欢迎您使用 MASF Tool（以下简称"本应用"）。本应用由上海马斯夫物联科技有限公司（以下简称"我们"）开发并运营。我们深知个人信息和设备数据对您的重要性，并将按照合法、正当、必要和诚信原则处理与本应用相关的信息。

MASF Tool 是一款面向 AI 打印机、标签机、喷墨打印机等硬件设备的配套应用软件。本应用的主要功能包括：① 通过蓝牙配网、AP 热点配网、快速配网等方式协助您完成设备联网配置与调试；② 通过局域网将照片传输到硬件设备；③「邮差」云端服务，包括会员注册与登录、设备绑定与群组管理、信箱信件（文字信、手写信、照片信、语音信、每日简报、个人待办等）的创建与云端投递、打印进度与回执推送；④ 由我们服务端提供的智能处理能力，如语音转文字、作业图片文字识别、图像风格化处理、AI 视频生成，以及在设备本地运行的图像处理（抠图、增强、智能裁剪）。请您在使用本应用前，仔细阅读并充分理解本隐私政策。

特别提示：本应用完整版包含上述云端服务与会员账号体系，在您主动注册或登录后，我们会处理您的手机号、会员资料（昵称、头像、性别、出生年月）以及您主动创建的信件内容。本应用同时支持「游客访问」模式；在游客模式下，我们不会收集您的手机号与会员资料。

本隐私政策适用于您在 iOS 设备、Android 设备上使用 MASF Tool 过程中，我们对相关信息的收集、使用、存储、保护、共享和删除等处理活动。

本隐私政策仅适用于 MASF Tool 本身，不适用于任何由第三方单独提供并向您另行说明隐私规则的产品或服务。

为了实现设备发现与联网配置、会员账号与登录、邮差信件投递与打印、以及您主动使用的智能处理功能，我们仅会处理实现相应功能所必需的信息：

2.1 您主动输入或确认的信息

信息类型	使用场景	使用目的
Wi‑Fi 名称（SSID）	设备联网配置	用于向目标设备写入待连接的无线网络名称
Wi‑Fi 密码	设备联网配置	用于向目标设备写入待连接的无线网络凭据。该密码仅通过蓝牙或热点通道下发给您指定的目标硬件设备，不会上传至我们的服务器
手机号	会员注册、登录，以及在个人资料页修改绑定手机号	用于创建和识别您的会员账号、完成登录校验与账号安全保护（如强制下线通知）。仅在您主动选择手机号注册/登录或主动修改手机号时收集；选择「游客访问」时不收集手机号
短信验证码	注册、登录、修改手机号	用于校验您对所持手机号的控制权，保障账号安全。验证码仅用于当次校验，不作为身份画像依据
会员资料：昵称、性别、出生年月	完善资料页、个人资料编辑页	用于生成您的会员展示信息、在信箱信件与群组中标识发件人身份，以及结合出生年月生成生日祝福类内容。上述资料均由您主动填写，可跳过或后续修改
头像图片	个人资料编辑页	用于在应用内及群组中展示您的个人形象。头像由您主动从相册选择或使用相机拍摄，经压缩后上传至我们的服务器存储
发件人名称	邮差信件寄出	用于在信件与打印结果上标注寄件人，保存在本地并在寄信时随信件内容提交
信件标题与正文内容	邮差信箱：文字信、手写信、个人待办、每日简报	用于生成信件、投递至目标打印机并保存在您的信箱中，以便您和同一设备群组的成员查阅与再次打印

上述信息均由您主动填写、选择或确认。其中手机号、短信验证码、会员资料与头像仅在您主动注册/登录或主动编辑个人资料时处理；Wi‑Fi 名称与密码仅用于完成当前设备的联网配置。

2.2 配网与设备连接过程中处理的信息

信息类型	使用场景	使用目的
蓝牙设备名称、蓝牙标识、连接状态	蓝牙扫描、设备发现、设备连接	识别可配网目标设备并建立连接
当前连接的 Wi‑Fi 名称（仅在系统授权和设备支持条件下）	配网界面预填充	帮助您快速确认当前无线网络名称，减少手动输入
配网状态信息、步骤结果、错误提示信息	蓝牙配网、AP 热点配网、快速配网、调试日志	展示配网进度、辅助排查连接异常
硬件设备信息：打印机设备 SN、设备型号与能力标识、固件版本	设备绑定、设备详情、固件升级	用于在您的手机与目标打印机之间建立绑定关系、匹配设备支持的功能能力、推送并展示固件升级进度
手机运行环境信息：操作系统名称与版本、应用版本号、当前网络类型（Wi‑Fi / 移动网络）	设备认证、消息推送通道建立	用于服务端签发访问凭证、判断设备在线状态、适配消息推送与问题排查
邮差群组成员信息：成员列表、成员昵称与头像、成员角色（持有人 / 管理员 / 普通成员）	邮差群组管理、信箱信件可见范围控制	用于展示可查阅同一台打印机信件的成员，并实现转让管理员、移除成员、"先审后打"等群组管理功能

2.3 云端服务中处理与上传的信息

「邮差」云端服务及相关智能处理功能由我们的服务端提供支持。当您主动使用相应功能时，以下内容会通过网络提交至我们的服务器处理：

信息类型	触发场景	处理方式与用途
语音录音	语音写信（按住录音）、个人待办语音录入、AI 视频生成语音描述	录音过程中音频数据实时提交至我们的语音识别服务转换为文字；语音写信场景下，完整录音文件还会上传至我们的文件存储服务，并在信件中以链接形式保留，供收件人通过信件上的二维码收听。个人待办与 AI 视频生成仅提交识别后的文字，不保留原始录音
图片：照片信图片、手写信画布图片、作业图片、喷墨拼图素材、AI 视频生成素材	您在对应功能中主动选择相册图片、拍照或完成手写绘制后点击提交	照片信、手写信与喷墨拼图素材上传至我们的文件存储服务并随信件或打印任务保存；作业图片上传至文字识别服务以提取题目文本（用于生成信件内容）；AI 视频生成素材上传至视频生成服务。端上图像处理（抠图、增强、智能裁剪）全部在您的设备本地完成，不上传服务器
日历日程信息：当日日程的标题、开始与结束时间、是否全天、地点	您主动点击「每日简报」生成入口并授予日历权限后	本应用仅读取当日日程，将其与天气信息一并整理为文本提交至我们的服务端，用于生成每日简报信件内容。本应用不读取历史或未来日程，不读取日历账号信息，不将日程用于其他目的
信件内容与打印状态	寄出信件、查看信箱、打印回执	信件标题、正文、图片与语音链接、寄件人名称、目标设备标识及打印状态保存在我们的服务器，用于投递信件、在您的信箱中展示历史记录、向群组内成员同步，并通过消息推送通道通知打印机出纸与回执

