隐私政策 · Privacy Policy
办公岛不收集你的任何数据
一句话说明：办公岛是一款完全在本机运行的 macOS 菜单栏工具。我们没有服务器，没有账号系统，不收集、不上传、不出售任何用户数据，也不含统计、广告或崩溃上报组件。
只有当你主动使用需要联网的功能时，数据才会从你的 Mac 直接发往你自己指定的第三方服务——例如你自己的邮箱服务器，或你自行配置的翻译服务商。这些请求不经过我们。
1. 我们是谁
办公岛（英文名 Office Island）是一款独立开发的 macOS 应用，只通过 Mac App Store 分发。开发者是个人开发者，不运营任何用于接收用户数据的后端服务。
隐私相关问题请联系 ixaiochao@foxmail.com。
2. 保存在本机的数据
以下数据只写入你这台 Mac 的本地磁盘：位于应用自己的沙盒容器内。它们不会被同步或备份到我们这里，也不会出现在任何服务器上。
| 数据 | 用途 | 存放位置 |
|---|---|---|
| 剪贴板历史（文本、图片、文件引用） | 找回之前复制过的内容 | 本地数据库与文件 |
| 待办事项与每日笔记 | 任务与笔记功能 | 本地文件 |
| 邮件头与正文缓存 | 断网时查看已取回的邮件 | 本地文件 |
| 邮箱授权码 / 翻译 API 密钥 | 登录你自己配置的服务 | macOS 钥匙串 |
| 外观、语言、快捷键等偏好 | 记住你的设置 | 本地偏好存储 |
| 离线翻译模型（约 1.13 GB） | 本机离线翻译 | 本地磁盘 |
| 运行日志 | 排查本机问题，不自动上报 | 本地文本文件 |
我们在实现上刻意保留了这些限制：
- 剪贴板历史不会被上传，也不参与任何云端同步。
- 截图与图片文字识别使用 macOS 自带的 Vision 框架，在本机完成，图片不离开你的 Mac。
- 离线翻译模型在本机进程中推理，过程不联网。
- 日志只记录运行状态与技术错误，需要你自己打开才有意义，我们没有任何读取它的通道。
3. 会联网的功能
办公岛不会自行联网。以下功能均由你主动触发，请求从你的 Mac 直接发往目标服务器。
3.1 邮箱（IMAP）
你在「偏好设置 → 邮箱」填入账户与授权码后，应用使用 TLS 直接连接你自己填写的邮件服务器收信。邮件内容、账户与授权码都不会发给我们，授权码保存在本机钥匙串中。
应用不向服务器写入已读状态：读取使用 EXAMINE 与 BODY.PEEK，因此不会改变你在其他设备上的未读标记。当前版本只收信，不连接 SMTP。
3.2 在线翻译
只有你选择在线引擎并主动翻译文本或邮件时，应用才会把源文本、目标语言与你配置的 API 密钥发送到你选择的服务商。可选服务商见第 5 节。我们不经手、不中转、不记录这些请求与结果。
默认引擎是 Apple 系统翻译，在 macOS 本地框架内完成；离线引擎完全在本机运行。
3.3 下载离线翻译模型
你主动点击下载时，应用从 Hugging Face 获取公开的模型文件（约 1.13 GB）。该请求不携带个人信息，只包含标准的 HTTP 请求信息。
3.4 邮件中的外部图片
邮件正文里的外部图片默认会自动加载。加载时，你的 IP 地址、大致地理位置、User-Agent 与阅读时间会被发件方或其图片托管服务器看到——这也是多数邮件客户端的已知取舍。
你可以在「偏好设置 → 邮箱」关闭「自动加载外部图片」，改为逐封手动加载。关闭后，外部图片与其他外部资源都会被拦截。
3.5 打开网页
点击邮件里的链接或「网页版邮箱」时，应用把网址交给系统默认浏览器打开。之后的访问行为由该浏览器与目标网站负责，与本应用无关。
3.6 应用内本地服务
离线翻译时，应用在本机 127.0.0.1 的随机端口启动翻译引擎，并生成一次性访问令牌。该连接只在你的 Mac 内部回环，不对外开放，也无法从其他设备访问。
4. 系统权限
| 权限 | 用途 | 是否必需 |
|---|---|---|
| 屏幕录制 | 截取你选择的屏幕区域与长截图 | 仅截图功能需要 |
| 开机自启 | 登录时自动启动办公岛 | 可选，默认关闭 |
| 网络访问 | 收邮件、在线翻译、下载模型 | 相关功能需要 |
应用不申请辅助功能权限，也不使用 Apple Events 控制其他应用，无法读取其他应用的窗口、菜单或数据。
5. 第三方服务
以下第三方只在你主动使用对应功能时才会接触到你的数据。我们无法控制它们的隐私实践，请查阅各自政策。
- 你的邮件服务商（如 QQ 邮箱、网易 163/126、Gmail、iCloud）——收信时连接你填写的服务器地址。
- 在线翻译服务商（可选，需自行配置密钥）：DeepSeek、阿里云通义千问、Kimi / Moonshot、智谱 GLM、火山引擎豆包、硅基流动，或你自己填写的任意 OpenAI 兼容接口（含本机
localhost服务）。 - Hugging Face——仅在下载离线翻译模型时访问。
- Apple——系统翻译与系统框架由 macOS 提供。通过 Mac App Store 安装时，Apple 可能按其自身政策收集安装与使用统计，这不属于本应用的数据收集行为。
