Tenon 账号隐私说明

处理哪些信息 / Information we process

Tenon 账号处理邮箱、称呼、邮箱验证状态、密码凭据、登录会话及登录安全所需的记录。密码由认证库哈希处理。使用 GitHub、Google 或 Apple 登录时，我们请求基本身份信息（标识、邮箱以及提供商返回的姓名），不请求邮件、云盘或通讯录的访问权限。

Tenon Account processes your email, display name, verification status, password credentials, sessions and records needed for login security. Passwords are hashed by the authentication library. GitHub, Google and Apple sign-in request basic identity information, such as identifiers, email and the name returned by the provider. We do not request access to your inbox, cloud drive or contacts.

如何使用 / How we use it

这些信息用于注册、身份验证、账号恢复、明确授权的身份绑定和安全管理。验证及密码重置邮件通过腾讯云 SES 发送。我们不会因为邮箱相同而自动合并账号；绑定其他登录方式需要验证双方身份。

We use this information for registration, authentication, recovery, explicitly requested identity linking and security. Verification and password reset messages are sent through Tencent Cloud SES. Matching email addresses do not automatically merge accounts. Linking requires proof of both identities.

子产品获取什么 / What products receive

在登录授权过程中，Tenon 子产品可获得稳定的用户标识、称呼、邮箱验证信息，以及适用的中央权限声明。产品自行管理业务数据和本地会话。统一身份不会赋予 Tenon 管理员读取用户密码本或解密私有数据的能力。

During an authorized login, Tenon products can receive your stable user identifier, display name, email verification information and applicable central role claims. Each product manages its own business data and local session. A shared identity does not give Tenon administrators access to your password vault or the ability to decrypt private data.

存储与安全 / Storage and security

账号服务部署在 Tenon 管理的服务器上，使用 HTTPS 和仅限账号域名的安全 Cookie。必要的账号、绑定和安全记录在服务运行期间保存；提供商令牌采用认证库的加密存储。密码本、CloudKit 与产品数据不存储在中央账号数据库中。

The account service runs on servers managed by Tenon and uses HTTPS and secure cookies restricted to the account domain. Necessary account, linking and security records are retained while the service operates. Provider tokens use encrypted storage provided by the authentication library. Vaults, CloudKit and product data are not stored in the central account database.

删除账号 / Account deletion

你可以直接进入删除 Tenon 账号页面，重新确认身份并二次确认后自助删除，无需发送邮件。删除会移除运行中的中央身份、密码和已绑定的登录凭据、Tenon 登录会话，以及该身份的产品授权。此身份之后无法再用于任何 Tenon 产品登录。各产品的独立会话和业务数据由产品管理，不会因中央网页操作而保证同时退出或全部删除。

Open Delete your Tenon account directly, verify your identity again and explicitly confirm deletion. No email request is required. Deletion removes the active central identity, password and linked sign-in credentials, Tenon sessions and product authorizations for that identity. It can no longer sign in to Tenon products. Each product manages its own sessions and business data; the central web action does not guarantee that all products sign out or delete their data simultaneously.

绑定 Apple 登录时，服务会撤销已保存的 Apple 令牌；如果缺少可撤销的令牌，仍会删除中央账号，并提示你在 Apple 账号中手动撤销授权。Tenon 不存储或解密你的密码本、恢复密钥或 CloudKit 私有数据，也不会代替你删除这些内容。请在相应产品中管理或删除产品数据。

For linked Apple sign-in, the service revokes stored Apple tokens. If no revocable token is available, the central account is still deleted and you are shown how to revoke access in your Apple Account. Tenon does not store or decrypt your vault, recovery keys or private CloudKit data, and does not delete them on your behalf. Manage or delete product data in the relevant product.

删除运行中的账号不代表历史灾备副本立即全部擦除。账号数据库备份采用 30 天保留策略，由受限维护任务按小时清理过期副本；未解决事故所需的恢复点可能暂时保留。恢复备份前必须重新应用删除记录，不得恢复已删除的身份。

Deleting an active account does not immediately erase every historical backup. Account database backups follow a 30-day retention policy, with a restricted hourly task removing expired snapshots. A recovery point required for an unresolved incident may be retained temporarily. Deletion records must be reapplied before any backup is restored to service, so deleted identities are not restored.

管理与联系 / Controls and contact

你可以在账号页管理称呼、密码、登录设备，以及已启用的第三方登录方式。至少保留一种可用的登录方式。其他隐私请求可联系 support@tenonai.cn。

You can manage your display name, password, sessions and enabled linked sign-in methods in Account. Keep at least one usable login method. For other privacy requests, contact support@tenonai.cn.