隐私政策

最后更新：2026 年 11 月 13 日

Matcha（下称「本应用」）是一个 AI 聊天角色应用，由 Chenga Lu（下称「我们」）运营。这份政策说明本应用收集什么、为什么收集、发给谁、存多久，以及你怎么删掉。联系方式：support@chat-matcha.com。

1. 你在跟 AI 聊天

Matcha 是 AI 角色，不是真人，也不是真狗。她的回复由 AI 模型生成，可能不准确。她不是医生、心理咨询师或律师，也不能代替专业帮助。

2. 我们处理哪些数据

你发的消息和最近的聊天记录：每次聊天时，你发的消息（最多约 500 字）、最近约 20 条聊天（每条最多约 600 字，可带时间）、她记得的与话题相关的事、关系/小本本状态、她惦记要问的事、当前人设选择、最近几句她主动说过的话，以及手机本地时间与地区代码，会发到我们的服务器，再转发给第三方 AI 服务商生成回复。
每天的聊天摘要：每天第一次打开 app 时，前面还没总结过的每一天的聊天（最多 7 天，每天最多 150 句）会发到服务器，由 AI 写成两三句话的摘要。聊天原文不会因此保存下来，保存的只有摘要。
她留给明天的一句话：服务器会保存一句她写给第二天的话，用来让她第二天接上前一天的话头。只存最新的一句，每天被新的一句覆盖。「清空她记得的事」和「删除全部数据」都会删掉它。
她记得的事（记忆与笔记）：聊天中她觉得值得记的（名字、喜好、在忙的事等），服务器存成一句话或整理后的笔记，并可在服务器本机上算成向量用于检索。她也会用你聊到过的兴趣来挑话题（比如跟你说她看到的新鲜事）。部分记忆会逐渐淡忘，但不会被自动删除，一直留到你自己删除：只说过一次的事大约一天后变简短，两天后只剩关键词，大约三天后转为休眠（平时不带进对话，只有你的消息明显相关时才可能被想起，一次最多两条，再聊到就重新记住）；变淡时原来的完整说法仍保留在服务器上。你钉住的不会淡忘。被你纠正、被新说法替换、到期、不再成立，或因为条数太多被挤出的记忆和笔记会停用并保留，不再用于对话，被替换前的旧版本也留着；聊到或你编辑过的笔记会相应延长。停用的记录、旧版本和淡忘前的完整原句不单独显示在 app 里，只能随「清空她记得的事」或「删除全部数据」一起删除。
话题记忆：服务器可能从你们的聊天中提炼出话题（例如你们正在聊什么、她打算稍后追问的事），按设备编号的哈希保存，用来让她在相关的时候接上未聊完的话题。保存的是提炼出的话题，不是你的原话，也不会为此另外保存原始消息摘录。你钉住的、或仍相关的话题会一直保留，直到你删除；她只会在当前对话明显相关时，才把这些话题放进发给 AI 的提示里，而不是每轮都带上。她也可能保存一份「已经追问过哪些话题」的记录，以免短时间内重复提起（大约 7 天）。
她讲过的内容：服务器会记下她已经跟你讲过哪些内容（例如分享过的新鲜事），以免重复讲。这份记录约 7 天后自动清理。
短引用与证据：整理笔记、观点和她提出的问题时，服务器可能保存你说过的短句作为证据（例如笔记的 evidence、观点的证据列表、观点变更原因 because、问题回答旁的 answer_evidence），用于核对她记的是否来自你的原话。
心情与动态状态：聊完后她留下的心情状态、你对她动态的点赞记忆，以及动态阅读状态（feed_state）会按设备保存在服务器，用于下次聊天与动态体验。
动态评论：你在她的动态下发的评论原文会保存在服务器（单条评论约 200 字上限），直到你删除相关动态数据、撤回同意时清理动态，或删除全部数据。
整理排队（organize_queue）：若聊天整理发生在 AI 服务高峰时段，服务器可能暂时保存待整理的聊天批次（含原始设备编号与 IP / IPv6 /64），最长约 12 小时；整理完成、超时、撤回同意、清空她记得的事，或删除全部数据时都会立刻删除。
联网搜索：你问到新闻、价格、新出的东西时，她会把你的问题变成搜索词，通过第三方 AI 服务商的搜索和网页读取接口去查。
随机设备编号：app 第一次打开时生成一个随机编号，放在手机钥匙串里，每次请求都带上。服务器只保存它的哈希值，用来按人分开记忆、统计每天聊了几条。它不是广告标识符，也不能用来追踪你。删除全部数据时，手机端会换新的设备编号。
用量记录：每个设备每天聊了几条；每次调用的 token 数和估算花费（花费账本不含设备编号）。按设备的每日条数与请求统计约保留 90 天；花费账本用于运营预算控制，不含可识别你个人的内容。中途取消的消息也计入额度。
举报：你举报一条聊天回复、一篇动态或一篇日记时，被举报内容（最多约 2000 字）、你选的原因、时间、设备编号哈希，以及前后最多约 4 条上下文（每条最多约 300 字）会发到服务器保存，用来审核。
日志：应用服务器日志记录时间、接口、设备编号哈希、token 数、错误，不记录消息内容。反向代理与系统日志同样不记录消息正文；IP 访问相关的应用内限流计数仅存在内存中，进程重启即清空。日志保留约 14 天。
只存在你手机上的：完整的聊天记录（最多约 1000 条）、她的「小本本」、她惦记的事、设置、本地通知。卸载 app 会删掉其中的文件，但钥匙串里的设备编号可能保留。

