1. What this policy covers
This policy covers two things: the macOS app "Wenyin" (including the local background program and the Finder extension included in the installer), and the Wenyin website (the static site this page belongs to).
Related documents: commercial terms for trials and purchases are inLicense and Refunds; the license and liability terms are inTerms of Use; licenses for bundled third-party components are inThird-Party Notices.
This policy does not cover other actions you initiate: for example, sharing an exported file with an external AI, a cloud drive, or another person. You decide whether to take such actions, and the rules of the relevant service apply.
2. What happens to a document, step by step
The table below lists, for each processing step, where the data is, whether it leaves your Mac, and what remains.
| Step | Where the data is | Leaves your Mac | What remains |
|---|---|---|---|
| Import | The file you selected; one copy is made in the local library | No | The copy in the library; the index records name, format, size, and time added |
| Detection | Local memory; the detection model and inference runtime ship with the installer | No | Review candidates (source text fragments, categories, replacement terms, positions) are written to the local index file so review can continue after the app closes |
| Review | The local interface | No | Your checked and unchecked choices are stored locally with the index file |
| Replacement (redaction) | Local memory and disk | No | A separate redacted copy within the same project; the original copy is not rewritten |
| Export | The destination you chose | No | The exported file. Undo only retracts the redacted copy in the library; it does not affect files already exported |
| Delete | This Mac | No | The copy in the library moves to the system Trash; the index entry is removed; your original file is unaffected |
One point needs emphasis: detection and review results are sensitive information, so they are stored on your Mac just like the copies you imported. They do not leave your Mac, but if you hand the computer to someone else, that person can see this content through the library. Please protect the device itself (login password, disk encryption, screen lock).
3. Why processing does not need a network connection
Document detection does not use a cloud document recognition service: the detection model and inference runtime ship with the installer, and inference runs on your Mac. Import, detection, review, replacement, and export never connect to the network or upload anything.
If the model or runtime is missing, damaged, or fails to load, detection continues with rule results and returns normally, and the reason for the degraded mode is written to the detection output and system logs. If the model is missing at packaging time, packaging stops and no installer without a model is produced. This process also does not use the network.
What is imported is a copy
On import, Wenyin copies the document into the local library (~/Library/Application Support/文隐/资料). Your original file is not moved, rewritten, or deleted. The redacted result is a separate copy within the same project and is written only to your Mac's disk.
4. What is stored on your Mac, for how long, and how to delete it
| Item | Location | Retention | How to delete |
|---|---|---|---|
| Imported copies and redacted copies | ~/Library/Application Support/文隐/资料/ |
Kept until you delete them or turn on storage cleanup | Delete in the app (goes to the system Trash); or automatic cleanup in Settings → Storage; or the uninstall script |
| Project and document index, including review candidates and checked states | ~/Library/Application Support/文隐/library.json |
Same as the corresponding document | Delete the corresponding document; use the uninstall script to clear everything |
| Preferences | ~/Library/Preferences/com.songsong.docredactor*.plist |
Until you change them or uninstall | The uninstall script; or delete manually |
| Trial record (key and number of documents used) | ~/Library/Application Support/文隐/License/ and the system keychain entry com.songsong.docredactor.trial.v2 |
Until you uninstall | The uninstall script (the system may ask once when deleting the keychain entry) |
| License status (the license code you pasted) | ~/Library/Application Support/文隐/License/license.txt |
Until you uninstall | The uninstall script; or delete manually |
| Caches and network caches | ~/Library/Caches/com.songsong.docredactor,~/Library/HTTPStorages/com.songsong.docredactor |
Reclaimed by the system and the app as needed | The uninstall script; or delete manually |
| Finder extension container | ~/Library/Containers/com.songsong.docredactor*,~/Library/Application Scripts/com.songsong.docredactor*,~/Library/Group Containers/group.com.songsong.docredactor |
Until you uninstall | The uninstall script; or delete manually |
Storage cleanup (off by default)
In Settings → Storage you can reclaim original copies in the library by number of days (7／14／30／60／90 days) or by a size limit (unlimited／500 MB／1 GB／2 GB／5 GB). Reclaimed items always go to the system Trash, never erased outright. There is also an "automatically delete the redacted copy after export" switch, also off by default. Automatic cleanup only affects the library; your original files were never in the library and are unaffected.
