macOS update · 5 November 2026

DingYue for macOS 1.5.3 follows the same purchase ownership rules: guest purchases are usable as a guest and can be restored with the purchasing Apple Account; using them with a DingYue account requires explicit linking. Purchases started while signed in belong to that account, including restoration. Switching accounts does not transfer membership. Mac sign-in uses system capabilities or the default browser; Developer ID builds retain their Apple browser fallback. macOS WebDAV credentials stay in Keychain, and guest and account iCloud backups remain separated in the channel-specific container.

iOS 购买归属补充 · 2026 年 11 月 4 日

游客购买可在游客状态使用，并可通过原购买 Apple 商店账户在重装后恢复；登录 DingYue 账户后，需主动关联才用于该账户。登录状态发起的购买会在 Apple 交易中携带当时账户的关联标识，并为该账户验签与恢复原归属。切换其他 DingYue 账户不继承会员，不因同一设备存在 Apple 购买而给其他账户权益。

一、适用范围与联系我们

本政策适用于 DingYue 国内版应用及 erieanna.tech 网站。服务由个人开发者罗华东提供；个人信息保护咨询、投诉、权利请求与未成年人保护事宜请联系 support@erieanna.tech。国际版使用独立账户和服务，应另行阅读其政策。

请在使用相关功能前阅读对应说明。账户服务所必需的信息与可选功能所需的信息分开处理；拒绝邮件提醒、文件上传或云盘授权不影响本地记录功能。服务运行仍可能产生必要的网络访问日志。

二、本地使用、账户与身份信息

首次打开可以不登录，在本机保存订阅和自定义项。只有选择登录、云同步、上传或云备份等联网功能时，相应内容才会提交到相关服务；请留意各操作的确认提示和同步设置。

邮箱注册、登录或找回账户时，我们处理邮箱、密码的不可逆散列、验证码及其有效期、必要的验证记录。昵称和头像可选。账户分配唯一 UID，换绑邮箱或第三方登录方式不应改变 UID 或已有记录的归属。

选择第三方登录时，我们接收该平台授权返回的用户标识、昵称、头像或经过验证的邮箱（如实际返回）。可能涉及华为、QQ、Microsoft、Google、Apple、GitHub、Gitee、微信，实际可用性以本渠道入口与平台开通状态为准。我们不接收第三方登录密码，不根据 OpenID 猜测 QQ 号码或邮箱。

未返回真实邮箱的第三方账户可能显示内部占位邮箱；该地址仅用于系统兼容，不能收信。通行密钥由系统或密码管理器保管私钥，我们保存公钥、凭据标识等验证信息；两步验证由您自行启用并管理。

三、订阅记录与普通云同步

您录入的订阅可包括名称、金额、币种、周期、开始和截止日期、分类、地区、图标、备注及账户记录（邮箱、手机号或自定义名称）。名称与有效日期为保存所需；金额可以不填并按 0 处理，图标和账户记录可选。账户记录不是 DingYue 手机号注册，也不会自动向该号码发送短信。

本地记录留在当前设备。选择普通云同步后，相关订阅和自定义项会上传至国内服务，以提供跨设备读取、更新和冲突处理。自动同步仅在您开启后运行；本地回收站不自动上传。切换设备、清除应用数据或卸载前，请先确认本地备份和云端状态。

当前 1.5.1 不提供订阅端到端加密：普通云数据由服务端存储和处理，不能承诺只有您能解密。历史加密数据和原密钥保留兼容边界，不会因重设登录密码自动恢复，也不据此承诺旧密文全部可用。登录会话和云盘凭据仍按各客户端的安全存储机制管理。

我们不要求您提供银行密码、银行卡完整信息、短信验证码或他人的敏感信息。自由文本可能包含您主动填写的个人信息，请仅填写管理订阅所必需的内容，并确保有权处理其中涉及他人的信息。

四、邮件提醒与独立收信地址

邮件提醒默认关闭。您可在“设置—邮件提醒”单独开启，并填写有权使用的真实收信邮箱，通过验证码确认。占位邮箱不能送达；未验证的收信地址不会用于发送订阅提醒。此处验证不修改登录邮箱、UID 或账户归属。

为发送提醒，服务会使用云端订阅的显示名称、账单日期、提醒时间或提前天数、语言及已验证的当前收信地址，记录必要的送达状态和失败原因。提醒邮件不包含金额、付款账户或完整备注。邮件服务商及收件方邮箱服务需处理相应地址和邮件内容。