我们不收集你的姓名、邮箱、电话、通讯录、位置、照片、广告标识符，也不使用任何统计、广告或追踪工具，不出售数据。

3. 发给谁

第三方 AI 服务商 DeepSeek（深度求索）：它是一家中国公司。你发的消息、最近的聊天记录、用于生成每日摘要的过往聊天、待整理的聊天批次（非高峰整理记忆）、你在动态下的评论、需要淡化改写的记忆，以及作为提示词一部分的她记得的事、笔记、看法、关系/小本本状态、搜索词，与当前对话相关的话题（不含你的原话摘录），以及她这几天已经跟你讲过的新鲜事（她自己说过的话，用来避免重复），会发给它的 API 来生成回复、动态、主动消息或整理记忆。数据会跨境传输，它如何处理和保留这些数据，适用它自己的政策。
我们的服务器：运行在美国 AWS 云服务器（us-east-2，俄亥俄），由 Chenga Lu 运营。传输使用 HTTPS 加密。
日记里的网页内容：Matcha 每天几次读取中文维基百科公开的特色/热门词条摘要，以及 Hacker News 公开热门帖子标题，并可能通过第三方 AI 服务商的网页读取接口打开其中一条来写日记。日记是所有人看到的同一份；挑话题时可能参考至少 3 台设备都聊到过的固定白名单兴趣类别词（如「电竞」，不含撤回同意的设备），绝不包含任何人的原话、名字或其他个人信息。

除此之外我们不把数据给别人，法律要求时除外。

4. 保存多久

她记得的事和摘要：不自动删除。没再聊到的会按上面的规则变淡、休眠；再聊到的更不容易淡，钉住的不淡。休眠的、停用的、旧版本和淡忘前的完整原句都保留，直到你删除。
整理后的笔记：到期或不再使用时停用并保留（见上），不自动删除；清空她记得的事或删除全部数据时立即删除，包括停用的记录、旧版本和完整原句。
话题记忆：只保存提炼出的话题，不保存你的原始消息摘录。这些话题一直保留到你删除：左滑删除一条话题时，会立刻删掉该条话题上的记忆；「清空她记得的事」或「删除全部数据」时全部删除。她用来避免短时间内重复追问的记录大约保留 7 天。
她讲过的内容：最长保留约 7 天，到期自动清理；「清空她记得的事」或「删除全部数据」时立刻删除。
用于生成回复而发送到服务器的聊天原文，不会作为完整聊天记录长期保存在服务器上。待整理的聊天批次仍按下面「整理排队」的规则，最长约 12 小时，或在完成、撤回、清空、删除时立刻删除。
她的问题（curiosities）及相关回答证据：约 14 天；删除全部数据时立即删除。回答旁保存的你的原话摘录，在「清空她记得的事」时也会清掉。
动态与评论：随你的设备数据保留，直到你删除动态、撤回同意时清理动态，或删除全部数据。
整理排队：最长约 12 小时，或在完成/撤回/清空/删除时立刻删除。
举报：保留供审核。你删除全部数据后，举报内容本身会保留，但设备编号哈希与上下文会被清除，无法再关联到你。
用量记录：每日条数与请求统计约 90 天；花费账本用于预算，不含设备编号。
日志：约 14 天。
数据库备份：服务器每日自动备份仅用于故障恢复，访问受限且最长保留 14 天；你删除的数据会在旧备份到期后一并清除。
手机上的数据：直到你清空或卸载。

