隐私政策 | Privacy Policy

1. 简介

1. Introduction

本隐私政策适用于由"小宇店铺"（以下简称"我们"、"我们的"）开发的 Chrome 浏览器扩展 AutoBanana for Google Gemini™（以下简称"本扩展"）。本扩展是在 Google Gemini™ 与 Google Flow™ 平台上批量生成 Nano Banana 图片与 Veo 视频的第三方自动化工具， 非 Google 官方产品，与 Google 公司无任何关联或赞助关系。

This Privacy Policy applies to the Chrome browser extension AutoBanana for Google Gemini™ (the "Extension") developed by "XiaoYu Shop" ("we", "us", or "our"). The Extension is a third-party automation tool for batch-generating Nano Banana images and Veo videos on Google Gemini™ and Google Flow™ platforms. It is not an official Google product and is not affiliated with or endorsed by Google Inc.

安装和使用本扩展即表示您已阅读并同意本隐私政策中描述的数据处理做法。如果您不同意本政策的任何部分，请勿安装或使用本扩展。

By installing and using the Extension, you acknowledge that you have read and agree to the data processing practices described in this Privacy Policy. If you do not agree with any part of this policy, please do not install or use the Extension.

2. 我们收集的用户数据

2. User Data We Collect

本扩展仅收集为提供会员服务所必需的最小数据。我们不会收集任何超出以下范围的信息。

The Extension only collects the minimum data necessary to provide membership services. We do not collect any information beyond the scope listed below.

数据类型	Data Type	收集方式	Collected Via	用途	Purpose	存储位置	Storage	共享对象	Shared With
邮箱地址	Email Address	用户在扩展登录界面主动输入	User-entered in extension login UI	账号唯一标识、登录认证、密码找回	Unique account ID, login auth, password recovery	我们的服务器数据库	Our server database	不共享给任何第三方	Not shared with any third party
密码	Password	用户在扩展登录界面主动输入	User-entered in extension login UI	登录认证	Login authentication	我们的服务器数据库（仅存储加盐哈希值，不明文存储）	Our server DB (salted hash only, no plaintext)	不共享给任何第三方	Not shared with any third party
设备 ID	Device ID	扩展安装时自动生成并存储于本地 chrome.storage	Auto-generated at install, stored in local chrome.storage	设备绑定，防止账号被多人共享	Device binding to prevent account sharing	本地 chrome.storage + 服务器数据库	Local chrome.storage + server database	不共享给任何第三方	Not shared with any third party
登录 Token (JWT)	Login Token (JWT)	服务器在登录成功后返回	Returned by server after successful login	维持登录会话状态	Maintain login session	本地 chrome.storage.local	Local chrome.storage.local	不共享给任何第三方	Not shared with any third party
会员等级信息	Membership Tier	服务器返回，本地缓存	Returned by server, cached locally	功能权限控制（免费/会员）	Feature access control (free/member)	本地 chrome.storage.local + 服务器数据库	Local chrome.storage.local + server database	不共享给任何第三方	Not shared with any third party
用户在 Gemini™ 上输入的提示词及生成的内容	User prompts & generated content on Gemini™	扩展在用户已登录的 Gemini™ 页面上自动化操作	Extension automates user's logged-in Gemini™ page	批量生成图片/视频（扩展核心功能）	Batch image/video generation (core function)	不存储在我们的服务器；数据直接发送至 Google 的服务器	NOT stored on our server; sent directly to Google's servers	Google LLC（通过 Gemini™ 平台）	Google LLC (via Gemini™ platform)
生成的图片/视频文件	Generated image/video files	通过 chrome.downloads API 下载到用户本地电脑	Downloaded to user's local PC via chrome.downloads API	保存用户的创作成果	Save user's creative output	用户本地电脑（不经过我们的服务器）	User's local computer (not via our server)	不共享	Not shared

2.1 我们明确不收集的数据

2.1 Data We Explicitly Do NOT Collect

您的 Google 账号密码或 Gemini™ 登录凭证
您的浏览历史记录
其他网站的 Cookie 或本地存储数据
您的书签、下载记录（除本扩展主动触发的下载外）
您的真实姓名、物理地址、电话号码
您的支付信息（支付通过第三方平台处理，我们不存储信用卡号）
用于广告追踪或用户画像的分析数据
您的精确地理位置信息

Your Google account password or Gemini™ login credentials
Your browsing history
Cookies or local storage data from other websites
Your bookmarks or download history (except downloads triggered by this Extension)
Your real name, physical address, or phone number
Your payment information (payments are processed by third-party platforms; we do not store credit card numbers)
Analytics data for ad tracking or user profiling
Your precise geolocation

3. 数据收集方式

3. How Data Is Collected

本扩展通过以下方式收集数据：

The Extension collects data through the following methods:

