简体中文
隐私，先说清楚。
同启让两个人先独立书写，再一起揭晓。这里说明内容由谁处理、保存多久，以及你可以怎样联系运营者。
对方看不到的阶段，不代表服务端看不到。双方都封存之前，参与者无法读取彼此的答案。提交的内容会经过服务端处理，授权管理员可访问尚未揭晓的提交内容。网络传输使用 TLS；同启不提供端到端加密。
01 · 我们处理哪些数据
- 你提交的内容：问题、答案，以及举报原因和补充说明；举报时可留存与该会话相关的问答作为处理证据。
- 会话信息：连接码、参与角色、确认词、创建和到期时间、确认与封存状态、揭晓和结束状态。
- 匿名安全标识：用于识别同一安全身份、执行屏蔽关系与防止滥用的随机标识和凭证。它不是姓名或账号，也不是广告标识；服务端保存凭证哈希及对应安全关系。
- 运行与访问信息：时间、访问路径、设备/系统/浏览器类型、部分遮蔽的 IP、由网络信息推断的国家，以及用于统计访问的哈希摘要。Cloudflare 在提供网络服务时也会处理网络请求信息。
无需注册，不要求姓名、手机号或联系人。我们不请求 GPS 定位权限，不读取精确定位，不展示广告，也不将数据用于广告追踪。
02 · 本机保存与手动导出
网页在当前标签页保存会话凭证，用于刷新后找回尚未到期的进度；匿名安全凭证保存在浏览器本地存储中。App 在本机保存必要的安全凭证与当前会话进度。草稿不作为自动历史记录保存。
同启不会自动建立本机对话历史。双方揭晓之后，你选择“保存这次对话”才会生成导出文件；文件由你选择保存的位置或系统分享目标管理。导出后是否进入系统云同步，取决于你选择的服务和设备设置，我们的服务端清理不会删除你已经导出的文件。
本机凭证和购买状态不等于对话历史；离开会话或到期后，对话正文不会自动转成本机历史。
03 · 保存多久
- 45 分钟
- 采用本留存机制的新普通会话，自创建起约 45 分钟到期。到期停止参与者访问；后台清理会移除会话服务及管理记录中的问题、答案正文，保留不含正文的事件与统计。正常情况下在到期后尽快执行，调度和短时故障可能使底层删除延后。
- 最多 30 天
- 举报说明及相关问题、答案作为举报证据，自举报起最多 30 天可供授权处理。到期禁止读取并纳入自动清理；后台调度或故障可能使底层删除稍后完成。不含正文的举报状态与处理统计可继续保留。
- 旧记录
- 启用本机制前已经存在的后台记录不参与本轮自动清理，仍可能保留。你可以通过公开邮箱提出核实或删除请求。
- 安全与统计
- 匿名安全标识、凭证哈希、屏蔽关系，以及不含问答正文的访问和运行统计，目前没有固定自动到期时间；用于安全处理与服务维护，可向运营者提出删除或解除关系请求。
“结束这次同启”会停止当前连接，不代表普通问答当场从所有存储中删除；普通正文仍按该会话的原到期时间清理。举报证据适用上面的 30 天规则。
04 · 举报、结束与屏蔽
会话内可“举报并结束”“屏蔽并结束”，也可只结束连接。举报会保留处理证据并屏蔽当前对方；屏蔽关系会阻止这些匿名安全身份今后再次配对。授权管理员可以查看举报材料、记录处理结果，并暂停被举报安全身份的发起和加入能力。
屏蔽依据匿名安全身份，而非真实姓名或 IP。清除站点数据、换浏览器、重新安装或换设备可能产生新的安全身份，因此屏蔽不能保证识别同一个现实中的人。不应把屏蔽当作现实人身安全的保证。
系统会拒绝部分明显不适当的内容；自动过滤有局限，举报与人工处理用于补充它。举报材料不会通过举报接口返还给另一位参与者。
05 · 服务提供方与购买
运营者为盛浩。Cloudflare 提供网页分发、网络处理、会话服务和数据存储；服务网络可能在不同国家或地区处理请求。授权管理员仅在运营、支持和安全处理范围内访问相应记录。
iOS 的购买、付款与恢复购买由 Apple App Store / StoreKit 处理。同启接收验证后的购买权限信息，不接收完整银行卡或付款凭证。一次买断用于发起问题和创建会话；加入、接受与回答免费。实际价格在购买前由 App Store 显示。
我们不出售用户内容，也不向广告平台提供内容。你主动选择的导出、邮件或系统分享目标会按各自的规则处理你发送的内容。
English
Privacy, explained clearly.