Two meanings of delete
Deleting data in the app moves the copy in the library to the system Trash (where it can be recovered); the original file stays where it is. "Remove from Recents" only affects the Recents list and does not delete files. The interface states both clearly; please follow the prompt.
5. When the app connects to the network
The app needs the network for one thing only: checking for updates and downloading updates. The table below is the complete network list.
| Scenario | Where the request goes | What is sent | What is not sent | Can it be avoided |
|---|---|---|---|---|
| Checking for updates (automatic by default, can be manual) | The update feed onbrickindex.pages.dev : appcast.xml(China route) or appcast-global.xml(overseas route) |
A standard HTTPS request, plus app version information used to compare versions | Document contents, file names, detection results, usage statistics, or system configuration | Yes: set Settings → General → Software Update to manual, or use the app in an offline environment |
| Downloading an update package (requires your click) | The HTTPS address given in the update feed (Gitee on the China route, GitHub on the overseas route) | A standard download request | Same as above | Yes: simply do not click download |
| Detection, review, replacement, export | No network request is made | — | — | It is offline by design |
| Finder extension and local interface | Communicates only locally (the Finder extension hands off to the main program; the local interface is a Unix socket) | File paths, project and document metadata | It does not listen on a network port and makes no external requests | No network is involved |
Update packages are verified with Ed25519 signatures, and the public key ships with the app. Updates download only the version feed and installer; they do not read or upload documents, send usage statistics, or send system configuration. Sparkle's system information collection is disabled at build time (SUEnableSystemProfiling=False).
Downloads and update checks are provided by the hosting services, whose servers receive the usual connection IP and request records — records that any download produces. There is no telemetry, no crash reporting, and no third-party analytics SDK in the app.
6. System permissions
| Permission | Used | Notes |
|---|---|---|
| Files and Folders | Only when you act | Open the document you selected and write to the library. macOS may ask on first access to certain directories; you decide in System Settings whether to allow it |
| Keychain | Needed to read the local trial record | It may ask once on first read or after an update; please confirm that the requesting party is Wenyin or its background program |
| Finder extension | Registered with the installer; can be turned off in System Settings | A sandboxed process that passes only the selected file paths to the main program and does not read document contents |
| First launch (not notarized) | Must be allowed in System Settings → Privacy & Security | The current version is not notarized by Apple; you are not asked to disable system security protection |
| Other system permissions | Not used, not requested | Screen Recording, Accessibility, Full Disk Access, Camera, Microphone, Location, Contacts, Calendars, Reminders, Photos, and the Automation permission to control other apps are not requested: the installer contains no usage-description keys for them, and the app has no features for screen capture, controlling other apps, or full-disk scanning |
You can revoke any of these authorizations in System Settings at any time. If you revoke file access, Wenyin cannot read the locations you choose; this does not affect the safety of your existing files.
7. The local interface (off by default)
Settings also includes a local interface that is off by default, for use from Terminal or automation scripts. It uses a local Unix socket (permissions 0600) and works only on the same computer under the same logged-in user; it does not listen on a network port.
It returns only metadata such as project names, file names, formats, library copy byte counts, and status; it does not return document text, originals, or detection results, and the protocol has no fields that could carry them. Regression tests assert that responses and on-the-wire bytes do not contain a unique token placed in the document text. Import copies the file into the library and leaves the original untouched; delete moves the library copy to the system Trash.