用户主动输入：邮箱地址和密码由用户在扩展的登录/注册界面中主动输入。
本地生成：设备 ID 在扩展首次安装时由本地代码随机生成，存储于 chrome.storage.local。
服务器返回：登录 Token 和会员等级由我们的服务器在登录成功后返回。
页面自动化：扩展在用户已登录的 Gemini™ 网页中读取并操作页面元素（如输入提示词、点击生成按钮、下载结果），这些操作完全在用户本地浏览器中进行。
本地存储：扩展使用 chrome.storage.local 存储登录状态、会员等级、设备 ID 等数据，仅在本机可用。

User input: Email and password are actively entered by the user in the Extension's login/register UI.
Local generation: Device ID is randomly generated by local code on first install and stored in chrome.storage.local.
Server response: Login token and membership tier are returned by our server after successful login.
Page automation: The Extension reads and manipulates page elements on the user's logged-in Gemini™ webpage (e.g., entering prompts, clicking generate buttons, downloading results). These operations occur entirely within the user's local browser.
Local storage: The Extension uses chrome.storage.local to store login state, membership tier, device ID, etc., available only on the local machine.

4. 数据使用目的

4. Purpose of Data Use

我们收集的数据仅用于以下目的，不会用于其他任何用途：

The data we collect is used solely for the following purposes and for no other purpose:

账号认证：使用邮箱和密码验证用户身份，允许登录会员系统。
会员服务：根据会员等级提供对应的功能权限（如批量生成数量限制）。
设备绑定：通过设备 ID 限制同一账号在多台设备上同时使用，防止账号共享和滥用。
会话维持：使用登录 Token 保持用户的登录状态，避免频繁重新登录。
安全防护：检测和防止欺诈行为、暴力破解攻击及其他安全威胁。
功能运行：在 Gemini™ 页面上执行自动化操作（输入提示词、触发生成、下载结果）。

Account authentication: Verify user identity using email and password to allow login to the membership system.
Membership service: Provide feature access based on membership tier (e.g., batch generation limits).
Device binding: Limit the same account from being used on multiple devices simultaneously via device ID to prevent account sharing and abuse.
Session maintenance: Use login token to maintain the user's login state and avoid frequent re-login.
Security protection: Detect and prevent fraud, brute-force attacks, and other security threats.
Function operation: Perform automation on the Gemini™ page (entering prompts, triggering generation, downloading results).

5. 数据共享与披露

5. Data Sharing and Disclosure

我们不会出售您的个人数据。我们仅在以下情况下与第三方共享数据：

We do not sell your personal data. We only share data with third parties in the following circumstances:

共享对象	Recipient	共享的数据	Data Shared	共享目的	Purpose	是否经过我们的服务器	Via Our Server?
Google LLC（Gemini™ / Flow™ 平台）	Google LLC (Gemini™ / Flow™ platform)	用户输入的提示词、生成参数、生成的图片/视频	User prompts, generation parameters, generated images/videos	执行内容生成请求（扩展核心功能）	Execute content generation requests (core function)	否，直接在用户浏览器与 Google 之间传输	No, transmitted directly between user's browser and Google
Google Chrome Web Store	Google Chrome Web Store	扩展安装/卸载/使用统计（由 Chrome 浏览器自动收集）	Extension install/uninstall/usage stats (auto-collected by Chrome)	扩展分发与商店运营	Extension distribution and store operations	否，由 Chrome 直接收集	No, collected directly by Chrome
支付服务提供商	Payment service providers	订单金额、订单号（不含完整卡号）	Order amount, order ID (no full card number)	处理会员订阅付款	Process membership subscription payments	否，通过第三方支付平台直接处理	No, processed directly via third-party payment platform

5.1 法律要求的披露

5.1 Legally Required Disclosure

在以下情况下，我们可能被要求披露您的数据：(a) 遵守法律义务或法院命令；(b) 保护我们的权利、财产或安全；(c) 防止欺诈或滥用行为。任何此类披露将仅限于法律要求的最小范围。

We may be required to disclose your data in the following circumstances: (a) to comply with legal obligations or court orders; (b) to protect our rights, property, or safety; (c) to prevent fraud or abuse. Any such disclosure will be limited to the minimum extent required by law.

6. 数据存储与保留

6. Data Storage and Retention

存储位置：您的账号数据（邮箱、密码哈希、设备 ID、会员等级）存储于我们位于 8.163.32.83 的服务器（中国）。

Storage location: Your account data (email, password hash, device ID, membership tier) is stored on our server at 8.163.32.83 (China).