上述内容均仅在您主动触发对应功能时提交；本应用不会在后台自动上传您的照片、录音或日历数据。

2.4 本地存储的信息

为了提升使用体验与操作连续性，本应用会在您的设备本地保存以下信息：

• 账号与会话信息：会员标识、登录方式、昵称、头像链接、性别、出生年月、手机号（用于个人资料页回显），以及消息推送通道所需的连接凭证。上述信息保存在应用私有目录中，其他应用无法直接读取。
• 设备与配网信息：已绑定及历史连接的蓝牙设备名称、蓝牙 MAC 地址、设备 SN，以及最近使用的配网相关设置。这些信息按测试 / 生产环境分别保存，避免混淆。
• 偏好设置：应用语言、发件人名称、隐私政策同意状态、喷墨设备类型等基础偏好。
• 临时缓存文件：拍照与相册选择的图片副本、录音临时文件、手写信与信件配图、照片传输与拼图的中间文件、固件升级包等，保存在应用缓存目录，可由系统或您随时清理。

调试日志仅用于在应用内展示状态与排查异常，不会上传至我们的服务器。

2.5 网络访问相关说明

本应用在提供服务过程中，可能通过网络访问与配网功能相关的配置资源，例如设备名称前缀等辅助配置内容，以便更好地识别和匹配目标设备。在 AP 热点配网或快速配网场景中，本应用也会与待配网设备进行局域网或热点网络通信，以完成配网参数下发。照片传输功能通过局域网 UDP 广播发现设备并使用 TFTP 协议向设备推送照片，该过程不经过我们的服务器。登录后，本应用会与我们的服务端保持加密的消息推送长连接，用于接收打印进度、群组信件与设备状态变更等通知。

2.6 我们通常不会收集的信息

• 本应用不收集您的姓名、身份证号、银行账户、精确地理位置轨迹，也不收集您的通讯录、短信内容、通话记录，以及您设备上已安装应用的软件列表。
• 本应用自身代码不读取、不上传您手机自身的 Wi‑Fi MAC 地址。如本政策 2.8 所述，MQTT 通信组件在建立加密长连接时可能读取设备网络接口信息（含网络接口 MAC 地址），该处理由该组件内部完成，仅用于维持消息推送连接，我们不将其用于识别您个人、广告追踪或用户画像。
• 本应用不包含任何第三方统计分析、崩溃上报、广告或推送联盟 SDK，不会将您的信息用于广告展示、广告追踪或用户画像。
• 本应用不会在后台静默录音、静默拍照或静默读取日历；相关权限仅在您主动使用对应功能时申请和使用。

2.7 设备标识符、MAC 地址、传感器与网络信息

为实现设备绑定、配网、连接与打印消息推送功能，本应用会在下列场景中处理相应的设备与网络信息：

信息类型	使用目的	使用方式	收集范围
设备标识符（Android ID；在支持的设备上优先使用 MediaDrm 硬件设备标识）	生成设备唯一标识（设备 SN），用于设备绑定、登录状态维护与打印消息推送路由	在您同意本政策后，读取系统提供的设备标识并在本地生成设备 SN	仅在本应用内使用，不用于跨应用广告追踪或用户画像
会员标识与设备 SN 的绑定关系	识别哪一会员账号持有 / 绑定了哪一台打印机，实现信件投递、群组管理与登录状态恢复	在您登录或绑定设备时，由服务端保存会员标识与设备 SN 的对应关系；游客模式下仅保存游客标识与设备的关系，不涉及手机号	仅用于设备归属与信件路由，不用于跨应用追踪或用户画像
Wi-Fi 扫描结果中的路由器 MAC 地址（BSSID）与信号强度	在设备配网时识别周边无线网络环境，辅助目标设备接入正确的 Wi-Fi	仅在您主动发起配网且已授予位置权限时读取	仅用于当次配网流程，不作长期留存
蓝牙设备 MAC 地址与蓝牙设备名称	扫描、识别并连接目标打印机硬件设备	仅在您主动发起蓝牙扫描或连接且已授予蓝牙权限时读取	仅用于设备发现与连接
网络连接状态（是否联网、网络类型）	在网络恢复时维持或重连打印消息推送通道	通过系统网络状态回调监听连接可用性	仅判断网络是否可用，不读取通信内容
加速度传感器与光线传感器数据	在您主动使用扫码功能（扫码入群、设备绑定）时，识别设备旋转方向以自动调整扫码取景框，并根据环境光线判断是否提示开启闪光灯辅助扫码	仅在您主动进入扫码功能期间，由扫码组件（ZXing）在设备本地读取加速度传感器与光线传感器的数值	传感器数值仅在设备本地即时处理，用于方向与光线判断，不上传服务器、不与个人身份关联、不用于用户追踪或画像，也不用于计步、运动或位置推断

上述所有信息的收集与处理，均在您阅读并同意本隐私政策之后进行。在您同意之前，本应用不会读取设备标识符，不会进行 Wi-Fi 扫描或蓝牙扫描，也不会建立任何网络连接。

2.8 集成的第三方 SDK 目录

为实现网络通信、消息推送、扫码、图片与音视频处理、端上图像处理等功能，本应用集成了下列第三方 SDK。我们已对各 SDK 的信息处理行为进行约束，要求其仅在实现相应功能所必需的范围内处理信息：

SDK 名称	提供方	处理的信息	使用目的	处理方式
HiveMQ MQTT Client（内部集成 ReactiveX RxJava2 响应式框架与 Netty 网络框架）	HiveMQ GmbH	为建立与维持 MQTT 长连接，可能读取设备网络接口信息（含网络接口 MAC 地址）与网络连接状态	实现打印任务下发、打印进度与消息的实时推送	在您登录后建立加密网络连接时，由 SDK 内部处理
ONNX Runtime（onnxruntime-android）	Microsoft Corporation	不上传个人信息，仅在设备本地对您选择的图片进行模型推理	端上图像处理（抠图、增强、智能裁剪）	全部在设备本地运行，推理过程不上传服务器
OkHttp	Square, Inc.	网络请求地址、请求头与响应内容	与服务端进行接口通信（登录、设备绑定、内容同步）	通过 HTTPS 加密传输
Gson	Google Inc.	不收集个人信息，仅进行本地数据格式转换	JSON 数据的序列化与解析	本地处理，不联网
ZXing（zxing-android-embedded）	JourneyApps / ZXing 开源项目	相机画面、加速度传感器与光线传感器数据（仅在您主动扫码时；传感器用于自动适配取景方向与判断环境光线）	二维码扫描与生成（扫码入群、设备绑定），并据传感器数据自动调整扫码取景框方向、在光线不足时提示	本地处理，不上传服务器
Coil	Coil 开源项目	不收集个人信息，仅加载应用内或您选择的图片	图片加载与显示	本地处理
AndroidX Media3 / ExoPlayer	Google Inc.	不收集个人信息	音视频内容播放	本地处理
concentus（Opus 音频编解码库）	io.github.jaredmdobson（开源）	不收集个人信息，仅处理音频数据	音频的编码与解码	本地处理，不联网
喷墨打印渲染 SDK（com.sanzangcn.pencutsdk）	com.sanzangcn（第三方渲染 SDK）	不收集个人信息，仅处理您选择打印的图片位图	喷墨打印下发前的位图渲染	本地处理，不联网

