玲珑远控隐私政策
XYZRemote Privacy Policy
最后更新：2026 年 10 月 21 日 · 适用版本：1.0
应用提供方：XYZTech（具体开发者主体以 App Store 产品页面显示为准）
本政策适用于 XYZRemote（中文名“玲珑远控”）的 iPhone、iPad 和 Mac 版本，说明远程桌面、设备发现与配对、键盘鼠标控制、文本剪贴板及文件传输如何处理信息。
核心说明：当前版本不要求注册 XYZRemote 账号，没有内置 AI、广告或使用情况分析功能。远程使用会把画面、操作及你选择分享的数据发送给所连接的设备，并可能经过你配置的服务器。“开发者不收集会话内容”不代表数据不会离开设备，也不代表远端设备或服务器运营者无法接触这些信息。
1. 信息处理范围与用途
| 信息 | 用途与处理位置 |
|---|---|
| 设备名称、安装设备标识、服务地址、协议版本、共享准备状态及必要的无人值守验证参数 | 用于在局域网发现、区分和配对设备。部分信息通过 Bonjour 等局域网发现机制广播，可被同一网络内的兼容设备发现。广播不包含连接令牌、服务器 API Secret 或无人值守密码。 |
| 所选 Mac 显示器画面及尺寸等显示信息 | 由被控 Mac 采集并发送给获授权的控制端，以显示远程桌面。画面可能包含其他应用、通知、个人或工作资料。 |
| 鼠标位置、点击、滚动、键盘及组合键事件 | 在授权会话中发送到被控 Mac 并执行，可能改变文档、文件、系统设置或其他应用状态。 |
| 文本剪贴板 | 按需在已连接设备之间传递文本。Mac 支持在开启同步后监测剪贴板变化；iPhone/iPad 发送本机文本需要主动操作，也可接收远端文本。 |
| 文件正文、文件名、大小、修改时间及传输标识 | 用于上传、下载、展示共享文件列表、校验与显示进度。已保存的传输文件保留在接收设备上。 |
| 网络地址、参与者和房间标识、连接与错误状态、时延等诊断信息 | 用于建立和维护连接、重连及问题排查。你配置的 LiveKit 服务或相关网络设施可能处理连接元数据并产生服务器日志。 |
2. 本机设置与凭据
设备名称、服务器地址、允许的控制端身份、画面与输入偏好等设置保存在本机。安装设备标识优先使用 Apple 钥匙串；钥匙串写入失败时，可回退到本机偏好设置。无人值守访问凭据使用 Apple 钥匙串保存。
被控端保存的是独立密码的加盐派生凭据；如果你在控制端主动保存无人值守密码，控制端会在本机钥匙串保存该密码，以便后续验证。这两种保存方式不同，不能理解为所有设备都不保存密码。手动输入或配对获得的会话参与者令牌主要供当前运行使用，不写入普通偏好设置。
Mac 的本机服务器模式还会在用户的 Application Support 目录下保存 LiveKit 服务密钥文件和运行日志。密钥文件采用本机文件访问权限限制；它不等同于仅存在内存中的临时会话令牌。停止共享或退出 App 不保证自动删除这些文件。
3. 设备授权与系统权限
- 局域网：用于发现并连接附近的 XYZRemote 设备，网络内其他设备也可能看到广播的设备名称、标识及服务地址。
- Mac 屏幕录制：用于采集并共享所选显示器。共享可能包含屏幕上的敏感内容；请在共享前整理桌面及通知。
- Mac 辅助功能：用于执行远程鼠标、滚动和键盘输入。允许访问可能使控制端操作其他应用。
- 文件访问：用于你选择发送的文件，以及当前传输目录中的普通文件。系统文件选择、保存与共享界面可能另外要求授权。
首次普通配对需要被控 Mac 明确允许。设备所有者主动启用无人值守访问后，符合验证条件的控制端可使用该独立密码连接，替代逐次点击确认；它不替代 macOS 权限，也不表示对所有用途的永久授权。你可断开会话、停止共享或在系统设置中撤回权限。关闭无人值守入口主要影响后续验证，不应被当作已经断开的证明；要立即停止当前访问，请同时断开会话并停止共享。
4. 剪贴板与文件
自动文本剪贴板同步默认关闭。开启或主动请求同步时，当前合格文本也可能立即发送，不限于之后复制的内容。收到的文本会写入系统剪贴板，可能替换原有内容，并受系统及其他应用的剪贴板行为影响。当前版本不提供保证识别密码、验证码或其他秘密的过滤机制，请自行检查分享内容。
断开连接会停止该会话的后续同步，但不会自动清空两端系统剪贴板，也不能撤回对方已经复制、粘贴、保存或截图的内容。
Mac 上传接收目录默认为“下载/XYZRemote Transfers”；iPhone/iPad 使用 App 文稿中的同名目录。下载还可能经过本机临时目录，之后由你保存或分享。授权会话中的文件列表可包含传输目录内符合条件的文件，而不限于刚收到的文件。请勿将不希望远端读取的文件放在共享传输目录中。
当前文件传输仅支持非空普通文件，不支持文件夹或符号链接，单个文件最大 2 GB。传输失败时会尝试删除未完成的临时文件；这不代表所有已完成下载、导出副本或操作系统缓存会同时删除。
5. 网络传输、LiveKit 与第三方
设备配对使用要求加密的 Multipeer Connectivity 会话。远程媒体与控制通信使用 LiveKit/WebRTC 相关组件及你选择的服务配置。公网服务器地址要求使用 wss://；本机或受支持的局域网地址可使用 ws://，该信令连接不使用 TLS。请在可信网络中使用本机模式，并保护主机、路由器及服务器。
当前版本未配置额外的应用层端到端加密，不承诺本机或第三方 LiveKit 服务器运营者无法访问会话内容。传输保护、信令保护和端到端加密是不同事项；不要仅因成功配对就假定所有后续链路都具有相同保护。
XYZTech 当前不提供开箱即用的云端账号或公共中转服务。使用你自行配置的服务器时，接收方为该服务器及其运营者，而不是因使用 LiveKit 软件就自动向 LiveKit 公司开通云服务。第三方服务器、系统分享目标及远端应用按各自政策处理收到的数据；请在使用前了解其访问、日志、保留与删除设置。
6. 开发者收集、支持与平台数据