关闭开关后停止安排新的提醒发送，已交给邮件服务投递的消息无法撤回。收信地址可在同页重新验证更换；关闭后可保留已验证地址以便再次开启。如需删除已留存地址，可注销账户或联系支持处理。验证码和账户安全通知属于用户触发的必要服务邮件，与订阅提醒开关分开。

五、上传、下载、云盘与系统权限

仅在您选取文件并确认相关操作后处理头像、订阅图标、导入或备份文件。头像和图标上传至服务后会生成资源地址；获得地址的人可能访问该资源，请勿上传身份证件等敏感图片。本地导入与服务器上传是不同操作，勿将所有文件默认视为已上传。

国内版云盘可选百度网盘和您配置的 WebDAV。授权及备份会把您选择的文件、必要授权令牌或连接信息交给对应服务；WebDAV 地址由您决定。断开连接会停止后续访问，不会自动删除您云盘中已有的备份。本地导出的文件由您和所选存储位置保管。

相册和文件访问通过系统选择器按需请求；通知、网络等权限仅用于相应功能，您可在系统设置撤回。通行密钥或系统身份验证可能使用设备生物识别，但 DingYue 不取得您的指纹或人脸模板。拒绝权限会影响对应功能，不强制开启无关权限。

六、必要日志、浏览器存储与用途

为保持登录、语言、主题、本地记录及同步状态，网站或客户端使用本地数据库、偏好存储、会话存储及必要的令牌。清除这些数据可能退出登录或删除未备份的本地记录。服务器为排查故障、防止滥用和执行访问控制处理必要的 IP、请求时间、接口、状态码、请求标识和认证安全事件。

这些信息用于履行您请求的服务、验证账户、保护数据和处理故障或投诉。我们不出售您的订阅记录，不将其用于个性化广告画像。本政策不授权将记录用于与服务无关的新目的；如用途或处理规则发生重大变化，我们会重新告知并在依法需要时征求同意。

七、服务提供方、第三方与跨境选择

国内 API 与普通云数据使用中国大陆部署的服务器。基础设施托管及发信服务仅处理提供服务所必要的信息，受相应访问控制。第三方登录由您点击授权后进行；我们仅按实际授权范围接收信息，不因您使用本地功能而自动登录第三方。

华为、QQ、Microsoft、Google、Apple、GitHub、Gitee、微信及百度网盘分别适用其自身政策；微信中继入口在授权页面显示 CZL Connect 时还会涉及该授权中继。Microsoft、Google、Apple、GitHub 等第三方或您指定的 WebDAV 可能由境外设施处理授权或备份数据，请在选择前阅读其说明。国内与国际 DingYue 账户不会因此自动合并或自动复制完整订阅库。

除为您选择的服务所必需的受托处理、依法履行义务等情形外，我们不会未经必要告知和同意向第三方提供您的个人信息。发生主体变更或需要转移个人信息时，将告知接收方和联系方式，并要求其承担相应保护义务。

QQ 登录／绑定在鸿蒙版使用 QQ互联 HarmonyOS SDK 1.0.4，在国内安卓版使用 QQ互联 Android SDK 3.5.19，由深圳市腾讯计算机系统有限公司提供；仅在您点击并同意相关条款后初始化。授权过程可能涉及设备型号、QQ／TIM 安装信息、OpenID、经开通的 UnionID、昵称及头像等实际授权信息，用于完成身份授权及返回本应用。不会因此取得 QQ 密码、QQ 号码或真实邮箱。QQ互联 SDK 隐私保护声明：https://wiki.connect.qq.com/qq互联sdk隐私保护声明 。您可不选择 QQ，继续使用本地功能或其他已开通方式。

八、保存、安全与事件处理

账户资料在提供账户服务期间保存；订阅数据按本地与云端各自状态保存，可通过编辑、回收站永久删除、云同步删除或账户注销处理。验证码有有效期，验证记录、送达记录和必要安全日志按用途及依法要求保留，超过必要期限后删除或匿名化。备份副本可能随备份轮换延后清除，在此期间限制恢复以外的使用。

我们采用 HTTPS、密码散列、账户访问控制、会话验证、必要的备份和权限限制。任何措施都不能保证绝对安全。发现个人信息安全事件后，将采取补救和风险控制措施，并依法向有关部门及受影响用户告知；请勿在支持邮件中发送密码、私钥或完整验证码。