2.9 我们自有的云端服务能力

除上述第三方 SDK 外，本应用的语音识别、作业图片文字识别、每日简报生成、待办拆解、图像风格化处理、AI 视频生成、文件存储与消息推送等能力，均由上海马斯夫物联科技有限公司自有服务端提供，不通过第三方 SDK 接入。相关数据仅用于实现您主动请求的对应功能，处理范围以完成该功能所必需为限，具体存储期限见本政策第五章，共享与委托处理规则见本政策第六章。

为了实现相应功能，本应用可能会申请以下系统权限。您可以根据系统提示选择是否授权；拒绝授权可能导致部分功能无法正常使用，但不影响其他不依赖该权限的功能。

权限	用途说明	拒绝授权后的影响
蓝牙权限	用于扫描附近可配网设备、识别设备、建立蓝牙连接并完成蓝牙配网。	无法使用蓝牙设备发现、蓝牙连接及蓝牙配网相关功能。
位置权限（Android）	本应用仅在以下两个用户主动触发的场景申请位置权限：① Android 11 及以下版本进入设备配网扫描页时（该版本系统将蓝牙扫描与位置权限强制关联）；② 用户在配网流程中主动点击“WiFi 列表扫描”图标时（Android 12+ 读取 WiFi 扫描结果与当前 WiFi 名称需位置权限）。Android 12 及以上版本的蓝牙扫描已声明 neverForLocation，进入配网页不再申请位置权限。本应用不将位置权限用于地图定位、轨迹追踪或导航。	在 Android 11 及以下版本可能无法扫描蓝牙设备；在 Android 12+ 上不影响蓝牙配网主流程，仅无法读取 WiFi 列表辅助配网，您仍可手动输入 WiFi 名称与密码完成配网。
网络访问	用于访问配网所需的辅助配置资源，并与目标设备进行热点或局域网通信。	可能无法完成设备联网配置、设备识别或相关状态同步。
相机权限	仅在您主动点击对应功能入口时申请，用于：① 扫描邮差群组二维码以加入群组或绑定设备；② 拍摄照片用于照片传输、照片信、喷墨打印、AI 视频生成素材；③ 拍摄头像；④ 拍摄作业图片以识别文字。拍照场景通过系统相机完成，本应用不读取您相册中的其他内容。	无法使用扫码、拍照及以拍摄方式创建内容的功能；您仍可从相册选择已有图片，或以手动输入等其他方式使用相关功能，设备配网与蓝牙打印不受影响。
相册 / 存储权限（照片与媒体文件读取）	用于在照片传输、照片信、喷墨拼图、喷墨打印、AI 视频生成、头像设置等功能中读取您主动选择的图片。本应用完整版使用应用内置的相册选择界面，因此需要该项权限才能列出并读取图片（Android 13 及以上申请「照片和视频」读取权限，Android 12 及以下申请存储读取权限）；在 Android 9 及以下设备上，将图片保存到相册还需要写入存储权限。	无法从相册选择图片，但您仍可使用拍照方式创建内容，设备配网、蓝牙连接与打印等核心功能不受影响。
麦克风 / 录音权限	仅在您主动使用语音功能时申请，用于：① 语音写信——录制您的语音并转换为信件文字，同时保留录音供收件人收听；② 个人待办语音录入——将语音转换为待办文本；③ AI 视频生成的语音描述输入。录音过程中音频实时提交至我们的语音识别服务，本应用不会在您未操作时录音，也不会在后台持续录音。	无法使用语音写信、语音录入待办与语音描述功能；您仍可通过键盘输入文字创建信件与待办，其他功能不受影响。
日历权限（读取日程）	仅在您主动点击「每日简报」相关入口时申请，用于读取您当日日程的标题、起止时间、是否全天与地点，据此生成每日简报信件内容。本应用不读取历史或未来日程，不写入、不修改、不删除您的任何日程，也不读取日历账号信息。	无法生成基于日程的每日简报；您仍可手动撰写信件，其他功能不受影响。
Wi-Fi 多播（照片传输功能）	用于在局域网中广播发现支持 TFTP 协议的 AI 硬件设备。	无法自动发现设备，但仍可手动输入 IP 地址进行照片传输。
传感器（加速度传感器 / 光线传感器）	由扫码组件在您主动扫码时使用：加速度传感器识别设备旋转方向以自动调整取景框，光线传感器判断环境光线以提示是否开启闪光灯。传感器数据仅在设备本地处理，不收集个人身份信息、不上传服务器、不用于追踪。	加速度与光线传感器属系统普通传感器，无需运行时授权弹窗；即使设备缺少相应传感器或其不可用，也仅影响扫码取景框的自动旋转与光线提示，不影响扫码识别这一主功能。

我们处理前述信息，主要用于以下目的：

1. 帮助您发现附近待配网设备，并建立蓝牙连接或热点连接。
2. 将您输入或确认的 Wi‑Fi 参数发送至目标设备，以完成联网配置。
3. 在照片传输功能中，通过局域网将您选择的照片推送到硬件设备。
4. 创建、登录和维护您的会员账号，建立手机号与会员标识、会员标识与设备之间的归属关系，并保障账号与设备安全（如账号在其他设备登录时的强制下线提醒）。
5. 实现邮差信件的创建、云端投递、群组内成员共享、打印下发与打印进度 / 回执推送。
6. 实现您主动使用的语音转文字、作业图片文字识别、每日简报生成、待办拆解、图像风格化处理与 AI 视频生成等功能。
7. 在应用内及群组中展示您的昵称与头像，便于成员识别信件寄件人身份。
8. 在应用界面中展示配网进度、结果信息和调试日志，辅助您完成操作或排查异常。
9. 缓存必要的本地配置项，以优化连续使用体验。
10. 履行法律法规规定的义务，维护、改进和保障本应用的安全稳定运行。

未经您的授权同意，我们不会将上述信息用于与实现本应用功能无关的用途，也不会将其用于广告展示、广告追踪或用户画像。

5.1 存储位置

您的偏好设置、账号会话信息、已绑定设备记录、发件人名称及各类临时缓存文件保存在您的本地设备应用私有目录中，其他应用无法直接读取。您的会员资料（手机号、昵称、头像、性别、出生年月）、邮差信件内容及其附带的图片与录音文件、群组成员关系，保存在我们位于中华人民共和国境内的服务器及配套的云端文件存储与消息推送服务中。我们不会将上述个人信息转移至境外存储或向境外主体提供；如后续因业务需要发生跨境传输，我们将依照法律法规的要求另行告知您并单独取得您的同意。