5. 你的选择

查看和删掉她记得的事：设置里「她随口记住的」「你们聊过的」和「她记得的事」可以左滑删除一条（这一条、淡忘前的完整说法和旧版本会一起立刻删除），或用「清空她记得的事」删掉全部，包括列表里看不到的停用记录、旧版本和完整原句。「删除我的全部数据」也会删掉这些。如果你看到未聊完的话题，左滑删除一条会立刻、真正删掉该条话题上的记忆，而不是只取消关联；「清空她记得的事」和「删除我的全部数据」也会删掉全部话题记忆，以及她讲过的内容的记录。
重置 Matcha：设置里「重置 Matcha」清空聊天记录、她记得的事、小本本和惦记的事等本地与相关服务器记忆状态。
不让她主动找我：设置里打开后，她不会先开口，也不会发通知。
撤回数据同意（设置里「撤回数据同意」）有两个选项：
只撤回，数据留在服务器：停止把你的数据送给 AI 处理，不能继续聊天；待整理的聊天批次与动态相关内容会清理，但记忆、笔记、观点等仍保留，直到你重新同意或选择删除。
撤回并删除我的全部数据：服务器上关于你这台设备的记录会被删除（记忆、笔记、观点、问题、动态与评论、用量记录、整理排队、话题记忆、她讲过的内容等）；举报记录会去掉设备标识与上下文后保留供审核；共享日记与不含设备编号的花费账本不属于个人数据范围，不会因你的删除而清空。手机上的聊天记录和设置也会清空，app 回到刚装好时的样子。
举报：长按她的消息、动态或日记，选原因举报。我们会尽快查看并处理（通常在 24 小时内）。
如果你所在地的法律给你更多权利（查阅、更正、删除、反对处理等），请写信到support@chat-matcha.com。

6. 年龄

本应用仅面向年满 18 岁的成年人，不面向 18 岁以下的未成年人。请勿在未满 18 岁时使用。如果你发现未满 18 岁的人在使用，请联系我们，我们会删除相关数据。

7. 安全

传输使用 HTTPS 加密。设备编号只存哈希。IP 限流计数仅存于内存，不写入数据库或应用日志。没有任何系统是绝对安全的。

8. 改动

政策改动后，我们会更新日期；改动数据用途时，app 会重新请你同意。

9. 联系我们

support@chat-matcha.com

Privacy Policy

Last updated: November 13, 2026

Matcha ("the App") is an AI chat character app operated by Chenga Lu ("we"). This policy explains what the App collects, why, who receives it, how long it is kept, and how you can delete it. Contact: support@chat-matcha.com.

1. You are talking to an AI

Matcha is an AI character, not a person and not a real dog. Her replies are generated by an AI model and may be wrong. She is not a doctor, therapist or lawyer and is no substitute for professional help.