九、查阅、更正、撤回与注销

您可在设置中查看或更正昵称、头像、登录邮箱和安全方式，导出本地备份，管理第三方绑定、云盘连接及邮件提醒。换绑登录邮箱需完成相应验证，不应创建新 UID。退出登录不等于注销，也不等于删除其他设备或云盘中的备份。

注销入口：登录后进入“设置—个人资料／账户—注销账户”，按提示确认；无法进入应用时可访问 erieanna.tech/close/ 或联系支持。确认前请自行导出所需记录并核对云端状态。注销会删除在线账户及关联的业务数据，停止账户服务；法律要求保留的最少记录和受限灾备副本按必要期限处理。您自行保存的本地／云盘文件、第三方平台账户和无法确认归属的历史资源不因注销自动全部删除，可联系支持进一步处理。

您也可以通过支持邮箱申请查阅、复制、更正、删除、撤回同意或说明处理规则。为避免数据被冒领，我们仅要求与请求相称的身份核验。我们将及时处理，并说明不能立即完成的原因及后续途径；对处理有异议，可继续投诉或向有管辖权的个人信息保护部门反映。

十、未成年人保护

账户及云端服务不面向未满十四周岁的儿童。若您未满十四周岁，请勿提交个人信息或自行注册账户；监护人发现儿童信息被提交时，可联系支持核验后删除。十四至十七周岁用户应在监护人指导下阅读本政策并在获得相应同意后使用账户功能。

我们不会以索取额外儿童敏感资料作为行使删除权的条件。若将来专门提供儿童账户服务，将先制定并公布专门规则和监护人同意机制，而非仅依赖本条替代。

十一、政策更新与版本

本次版本更新日期为 2026 年 10 月 20 日。涉及信息类型、目的、第三方或权利方式的重大变化会通过页面或应用提示告知；需要重新同意的，不以继续使用自动替代。中文正文在前，完整英文在后；两者有不一致时，国内服务以中文为准，但不减少法律赋予您的权利。

Apple 购买、iCloud 与诊断补充（2026年11月3日）

国区 iOS 1.5.3 的本机购买及恢复由 Apple StoreKit 验证，无需 DingYue 账户，不向我们提供银行卡或 Apple 账户密码。对于游客购买，仅在您登录后主动确认关联购买时，我们接收 Apple 签名交易并向 Apple 核验，将必要的交易编号、商品、环境、有效期及续订状态与当前 DingYue 账户关联，用于授予和维护权益、防止重复归属。关联不转移其他账户的数据或 UID。

选择 iCloud 备份时，您导出的订阅及备份内容会交给 Apple iCloud，保存在 iCloud.com.dingyue.app.ios 容器，受您的 Apple 账户及 iCloud 设置控制，不经 DingYue 服务器转存。备份为普通数据，不承诺由 DingYue 实施端到端加密。游客与 DingYue 账户的备份分别存放；恢复、断开连接与删除文件按界面和 iCloud 控制进行。账户注销不自动清除 iCloud 文件。

内购诊断仅在本机内存临时保留最近30条，包含应用版本、处理阶段、商品标识、商店地区以及错误域和错误码，不包含密码、会话令牌、完整交易凭据或账户邮箱。只有您主动使用系统分享时才发送至您选择的接收方，我们不会自动上传这份诊断。

macOS 更新 · 2026 年 11 月 5 日

DingYue macOS 1.5.3 同样遵循购买归属规则：游客购买可供游客使用，并用原购买 Apple 商店账户恢复；要在 DingYue 账户使用，需主动关联。登录状态购买和恢复保持原账户归属，切换其他账户不继承会员。Mac 登录使用系统能力或默认浏览器，Developer ID 公证分发版保留 Apple 浏览器回退；macOS WebDAV 凭据保存在钥匙串，游客与账户的 iCloud 备份按渠道容器分别存放。

iOS purchase ownership · 4 November 2026

Guest purchases can be used as a guest and restored after reinstallation with the purchasing Apple Account. To use them while signed in to DingYue, explicitly link them to that DingYue account. Purchases started while signed in carry the account association in the Apple transaction and are verified for that account; restoring preserves the original ownership. Switching to another DingYue account does not transfer membership. No other account is granted access merely because the device has an Apple purchase.

1. Scope and contact

This policy covers DingYue CN applications and erieanna.tech, provided by individual developer Luo Huadong. Contact support@erieanna.tech about privacy, complaints, personal-data rights or protection of minors. The international edition uses separate accounts and services and has its own policy.

Read the relevant notice before using a feature. Information needed for an account is distinguished from optional features. Declining email reminders, uploads or cloud-drive access does not prevent local record keeping. Necessary network access logs may still be generated.