5.2 存储期限

我们仅在实现本隐私政策所述目的所必需的最短期限内保留相关信息：

• 会员账号信息（手机号、昵称、头像、性别、出生年月）：自您注册起保存，直至您注销账号或退出登录并申请删除。
• 邮差信件内容及其附带的图片、录音文件：保存至您或群组管理员主动删除该信件；信件删除后，对应的云端图片与录音文件随之删除。
• 设备绑定关系与打印记录：保存至您主动解绑相应设备。
• 为满足网络与账号安全要求、履行法律法规规定义务所必需的日志类信息，保留期限不超过法律法规要求的最短期限。
• 本地数据：您卸载本应用后，保存在设备本地的应用数据将被清除；您也可通过系统设置随时清理应用缓存和数据。

超出上述期限后，我们将对相关信息进行删除或匿名化处理。

5.3 安全措施

• 我们采取合理的管理和技术措施保护您的信息，避免未经授权的访问、使用或披露，包括访问权限最小化、账号凭证有效期管理与操作留痕。
• 客户端与服务端之间的接口通信采用 HTTPS 加密传输；打印消息推送通道采用 TLS 加密长连接，并对每次会话进行设备身份签名校验。
• 登录凭证以具备有效期的令牌形式保存，本应用不保存您的登录密码（本应用采用手机号加短信验证码方式登录，不设密码）。
• 调试日志仅在设备本地用于问题排查和状态展示，不上传至我们的服务器。
• 如发生个人信息安全事件，我们将按照法律法规要求及时告知您并向监管部门报告。

我们不会出售、出租您的个人信息，也不会在未经您同意的情况下向无关第三方共享您的信息。仅在以下情形下，我们可能依据法律法规或服务需要进行必要处理：

1. 根据您的明确授权或主动请求进行处理。
2. 根据法律法规、司法机关或行政机关的要求提供。
3. 为实现设备配网所必需，在您的操作触发下与目标硬件设备进行数据通信。
4. 邮差群组成员之间的必要披露：您寄出的信件标题、正文、附带图片与录音、寄件人昵称与头像，以及打印状态，对绑定同一台打印机的群组成员可见。您可通过退出群组、解除设备绑定或删除信件来终止相应的可见范围。请在寄信前确认内容适合向群组成员展示。
5. 委托处理：为实现短信验证码下发、云端文件存储、消息推送与智能处理等功能，我们可能委托具备相应安全能力的服务提供商处理必要信息。我们会通过协议约定其处理目的、期限、方式与安全义务，要求其仅在受托范围内处理，不得超范围使用或另行提供。
6. 在涉及合并、收购、资产转让或破产清算时，如发生个人信息转让，我们会要求新的持有方继续受本政策约束，否则将要求其重新取得您的授权同意。

除上述情形外，我们不会向任何第三方共享、转让或公开披露您的个人信息。

在适用法律法规规定的范围内，您对相关信息享有查阅、复制、更正、补充、删除以及撤回同意等权利，并可通过下列方式行使：

• 查阅与更正：您可在应用内「个人资料编辑」页面查阅并修改您的昵称、头像、性别、出生年月与绑定手机号（修改手机号需通过短信验证码校验）。
• 删除：您可在邮差信箱中删除单条信件，删除后其云端内容、图片与录音随之删除；您可移除群组成员或退出群组，以终止信件在该群组内的可见范围。
• 解除绑定：您可在设备管理中解除手机与打印机的绑定关系，并可在「登录设备管理」中将其他设备强制下线。
• 退出登录：您可在设置页退出当前会员账号，退出后本地保存的账号资料与会话信息将被清除；本应用亦支持以游客模式继续使用不依赖账号的功能。
• 注销账号：您可通过本政策末尾的联系邮箱提交账号注销申请。注销后，我们将删除或匿名化处理您的手机号、会员资料及与您账号关联的信件内容，法律法规另有规定的除外。
• 撤回同意：您可以通过系统设置随时开启或关闭蓝牙、位置、相机、相册、麦克风、日历等权限。撤回同意不影响撤回前基于您的同意已进行的处理，且仅影响依赖该权限的功能，不影响其他功能的正常使用。
• 停止处理与卸载：您可以停止输入 Wi‑Fi 信息、停止配网流程，或卸载本应用以终止后续信息处理并清除本地数据。
• 获取副本与投诉：如需获取您的个人信息副本，或认为我们的信息处理行为损害了您的合法权益，您可通过本政策末尾的联系方式与我们联系，也可向有关监管部门投诉。我们将在收到您的请求后尽快核实并处理，通常在十五个工作日内答复。

我们高度重视未成年人个人信息的保护。本应用面向家庭场景使用，主要服务对象为成年人；但邮差功能中存在由监护人为未成年子女（包括不满十四周岁的儿童）填写昵称、性别、出生年月等资料以完成会员注册与设备绑定的使用场景。为此我们作出如下特别约定：

• 监护人同意：若您是未成年人，请在监护人的陪同和指导下阅读本隐私政策并使用本应用。若您是监护人，在为儿童填写资料、创建或寄出信件、上传照片与录音之前，请仔细阅读本隐私政策并确认同意；您点击同意或主动填写并提交儿童资料，即视为您已同意我们在本政策所述范围内处理该儿童的个人信息。
• 最小必要：我们仅在实现信件寄出、寄件人标识、生日与纪念日祝福类内容生成所必需的最小范围内处理儿童的昵称、性别与出生年月，不会收集儿童的身份证件号码、住址、就读学校、精确地理位置或通讯录信息，也不会将儿童信息用于广告展示、广告追踪或用户画像。
• 可见范围提示：儿童作为寄件人或收件人参与的信件，对绑定同一台打印机的群组成员可见。请监护人在寄信前确认信件文字、照片与录音内容适合向群组成员展示。
• 监护人权利：监护人可随时在「个人资料编辑」页面查阅、更正儿童的昵称、性别与出生年月，删除相关信件，或通过本政策末尾的联系邮箱申请删除儿童个人信息、注销账号。我们将在核实监护人身份后尽快处理。
• 误收集的处理：如我们发现在未取得可证实的监护人同意的情况下收集了儿童的个人信息，将设法尽快删除相关数据。
• 如监护人对我们处理儿童个人信息的方式有任何疑问、意见或投诉，可通过本政策末尾的联系方式与我们联系。

我们可能根据产品功能变化、法律法规要求或业务调整适时修订本隐私政策。更新后的隐私政策将在相关页面发布，并自公布之日起生效。若变更内容涉及您的重大权益，我们会通过适当方式提示您关注。

如果您对本隐私政策有疑问、意见、建议，或希望就相关信息处理事项与我们沟通，请通过以下方式联系我们：

• 公司名称：上海马斯夫物联科技有限公司
• 联系邮箱：jarvis@kymasf.com
• 联系地址：上海市青浦区夏阳街道盈港东路8900弄南浔（青浦）人才科创中心1902室

我们将在收到您的反馈后尽快处理并回复。

Welcome to MASF Tool (the "App"). This App is developed and operated by Shanghai MASF IoT Technology Co., Ltd. ("we", "us", or "our"). We understand the importance of personal information and device-related data and will process relevant information in a lawful, proper, necessary, and good-faith manner.

