy terms apply. Turn off AI candidate suggestions to stop these requests.
|
|
|
|
**Candidate translation requires credentials you supply.** `[tencent_tmt] enabled` ships as `true` with placeholder credentials, so nothing is sent until real Tencent Cloud keys are entered. Once configured, candidate text that the local dictionaries could not gloss is sent to `https://tmt.tencentcloudapi.com`. Translations are display metadata and never change the text that is committed.
|
|
|
|
**Voice input requires a token you supply.** `[voice_input] voice_input` ships as `true` with a placeholder ASR token, so the hotkeys do nothing over the network until a real token is entered. Once configured, recorded audio is uploaded to the configured endpoint — Doubao (`wss://openspeech.bytedance.com/...`), OpenAI, SiliconFlow or Groq. If text polishing is enabled, the returned transcript is additionally sent to the configured Chat Completions endpoint.
|
|
|
|
**The update check runs only when you press the button.** 设置 → 关于 → 检查更新 fetches `https://msime.app/update.json` and compares the version. There is no background or scheduled update check, and the request carries no identifier beyond the IP address and a cache-busting timestamp.
|
|
|
|
## No telemetry
|
|
|
|
There is no analytics, telemetry, crash reporting, or usage measurement that leaves this machine. The input method does not record, store or transmit what you type: the only records it can keep are the optional local counters described below, and those cover character classes, activity time and candidate-choice counts, never text. No third-party SDK for those purposes is linked, and there is no endpoint that receives usage data. This is verifiable: searching the `server/`, `windows/`, `ui/` and `installer/` trees for `telemetry`, `analytics`, `sentry`, `matomo`, `posthog`, `amplitude`, `mixpanel`, `crashpad` and `breakpad` returns nothing.
|
|
|
|
## Local input statistics (built-in, off by default)
|
|
|
|
The input method can show a local typing summary in 设置 → 统计. This is a built-in capability, not a separately distributed tool: `statistics.enabled` is `false` in the shipped `installer/default_config/config.default.toml`, so a fresh install records nothing, and 设置 → 统计 lets you turn recording on.
|
|
|
|
While enabled, the input method records only counters in a local SQLite database: per-day and per-hour counts of five character classes (Chinese, Latin, digits, punctuation, other), the time counted as actively typed, and two further counters of candidate choices — how many commits were made from the Chinese candidate list and how many of those selected the first candidate of the first page. Those two counters power the "first-word hit rate" card and let you measure ranking quality locally; they carry no text and no way to reconstruct any wording. The counts come from text the input method commits to the document and from printable keystrokes it leaves for the application to insert; the second half is a keystroke-level approximation and can slightly over-count (for example an input field that rejects or truncates the character). No text, spelling, candidates, application name or window title is stored, and the counters are carried to the Server process over a session-scoped local named pipe only. The database is `<DataDir>\stats.db`, where `<DataDir>` is the data directory chosen at install time (default `%LOCALAPPDATA%\metasequoiaime`); it makes no network requests and uploads nothing.
|
|
|
|
Turning the switch off stops new recordings; existing counters are kept until they are deleted. To remove them, use the controls in 设置 → 统计: the automatic retention policy (keep the last 30 / 90 / 180 / 365 days) deletes expired days on the next write after midnight, and the "clear all statistics" button immediately wipes every record, including today's. `statistics.retention` in `config.toml` stores the policy and defaults to `forever`, which never deletes automatically; an invalid value falls back to `forever` so a broken config cannot delete data. Deleting `stats.db` works too.
|
|
|
|
## Local data
|
|
|
|
Settings live in `%LOCALAPPDATA%\metasequoiaime\config.toml`. Learned word frequencies and user-created words are stored in `%LOCALAPPDATA%\metasequoiaime\msime_user.db`. Diagnostic logs are written to `%LOCALAPPDATA%\metasequoiaime\log\` and record process lifecycle and error conditions, not typed content. Clipboard history is disabled by default (`clipboard_history = false`); when enabled it records copied text locally and is cleared as soon as it is switched off.
|
|
|
|
**API tokens are stored in plain text in `config.toml`.** This differs from the other platforms — macOS and iOS use the Keychain, and Linux uses the desktop Secret Service — and it means anything able to read that file can read the tokens. Use provider tokens scoped to this purpose, and treat the file as a secret when backing up or syncing the profile directory.
|
|
|
|
All of these files sit in the current user's profile and are protected only by that account's permissions.
|
|
|
|
## Uninstall
|
|
|
|
Uninstalling deletes `%LOCALAPPDATA%\metasequoiaime` and `%PROGRAMDATA%\metasequoiaime` in full, including the user dictionary, settings and any installed skins. Back up `msime_user.db` first if you want to keep learned words. An in-place upgrade behaves differently: it preserves `msime_user.db`, `stats.db`, `config.toml`, `config.base.toml`, `custom_translations.txt`, and the `skins`, `shuangpin`, `models` and `helpcodes\custom` directories, and replaces everything else.
|
|
|
|
## General
|
|
|
|
Metasequoia IME does not sell or share personal data, and installing or using it does not create an account. If a future release adds another network-backed feature, this notice must be updated before that feature ships.
|
|
|
|
Security or privacy concerns should be reported privately as described in the organisation [SECURITY.md](https://github.com/metasequoiaime/.github/blob/main/SECURITY.md).
|