ForeignMenu · 外乡人的菜单 — 隐私政策
最后更新 / Last updated: 2026-10-19
一句话总结
外乡人的菜单（ForeignMenu）有一个很小的服务器，只做两件事：管理你的点数，以及把你主动送去翻译的菜单转交给 OpenAI。服务器不保存菜单照片和文字；它只记得一个匿名账号 ID、你的点数余额和用量统计。翻译记录、同行成员和照片都留在你的手机上。我们不出售任何数据，也不做任何追踪。
我们如何处理你的数据
- 账号：不需要登录。第一次打开时，App 自动在服务器上建一个本机账号
——只是一个随机的账号 ID，加上一段只存在这台设备钥匙串里的密钥，用来记录你的点数余额。
用 Apple 登录是可选的：登录后，本机账号的余额会并入你的 Apple 账号，
这样在其他设备上也能用；App 不请求你的姓名和邮箱，我们只收到 Apple 给这个 App 的匿名账号 ID。
你可以随时在 App 的设置页 →「账号」里删除账号（本机账号或 Apple 账号都可以），账号和余额会从服务器上删除。
- 购买点数：付款完全由 Apple 处理，我们看不到你的支付信息。App 只把 Apple 签名的交易凭证
发给服务器，用来核对并给对应账号加点数。App Store 优惠码兑换的点数包也一样处理。
- 菜单照片和文字：为了识别和翻译，你选择的菜单照片、从中识别出的文字
（以及你要求生成配图时的菜名）会通过加密连接（HTTPS）发送到我们的服务器，
服务器把它们原样转交 OpenAI 的接口处理，再把结果传回你的手机。
服务器不保存这些内容，也不写进日志。
首次发送前，App 会明确询问你是否同意，并说明发送的内容；你可以拒绝
—— 拒绝后示例菜单和已保存的翻译照常可用。这项许可可以随时在设置页关闭。
OpenAI 会短期保留 API 数据用于滥用监控，其处理遵循
API 数据使用政策
（API 提交的数据默认不用于训练模型）。
- 服务器保存的内容：匿名账号 ID、点数余额、赠送记录、购买记录（Apple 的交易编号、所买的点数包、
Apple 告诉我们的价格、币种和所在的 App Store 地区），以及每次请求的用量统计
（请求大小、token 数、花费的点数、时间）。仅用于计费、处理售后和维持服务运行。
删除账号后，余额和用量统计会被删除；购买记录作为交易凭证保留，不再与任何账号资料关联使用。
- 防止滥用：为了防止有人批量新建账号领取免费点数，新建本机账号时服务器会按网络地址计数
——只存 IP 地址的哈希值和次数，不与任何账号关联，最多 2 天后自动删除。
- 翻译结果与历史记录：全部保存在你设备本地的应用沙盒中。删除记录或卸载应用即彻底清除。
- 同行成员姓名与头像：仅保存在设备本地，用于点菜标记，绝不上传。
- 相机与相册权限：仅在你主动拍摄或选择菜单照片时使用。
我们不做的事
- 不请求姓名、邮箱或电话。
- 没有分析/统计 SDK，没有广告 SDK，没有崩溃收集。
- 不收集设备标识符、位置信息或联系人。
- 不保存、不查看你的菜单照片和翻译内容。
联系方式
对本政策有任何疑问，请联系：chuanbei666@gmail.com
Privacy Policy (English)
In one sentence
ForeignMenu has a small server that does two things: it keeps your credit balance, and it passes the menus you deliberately send for translation on to OpenAI. It does not keep menu photos or text; it remembers only an anonymous account id, your credit balance and usage counts. Your history, party members and photos stay on your phone. We sell nothing and track nothing.
How your data is handled
- Account: no sign-in is needed. On first launch the app opens a device
account on our server — just a random account id, plus a secret kept only in this
device's keychain — to keep your credit balance. Sign in with Apple is optional:
it moves the device account's balance into your Apple account so you can use it on other devices.
The app does not ask for your name or email; we receive only the anonymous account id Apple issues
for this app. You can delete the account (device or Apple) at any time in Settings → Account, which
removes the account and its balance from our server.
- Buying credits: payment is handled entirely by Apple; we never see your payment
details. The app sends our server only Apple's signed transaction, which is checked and used to add
the credits to your account. Credit packs redeemed with an App Store offer code are handled the same way.
- Menu photos and text: the menu photo you choose, the text read from it (and dish
names, if you ask for generated dish photos) are sent over HTTPS to our server, which passes them
unchanged to OpenAI's API and returns the result to your phone. Our server does not store
or log this content. Before the first send, the app asks for your permission and states
exactly what will be sent; you can decline, and the sample menus and your saved translations keep
working. You can withdraw the permission at any time in Settings. OpenAI retains API data briefly
for abuse monitoring, under its
API data usage policies
(API data is not used for model training by default).
- What our server keeps: the anonymous account id, your credit balance, free grants, purchases
(Apple's transaction id, the pack bought, and the price, currency and App Store region Apple reports),
and per-request usage counts (request size, token counts, credits charged, time) — only for
billing, purchase support and keeping the service running. Deleting your account removes the
balance and usage counts; purchase records are kept as transaction records.
- Abuse prevention: to stop anyone from opening accounts in bulk for the free credits,
the server counts new device accounts per network address — only a hash of the IP address and a
count, not linked to any account, deleted automatically after at most 2 days.
- Translations and history live entirely in the app's local sandbox.
Deleting a record or the app removes them completely.
- Party member names and avatars stay on the device only.
- Camera and photo access is used only when you actively capture or pick a menu photo.
What we don't do
- No name, email or phone number requested.
- No analytics, advertising, or crash-reporting SDKs.
- No device identifiers, location, or contacts collected.
- We neither store nor look at your menu photos or translations.
Contact
Questions: chuanbei666@gmail.com