MASF Tool is a companion application for hardware devices such as AI printers, label printers, and inkjet printers. Its main functions are: (1) helping you configure and debug device connectivity through Bluetooth provisioning, AP hotspot provisioning, and quick provisioning; (2) transferring photos to hardware devices over a local network; (3) the "Mail" cloud service, including member registration and login, device binding and group management, creation and cloud delivery of mailbox letters (text, handwriting, photo, voice, daily briefing, personal to-do, etc.), and push notifications for printing progress and receipts; and (4) intelligent processing capabilities provided by our servers, such as speech-to-text, homework image text recognition, image stylization, and AI video generation, as well as image processing that runs locally on your device (cut-out, enhancement, smart cropping). Please read and fully understand this Privacy Policy before using the App.

Important notice: this full version of the App includes the cloud services and member account system described above. After you actively register or log in, we process your mobile phone number, member profile (nickname, avatar, gender, year and month of birth), and the letter content you actively create. The App also supports a "Guest access" mode; in guest mode we do not collect your mobile phone number or member profile.

This Privacy Policy applies to our collection, use, storage, protection, sharing, and deletion of relevant information when you use MASF Tool on iOS and Android devices.

This Privacy Policy applies only to MASF Tool itself and does not apply to any third-party products or services that provide their own separate privacy notices.

To provide device discovery and network configuration, member accounts and login, Mail letter delivery and printing, and the intelligent processing features you actively use, we only process information that is necessary for the corresponding function.

2.1 Information You Provide or Confirm

Information Type	Scenario	Purpose
Wi‑Fi Name (SSID)	Device Network Configuration	Used to write the target wireless network name to the device being configured
Wi‑Fi Password	Device Network Configuration	Used to write the wireless network credentials to the device being configured. The password is delivered only to the target hardware device you designate, over Bluetooth or a hotspot channel, and is never uploaded to our servers
Mobile phone number	Member registration and login, and changing the bound phone number on the profile editing page	Used to create and identify your member account, verify login, and protect account security (such as forced-logout notifications). Collected only when you actively choose phone-number registration/login or actively change your phone number; not collected if you choose "Guest access"
SMS verification code	Registration, login, phone number change	Used to verify that you control the phone number and to protect account security. The code is used only for that verification and is not used for profiling
Member profile: nickname, gender, year and month of birth	Profile completion page, profile editing page	Used to generate your member display information, identify the sender in mailbox letters and groups, and generate birthday-greeting content based on the birth date. All of these are entered by you voluntarily and may be skipped or changed later
Avatar image	Profile editing page	Used to display your personal image in the App and in groups. The avatar is chosen from your photo library or captured with the camera by you, compressed, and then uploaded to our servers for storage
Sender name	Sending a Mail letter	Used to mark the sender on the letter and on the printed output; stored locally and submitted together with the letter content when sending
Letter title and body content	Mail mailbox: text letter, handwriting letter, personal to-do, daily briefing	Used to generate the letter, deliver it to the target printer, and keep it in your mailbox so that you and members of the same device group can view and print it again

All of the information above is entered, selected, or confirmed by you. The mobile phone number, SMS verification code, member profile, and avatar are processed only when you actively register/log in or actively edit your profile; the Wi‑Fi name and password are used only to complete network configuration for the current device.

2.2 Information Processed During Provisioning and Device Connection

Information Type	Scenario	Purpose
Bluetooth device name, Bluetooth identifier, connection status	Bluetooth scanning, device discovery, device connection	Used to identify target devices and establish connections
Current connected Wi‑Fi name, subject to system permission and device support	Prefilling provisioning screens	Helps you confirm the current wireless network name and reduce manual input
Provisioning status, step results, error messages	Bluetooth provisioning, AP hotspot provisioning, quick provisioning, debug logs	Used to display progress and assist with troubleshooting connection issues
Hardware device information: printer device SN, device model and capability identifiers, firmware version	Device binding, device details, firmware upgrade	Used to establish the binding between your phone and the target printer, match the capabilities supported by the device, and push and display firmware upgrade progress
Phone runtime environment: operating system name and version, App version, current network type (Wi‑Fi / cellular)	Device authentication, establishing the message push channel	Used by the server to issue access credentials, determine device online status, and adapt message push and troubleshooting
Mail group member information: member list, member nicknames and avatars, member roles (owner / administrator / regular member)	Mail group management, controlling mailbox letter visibility	Used to show which members can view letters for the same printer, and to enable group management such as transferring administrator rights, removing members, and "review before printing"

2.3 Information Processed and Uploaded by Cloud Services

The "Mail" cloud service and the related intelligent processing features are powered by our servers. When you actively use the corresponding feature, the following content is submitted to our servers over the network:

Information Type	Trigger	Processing and Purpose
Voice recordings	Voice letter (press and hold to record), voice input for personal to-do, voice description for AI video generation	During recording, audio data is streamed in real time to our speech recognition service to be converted into text. In the voice letter scenario, the complete audio file is also uploaded to our file storage service and kept as a link within the letter so that the recipient can listen to it via the QR code printed on the letter. Personal to-do and AI video generation submit only the recognized text and do not retain the original recording
Images: photo letter images, handwriting canvas images, homework images, inkjet collage materials, AI video generation materials	After you actively select a photo library image, take a photo, or finish a handwriting drawing in the corresponding feature and tap submit	Photo letter, handwriting letter, and inkjet collage materials are uploaded to our file storage service and retained with the letter or print task; homework images are uploaded to the text recognition service to extract the question text used to generate the letter content; AI video generation materials are uploaded to the video generation service. On-device image processing (cut-out, enhancement, smart cropping) runs entirely on your device and is not uploaded
Calendar event information: title, start and end time, all-day flag, and location of the current day's events	After you actively tap the "Daily Briefing" entry and grant calendar permission	The App reads only the current day's events, combines them with weather information into text, and submits it to our server to generate the daily briefing letter content. The App does not read past or future events, does not read calendar account information, and does not use your events for any other purpose
Letter content and print status	Sending a letter, viewing the mailbox, print receipts	The letter title, body, image and audio links, sender name, target device identifier, and print status are stored on our servers to deliver the letter, display history in your mailbox, synchronize with group members, and notify the printer to feed paper and return receipts through the message push channel

All of the above content is submitted only when you actively trigger the corresponding feature; the App never uploads your photos, recordings, or calendar data automatically in the background.