保留期限：

Retention period:

账号数据：在账号存续期间持续保留；用户主动注销账号后 30 天内 永久删除。
登录 Token：有效期 7 天，过期自动失效。
日志数据：服务器访问日志保留 90 天 后自动清除，用于安全审计。
用户在 Gemini™ 上的数据：不存储在我们的服务器，保留策略遵循 Google 的隐私政策。

Account data: Retained for the duration of the account; permanently deleted within 30 days after the user voluntarily deletes their account.
Login token: Valid for 7 days, automatically expires thereafter.
Log data: Server access logs are retained for 90 days and then automatically cleared for security auditing.
User data on Gemini™: Not stored on our server; retention follows Google's privacy policy.

7. 数据安全措施

7. Data Security Measures

传输加密：所有扩展与服务器之间的数据传输均通过 HTTPS (TLS 1.2/1.3) 加密。
密码保护：密码使用 bcrypt 加盐哈希算法存储，不可逆，我们无法查看您的明文密码。
Token 时效：登录 Token (JWT) 设置有效期，过期需重新登录。
最小化数据：仅收集提供服务所必需的最少数据，不收集无关信息。
服务器安全：服务器配置防火墙，仅开放必要端口（80/443）。
本地隔离：扩展使用独立的 chrome.storage 命名空间，不与其他扩展或网站共享数据。

Transmission encryption: All data transmission between the Extension and our server is encrypted via HTTPS (TLS 1.2/1.3).
Password protection: Passwords are stored using the bcrypt salted hash algorithm, which is irreversible; we cannot view your plaintext password.
Token expiration: Login tokens (JWT) have an expiration period and require re-login after expiry.
Data minimization: We only collect the minimum data necessary to provide the service, without collecting irrelevant information.
Server security: The server is configured with a firewall, opening only necessary ports (80/443).
Local isolation: The Extension uses a separate chrome.storage namespace and does not share data with other extensions or websites.

8. 您的数据权利

8. Your Data Rights

您对个人数据享有以下权利，您可随时通过第 10 节的联系方式行使：

You have the following rights regarding your personal data, which you can exercise at any time through the contact information in Section 10:

访问权：您可登录账号查看自己的会员信息和设备绑定情况。
更正权：您可在账号设置中修改邮箱或重置密码。
删除权：您可联系我们删除账号及其所有关联数据。删除请求将在 30 天内 处理完成。
限制处理权：您可要求我们在特定情况下限制对您数据的处理。
退出权：您可随时卸载本扩展以停止所有数据收集；卸载后本地存储的数据将被清除。
撤回同意权：您可随时停止使用本扩展以撤回对数据处理的同意。

Right to access: You can log in to view your membership information and device binding status.
Right to correction: You can modify your email or reset your password in account settings.
Right to deletion: You can contact us to delete your account and all associated data. Deletion requests will be processed within 30 days.
Right to restrict processing: You can request us to restrict processing of your data under certain circumstances.
Right to opt-out: You can uninstall the Extension at any time to stop all data collection; locally stored data will be cleared upon uninstall.
Right to withdraw consent: You can stop using the Extension at any time to withdraw consent to data processing.

9. 儿童隐私

9. Children's Privacy

本扩展不面向 13 岁以下的儿童（或适用法律规定的其他年龄限制）。我们不会故意收集 13 岁以下儿童的个人数据。如果您是家长或监护人，发现您的孩子向我们提供了个人数据，请通过第 10 节的联系方式联系我们，我们将立即删除相关数据。

The Extension is not intended for children under 13 years of age (or other age limits under applicable law). We do not knowingly collect personal data from children under 13. If you are a parent or guardian and discover that your child has provided us with personal data, please contact us via the information in Section 10, and we will immediately delete the relevant data.

10. 联系我们

10. Contact Us

如果您对本隐私政策有任何疑问、意见或请求（包括行使您的数据权利），请通过以下方式联系我们：

If you have any questions, comments, or requests regarding this Privacy Policy (including exercising your data rights), please contact us via:

邮箱：support@xiaoyudianpu.xyz
网站：https://xiaoyudianpu.xyz

Email: support@xiaoyudianpu.xyz
Website: https://xiaoyudianpu.xyz

我们将在收到您的请求后 30 天内 回复并处理。

We will respond to and process your request within 30 days of receipt.

11. 隐私政策变更

11. Privacy Policy Changes

我们可能会不时更新本隐私政策。任何变更将在本页面发布，并更新顶部的"最后更新"日期。对于重大变更（如新增数据收集类型或扩大数据共享范围），我们将通过扩展内通知或电子邮件方式告知您。建议您定期查阅本页面以了解最新信息。

We may update this Privacy Policy from time to time. Any changes will be published on this page with an updated "Last Updated" date at the top. For material changes (such as new data collection types or expanded data sharing), we will notify you via in-extension notification or email. We recommend reviewing this page periodically for the latest information.