账序隐私政策
生效日期：2026 年 10 月 4 日
概述
账序是一款本地优先的记账 App。没有账号系统，不需要注册或登录；没有广告；没有接入任何第三方统计、广告、崩溃收集或推送 SDK；不追踪你。我们（开发者）不收集、不上传、不出售你的任何个人信息，也看不到你的账本。
数据存在哪里
- 你记录的账目、分类、标签、预算、账户、固定账单、存钱计划、模板等，保存在这台设备上账序自己的存储空间里。
- 如果你的设备开启了系统的 iCloud 云备份或电脑备份，账本会按系统设置包含在这份设备备份里（AA 收款码除外，见下文）。
- 「导出表格」「导出账本备份」生成的文件，由你自己决定通过系统分享面板存到哪里或发给谁。
iCloud 同步（可选，默认关闭）
只有你在「我的 → iCloud 同步」里打开后，账本（以及记账图片）才会保存到你自己 Apple 账户的 iCloud 私有数据库（CloudKit 私有数据库），用于在你的多台设备间同步。这部分数据由 Apple 按其隐私政策保管，开发者无法访问。
联网做什么
账序只为获取汇率和价格主动联网：App 启动时、回到前台且报价已超过 5 分钟时、以及在汇率换算页刷新时，向下列公开服务请求报价，用于外币记账的入账汇率和汇率换算：
- 法币汇率：新浪财经、中国外汇交易中心（人民币汇率中间价）、Currency API（经 jsDelivr 和 Cloudflare 分发）、Coinbase。
- 加密货币参考价：Coinbase、Kraken、Binance、OKX、Gate、HTX、Bitget。
请求里只有固定的币种代码（如 USD、BTC），不包含你的账目、金额或任何身份信息。和访问任何网站一样，这些服务按常规会看到你的网络 IP 地址。报价只缓存在本机。
App Store 所在地区为中国大陆时，App 不提供加密货币换算，也不请求加密货币价格。所在地区由系统 StoreKit 在本机提供，只用于这一判断，不上传。
此外，iCloud 同步（你打开时）和 App 内购买由 Apple 的系统服务完成。除上述情况外，账序不向任何服务器发送数据。
相机
只在你主动使用时打开：给一笔账拍照（记账图片），或用「拍小票」（系统文档相机）识别纸质小票。记账图片保存在本机，打开 iCloud 同步时也存到你自己的 iCloud；保存时重新压缩并去掉拍摄位置等元数据。拍小票只用于识别，识别完不保存照片。
截图记账与拍小票：只在本机识别
截图记账、拍小票的文字识别使用 Apple 的 Vision 框架，全部在你的设备上完成，图片和识别出的文字都不会上传到任何服务器。识别结果只用来预填一笔账，保存前由你确认。快捷指令「用截图记一笔」同样在本机识别。
相册
- 仅添加权限：只在你主动保存图片时使用——把月报／年报分享图、AA 收款图、App 锁恢复码图片存到相册。账序不能读取你的相册。
- 从相册选图（截图记账、记账图片、AA 收款码）使用系统选图器，账序只能拿到你选中的那几张，看不到相册里的其他照片，也不需要相册读取权限。
AA 收款码
你添加的 AA 收款码图片只存在这台设备上账序的本地目录里：不写进账本，不随 iCloud 同步，不进入导出表格和账本备份，并已标记为不进入设备备份（iCloud 云备份或电脑备份）。换手机或删除账序后需要重新添加。识别和裁剪收款码在本机完成。
导入账单
导入支付宝、微信账单、银行流水（CSV、Excel、PDF）或其他记账 App 的导出文件时，账序只读取你在系统文件选择器里选中的文件，只在本机解析，不上传。带密码的文件，密码只用于这次打开，不保存。
App 锁、Face ID 与 iPhone 锁屏密码
- 账序密码和恢复码不以原文保存：只把加盐后的校验值存在这台设备的钥匙串里（仅本机、不随 iCloud 钥匙串同步），换设备需要重新设置。忘记密码时的 72 小时等待计时也存在本机钥匙串。
- Face ID／Touch ID 和「用 iPhone 锁屏密码重设」由 iOS 系统验证，账序只得到「通过／未通过」的结果，拿不到你的面部、指纹数据或 iPhone 锁屏密码。
- App 锁保护的是进入 App 的界面，它不是对账本文件的额外加密。
通知
到期提醒、信用卡还款提醒都是在本机安排的本地通知，不经过任何服务器，也没有推送服务。开启隐藏金额时通知不含金额；开启 App 锁时连对方名字也不显示。
小组件、Siri 与快捷指令
桌面／锁屏小组件读取 App 在本机共享区域写好的汇总（本月支出、今日支出、预算进度）；开启 App 锁或隐藏金额时只显示 ••••。Siri 和快捷指令的操作由系统在本机交给账序处理，账序不把内容发给开发者。
购买账序 Pro
账序 Pro 是一次买断的 App 内购买，付款全部由 Apple 处理，账序收不到你的支付信息，也不知道你的 Apple 账户。App 只通过 Apple 的 StoreKit 在本机确认是否已购买；购买状态不写进账本、不上传。账序 Pro 不支持家人共享。
删除数据
你可以在 App 里删除任意记录。删除账序会删除本机上的全部账本、图片和 AA 收款码（为防止重装后免费额度被重置，钥匙串里的免费次数记录和 App 锁记录可能由系统保留）。iCloud 里的同步数据可以在 系统设置 → [你的名字] → iCloud → 管理储存空间 → 账序 中删除。
儿童
账序不收集任何人的个人信息，包括儿童。
政策更新
如果本政策有变化，我们会更新本页面并修改上方的生效日期，重要变化会随 App 更新说明。
联系我们
对本政策有任何疑问，请发邮件至 support@sodos.dev。
账序 Privacy Policy
Effective date: October 4, 2026
Summary
账序 (Zhangxu) is an offline-first money tracker. There is no account or sign-in, no ads, and no third-party analytics, advertising, crash-reporting or push SDKs, and it does not track you. We (the developer) do not collect, upload or sell any personal information, and we cannot see your ledger.