Unseal lets two people write independently and reveal together. Here is who handles your information, how long it is kept, and how to contact the operator.
Hidden from your partner does not mean hidden from the service.Participants cannot read each other’s answers before both have sealed them. Submitted content is processed by the service, and authorized administrators can access submissions before reveal. Connections use TLS. Unseal does not provide end-to-end encryption.
01 · Information we process
- Content you submit: questions, answers, report reasons and additional report details. Relevant questions and answers may be retained as evidence when a session is reported.
- Session information: connection code, participant role, verification phrase, creation and expiry times, confirmation, sealing, reveal and ending status.
- Anonymous safety identity: random identifiers and credentials used to recognize a safety identity, enforce blocking and prevent abuse. These are not a name, account or advertising identifier. The server stores credential hashes and related safety records.
- Operational and visit information: time, request path, device/OS/browser category, partially masked IP address, country inferred from network information and a hashed visit summary. Cloudflare also handles network request information while providing the service.
No registration is required. We do not require your name, phone number or contacts. We do not request GPS permission, read precise location, show ads or use information for advertising tracking.
02 · On-device storage and manual export
The website keeps session credentials in the current tab so an unexpired session can recover after a refresh. Anonymous safety credentials are kept in browser local storage. The app keeps the necessary safety credentials and current session progress on the device. Drafts are not saved as an automatic history.
Unseal does not automatically create an on-device conversation history. A file is exported only when you choose to save after mutual reveal. You control its destination or system share target. Whether that destination syncs to a cloud depends on the service and device settings you choose. Server cleanup does not delete files you have already exported.
Local credentials and purchase access are separate from conversation history. Leaving or expiry does not automatically turn the conversation into a local history record.
03 · Retention
- 45 minutes
- New ordinary sessions using this retention mechanism expire about 45 minutes after creation. Participant access ends at expiry. Background cleanup removes question and answer text from the session service and administration records, while keeping events and statistics without that text. It normally runs promptly after expiry; scheduling or temporary failures can delay deletion in underlying storage.
- Up to 30 days
- Report details and related questions and answers are available to authorized reviewers as report evidence for up to 30 days from reporting. Access is refused at expiry and the evidence enters automatic cleanup. Background scheduling or failures can delay deletion in underlying storage. Report status and processing statistics without that text may remain.
- Earlier records
- Administration records created before this mechanism was introduced are outside this automatic cleanup change and may still be retained. You can email the operator to request verification or deletion.
- Safety & statistics
- Anonymous safety identities, credential hashes and blocking relationships, along with visit and operational statistics without question or answer text, currently have no fixed automatic expiry. They support safety and service maintenance. You may ask the operator to delete relevant records or remove a relationship.
Ending a session stops the current connection. It does not mean ordinary content is immediately deleted from every store: that content follows the session’s original expiry. Report evidence follows the 30-day rule above.
04 · Reports, ending and blocking
A session offers “Report and end”, “Block and end”, and ending without blocking. A report retains review evidence and blocks the current partner. Blocking prevents the same anonymous safety identities from pairing again. Authorized administrators can review report material, record an outcome and suspend a reported identity’s ability to create or join sessions.
Blocking is based on anonymous safety identities, not a real name or IP address. Clearing site data, changing browsers, reinstalling or using another device can create a new safety identity. Blocking therefore cannot reliably identify the same person in the physical world or guarantee personal safety.
Some clearly inappropriate content is rejected automatically. Filtering has limitations; reports and human review complement it. A report endpoint does not return report evidence to the other participant.
05 · Providers and purchases
The operator is 盛浩 (Sheng Hao). Cloudflare provides web delivery, network processing, session services and storage. Its service network may process requests in different countries or regions. Authorized administrators access relevant records for operation, support and safety review.
Apple App Store / StoreKit handles iOS purchases, payment and restore. Unseal receives verified access information, not full payment-card details. A lifetime purchase enables starting questions and creating sessions. Joining, accepting and answering are free. The App Store shows the actual price before purchase.
We do not sell user content or provide it to advertising platforms. An export destination, email provider or share target you choose handles what you send under its own rules.