6. 数据保留与删除
由于我们不留存任何数据，所谓「保留」完全发生在你的设备上，由你掌控。
- 删除单条记录：在剪贴板、待办或笔记界面直接删除。
- 清空全部本地数据：删除应用数据目录即可。菜单栏与「偏好设置 → 通用」均提供「打开数据目录」入口。此操作不可恢复。
- 删除密钥：在邮箱或翻译设置中清除，或使用「钥匙串访问」删除对应条目。
- 卸载：将应用移到废纸篓；如需彻底清除，再删除上述数据目录。
- 撤回第三方授权：在对应服务商的账户设置中吊销 API 密钥；删除或更换邮箱授权码即可停止收信。
关闭或卸载应用后，本机不再产生新的数据处理行为。
7. 儿童隐私
本应用不面向 13 岁以下儿童，也不会有意收集任何人的个人信息——因为我们根本不收集数据。若你认为存在相关问题，请通过上面的邮箱联系我们。
8. 政策变更
如果未来版本新增了会传输数据的功能，我们会同步更新本页面并修改页首的生效日期。涉及数据处理方式的重大变更，也会在应用更新说明中提示。
In one sentence: Office Island is a macOS menu bar utility that runs entirely on your Mac. We have no servers and no accounts. We do not collect, upload, or sell any user data, and the app contains no analytics, advertising, or crash-reporting components.
Data leaves your Mac only when you actively use a feature that requires the network, and then it goes directly to a service you chose yourself — your own mail server, or a translation provider you configured. Those requests never pass through us.
1. Who we are
Office Island is an independently developed macOS application distributed exclusively through the Mac App Store. The developer is an individual and operates no backend service that receives user data.
Privacy questions: ixaiochao@foxmail.com.
2. Data stored on your device
The following data is written only to your Mac's local disk, inside the app's own sandbox container. It is never synced or backed up to us and never appears on any server.
| Data | Purpose | Location |
|---|---|---|
| Clipboard history (text, images, file references) | Retrieve what you copied earlier | Local database and files |
| To-dos and daily notes | Task and note features | Local files |
| Cached mail headers and bodies | Read fetched mail offline | Local files |
| Mail authorization codes / translation API keys | Authenticate to services you configured | macOS Keychain |
| Appearance, language, and shortcut preferences | Remember your settings | Local preferences |
| Offline translation model (about 1.13 GB) | On-device translation | Local disk |
| Runtime log | Local troubleshooting, never auto-uploaded | Local text file |
Several constraints are deliberate:
- Clipboard history is never uploaded and has no cloud sync.
