隐私政策

适用于 掌柜CFO（中国区）／ Solo CFO（国际区）iOS 应用
生效日期：2026 年 8 月 5 日 ｜ 最后更新：2026 年 8 月 13 日

1. 我们收集哪些数据

我们不收集任何数据。具体而言：

• 本应用没有用户账号、没有注册登录，我们不知道也无从知道你是谁。
• 你录入的账户、流水、金额、备注等全部财务信息，仅保存在你设备的本地存储中，并以 AES-256-GCM 加密后存放。解密所需的密钥由你设置的密码与恢复码派生，我们不持有、也无法获取。
• 本应用不含任何第三方分析、统计、广告或崩溃上报 SDK。
• 我们不收集设备标识符、位置、通讯录、日历、健康数据或任何其他个人信息。

2. 系统权限

本应用默认不请求任何系统权限。只有当你主动使用「拍照/截图识别」去识别账单图片时，系统才会询问是否允许访问相册或相机——你可以拒绝，拒绝后其余功能不受影响。图片只在你的设备上处理，不会上传，也不会被保存进 App。本应用不访问位置、通讯录、麦克风、日历或健康数据。

除此之外，本应用只读写属于它自己的应用沙盒目录（用于保存你的加密账本与备份文件），此操作无需向你索取额外授权，其他应用也无法读取该目录。

3. 数据的用途

你的数据只有一个用途：在你自己的设备上，为你计算和展示你的账目、负债、利息与现金流。

我们不将其用于任何其他目的，不做用户画像，不做定向广告，不作训练数据，也不以任何形式对外提供。

4. 第三方

本应用不与任何第三方共享用户数据——因为我们本身就不持有这些数据。本应用不集成第三方分析、广告网络、崩溃上报或数据代理服务。

掌柜CFO 不设账号，不连接开发者或第三方服务器。您的财务记录、账单图片、OCR 内容和账本数据仅在设备本地处理和保存，不会上传。若您购买或恢复高级功能，交易由 Apple App Store 处理；开发者不接收您的银行卡或 Apple ID 付款信息。

购买与恢复过程中与 App Store 的通信全部由 Apple 完成，适用 Apple 的隐私政策。除此之外，本应用的记账、报表、备份等功能全程在你的设备上完成。

5. 数据留存与删除

• 留存：你的数据保存在你设备本地，保存多久完全由你决定。我们手上没有你的任何数据副本——因为我们没有自己的服务器。
• 删除：你可以在应用内删除账户（该账户下没有流水时才删得掉）。要清空全部数据，删除本应用即可——iOS 会一并删除它在设备上的所有数据，包括加密账本与应用文件夹内的备份文件。你此前另存到其他位置或已发送出去的备份副本不在其中，需要你自行删除。
• 撤回同意：若你曾允许本应用访问相册或相机（只有「拍照/截图识别」会用到），可以随时在 iOS 的「设置 → 掌柜CFO」里撤回该授权，撤回后其余功能不受影响；你也可随时删除本应用，其全部数据随之删除。
• 向我们请求删除：由于我们从未持有你的数据，无需也无法代你执行删除。删除权完全在你手上。

6. 数据安全

本地账本采用 AES-256-GCM 信封加密。密钥由你的密码派生，并可由你的 16 位恢复码解开。恢复码只在设置时向你展示一次，不会上传、我们也不留存副本——因此若密码与恢复码同时遗失，任何人（包括我们）都无法解开你的账本。请务必妥善保管恢复码。

7. 儿童隐私

本应用不面向 13 周岁以下儿童，也不会有意收集其任何信息（事实上本应用不收集任何人的信息）。

8. 政策变更

若本政策发生变更，我们会更新本页面顶部的「最后更新」日期。重大变更将在应用内一并告知。

9. 联系我们

如对本政策有任何疑问，请联系：tidewave@163.com

开发者：阮潮波

Privacy Policy

For 掌柜CFO (China) / Solo CFO (International) iOS app
Effective: August 5, 2026 ｜ Last updated: August 13, 2026

1. What data we collect

We collect nothing. Specifically:

• The app has no user accounts and no sign-up or sign-in. We do not know, and cannot know, who you are.
• Every account, transaction, amount and note you enter is stored solely in local storage on your device, encrypted with AES-256-GCM. The decryption key is derived from the password and recovery code that you choose; we neither hold nor can obtain it.
• The app contains no third-party analytics, telemetry, advertising or crash-reporting SDKs.
• We do not collect device identifiers, location, contacts, calendars, health data, or any other personal information.

2. System permissions

By default this app requests no system permissions. Only when you actively use "Scan / photo recognition" to read a bill image does the system ask whether to allow access to your photo library or camera — you may decline, and every other feature keeps working. Images are processed only on your device; they are never uploaded and are never saved into the app. This app does not access your location, contacts, microphone, calendar or health data.

Apart from that, it only reads and writes within its own application sandbox (to store your encrypted ledger and backup files). This requires no additional permission from you, and no other app can read that directory.

3. How your data is used

Your data serves exactly one purpose: to calculate and display your balances, debts, interest and cash flow — on your own device.

We do not use it for anything else. No profiling, no targeted advertising, no training data, and no disclosure to anyone.

4. Third parties

We share no user data with third parties — we do not hold any to share. The app integrates no third-party analytics, ad networks, crash reporting or data brokers.

Solo CFO has no accounts and connects to no developer or third-party server. Your financial records, bill images, OCR content and ledger data are processed and stored only on your device and are not uploaded. If you purchase or restore premium features, the transaction is handled by the Apple App Store; the developer does not receive your bank card or Apple ID payment information.

All communication with the App Store during purchase and restore is performed by Apple and is governed by Apple's Privacy Policy. Apart from that, bookkeeping, reporting and backup all run entirely on your device.

5. Retention and deletion

• Retention: Your data lives on your device for exactly as long as you choose. We hold no copy of it, because we run no server of our own.
• Deletion: You can delete an account in-app (only while it has no transactions). To erase everything, simply delete the app — iOS removes all of its on-device data, including the encrypted ledger and any backup files inside the app's own folder. Backup copies you previously saved elsewhere or sent to someone are not covered and must be deleted by you.
• Withdrawing consent: If you have granted access to your photo library or camera (used only by "Scan / photo recognition"), you can revoke it at any time in iOS Settings → Solo CFO; every other feature keeps working. You may also delete the app at any time, which removes all of its data.
• Requesting deletion from us: Since we have never held your data, there is nothing for us to delete and no request is needed. Deletion is entirely in your hands.

6. Security

Your local ledger uses AES-256-GCM envelope encryption. The key is derived from your password and can also be unlocked by your 16-character recovery code. The recovery code is shown to you once during setup; it is never uploaded and we keep no copy. If you lose both your password and your recovery code, no one — including us — can decrypt your ledger. Please store your recovery code safely.

7. Children's privacy

This app is not directed to children under 13, and we do not knowingly collect information from them (indeed, we collect information from no one).

8. Changes to this policy

If this policy changes, we will update the "Last updated" date at the top of this page. Material changes will also be announced in-app.

9. Contact us

Questions about this policy: tidewave@163.com

Developer: 阮潮波