About this policy
This policy describes zhangjijun, a local-first Windows email outreach application, and its official website at 1858663.xyz. Product and privacy questions can be sent to zjj3517164771@gmail.com.
The application runs on your computer. It is not a cloud-hosted mailbox or a service that uploads your Gmail inbox to our servers. Connecting Gmail is optional; your local administrator identity is separate from Google authorization.
Google User Data / Google 用户数据
This section explains the Google data practices of the updated Windows application described above. It supplements, and does not replace, the rest of this policy.
本章节说明上述更新版 Windows 应用的 Google 数据处理方式，是现有隐私政策的补充，不替代其他章节。
Gmail permissions and purpose / Gmail 权限与用途
https://www.googleapis.com/auth/gmail.send: When you actively create and start an email Campaign or Sequence in the zhangjijun Windows desktop application, the application uses your own connected Gmail account to send those user-initiated emails according to your settings. It also supports a test email that you explicitly request.当您主动在 zhangjijun Windows 桌面应用中创建并启动邮件 Campaign / Sequence 时，应用通过您本人连接的 Gmail 账号，按照您的设置发送这些由您主动发起的邮件。您也可以主动发起测试邮件。
https://www.googleapis.com/auth/gmail.readonly: The application uses read-only Gmail access to synchronize incoming email replies and match them with emails previously sent from the application, their Campaigns or Sequences. This displays customer replies locally and stops pending follow-ups after a matched reply to avoid unnecessary emails.应用使用只读 Gmail 权限同步收到的邮件回复，并与此前从应用发送的邮件及其 Campaign 或 Sequence 匹配，在本地显示客户回复，并在成功匹配后停止尚未发送的跟进，避免不必要的后续邮件。
The read-only permission technically allows reading mailbox messages, not only replies. The application narrows candidate requests and performs reply matching locally. The separate openid and userinfo.email identity permissions are described in Google permissions and their use; this policy update does not change the requested scopes.
只读权限在技术上允许读取邮箱邮件，不仅限于回复；应用会缩小候选邮件查询范围，并在本地进行回复匹配。用于账号身份的 openid 与 userinfo.email 权限见下方权限说明，本次政策更新不改变申请的权限。
Local processing and restricted uses / 本地处理与用途限制
Google Gmail data obtained by zhangjijun is processed and stored only on your own Windows device. The application does not upload Gmail message bodies, Google OAuth tokens or other Google user data to remote servers controlled by the zhangjijun developer. Local processing still requires direct communication with Google for OAuth and Gmail API operations; emails you choose to send are delivered through Google to your recipients.
zhangjijun 获取的 Google Gmail 数据仅在您自己的 Windows 设备上本地处理和存储。应用不会将 Gmail 邮件正文、Google OAuth Token 或其他 Google 用户数据上传到开发者控制的远程服务器。本地处理仍需要为 OAuth 和 Gmail API 操作直接与 Google 通信；您主动发送的邮件通过 Google 送达收件人。
- Google Gmail data is not sold, used for advertising, or provided to data brokers. Google Gmail 数据不会被出售、用于广告或提供给数据经纪商。
- Google Gmail data is not used to train general-purpose AI/ML models. Google Gmail 数据不会用于训练通用 AI / ML 模型。
- Google Gmail data is not sent to OpenAI or any other third-party AI service for processing, or to remote analytics, telemetry, logging or crash-reporting services. Google Gmail 数据不会发送给 OpenAI 或其他第三方 AI 服务处理，也不会发送给远程分析、遥测、日志或崩溃报告服务。
Optional AI personalization uses approved user-authored template/product information and imported or public contact fields, not data read from Gmail. Do not paste Gmail content into these AI inputs: the application cannot reliably recognize the origin of manually copied text. See AI is separate from Gmail data.
可选 AI 个性化仅使用获准的用户自创模板、产品信息和导入或公开联系人字段，不读取 Gmail 数据。请勿将 Gmail 内容粘贴到这些 AI 输入中：应用无法可靠识别手动复制文字的原始来源。
OAuth tokens and retention / OAuth Token 与保留期限
Google OAuth access tokens and refresh tokens are securely stored only on your device using the application's existing local AES-256-GCM encryption mechanism. The key is also stored locally, separately from the database. Tokens are transmitted only to Google as required for authentication and authorized API operations, not to developer-controlled servers or AI services. This protection does not encrypt all local email content.
Google OAuth access token 和 refresh token 仅保存在您的设备本地，使用应用现有的 AES-256-GCM 本地加密机制保护；密钥也在本地保存，与数据库分开。Token 仅在认证和已授权 API 操作所需时传给 Google，不传给开发者服务器或 AI 服务。此保护不等于所有本地邮件内容均已加密。
Google user data is retained locally only for as long as needed to provide the Gmail functionality you actively use, including reply history and matching. There is no automatic age-based deletion period: saved replies remain until you use the deletion controls below. When you no longer need this functionality or its local reply history, disconnect the account and delete its local Google data. Minimal account identity and sent/reply/stop safety records remain as explained below to preserve business history and prevent duplicate or unwanted sending.