8. Finder extension
The Finder extension is a sandboxed process. It passes only the file paths you select to the app; it does not read document contents and does not access the library. "Redact Here" launches the main program in the background without opening a window; on failure it writes the reason to standard error and the system log and exits non-zero, so it never hangs behind a dialog. Clicking real Finder menu items is still pending validation, and we do not hide that.
9. What we do not collect
- No accounts: Wenyin has no registration, login, or cloud account system, and no password recovery flow.
- No personal information: we do not ask for your name, phone number, or national ID number, and we do not collect the original hardware UUID. The machine code is a one-way hash and encoding of a hardware identifier, used only to check whether a license code was signed for this machine.
- No document contents: we do not upload documents and do not collect originals, detection results, replacement mappings, or exported files.
- No usage statistics: no behavioral tracking, no advertising identifiers, no crash reporting, no third-party analytics SDK.
- No selling or sharing of data: there is no data to sell, and we do not share any documents or detection results with third parties.
Purchasing a license requires only two things: the order number, and the machine code you copy from the app (in the form XXXX-XXXX-XXXX-XXXX-XXXX). We do not need your documents, your national ID, your phone number, or the original hardware UUID.
10. This website
- It does not receive documents: the site has no upload entry point and does not send your files anywhere.
- It does not track you: the site sets no tracking cookies, loads no third-party analytics scripts, and does not place ads.
- Theme preference: the light/dark switch stores your choice in the browser's
localStorageunder the keywenyin-theme, with one of three values:auto,light, ordark. It contains no identifiers, is never sent with requests, and is not used for tracking; clearing site data in your browser removes it. - Hosting logs: this site is served by a static hosting service, and access logs are handled by the host under its own policy. We cannot access the raw access logs and do not use them for statistics or analysis.
- External links: download buttons and update channels point to the public download repository; the rules of the relevant service apply after you click.
Please do not send real documents by email or group chat. If you need to explain a detection problem, first reproduce it with a synthetic sample as described inSupport and Updates.
11. Your rights and how to exercise them
Because your data is stored on your Mac, we cannot access it, and you do not need to submit access or deletion requests to us. You can exercise your rights directly through the app and the system:
| What you want to do | How to do it |
|---|---|
| See what Wenyin stores | Open the library to view copies and the index; find the files in Finder using the paths in section 4 |
| Correct a detection result | Check, uncheck, or add candidates in the review pane; detection results are not written into the document itself, so you change this review session's choices |
| Delete a document | Delete it in the app (goes to the system Trash); empty the Trash for complete removal |
| Export your data | Export the documents themselves; library copies can also be copied out directly |
| Clear all local data | Run the 卸载文隐.command script in the installer |
| Complain or ask a question | Contact us through the channels in section 14. For complaints about personal information protection, we will talk with you first; you may also report to a competent authority under the law |
12. Minors
Wenyin is intended for adult users who need to process legal documents. The app has no accounts and does not collect age or personal identity information. Minors should use the app and this website under the guidance of a guardian.
13. Policy changes, versions, and effective dates
The current document version of this policy is v1, and the effective date is at the top of this page. Each revision updates both the effective date and the version number; this is the first public version.
Significant changes to how data is handled will be explained on this page and in thepublic release notes. Historical versions of the policy are kept in our records; if you need to check an older version, write to us and we will provide it.
This policy applies from its effective date to the currently published beta version. Final pricing and sales terms have not been determined; once they are, theLicense and Refundspage will be updated accordingly.
14. Contact and response time
- Email:songsong24@foxmail.com
- WeChat groups: the two WeChat groups linked from "Join the group chats" in the website footer (the beta group and the AI discussion group)
- Download repository:github.com/songoao25/wenyin-downloads
Wenyin is maintained by an individual developer. We do not promise a fixed response time, but we will do our best to reply within a reasonable time. For privacy questions, include the version and OS version you use; do not attach real documents.
Related pages:Terms of Use · License and Refunds · Third-Party Notices · Support and Updates