当前 App 不向 XYZTech 的开发者服务器主动上传远程画面、输入、剪贴板或文件，也没有内置广告、跨应用跟踪、使用情况分析或模型训练上传功能。App Store 隐私标签中的“未收集数据”针对开发者通过该 App 的数据收集，不排除完成你要求的远程会话所必需的设备间处理。
如果你主动发来支持请求，我们会处理你提供的联系信息、问题说明和附件，以回复和排查问题。请勿发送密码、参与者令牌、服务器密钥或不相关的私人画面。反馈所用邮箱或托管服务可能按其政策保留记录；我们会在处理请求所需的合理期间保留相关材料，之后删除或去标识化，但依法需要保留的除外。
Apple 可能根据你的系统选择处理 App Store 交易、下载、诊断或崩溃信息。你可在 Apple 的相关设置中管理适用的诊断共享；这些平台行为与 App 内置分析功能不同。
7. 保留、删除与撤回
- 本机设置保留到你修改、清理相应应用数据或系统移除相关数据为止；钥匙串项目可能在卸载后继续保留。
- 控制端关闭“保存的无人值守密码”会删除相应钥匙串密码；被控端关闭无人值守访问会删除其对应派生凭据。此操作不自动删除其他设置、运行日志、文件或其他设备的副本。
- 本机 LiveKit 密钥与日志需在服务停止后按需清理相应本机目录；删除或更换服务密钥会影响后续连接。App 未承诺日志自动到期清理。
- 完成传输的文件、另存或分享的副本需在各自保存位置删除；临时目录也受操作系统清理机制影响。App 不保证退出时立即擦除全部缓存。
- 远端设备、外部服务器、备份和其他应用已经收到的数据，由其控制者或相应设置管理。撤回权限不能自动删除已有副本。
你可通过下列联系渠道提出关于开发者持有数据的访问、更正、删除或其他依法享有的请求。我们可能要求与请求相称的信息确认身份；对不由 XYZTech 持有的数据，请同时联系接收设备或服务器运营者。当前没有 XYZRemote 注册账号，因此没有 App 账号注销步骤。
8. 儿童与跨境处理
本 App 面向一般工具使用场景，不以收集儿童信息为目的。未成年人应在监护人适当指导下使用远程控制功能，不要向陌生人提供访问权限。若你认为支持材料中包含不应提供的儿童信息，请联系我们处理。
会话数据的处理位置取决于两端设备、所选服务器、分享目标及支持服务的位置。使用境外设备或服务器可能产生跨境传输；本 App 不会替你确定这些外部接收方满足你所在组织或地区的要求。
9. 政策更新与联系
我们会在功能或数据处理方式变化时更新本政策及日期。若新增处理需要另行告知或同意，将按适用要求处理，不以本次同意代替未来所需授权。
隐私与使用问题请联系 XYZTech：XYZTechFeedBack@gmail.com。建议注明“XYZRemote / 玲珑远控”，并只提供定位问题所需的信息。
XYZRemote Privacy Policy
Last updated: October 21, 2026 · Applies to version 1.0
App provider: XYZTech; the legal developer is identified on the App Store product page.
This policy covers XYZRemote, also known as 玲珑远控, on iPhone, iPad, and Mac. It explains remote desktop sharing, discovery and pairing, pointer and keyboard control, text clipboard exchange, and file transfer.
Summary: The current version has no XYZRemote account registration, built-in AI, advertising, or usage analytics. Remote use sends information to the connected device and may involve your configured server. The developer not collecting session content does not mean that information stays on one device or is inaccessible to a recipient or server operator.
1. Information and purposes
- Discovery: device names, installation identifiers, service addresses, protocol and readiness information, and necessary unattended-authentication parameters identify compatible devices. Some are advertised over the local network. Advertisements do not contain participant tokens, server API secrets, or unattended passwords.
- Display: the selected Mac display and display characteristics are sent to the authorized controller. The image may include other apps, notifications, and personal or work information.
- Input: pointer positions, clicks, scrolling, and keyboard events are sent to and executed on the host. They may change documents, files, settings, or other apps.
