Colly Portfolio 隐私政策
最后更新：2026 年 10 月 21 日
Colly Portfolio 由 Colly Developer 提供，用于在本地管理订阅记录。
1. 本地数据与安全
本地账户信息、订阅记录、付款与操作历史及设置保存在你的设备上。应用不会将这些内容自动上传。订阅账户名称、密码和备注等敏感文本以加密形式保存；金额、货币、日期等计算字段以明文保存。本地账户密码用于解锁和加密数据，不发送给开发者。
2. 你主动使用的联网功能
成功解锁或初始化同步文件夹后，应用会使用操作系统当前用户的加密保护，在本机安全记住同步密码。保存值绑定本地账户和同步目录/通道，可在同步设置中清除，不发送给开发者或授权服务，不进入账户备份、导出、迁移包或同步文件。清除已保存密码不会改变既有加密文件的密码；需要新密码时，请先完成所有需要同步设备的同步，再设置新的同步文件夹。
更新汇率时，应用访问你选择的汇率服务；请求失败时可能尝试其他来源，包括 Frankfurter、欧洲央行、中国银行或自定义服务。请求可能包含货币代码，服务方会接收 IP 地址等网络信息，不包含订阅名称、金额或账户密码。打开外部网站时，适用该网站的隐私政策。
备份、导出、迁移和同步由你发起。普通导出可直接读取，不含订阅账户密码；加密迁移包包含完整本地账户数据及加密的订阅账户密码。同步文件内容加密，文件名包含设备名称；迁移包文件名包含账户名称。网盘客户端按自身设置传输所选文件夹中的文件，适用网盘服务的隐私政策。Colly Portfolio 授权服务不接收订阅数据库、同步文件内容或其解密密码。
3. 购买身份、Pro 与设备授权
选择使用购买身份登录或恢复购买时，你可以使用 Google 账号或 Microsoft 账号。登录在 Google 或 Microsoft 的页面完成，密码只在该页面输入。Colly Portfolio 身份服务只使用登录证明中的账号标识，并将其单向转换为不透明的购买身份标识；不读取、不保存你的邮箱、姓名、头像或密码。
为免去频繁重新登录，身份服务会从 Google 或 Microsoft 获取续期令牌，以 Azure Key Vault 保护的密钥加密保存，仅用于向该提供方确认你的登录仍然有效。每台设备的登录会话最长 30 天，到期后需要重新登录；退出或删除购买身份时，对应的续期令牌会被清除。你的设备只在系统安全存储（如 Windows 数据保护或 Android Keystore）中加密保存一个与本设备绑定的续期凭据，用于向 Colly Portfolio 身份服务续期，不保存 Google 或 Microsoft 的令牌，也不包含在应用生成的备份、导出、迁移包或同步文件中。退出购买身份会清除本机登录缓存，并撤销该设备的登录会话。
付款由 Google Play 或 Microsoft Store 处理，我们不会收到你的银行卡或其他付款信息。在 Google Play 购买时，应用会向 Google Play 提供一个由购买身份派生的匿名标识，以便将购买关联到你的购买身份。授权服务通过 Google Play Developer API 核验并确认购买，读取商品、购买状态和退款状态，并接收 Google Play 发送的购买和退款通知；订单以经过哈希处理的标识记录。服务器使用不含长期密钥的联合身份访问 Google Play。
为核验购买、恢复 Pro、管理五台活跃设备及防止重复授权，Colly Portfolio 授权服务处理购买身份标识、商店商品与订单标识、购买或退款状态、授权修订、设备公钥及其指纹、系统设备名称、设备启用状态和短时验证记录。系统设备名称可能包含你设置的人名，仅用于识别设备；设备验证后更新，删除购买身份时从运行账本清除，不写入令牌或运行日志。商店查询凭据（Microsoft Store 查询凭据和 Google Play 购买令牌）用于向商店核验购买，以加密形式存储，封装密钥由 Azure Key Vault 保护；仅授权服务可使用。服务通过 Microsoft Azure 托管，当前授权数据存储于美国区域；Microsoft 和 Google 分别根据其服务条款处理托管、商店及登录数据。
Pro 激活后，本地记录管理可离线使用。同步对免费版和 Pro 均开放，开始同步不联网核验购买或设备授权，也不向 Colly Portfolio 身份或授权服务发送数据。Pro 权益验证暂不可用不会被当作退款，已验证的本地权益和记录会保留。登录及购买入口将随通过验收的版本开放。
4. 留存、删除与数据控制
你可以查看、编辑、导出记录，或删除本地账户。卸载默认保留本地数据；退出购买身份、解绑设备或删除本地账户不会删除云端购买身份。导出、备份、迁移包、同步目录及网盘副本由你自行管理。
授权服务运行期间，保留恢复购买与防止重复认领、撤销回退所需的最少购买身份、订单、事件及设备授权记录。商店查询凭据保留至更新替换或购买身份删除；过期后停止用于新的购买核验，但其加密记录可能仍被保留。删除购买身份须验证归属：在已登录购买身份的应用中打开 Pro，选择“删除购买身份”并确认即可，删除作用于你所有设备上的 Pro 授权。删除时，停用设备授权并清除设备名称，撤销登录会话及加密保存的续期令牌，删除短时验证记录及加密的商店查询凭据；上述防重复和撤销记录继续保留，不用于广告或行为分析。删除购买身份不会触发退款，也不会删除你的 Google 或 Microsoft 账户或商店中的购买记录。
去敏运行日志保留 30 天。授权数据库自动备份保留 7 天，未启用长期备份；删除前的数据可能留在备份中直至轮换到期。恢复后仍须执行已确认的删除和撤销，不能将备份中的旧状态作为重新授权的依据。
5. 网站、支持与联系
Colly Portfolio 和本帮助站不提供广告或行为追踪功能。帮助站不设置分析统计 Cookie；Azure 托管平台可能处理 IP 地址、请求时间等运行与安全信息。主动联系支持时，我们使用你提供的邮箱和问题描述回复；请勿发送密码、个人数据库、同步文件或完整商店凭据。与 Microsoft 相关的数据处理请参阅 Microsoft 隐私声明，与 Google 相关的数据处理请参阅 Google 隐私权政策。本政策随功能及数据处理方式更新。
联系开发者或咨询隐私问题：collydeveloper@outlook.com
Colly Portfolio Privacy Policy
Last updated: October 21, 2026