2. What we process

Your messages and recent chat: with each message, the text you send (about 500 characters), about the last 20 turns of chat (about 600 characters each, with times), related memories, relationship/notebook state, things she means to ask about, the persona choice, recent proactive lines, and your phone's local time and region code are sent to our server, which forwards them to a third-party AI provider to generate a reply.
Daily chat summaries: the first time you open the App each day, chats from earlier days that have not been summarized yet (up to 7 days, up to 150 lines per day) are sent to the server, and an AI writes a two- or three-sentence summary. The chat text itself is not kept; only the summary is.
Her note for tomorrow: the server keeps one line she writes for the next day, so she can pick up where you left off. Only the latest line is kept, and each day's new line replaces it. Clearing what she remembers or deleting all your data removes it.
What she remembers (memories and notes): things she judges worth remembering are stored as one-line facts or consolidated notes on the server, optionally with a numeric vector computed on the server's own machine for retrieval. She also uses interests you have talked about to pick topics, such as fresh news to bring up with you. Some memories fade, but they are not deleted automatically and stay until you delete them: something mentioned once is shortened after about a day, reduced to a keyword after about two, and becomes dormant after about three (left out of conversation unless your message is clearly about it, at most two at a time, and remembered again if it comes up). The full wording from before it faded is kept on the server. Pinned items never fade. A memory or note that you correct, that is replaced by a newer wording, that reaches the end of its period, that no longer holds, or that is dropped because there are too many, is marked inactive and kept; it is no longer used in conversation, and the earlier version is kept too. Bringing a note up again or editing it extends its period. Inactive records, earlier versions and the original wording are not listed on their own in the app. They are deleted only when you clear what she remembers or delete all your data.
Topic memory: the server may extract topics from your chats (for example what you are in the middle of talking about, or something she plans to follow up on) and store them under a hash of your device ID, so she can pick the thread up later when it is relevant. What is stored is the extracted topic, not an excerpt of your original wording, and we do not keep a separate raw-message excerpt for this purpose. Pinned or still-relevant topics are kept until you delete them. She includes these topics in the prompt sent to the AI only when the current conversation clearly relates to them, not on every turn. She may also keep a short record of topics she has already followed up on, so she does not bring the same one up again too soon (about 7 days).
What she has already told you: the server keeps a record of what she has already told you (such as news she shared), so she does not repeat herself. This record is cleared automatically after about 7 days.
Short quotes and evidence: when organizing notes, opinions, or questions she wants to ask, the server may keep short lines you said as evidence (for example a note's evidence, opinion evidence lists, a stance-change reason because, or answer_evidence next to an answered curiosity), to check that what she recorded comes from your own words.
Mood and feed state: the mood she is left with after a talk, like-memories for her posts, and feed reading state (feed_state) are stored per device for later chat and feed experience.
Post comments: the original text of comments you leave under her posts is stored on the server (about 200 characters per comment) until you delete related feed data, withdraw consent (which clears the feed), or delete all your data.
Organize queue (organize_queue): if memory organizing arrives during the AI provider's peak hours, the server may temporarily hold the batch (including the original device ID and IP / IPv6 /64) for up to about 12 hours; it is deleted on completion, after 12 hours, when you withdraw consent, clear what she remembers, or delete all your data.
Web search: when you ask about news, prices or new things, she turns your question into search terms and looks it up through the AI provider's search and page-reading interface.
Random device ID: on first launch the App generates a random ID, keeps it in the iOS Keychain and sends it with every request. The server stores only a hash of it, to keep each person's memories apart and count messages per day. It is not an advertising identifier and cannot be used to track you. Deleting all your data causes the phone to start a new device ID.
Usage records: messages per device per day; tokens and estimated cost per model call (the spend ledger has no device ID). Per-device daily counts and request stats are kept about 90 days; the spend ledger is for operating budget control and does not identify you. A message you cancel midway still counts toward your daily limit.
Reports: when you report a chat reply, a post or a diary entry, that content (up to about 2,000 characters), the reason you chose, the time, a hash of your device ID and up to about 4 surrounding context lines (about 300 characters each) are stored on the server for review.
Logs: application server logs record time, endpoint, hashed device ID, token counts and errors. They do not record message content. Reverse-proxy and system logs likewise do not record message bodies; in-app IP rate-limit counters live in memory only and are cleared on restart. Logs are kept about 14 days.
Only on your phone: the full chat history (up to about 1,000 messages), her "notebook", things she means to ask about, settings and local notifications. Uninstalling the App removes the files, but the device ID in the Keychain may remain.

We do not collect your name, email, phone number, contacts, location, photos or advertising identifier, we use no analytics, advertising or tracking tools, and we do not sell data.

3. Who receives it

DeepSeek, the third-party AI provider: it is a company based in China. Your messages, recent chat, past chats sent for daily summaries, queued chat batches for off-peak memory organizing, comments you leave on her posts, memories rewritten as they fade, and prompt context including what she remembers, consolidated notes, opinions, relationship/notebook state, search terms, topics relevant to the current conversation (not excerpts of your original wording), and the news she has told you in the last few days (her own lines, used to avoid repeating herself) are sent to its API to generate replies, posts, proactive messages or organized memories, which means your data is transferred across borders. What it does with the data is governed by its own policy.
Our server: runs on an AWS cloud server in the United States (us-east-2, Ohio), operated by Chenga Lu. Data in transit is encrypted over HTTPS.
Web content for the diary: several times a day Matcha reads the public Chinese Wikipedia featured/most-read feed and Hacker News top-story titles, and may open one item through the AI provider's page-reading interface to write her diary. The diary is the same for everyone; when picking a topic it may consider fixed allowlisted interest-category labels mentioned across at least 3 devices (such as "esports", excluding devices that withdrew consent), and never includes anyone's words, name or other personal information.