- Clipboard: text is exchanged when synchronization or a specific clipboard action is used. Mac can monitor clipboard changes after synchronization is enabled; sending local iPhone/iPad text requires an explicit action. Mobile devices can receive remote text.
- Files: file contents, names, sizes, modification times, and transfer identifiers support listings, transfers, validation, and progress. Received files may remain on the recipient device.
- Connections: network addresses, participant and room identifiers, connection/error states, and timing information support connectivity and troubleshooting. Configured servers and network infrastructure may process metadata and create logs.
2. Local settings and credentials
Device names, server addresses, allowed controller identities, and display/input preferences are stored locally. Installation identity prefers Apple Keychain and can fall back to local preferences if a Keychain write fails. Unattended-access credentials use Apple Keychain. A host stores a salted password-derived credential. A controller that you configure to remember an unattended password stores the password itself in its local Keychain. These are different storage arrangements. Participant tokens entered or obtained for a session are principally used during the current app run rather than written to ordinary preferences.
Local-server mode on Mac also saves LiveKit service keys and runtime logs under the user’s Application Support directory, protected by local file permissions. Service keys are distinct from temporary participant tokens. Stopping sharing or quitting does not guarantee deletion of these files.
3. Permissions and authorization
Local Network access supports discovery and connections. Mac Screen Recording captures the selected display; Accessibility executes authorized remote input. File access supports your selected files and the transfer directory. System pickers and sharing destinations may request their own permissions.
Ordinary pairing requires approval on the host Mac. If the owner enables unattended access, a controller satisfying password verification can connect without a separate approval click each time. This does not replace macOS permissions or authorize every future purpose. Disconnect, stop sharing, or revoke permissions in system settings to stop access as appropriate. Turning off unattended access primarily affects subsequent verification; also disconnect and stop sharing to end an existing session immediately.