Colly Portfolio is provided by Colly Developer to help you manage subscription records locally.
1. Local Data and Security
Local account information, subscription records, payment and activity history, and settings are stored on your device. The app does not automatically upload this information. Sensitive text, including subscription account names, passwords and notes, is stored encrypted. Calculation fields such as amounts, currencies and dates are stored in plain text. Your local account password unlocks and encrypts data and is not sent to the developer.
2. Online Features You Initiate
After you successfully unlock or initialize a sync folder, the app securely remembers its password on this device using your operating system’s current-user encryption. It is bound to the local account and sync folder/channel and can be forgotten from the sync setup screen. The saved password is not sent to the developer or authorization service and is not included in account backups, exports, migration packages or sync files. Forgetting it does not change the password of existing encrypted files. To use a new password, finish syncing all devices that need the current data, then set up a new sync folder.
When you update exchange rates, the app contacts your selected service and may try alternatives after a failed request, including Frankfurter, the European Central Bank, the Bank of China or a custom service. Requests may contain currency codes, and providers receive network information such as your IP address. They do not contain subscription names, amounts or account passwords. External websites have their own privacy policies.
You initiate backups, exports, migrations and synchronization. Standard exports are readable without decryption and exclude subscription account passwords. Encrypted migration packages contain complete local account data, including encrypted subscription account passwords. Sync contents are encrypted; sync filenames include the device name, and migration filenames include the account name. Your cloud storage client transfers files in the chosen folder according to its settings and its provider's privacy policy. Colly Portfolio's authorization service does not receive your subscription database, sync file contents or their decryption password.
3. Purchase Identity, Pro and Device Authorization
When you choose purchase sign-in or purchase restoration, you can use a Google account or a Microsoft account. Sign-in happens on Google's or Microsoft's page, and you enter your password only there. Colly Portfolio's identity service uses only the account identifier in the sign-in proof and converts it one-way into an opaque purchase identity identifier. It does not read or store your email address, name, profile photo or password.