We do not give data to anyone else, except where the law requires it.

4. How long we keep it

Memories and summaries: not deleted automatically. Ones that do not come up again fade and may go dormant, as described above; ones that come up again fade more slowly, and pinned ones do not fade. Dormant memories, inactive records, earlier versions and the original wording are all kept until you delete them.
Consolidated notes: when their period ends or they are no longer used, they are marked inactive and kept (see above), not deleted automatically. Clearing what she remembers or deleting all your data deletes them immediately, including inactive records, earlier versions and the original wording.
Topic memory: only extracted topics are kept, not excerpts of your original messages. These topics stay until you delete them: swiping left to delete a topic immediately deletes the memory attached to that topic; "Clear what she remembers" or deleting all your data deletes all of them. The short record she uses to avoid asking about the same topic again too soon is kept about 7 days.
What she has already told you: kept for up to about 7 days and then cleared automatically; deleted immediately when you clear what she remembers or delete all your data.
The chat text sent to the server to generate a reply is not kept on the server as a long-term chat log. Batches waiting to be organized are still kept for up to about 12 hours under the organize-queue rule below, or deleted immediately on completion, withdrawal, clearing, or delete-all.
Curiosities and related answer evidence: about 14 days; deleted immediately with delete-all. Short quotes kept next to answers are also cleared when you clear what she remembers.
Posts and comments: kept with your device data until you delete them, withdraw consent (which clears the feed), or delete all your data.
Organize queue: up to about 12 hours, or immediately on completion / withdraw / clear / delete-all.
Reports: kept for review. After you delete all your data, the reported content remains, but the device-ID hash and surrounding context are cleared so it can no longer be linked to you.
Usage records: daily counts and request stats about 90 days; the spend ledger is for budget and has no device ID.
Logs: about 14 days.
Database backups: daily server backups are kept solely for disaster recovery with restricted access for up to 14 days, after which deleted data ages out automatically.
Data on your phone: until you clear it or uninstall.

5. Your choices

See and delete what she remembers: in Settings, "Picked up in passing", "Your past chats" and "What she remembers". Swipe left to delete one item (that item, the full wording from before it faded, and earlier versions are deleted immediately), or use "Clear what she remembers" to delete all of them, including inactive records, earlier versions and original wording that are not shown in the list. "Delete all my data" deletes these as well. If you see an unfinished topic, swiping left to delete it immediately and fully deletes the memory attached to that topic, rather than only unlinking it. "Clear what she remembers" and "Delete all my data" also delete all topic memory and the record of what she has already told you.
Reset Matcha: Settings, "Reset Matcha" clears the chat history, what she remembers, her notebook and related local/server memory state.
Stop her from starting conversations: switch this on in Settings and she will not speak first or send notifications.
Withdraw data consent (Settings, "Withdraw data consent") has two options:
Withdraw only, keep data on the server: stops sending your data to the AI, and you cannot keep chatting; waiting organize batches and feed-related content are cleared, but memories, notes, opinions and similar data remain until you agree again or choose to delete.
Withdraw and delete all my data: everything the server holds about your device is deleted (memories, notes, opinions, curiosities, posts and comments, usage records, organize queue, topic memory, what she has already told you, and so on); reports are kept for moderation with the device identifier and context wiped; the shared diary and the spend ledger (no device ID) are not personal records cleared by your delete. Chat history and settings on your phone are cleared, and the App returns to its first-launch state.
Report: long-press her message, a post or a diary entry and choose a reason. We review and act promptly (usually within 24 hours).
If the law where you live gives you more rights (access, correction, deletion, objection and so on), write to support@chat-matcha.com.

6. Age

You must be at least 18 years old to use the App. Do not use the App if you are under 18. The App is for adults only. If you find someone under 18 using it, contact us and we will delete their data.

7. Security

Data in transit is encrypted over HTTPS. Only a hash of the device ID is stored. IP rate-limit counters live in memory only and are not written to the database or application logs. No system is perfectly secure.

8. Changes

When this policy changes we will update the date; if what we use data for changes, the App will ask for your consent again.

9. Contact

support@chat-matcha.com