4. Clipboard and files
Automatic text clipboard synchronization starts off. Enabling synchronization or requesting a snapshot may immediately send existing eligible text, not just later changes. Received text replaces system clipboard contents and is subject to operating-system and other-app behavior. There is no guaranteed filter for passwords, verification codes, or other secrets. Disconnecting stops future session synchronization but does not clear either clipboard or recall copies, pasted content, screenshots, or saved files.
Uploaded files normally go to Downloads/XYZRemote Transfers on Mac or the app’s Documents/XYZRemote Transfers directory on iPhone/iPad. Downloads may pass through temporary storage before you save or share them. The remote listing can include eligible files already in the shared transfer directory, not only a new upload. Keep private files out of that directory.
Transfers currently support non-empty regular files up to 2 GB, excluding folders and symbolic links. The app attempts to remove incomplete temporary files after failure; that does not erase completed downloads, exported copies, or every system cache.
5. Connections and third parties
Pairing requires an encrypted Multipeer Connectivity session. Media and control communication use LiveKit/WebRTC components with your chosen server configuration. Public endpoints require wss://. Supported local-network and loopback endpoints may use ws://, which does not provide TLS for signaling. Use trusted networks and protect the host and server.
The current version does not configure additional application-level end-to-end encryption. We do not promise that a local or third-party LiveKit server operator cannot access session content. Pairing encryption, signaling protection, and end-to-end encryption are separate properties.
XYZTech currently offers no bundled cloud account or public relay service. Using LiveKit software does not itself establish use of LiveKit’s cloud service. A server you configure, its operator, a system sharing destination, and remote applications process received information under their own arrangements. Review their access, logging, retention, and deletion settings.
6. Developer collection, support, and Apple
The app currently does not upload session images, input, clipboard text, or files to developer-operated XYZTech servers. It includes no built-in advertising, cross-app tracking, usage analytics, or model-training upload feature. An App Store “Data Not Collected” label describes developer collection through the app, while devices still process information needed for a session you request.
When you voluntarily contact support, we process the contact details, description, and attachments you provide to reply and investigate. Do not send passwords, participant tokens, server secrets, or unrelated private images. The email or hosting provider may retain records under its policies. We retain support materials for a reasonable period needed to handle the request, then delete or de-identify them unless lawful retention is required.
Apple may process downloads, transactions, diagnostics, or crash information under its policies and your system choices. Applicable Apple diagnostic-sharing settings are separate from built-in app analytics.
7. Retention and your choices
- Local preferences remain until changed or removed through applicable app/system data controls. Keychain items may survive uninstalling the app.
- Disabling the controller’s saved unattended password deletes that password’s Keychain item; disabling host unattended access deletes its corresponding derived credential. Other settings, logs, files, and other devices’ copies are separate.
- Local-server keys and logs require appropriate local cleanup after stopping the service. Deleting or replacing keys affects later connections. Automatic log expiration is not promised.
- Delete completed or exported files at each storage location. Temporary storage also follows operating-system cleanup behavior; quitting does not guarantee immediate erasure.
- Recipients, servers, backups, and other apps control copies they already hold. Revoking a permission does not delete those copies.
Contact us to exercise applicable access, correction, deletion, or other rights concerning information held by the developer. Proportionate identity checks may be necessary. For information we do not hold, contact the recipient or server operator. There is no XYZRemote app account to delete.
8. Children and international processing
This is a general utility and is not intended to collect children’s information. Minors should use remote access with appropriate guardian guidance and should not grant access to strangers. Contact us about children’s information in support materials that should not have been supplied.
Processing locations depend on both devices, selected servers, sharing destinations, and support providers. Connecting to an overseas device or server may transfer information internationally. The app does not determine whether your external recipients meet your organization’s or jurisdiction’s requirements.
9. Changes and contact
We update this policy and date when relevant behavior changes. New processing requiring notice or consent will be handled under applicable requirements; this policy does not grant blanket authorization for future processing.
Contact XYZTech at XYZTechFeedBack@gmail.com. Identify the app as “XYZRemote / 玲珑远控” and provide only what is needed for the request.