2.4 Information Stored Locally

To improve the user experience and workflow continuity, the App stores the following information locally on your device:

• Account and session information: member identifier, login type, nickname, avatar URL, gender, year and month of birth, mobile phone number (used to redisplay your profile page), and the connection credentials required by the message push channel. This information is kept in the App's private directory and cannot be read directly by other apps.
• Device and provisioning information: names, Bluetooth MAC addresses, and device SNs of bound and previously connected Bluetooth devices, as well as recently used provisioning settings. This information is stored separately per test / production environment to avoid mixing.
• Preferences: App language, sender name, privacy policy consent status, inkjet device type, and other basic preferences.
• Temporary cache files: copies of photos taken or selected from the library, temporary recording files, handwriting and letter images, intermediate files for photo transfer and collage, firmware packages, etc. These are stored in the App cache directory and can be cleared by the system or by you at any time.

Debug logs are used only to display status within the App and to assist troubleshooting; they are not uploaded to our servers.

2.5 Network Access

During operation, the App may access network-based resources related to provisioning, such as auxiliary configuration content used to identify and match target devices, including device name prefixes. In AP hotspot provisioning or quick provisioning scenarios, the App may also communicate with the target device over a local network or hotspot network to deliver provisioning parameters. The photo transfer feature discovers devices via UDP broadcast on the local network and pushes photos to the device using the TFTP protocol; this process does not pass through our servers. After login, the App maintains an encrypted message push connection with our servers to receive notifications such as printing progress, group letters, and device status changes.

2.6 Information We Generally Do Not Collect

• The App does not collect your name, government ID number, bank account, precise geographic location trail, contacts, SMS content, call logs, or the list of applications installed on your device.
• The App's own code does not read or upload your phone's Wi‑Fi MAC address. As described in Section 2.8 of this Policy, the MQTT communication component may read device network interface information (including the network interface MAC address) when establishing its encrypted persistent connection; that processing happens inside the component and is used only to maintain the message push connection. We do not use it to identify you personally, for ad tracking, or for user profiling.
• The App contains no third-party analytics, crash reporting, advertising, or push-alliance SDK, and does not use your information for ad display, ad tracking, or user profiling.
• The App never records audio, takes photos, or reads your calendar silently in the background; these permissions are requested and used only when you actively use the corresponding feature.

2.7 Device Identifiers, MAC Addresses, Sensors, and Network Information

To provide device binding, provisioning, connection, and print message push functions, the App processes the following device and network information in the corresponding scenarios:

Information Type	Purpose	Method	Scope
Device identifier (Android ID; on supported devices the MediaDrm hardware device ID is preferred)	To generate a unique device identifier (device SN) for device binding, login session maintenance, and print message routing	After you accept this Policy, the App reads the system-provided device identifier and generates the device SN locally	Used only within this App; not used for cross-app advertising tracking or user profiling
Binding relationship between the member identifier and the device SN	To identify which member account owns or has bound which printer, enabling letter delivery, group management, and login session restoration	When you log in or bind a device, the server stores the mapping between the member identifier and the device SN. In guest mode, only the mapping between a guest identifier and the device is stored, with no phone number involved	Used only for device ownership and letter routing; not used for cross-app tracking or user profiling
Router MAC address (BSSID) and signal strength from Wi-Fi scan results	To identify the surrounding wireless environment during provisioning and help the target device join the correct Wi-Fi	Read only when you actively initiate provisioning and have granted location permission	Used only for the current provisioning session; not retained long term
Bluetooth device MAC address and Bluetooth device name	To scan for, identify, and connect to target printer hardware	Read only when you actively initiate a Bluetooth scan or connection and have granted Bluetooth permission	Used only for device discovery and connection
Network connection status (whether online, network type)	To maintain or reconnect the print message push channel when the network recovers	Monitored via the system network status callback	Used only to determine network availability; communication content is not read
Accelerometer and ambient light sensor data	When you actively use the code-scanning feature (scan to join a group, device binding), to detect device rotation and automatically adjust the scanning viewfinder, and to assess ambient light to decide whether to prompt you to turn on the flashlight	Read locally on the device by the scanning component (ZXing) only while you are actively in the code-scanning feature	Sensor values are processed locally and in real time only for orientation and light detection; they are not uploaded to any server, not linked to personal identity, not used for tracking or profiling, and not used for step counting, motion, or location inference

All of the above information is collected and processed only after you have read and accepted this Privacy Policy. Before you accept, the App does not read device identifiers, does not perform Wi-Fi or Bluetooth scanning, and does not establish any network connection.

2.8 Third-Party SDK Catalog

To provide network communication, message push, code scanning, image/audio-video processing, and on-device image processing, the App integrates the following third-party SDKs. We have imposed constraints on each SDK and require them to process information only to the extent necessary for the relevant function:

SDK Name	Provider	Information Processed	Purpose	Processing Method
HiveMQ MQTT Client (integrates the ReactiveX RxJava2 framework and the Netty network framework)	HiveMQ GmbH	To establish and maintain the MQTT connection, it may read device network interface information (including the network interface MAC address) and network connection status	To deliver print tasks and push print progress and messages in real time	Processed internally by the SDK when an encrypted network connection is established after you log in
ONNX Runtime (onnxruntime-android)	Microsoft Corporation	No personal information uploaded; performs on-device model inference only on the image you select	On-device image processing (matting, enhancement, smart crop)	Runs entirely on the device; inference is not uploaded to any server
OkHttp	Square, Inc.	Network request address, request headers, and response content	Interface communication with the server (login, device binding, content sync)	Transmitted over encrypted HTTPS
Gson	Google Inc.	No personal information; local data format conversion only	JSON serialization and parsing	Local processing, no network
ZXing (zxing-android-embedded)	JourneyApps / ZXing open-source project	Camera frames, accelerometer and ambient light sensor data (only when you actively scan a code; the sensors are used to auto-adjust the viewfinder orientation and detect ambient light)	QR code scanning and generation (scan to join a group, device binding), and using sensor data to auto-adjust the viewfinder orientation and prompt for low light	Local processing, not uploaded
Coil	Coil open-source project	No personal information; loads only in-app or user-selected images	Image loading and display	Local processing
AndroidX Media3 / ExoPlayer	Google Inc.	No personal information	Audio and video playback	Local processing
concentus (Opus audio codec)	io.github.jaredmdobson (open source)	No personal information; processes audio data only	Audio encoding and decoding	Local processing, no network
Inkjet print rendering SDK (com.sanzangcn.pencutsdk)	com.sanzangcn (third-party rendering SDK)	No personal information; processes only the image bitmap you select for printing	Bitmap rendering before inkjet print delivery	Local processing, no network

2.9 Our Own Cloud Service Capabilities

In addition to the third-party SDKs listed above, the speech recognition, homework image text recognition, daily briefing generation, to-do decomposition, image stylization, AI video generation, file storage, and message push capabilities of this App are all provided by the servers of Shanghai MASF IoT Technology Co., Ltd. itself and are not accessed through any third-party SDK. The relevant data is used only to deliver the corresponding feature that you actively request, limited to what is necessary to complete that feature. Retention periods are described in Chapter 5, and the rules on sharing and entrusted processing are described in Chapter 6.

