牧云图片 · 隐私政策 / Privacy Policy

中文版

牧云图片不收集、不上传、不分享你的任何数据。 你的图片、编辑记录、偏好设置全部只在你这台 Mac 本地处理和保存。没有后端服务器，没有云同步，不内嵌任何第三方分析、追踪或广告 SDK。所有图像处理——滤镜、调色、标注、马赛克、内容感知消除与 AI 消除——全部在你的设备上完成。

我们处理什么，在哪处理

数据	用途	处理/存储位置
你打开的图片	显示与编辑	仅内存，经 macOS 沙盒"用户选择文件"权限读取，保存时写回你指定位置
编辑内容（标注/滤镜/调整/消除区域）	当前编辑会话	仅内存，随导出图片保存，不单独持久化
AI 消除模型（LaMa，约 200MB）	本地 AI 消除推理	设备本地 `Application Support/MuyunImage/Models/LaMa`，可随时删除
打印任务	你主动打印图片	macOS 系统打印服务，App 不留存副本

我们不做的事

不向任何远端服务器上传你的图片或任何数据
不接入广告网络
不接入分析平台（无 Google Analytics / Firebase / Mixpanel / 友盟 / 神策 / Sentry / 自建埋点）
不读取通讯录、位置、麦克风、摄像头
不要求登录账号，不绑定手机号/邮箱
不在后台静默上传任何信息
AI 消除不调用任何云端 API——模型下载到本地后，推理完全离线

网络通信

本 App 仅在一种情况下发起网络连接，且完全由你主动触发：

下载 AI 消除模型 — 当你在"消除"工具中选择"AI 智能消除"并点击下载时，App 通过 HTTPS 从 GitHub Releases（开源项目 CoreMLaMa 的公开构建）下载 LaMa CoreML 模型；直连失败时会尝试公共 GitHub 镜像加速站。请求中不包含你的任何图片或个人信息。

除此之外，App 不与任何服务器通信。若不使用 AI 消除（内容感知消除无需模型），App 可在完全断网环境下使用全部功能。

文件访问

牧云图片运行在 macOS App Sandbox 中，仅能访问你通过打开/保存对话框或拖拽主动授予的文件，无法扫描或读取磁盘上的其他内容。

数据删除

已下载的 AI 模型：在 App 的模型管理界面删除，或直接删除上述 Application Support 目录。
全部清除：从"应用程序"删除 App，并移除 ~/Library/Containers/com.gezhipeng0201.MuyunImage，无任何残留。

English Version

MuyunImage collects no data, transmits nothing to remote services, and shares nothing with third parties. Your images, edits, and preferences are processed and stored exclusively on your own Mac. There is no backend server, no cloud sync, and no embedded analytics, tracking, or advertising SDK. All image processing — filters, color adjustment, annotations, mosaic, content-aware removal, and AI removal — happens entirely on your device.

What we process and where

Data	Purpose	Location
Images you open	Display & editing	In-memory only, via macOS sandbox user-selected-file permission; saved back where you choose
Edits (annotations / filters / adjustments / masks)	Current session	In-memory only, baked into exported images; never persisted separately
AI removal model (LaMa, ~200 MB)	On-device AI inpainting	Device-local `Application Support/MuyunImage/Models/LaMa`, removable anytime
Print jobs	Printing you initiate	macOS print system; the app keeps no copy

What we do not do

No upload of your images or any data to any remote server
No ad networks
No analytics SDKs (no Google Analytics / Firebase / Mixpanel / Sentry / custom telemetry)
No access to Contacts, Location, Microphone, or Camera
No account sign-up, no phone, no email
No background silent uploads
AI removal never calls any cloud API — once downloaded, inference is fully offline

Network traffic

The app initiates network traffic in exactly one case, explicitly triggered by you:

AI model download — Choosing "AI Removal" and tapping download fetches the LaMa CoreML model over HTTPS from GitHub Releases (public build of the open-source CoreMLaMa project), with public GitHub mirror CDNs as fallback. The request contains none of your images or personal information.

Outside of that, the app talks to no servers at all. Without AI removal (the content-aware engine needs no model), the app works completely offline.

File access

MuyunImage runs inside the macOS App Sandbox and can only access files you explicitly grant via open/save dialogs or drag & drop.

Data deletion

Downloaded AI model: delete from the in-app model manager, or remove the Application Support folder above.
Complete wipe: delete the app from /Applications and remove ~/Library/Containers/com.gezhipeng0201.MuyunImage.

Technical Statement

For App Store reviewers and security-conscious users:

Sandbox & Hardened Runtime: sandboxed (com.apple.security.app-sandbox) with only the user-selected files (read/write) entitlement — no network server, no device hardware entitlements.
On-device ML: AI removal runs a locally stored LaMa model via Apple CoreML (CPU+GPU). No image bytes are ever transmitted.
Content-aware removal: a pure-CPU PatchMatch implementation compiled into the app; no model, no network.
Only network endpoint: github.com releases (plus public mirrors) for the optional one-time model download over HTTPS.
No third-party SDK at runtime: Apple system frameworks only (SwiftUI, CoreGraphics, CoreML, CoreImage).

牧云图片 — 隐私政策

中文版