So you do not have to sign in repeatedly, the identity service obtains a renewal token from Google or Microsoft, stores it encrypted with keys protected by Azure Key Vault, and uses it only to confirm with that provider that your sign-in is still valid. Each device's sign-in session lasts at most 30 days, after which you sign in again; signing out or deleting the purchase identity clears the corresponding renewal tokens. Your device keeps only a device-bound renewal credential, encrypted in the system's secure storage (such as Windows Data Protection or Android Keystore), for renewing with Colly Portfolio's identity service. It does not keep Google or Microsoft tokens and is not included in app backups, exports, migration packages or sync files. Signing out clears the local sign-in cache and revokes that device's sign-in session.
Payments are processed by Google Play or the Microsoft Store; we do not receive your payment card or other payment details. For Google Play purchases, the app gives Google Play an anonymous identifier derived from your purchase identity so the purchase can be linked to it. The authorization service verifies and acknowledges purchases through the Google Play Developer API, reads the product, purchase state and refund state, and receives purchase and refund notifications sent by Google Play. Orders are recorded under hashed identifiers. The server reaches Google Play through federated identity without long-lived keys.
To verify purchases, restore Pro, manage five active devices and prevent duplicate authorization, Colly Portfolio's authorization service processes the purchase identity identifier, Store product and order identifiers, purchase or refund status, authorization revisions, device public keys and their fingerprints, system device names, device activation status, and short-lived verification records. A system device name may contain a personal name you chose. It is used only to identify the device, updated after device verification, and cleared from the live ledger when you delete the purchase identity. It is not included in tokens or operational logs. Store query credentials (Microsoft Store query credentials and Google Play purchase tokens) enable purchase checks with the stores. They are stored encrypted, with wrapping keys protected by Azure Key Vault, and are usable only by the authorization service. The services are hosted on Microsoft Azure; authorization data is currently stored in a US region. Microsoft and Google process hosting, store and sign-in data under their respective service terms.
After Pro activation, local record management works offline. Sync is available in Free and Pro; starting a sync does not check the purchase or device authorization online and sends no data to Colly Portfolio's identity or authorization services. Unavailable Pro verification is not treated as a refund: verified local rights and records are kept. Sign-in and purchases will open in releases that pass integration checks.
4. Retention, Deletion and Your Control
You can view, edit and export records, or delete a local account. Uninstalling leaves local data in place by default. Signing out, unlinking a device or deleting a local account does not delete your cloud purchase identity. You manage exports, backups, migration packages, sync folders and cloud copies yourself.
While the authorization service operates, it retains the minimum purchase identity, order, event and device authorization records needed to restore purchases and prevent duplicate claims or reversal of revocations. Store query credentials remain until replaced by an update or deleted with the purchase identity. Expired credentials stop being used for new purchase checks, but their encrypted records may remain. Purchase identity deletion requires ownership verification: in the app, signed in with your purchase identity, open Pro, choose "Delete purchase identity" and confirm. Deletion applies to Pro on all your devices. It deactivates device authorizations and clears device names, revokes sign-in sessions and their encrypted renewal tokens, and removes short-lived verification records and encrypted store query credentials. The minimal duplicate-prevention and revocation records remain and are not used for advertising or behavioral analysis. Deleting the purchase identity does not trigger a refund and does not delete your Google or Microsoft account or your store purchase history.
Sanitized operational logs are retained for 30 days. Automatic authorization database backups are retained for seven days; long-term backup retention is disabled. Data from before deletion may remain in backups until they expire. A restore must reapply confirmed deletions and revocations; an old backup state cannot justify renewed authorization.
5. Website, Support and Contact
Colly Portfolio and this help site have no advertising or behavioral tracking features. The help site does not set analytics cookies. Azure hosting may process IP addresses, request times and other operational or security information. If you contact support, we use the email and issue description you provide to respond. Do not send passwords, personal databases, sync files or complete Store credentials. For Microsoft's data processing, see the Microsoft Privacy Statement; for Google's, see the Google Privacy Policy. This policy will be updated when features or data handling change.
Contact the developer or ask a privacy question: collydeveloper@outlook.com