2. Local use, accounts and identity

You can start without signing in and keep subscriptions and custom items on your device. Relevant content is submitted when you choose online features such as sign-in, sync, uploads or cloud backup. Review each confirmation and your sync settings.

For email registration, sign-in and recovery, we process your email, an irreversible password hash, verification codes and their validity, and necessary verification records. Nickname and avatar are optional. Each account has a unique UID; changing email or sign-in methods does not change ownership of its records.

If you choose third-party sign-in, we receive the identifier, name, avatar or verified email that the provider actually authorizes. Providers may include Huawei, QQ, Microsoft, Google, Apple, GitHub, Gitee and WeChat, subject to channel availability and provider setup. We do not receive their passwords or infer a QQ number or mailbox from an OpenID.

A third-party account without a real email may show an internal placeholder that cannot receive messages. For passkeys, your system or password manager keeps the private key; we store the public key and credential information needed to verify sign-in. Two-step verification is optional.

3. Subscription records and ordinary sync

Records may include name, amount, currency, cycle, start and billing dates, category, region, icon, notes and an account label such as email, phone number or custom text. A name and valid dates are required; an empty amount is zero, and icon and account label are optional. A record label does not register a DingYue phone account or trigger an SMS.

Local records remain on the device. Ordinary sync uploads relevant records and custom items to the CN service for cross-device access, updates and conflict handling. Automatic sync runs only when enabled; the local recycle bin is not automatically uploaded. Check backups and cloud status before switching devices, clearing app data or uninstalling.

Version 1.5.1 does not provide end-to-end encryption for subscriptions: ordinary cloud data is stored and processed by the server. We cannot claim that only you can decrypt it. Historical encrypted data and keys retain their compatibility limits; a password reset cannot automatically recover it. Sign-in sessions and cloud-drive credentials continue to use the clients’ security mechanisms.

We do not require bank passwords, full card details, SMS codes or sensitive information about others. Free text may contain personal data you choose to enter. Limit it to what your records need and ensure you have authority to include information about others.

4. Email reminders and a separate recipient

Email reminders are off by default. Enable them under Settings → Email reminders and verify a real recipient address you are authorized to use. Placeholders cannot receive mail; unverified recipients are not used for subscription reminders. Recipient verification does not change your sign-in email, UID or account ownership.

Delivery uses the cloud record’s display name, billing date, reminder timing, language and verified recipient, with necessary delivery status and failure records. Reminder emails omit amounts, payment-account labels and full notes. Mail providers and the recipient’s mail service process the address and message content.

Turning the switch off stops new reminder deliveries; messages already handed to a mail service cannot be recalled. Verify a replacement on the same page. A verified recipient can remain saved while disabled; request removal through support or account deletion. User-requested verification and essential account-security notices are separate from subscription reminders.

5. Files, cloud drives and permissions

We process avatars, icons and import or backup files when you select them and confirm an operation. Uploaded avatars and icons receive resource URLs that may be accessible to anyone who knows them; do not upload sensitive images such as identity documents. Local import and server upload are different actions.

CN cloud-drive options are Baidu Netdisk and your chosen WebDAV server. Authorization and backup involve selected files and necessary access tokens or connection information. You choose the WebDAV destination. Disconnecting stops future access but does not automatically delete existing cloud backups. You control locally exported files.

Photo and file access is requested as needed through system pickers; notification and network capabilities serve their related features. Manage permissions in system settings. System authentication may use biometrics, but DingYue does not receive fingerprint or face templates. Declining a permission affects the related feature.

6. Necessary logs and browser storage

Local databases, preferences, session storage and tokens maintain sign-in, language, theme, local records and sync state. Clearing them may sign you out or erase unbacked-up records. Necessary server logs include IP, time, endpoint, status, request identifier and authentication events for reliability, abuse prevention and access control.

We use this information to provide requested services, authenticate accounts, protect data and address faults or complaints. We do not sell your subscription records or use them for personalized advertising profiles. This policy does not authorize unrelated new uses; material changes will be disclosed and consent sought where required.

7. Service providers and cross-border choices

The CN API and ordinary cloud data use servers deployed in mainland China. Hosting and mail infrastructure process information necessary for the service under access controls. Third-party sign-in starts when you choose it; we receive information within the granted scope, not merely because you use local features.