- Screenshots and OCR use Apple's on-device Vision framework. Images never leave your Mac.
- The offline translation model runs in a local process; inference makes no network calls.
- The log records runtime state and technical errors only. It has value only if you open it yourself, and we have no channel to read it.
3. Features that use the network
The app does not connect on its own. Every feature below is initiated by you, and each request goes directly from your Mac to its destination.
3.1 Mail (IMAP)
After you enter an account and authorization code in Settings → Mail, the app connects over TLS directly to the mail server you entered. Neither message content nor your credentials are sent to us. The authorization code is stored in your local Keychain.
The app does not write read state back to the server; it uses EXAMINE and BODY.PEEK, so your unread markers on other devices stay unchanged. This version fetches mail only and does not connect over SMTP.
3.2 Online translation
Only when you select an online engine and actively translate text or mail does the app send the source text, the target language, and your configured API key to the provider you chose. See section 5 for the list. We neither receive, relay, nor record these requests or their results.
The default engine is Apple's system translation, which runs in a local macOS framework; the offline engine runs entirely on your Mac.
3.3 Downloading the offline model
When you start the download, the app fetches a public model file (about 1.13 GB) from Hugging Face. The request carries no personal information beyond standard HTTP request metadata.
3.4 Remote images in mail
Remote images in message bodies load automatically by default. When they load, the sender or their image host can see your IP address, approximate location, User-Agent, and when you read the message — a known trade-off in most mail clients.
You can turn off "Load remote images automatically" in Settings → Mail and load them per message instead. Disabling it blocks remote images and all other external subresources.
3.5 Opening web pages
When you click a link in an email or open the webmail entry, the app hands the URL to your default browser. Everything after that is governed by that browser and the destination site.
3.6 In-app local service
For offline translation the app starts the engine on a random port on 127.0.0.1 with a one-time access token. That connection stays on the loopback interface, is not exposed externally, and cannot be reached from other devices.
4. System permissions
| Permission | Purpose | Required |
|---|---|---|
| Screen Recording | Capture the region you select for screenshots and scrolling capture | Only for screenshots |
| Launch at login | Start Office Island when you log in | Optional, off by default |
| Network access | Fetch mail, online translation, model downloads | For the related features |
The app does not request Accessibility permission and does not use Apple Events to control other apps. It cannot read other apps' windows, menus, or data.
5. Third parties
These parties see your data only when you actively use the corresponding feature. We do not control their privacy practices; please review their policies.
- Your mail provider (e.g. QQ Mail, NetEase 163/126, Gmail, iCloud) — contacted at the server address you enter.
- Online translation providers (optional, you supply the key): DeepSeek, Alibaba Cloud Qwen, Kimi / Moonshot, Zhipu GLM, Volcengine Doubao, SiliconFlow, or any OpenAI-compatible endpoint you configure, including a local
localhostservice. - Hugging Face — contacted only to download the offline translation model.
- Apple — system translation and system frameworks are provided by macOS. When installed via the Mac App Store, Apple may collect install and usage statistics under its own policies; that is not collection by this app.
6. Retention and deletion
Because we retain nothing, all "retention" happens on your device and is under your control.
- Delete a single record directly in the clipboard, to-do, or notes view.
- Erase all local data by deleting the app's data directory. Both the menu bar and Settings → General offer an "Open data folder" entry. This cannot be undone.
- Remove keys in the Mail or Translation settings, or delete the items in Keychain Access.
- Uninstall by moving the app to the Trash; delete the data directory above to remove every trace.
- Revoke third-party access by revoking the API key in that provider's account settings, or by removing the mail authorization code to stop fetching.
Once the app is closed or removed, no further processing occurs on your Mac.
7. Children
The app is not directed at children under 13 and does not knowingly collect personal information from anyone — because it collects no data at all. If you believe there is an issue, contact us at the address above.
8. Changes
If a future version adds a feature that transmits data, we will update this page and revise the effective date at the top. Material changes to data handling will also be noted in the app's release notes.