Where your data lives
- Your entries, categories, tags, budgets, accounts, recurring bills, savings goals and templates are stored on this device, inside the app’s own storage.
- If your device uses iCloud Backup or computer backups, the ledger is included in that device backup according to your system settings (except payment QR codes, see below).
- Files created with Export or Export Ledger Backup go wherever you choose in the system share sheet.
iCloud Sync (optional, off by default)
Only if you turn on Me → iCloud Sync is your ledger (and entry photos) saved to the private CloudKit database of your own Apple Account to sync between your devices. Apple keeps this data under its privacy policy; the developer cannot access it.
Network use
The app connects to the internet only to fetch exchange rates and prices — at launch, when returning to the app if quotes are more than 5 minutes old, and when you refresh the currency converter — from these public services:
- Currency rates: Sina Finance, China Foreign Exchange Trade System (CNY central parity), Currency API (via jsDelivr and Cloudflare), Coinbase.
- Crypto reference prices: Coinbase, Kraken, Binance, OKX, Gate, HTX, Bitget.
Requests contain only fixed currency codes (such as USD or BTC) — none of your records, amounts or identity. As with any website, these services normally see your IP address. Quotes are cached on device only.
When your App Store region is mainland China, crypto conversion is not offered and crypto prices are not requested. The region is provided on device by StoreKit and used only for this check.
iCloud Sync (when you turn it on) and in-app purchases are handled by Apple system services. Other than the above, the app sends no data to any server.
Camera
Used only when you choose to take a photo for an entry or scan a paper receipt (system document camera). Entry photos are stored on device, and in your own iCloud when iCloud Sync is on; they are re-encoded without location metadata. Receipt scans are used for recognition only and are not kept.
Screenshot and receipt recognition happens on device
Text recognition for screenshot entries and receipt scans uses Apple’s Vision framework entirely on your device. Neither the images nor the recognized text are uploaded. Results only pre-fill an entry, which you confirm before saving. The “Add Entry from Screenshot” shortcut works the same way.
Photos
- Add-only access is used only when you save an image yourself: report share images, split-bill payment images, and App Lock recovery code images. The app cannot read your photo library.
- Choosing images (screenshot entry, entry photos, payment QR codes) uses the system photo picker. The app receives only the images you select and needs no library read access.
Payment QR codes for split bills
Payment QR code images you add are stored only in the app’s local folder on this device: not in your ledger, not synced to iCloud, not included in exports or ledger backups, and excluded from device backups. You need to add them again on a new device. Detecting and cropping the code happens on device.
Importing statements
When you import Alipay or WeChat statements, bank statements (CSV, Excel, PDF) or exports from other budgeting apps, the app reads only the files you pick in the system file picker and parses them on device. File passwords are used only to open that file and are not stored.
App Lock, Face ID and device passcode
- Your app passcode and recovery code are never stored in plain text — only salted verification values in this device’s Keychain (this device only, not synced via iCloud Keychain). The 72-hour reset wait timer is also kept in the local Keychain.
- Face ID / Touch ID and “reset with iPhone passcode” are verified by iOS; the app only receives pass/fail and never gets your biometric data or device passcode.
- App Lock protects access to the app’s screens; it is not an extra encryption of the ledger file.
Notifications
Due-date and credit card payment reminders are local notifications scheduled on device. No server or push service is involved. With Hide Amounts on, notifications contain no amounts; with App Lock on, names are hidden too.
Widgets, Siri and Shortcuts
Widgets read a summary the app writes to a shared area on this device (this month’s and today’s spending, budget progress); with App Lock or Hide Amounts on they show only ••••. Siri and Shortcuts actions are handed to the app on device; nothing is sent to the developer.
账序 Pro purchase
账序 Pro is a one-time in-app purchase. Payment is handled entirely by Apple; the app never receives your payment details or your Apple Account. The app only checks on device, through StoreKit, whether you own it. Purchase status is not written to your ledger or uploaded. 账序 Pro does not support Family Sharing.
Deleting data
You can delete any entry in the app. Deleting the app removes the ledger, photos and payment QR codes from this device (the system may keep the app’s Keychain items, such as free-use counters and App Lock data). Synced iCloud data can be deleted in Settings → [your name] → iCloud → Manage Storage → 账序.
Children
The app collects no personal information from anyone, including children.
Changes
If this policy changes, we will update this page and the effective date above, and mention important changes in the app’s release notes.
Contact
Questions about this policy: support@sodos.dev