Huawei, QQ, Microsoft, Google, Apple, GitHub, Gitee, WeChat and Baidu have their own policies. A WeChat relay identified as CZL Connect also involves that authorization intermediary. Some providers or your WebDAV destination may process authorization or backup data outside mainland China. Review their notices before choosing them. This does not automatically merge CN and international DingYue accounts or copy a complete subscription database.

Apart from processing needed for your chosen service or legal obligations, we do not provide personal data to third parties without the required notice and consent. If a change of operator requires transfer, we will disclose the recipient and contact details and require appropriate protection.

QQ sign-in and linking use QQ Connect HarmonyOS SDK 1.0.4 on HarmonyOS and QQ Connect Android SDK 3.5.19 on Android CN, provided by Shenzhen Tencent Computer Systems Company Limited. They initialize only after you choose the feature and agree to the relevant terms. Authorization may involve the device model, QQ/TIM installation information, OpenID, an authorized UnionID, name and avatar as actually granted, to complete identity authorization and return to this app. It does not disclose a QQ password, QQ number or real mailbox. QQ Connect SDK privacy notice: https://wiki.connect.qq.com/qq互联sdk隐私保护声明 . You can decline QQ and keep using local features or another available sign-in method.

8. Retention, security and incidents

Account data is retained while providing the account service. Local and cloud records follow their respective states and can be managed by editing, permanent deletion, synced deletion or account closure. Codes expire; verification, delivery and security records are retained only for their purposes and legal requirements. Backup copies may be removed later in rotation, with their use restricted to recovery until then.

Protections include HTTPS, password hashing, access control, session checks, backups and restricted permissions. No measure guarantees absolute security. If a personal-data incident occurs, we will contain and remediate it and notify authorities and affected users as required. Do not send passwords, private keys or complete verification codes to support.

9. Access, correction, withdrawal and closure

Settings lets you review or change your name, avatar, sign-in email and security methods, export local backups, and manage linked sign-ins, cloud drives and reminders. Email changes require verification without creating a new UID. Signing out is not account deletion and does not remove copies on other devices or drives.

To close an account, sign in and open Settings → Profile/account → Delete account, then confirm. If unavailable, visit erieanna.tech/close/ or contact support. Export needed records first. Closure deletes the online account and related business data and ends account services. Legally required records and restricted disaster-recovery copies follow necessary retention. Local or cloud-drive files, third-party accounts and historical resources whose ownership cannot be established are not automatically all erased; contact support for further handling.

You may request access, a copy, correction, deletion, withdrawal of consent or an explanation through support. We request proportionate identity verification to prevent unauthorized disclosure. We will respond promptly and explain any delay or refusal and available follow-up. You may complain further or contact the competent data-protection authority.

10. Protection of minors

Account and cloud services are not directed to children under fourteen. If you are under fourteen, do not submit personal data or register independently. Guardians may contact support to verify and remove a child’s information. Users aged fourteen to seventeen should review this policy with a guardian and obtain the appropriate consent for account features.

We will not require unnecessary sensitive information about a child to exercise deletion rights. Dedicated child account services, if introduced, would first need specific published rules and a guardian-consent process.

11. Changes and version

Updated 3 November 2026. Material changes to data types, purposes, third parties or rights procedures will be communicated in the app or on the site. Where renewed consent is needed, continued use alone does not replace it. Chinese appears first, followed by the complete English text. Chinese governs the CN service in case of inconsistency without reducing statutory rights.

Apple purchases, iCloud and diagnostics supplement (3 November 2026)

Device purchases and restores in CN iOS 1.5.3 are verified by Apple StoreKit without a DingYue account. We do not receive your bank-card details or Apple Account password. For guest purchases, only if you sign in and explicitly confirm linking a purchase do we receive its signed Apple transaction, verify it with Apple, and associate necessary transaction identifiers, product, environment, validity and renewal state with the current DingYue account to maintain access and prevent conflicting ownership. Linking does not transfer another account’s data or UID.

If you choose iCloud backup, your exported subscription and backup contents are stored by Apple iCloud in iCloud.com.dingyue.app.ios under your Apple Account and iCloud controls, without passing through DingYue servers. Backups are ordinary data; we do not claim DingYue end-to-end encryption. Guest and DingYue account backups are stored separately. Use the app and iCloud controls for restoration, disconnection and file management. Closing a DingYue account does not automatically erase iCloud files.

Purchase diagnostics keep the latest 30 entries temporarily in device memory: app version, processing stage, product identifiers, storefront country, and error domain and code. They exclude passwords, session tokens, full transaction credentials and account email. They leave the device only if you use system sharing and choose a recipient; we do not upload them automatically.