阿福的对话与推理全部在你的设备上完成，聊天内容不会上传到我们或任何第三方的服务器。 没有账号，没有自建后端，不内嵌广告、分析或追踪 SDK。
| 数据 | 用途 | 位置 |
|---|---|---|
| 你输入的文本、模型回复、会话标题与时间 | 构建提示词并在本机生成回复 | 设备本地数据库 |
| 你从相册选择或拍摄的图片 | 在本机做文字识别、画面理解或摘要 | 设备本地；不上传 |
| 你通过「文件」导入的 PDF / Word / Excel / CSV / TXT / Markdown | 在本机解析为模型可读的文本 | 设备本地；不上传 |
| 生成参数（温度、Top-P、最大长度、系统提示词） | 控制模型行为 | 设备本地 |
| Hugging Face Access Token（仅你主动填写时） | 下载需要授权的模型 | 设备钥匙串；只用于该次下载 |
关于图片与文件：图片可能使用 Apple 提供的本机能力（如 Vision）处理；文件在本机被解析为文本摘录。两者都不会离开设备。
应用只在两处联网：
除此之外，阿福不发起任何网络请求。断网时已下载的模型仍可正常对话。
在应用内删除会话即可移除对应记录；删除整个 App 并移除其容器，即可清除全部本地数据（已下载的模型文件也会一并删除）。
Afu runs all inference on your device. Your conversations are never uploaded to us or any third party. No account, no backend, no ads, analytics, or tracking.
| Data | Purpose | Where |
|---|---|---|
| Your messages, model replies, session titles and timestamps | Build prompts and generate replies on-device | Local database on your device |
| Photos you pick or capture | On-device text recognition and image understanding | On device only |
| Files you import (PDF, Word, Excel, CSV, TXT, Markdown) | Parsed into text on-device | On device only |
| Generation settings (temperature, Top-P, max length, system prompt) | Control model behaviour | On device |
| Hugging Face access token (only if you enter one) | Download gated models | Device keychain; used only for that download |
The app connects to the network in exactly two places: fetching the public model catalog from a GitHub repository (reads a list only, sends nothing about you), and downloading model weights from Hugging Face or a mirror you choose. Only the model files travel; your conversations, photos, and files are never included. Downloaded models keep working offline.
Delete a session in-app to remove it. Removing the app and its container clears all local data, including downloaded models.