To provide relevant functions, the App may request the following system permissions. You may choose whether to grant them based on system prompts. Refusing permission may prevent certain functions from working properly, but will not affect other functions that do not depend on that permission.

Permission	Purpose	Impact if Denied
Bluetooth	Used to scan nearby devices, identify target devices, establish Bluetooth connections, and complete Bluetooth provisioning.	Bluetooth device discovery, Bluetooth connection, and Bluetooth provisioning features may not work.
Location (Android)	The App requests location permission only in the following two user-initiated scenarios: (1) When entering the device provisioning scan page on Android 11 or lower (where the OS mandates location permission for Bluetooth scanning); (2) When the user actively taps the "Wi-Fi list scan" button during provisioning (Android 12+ requires location permission to read Wi-Fi scan results and the current Wi-Fi name). On Android 12 and above, Bluetooth scanning is declared with neverForLocation, so entering the provisioning page no longer requests location permission. This permission is never used for mapping, tracking, or navigation.	On Android 11 or lower, Bluetooth device scanning may fail; on Android 12+, the main Bluetooth provisioning flow is unaffected — only the Wi-Fi list assistant is unavailable, and you can still manually enter the Wi-Fi SSID and password to complete provisioning.
Network Access	Used to access auxiliary provisioning resources and communicate with target devices over hotspot or local networks.	Device network configuration, device identification, or related status synchronization may not work properly.
Camera	Requested only when you actively tap the corresponding entry, and used to: (1) scan Mail group QR codes to join a group or bind a device; (2) capture photos for photo transfer, photo letters, inkjet printing, and AI video generation materials; (3) capture an avatar; (4) capture homework images for text recognition. Photo capture is handled by the system camera; the App does not read other content in your photo library through this permission.	Code scanning, photo capture, and content creation by camera will not work. You can still select existing images from your photo library or use other input methods, and device provisioning and Bluetooth printing are unaffected.
Photo Library / Storage (photo and media file access)	Used to read the images you actively select in photo transfer, photo letters, inkjet collage, inkjet printing, AI video generation, and avatar settings. This full version of the App uses a built-in photo library picker, so this permission is required to list and read images (on Android 13 and above, "Photos and videos" access is requested; on Android 12 and below, storage read access is requested). On Android 9 and below, saving images to the photo library also requires storage write access.	You will not be able to select images from the photo library, but you can still create content by taking photos, and core functions such as device provisioning, Bluetooth connection, and printing are unaffected.
Microphone / Recording	Requested only when you actively use a voice feature, and used to: (1) voice letters — record your voice and convert it into letter text, while retaining the recording for the recipient to listen to; (2) voice input for personal to-dos — convert speech into to-do text; (3) voice description input for AI video generation. During recording, audio is streamed in real time to our speech recognition service. The App never records audio when you are not operating it and never records continuously in the background.	Voice letters, voice to-do input, and voice description features will not work. You can still type text to create letters and to-dos, and other features are unaffected.
Calendar (read events)	Requested only when you actively tap a "Daily Briefing" entry, and used to read the title, start and end time, all-day flag, and location of your events for the current day in order to generate the daily briefing letter content. The App does not read past or future events, does not write, modify, or delete any of your events, and does not read calendar account information.	Calendar-based daily briefings cannot be generated. You can still write letters manually, and other features are unaffected.
Wi-Fi Multicast (Photo Transfer)	Used to broadcast and discover AI hardware devices that support the TFTP protocol on the local network.	Automatic device discovery will not work, but you can still manually enter an IP address for photo transfer.
Sensors (Accelerometer / Ambient Light)	Used by the scanning component only when you actively scan a code: the accelerometer detects device rotation to auto-adjust the viewfinder, and the light sensor assesses ambient light to prompt whether to turn on the flashlight. Sensor data is processed locally on the device only; no personal identity information is collected, nothing is uploaded to any server, and it is not used for tracking.	The accelerometer and ambient light sensor are ordinary system sensors that require no runtime permission dialog; even if the device lacks them or they are unavailable, only the auto-rotation of the scanning viewfinder and the light prompt are affected — the core code-scanning function still works.

We process the information described above mainly for the following purposes:

1. To help you discover nearby devices and establish Bluetooth or hotspot connections.
2. To send the Wi‑Fi parameters you enter or confirm to the target device in order to complete network configuration.
3. In the photo transfer feature, to push your selected photos to hardware devices over the local network.
4. To create, log in to, and maintain your member account, establish the ownership relationship between your phone number and member identifier and between the member identifier and devices, and protect account and device security (such as forced-logout notifications when your account logs in on another device).
5. To enable the creation, cloud delivery, sharing among group members, print dispatch, and printing progress / receipt push of Mail letters.
6. To provide the features you actively use, such as speech-to-text, homework image text recognition, daily briefing generation, to-do decomposition, image stylization, and AI video generation.
7. To display your nickname and avatar in the App and in groups so that members can identify the sender of a letter.
8. To display provisioning progress, result information, and debug logs in the App to assist with operation and troubleshooting.
9. To cache necessary local settings and improve continuity of use.
10. To comply with obligations under applicable laws and regulations, and to maintain, improve, and support the secure and stable operation of the App.

Without your authorization or consent, we will not use the information described above for purposes unrelated to providing the functions of this App, nor for ad display, ad tracking, or user profiling.

5.1 Storage Location

Your preferences, account session information, bound device records, sender name, and various temporary cache files are stored in the App's private directory on your local device and cannot be read directly by other apps. Your member profile (mobile phone number, nickname, avatar, gender, year and month of birth), Mail letter content together with its attached images and recordings, and group member relationships are stored on our servers located within the People's Republic of China, together with the associated cloud file storage and message push services. We do not transfer the above personal information to storage outside China or provide it to overseas entities. If cross-border transfer becomes necessary for business reasons in the future, we will notify you separately and obtain your separate consent in accordance with applicable laws and regulations.

5.2 Retention Period

We retain relevant information only for the minimum period necessary to fulfill the purposes described in this Privacy Policy:

• Member account information (mobile phone number, nickname, avatar, gender, year and month of birth): retained from registration until you deactivate your account or log out and request deletion.
• Mail letter content and its attached images and audio files: retained until you or a group administrator actively deletes the letter; when the letter is deleted, the corresponding cloud image and audio files are deleted as well.
• Device binding relationships and print records: retained until you actively unbind the device.
• Log-type information necessary to meet network and account security requirements and to comply with legal obligations: retained for no longer than the minimum period required by applicable laws and regulations.
• Local data: after you uninstall the App, the App data stored on your device is removed. You may also clear the App cache and data at any time through system settings.

Beyond the periods described above, we will delete or anonymize the relevant information.

5.3 Security Measures

• We take reasonable management and technical measures to protect your information against unauthorized access, use, or disclosure, including least-privilege access, credential validity management, and operation logging.
• API communication between the client and our servers uses HTTPS encryption; the print message push channel uses a TLS-encrypted persistent connection with per-session device identity signature verification.
• Login credentials are stored as tokens with a validity period. The App does not store a login password (the App uses mobile phone number plus SMS verification code and has no password).
• Debug logs are used locally on the device only, for troubleshooting and status display, and are not uploaded to our servers.
• In the event of a personal information security incident, we will promptly notify you and report to the competent authorities as required by applicable laws and regulations.

We do not sell or rent your personal information, and we do not share your information with unrelated third parties without your consent. We may process or disclose information only when necessary under the following circumstances:

1. Where processing is based on your explicit authorization or active request.
2. Where required by applicable laws, regulations, judicial authorities, or administrative authorities.
3. Where data communication with the target hardware device is required to complete device provisioning based on your actions.
4. Necessary disclosure among Mail group members: the title, body, attached images and recordings, sender nickname and avatar, and print status of a letter you send are visible to members of the group bound to the same printer. You can end the corresponding visibility by leaving the group, unbinding the device, or deleting the letter. Please confirm before sending that the content is suitable for display to group members.
5. Entrusted processing: to provide SMS verification code delivery, cloud file storage, message push, and intelligent processing, we may entrust service providers with adequate security capabilities to process the necessary information. We bind them by agreement to the processing purpose, period, method, and security obligations, and require them to process only within the entrusted scope and not to use or provide the information beyond it.
6. In the event of a merger, acquisition, asset transfer, or bankruptcy liquidation involving a transfer of personal information, we will require the new holder to remain bound by this Privacy Policy; otherwise we will require it to obtain your authorization and consent again.

Apart from the circumstances above, we will not share, transfer, or publicly disclose your personal information to any third party.

To the extent provided by applicable laws and regulations, you have the rights to access, copy, correct, supplement, and delete your information and to withdraw consent, and you may exercise them as follows:

• Access and correction: you may view and modify your nickname, avatar, gender, year and month of birth, and bound mobile phone number on the in-app "Profile Edit" page (changing the phone number requires SMS verification).
• Deletion: you may delete individual letters in the Mail mailbox; after deletion, the cloud content, images, and recordings of that letter are deleted as well. You may remove group members or leave a group to end the visibility of letters within that group.
• Unbinding: you may unbind your phone from a printer in device management, and force other devices offline in "Login Device Management".
• Logging out: you may log out of the current member account on the settings page; after logging out, the account profile and session information stored locally are cleared. The App also supports continuing to use account-independent features in guest mode.
• Account deactivation: you may submit an account deactivation request via the contact email at the end of this Privacy Policy. After deactivation, we will delete or anonymize your mobile phone number, member profile, and the letter content associated with your account, except where otherwise required by applicable laws and regulations.
• Withdrawing consent: you may enable or disable Bluetooth, location, camera, photo library, microphone, calendar, and other permissions at any time through system settings. Withdrawing consent does not affect processing already carried out based on your prior consent, and affects only the features that depend on that permission, without affecting the normal use of other features.
• Stopping processing and uninstalling: you may stop entering Wi‑Fi information, stop the provisioning process, or uninstall the App to terminate subsequent processing and clear local data.
• Copies and complaints: to obtain a copy of your personal information, or if you believe our information handling has infringed your lawful rights and interests, you may contact us using the details at the end of this Policy, or file a complaint with the competent authorities. We will verify and handle your request promptly and normally respond within fifteen working days.

We attach great importance to the protection of minors' personal information. The App is intended for family scenarios and its primary users are adults; however, the Mail feature includes a scenario in which a guardian fills in a minor child's (including a child under the age of fourteen) nickname, gender, and year and month of birth in order to complete member registration and device binding. We therefore make the following specific commitments:

• Guardian consent: if you are a minor, please read this Privacy Policy and use the App under the supervision and guidance of a guardian. If you are a guardian, please read this Privacy Policy carefully and confirm your consent before filling in a child's information, creating or sending letters, or uploading photos and recordings. By tapping consent, or by actively filling in and submitting a child's information, you are deemed to have agreed that we process that child's personal information within the scope described in this Privacy Policy.
• Data minimization: we process a child's nickname, gender, and year and month of birth only to the minimum extent necessary to send letters, identify the sender, and generate birthday and anniversary greeting content. We do not collect a child's government ID number, home address, school, precise geographic location, or contacts, and we do not use children's information for ad display, ad tracking, or user profiling.
• Visibility notice: letters in which a child participates as sender or recipient are visible to the members of the group bound to the same printer. Guardians should confirm before sending that the letter text, photos, and recordings are suitable for display to group members.
• Guardian rights: a guardian may at any time view and correct the child's nickname, gender, and year and month of birth on the "Profile Edit" page, delete relevant letters, or request deletion of the child's personal information or account deactivation via the contact email at the end of this Privacy Policy. We will handle such requests promptly after verifying the guardian's identity.
• Inadvertent collection: if we discover that a child's personal information has been collected without verifiable guardian consent, we will seek to delete the relevant data as soon as possible.
• If a guardian has any questions, comments, or complaints about how we process a child's personal information, please contact us using the details at the end of this Policy.

We may revise this Privacy Policy from time to time based on product feature changes, legal or regulatory requirements, or business adjustments. The updated Privacy Policy will be published on the relevant page and will take effect upon publication. If a change materially affects your rights, we will provide appropriate notice.

If you have any questions, comments, suggestions, or requests regarding this Privacy Policy or related information handling matters, please contact us through the following channels:

• Company: Shanghai MASF IoT Technology Co., Ltd.
• Email: jarvis@kymasf.com
• Address: Room 1902, Nanxun (Qingpu) Talent Innovation Center, Lane 8900 Yinggang East Road, Xiayang Subdistrict, Qingpu District, Shanghai, China

We will review and respond to your request as soon as reasonably practicable after receiving it.