Google 用户数据仅在实现您主动使用的 Gmail 功能（包括回复历史及匹配）所必需的期间保留在本地。当前没有按时间自动删除的期限：已保存的回复会保留到您使用下述删除功能。当您不再需要这些功能或本地回复历史时，请断开账号并删除本地 Google 数据。下述最小账号身份与已发送、已回复、停止等安全记录仍会保留，用于保护业务历史并防止重复或不必要的发送。
Disconnect, delete and uninstall / 断开、删除与卸载
In Settings → Privacy & Google Data, a workspace owner or administrator can confirm these actions for the selected account:
工作区所有者或管理员可在设置 → 隐私与 Google 数据中，对选定账号二次确认后执行：
- Disconnect Google Account: stops reply synchronization, removes locally saved access/refresh tokens and clears local authorization and synchronization state. Previously synchronized replies remain. 断开 Google 账号：停止回复同步、删除本机 access / refresh token，并清除本地授权和同步状态；已同步回复仍保留。
- Delete Local Google Data: also deletes local synchronized reply content and associated Gmail message/thread identifiers, reply metadata and synchronization records. Imported contacts, user-created Templates, Campaigns and Sequences are not deleted. Account email/display identity, user-authored outgoing content, sent-history deduplication records and reply/stop/unsubscribe safety flags remain. Stop unfinished Campaigns for that account before full deletion; an in-progress or unresolved send can block deletion until it is resolved. 删除本地 Google 数据：同时删除本地同步回复内容、关联的 Gmail message / thread 标识、回复元数据及同步记录；不删除导入联系人、自创 Template、Campaign 或 Sequence。账号邮箱/显示身份、用户自创发信内容、发送去重记录和回复/停止/退订安全标记仍保留。完整删除前须先停止该账号未结束的 Campaign；正在发送或结果未确定的邮件需处理完成后才能删除。
- Revoke at Google: use Google's third-party connections page to revoke authorization. Local disconnect alone does not revoke Google's grant. 在 Google 撤销授权：访问 Google 官方第三方连接页面；仅本地断开不会撤销 Google 端的授权。
- Uninstall: by default, uninstalling removes program files but preserves local user data, including the database, saved replies and encrypted OAuth credentials. Use Delete Local Google Data before uninstalling if you want these removable local records deleted. Deletion does not erase Gmail cloud mail, existing backups, exports, database recovery logs/old pages, caches or disk remnants. Manage those copies separately; this is not secure disk erasure. 卸载：默认只删除程序文件，保留本地用户数据，包括数据库、已保存回复和加密 OAuth 凭据。如需删除上述可删除记录，请先在应用中执行“删除本地 Google 数据”。此功能不会清除 Gmail 云端邮件、已有备份、导出文件、数据库恢复日志/旧页、缓存或磁盘残留，需另行管理这些副本，也不等于磁盘安全擦除。
See Data Deletion for the procedure and backup/reconnection limitations.
Limited Use / 有限使用
zhangjijun's use and transfer of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.
zhangjijun 对从 Google API 获取的信息的使用与传输将遵守《Google API 服务用户数据政策》，包括其中的“有限使用”（Limited Use）要求。
Read the Google API Services User Data Policy. This commitment does not imply Google verification, certification or endorsement.
请参阅 Google 官方政策。本声明不表示应用已获得 Google 验证、认证或背书。
Google permissions and their use
You choose whether to connect your Google account through Google's OAuth consent page. The application requests these permissions:
| Scope | Use |
|---|---|
openid | Identify the account participating in Google authorization. Non-sensitive. |
https://www.googleapis.com/auth/userinfo.email | Read the connected account's email address and display its connection identity. Non-sensitive. |
https://www.googleapis.com/auth/gmail.send | Send the messages and test emails you choose to send through Gmail. Sensitive. |
https://www.googleapis.com/auth/gmail.readonly | Read candidate messages to synchronize and match campaign replies. Restricted. |
The read-only scope technically permits reading mailbox messages; Google does not limit this permission to campaign replies. zhangjijun narrows its requests using sent-message and contact evidence. It reads candidate subject/body, sender and recipient addresses, timestamps, Gmail message/thread IDs and reply headers to determine whether a message belongs to a campaign. Unrelated candidates may be parsed locally; the default customer replies view shows matched replies, not a full personal inbox.
Read access is used to match Gmail thread IDs and RFC Message-ID, In-Reply-To and References headers, display replies and stop future follow-ups after a matched reply. No full-mailbox control scope is requested. The application does not delete, trash or modify messages in your Gmail mailbox.
Local processing and storage
Gmail data is processed locally on the user's Windows device. Gmail replies flow from Google's Gmail API to your Windows application, where they are parsed and matched, then saved in the local database and shown in the customer replies page. Reply classification is manual and local.
OAuth credentials are stored locally in encrypted form. Access and refresh tokens, expiry and authorized scopes are stored in the local database using authenticated encryption. The encryption key is stored locally, separately from the database. Tokens are used with Google for authorization, account checks, Gmail requests and automatic refresh; they are not sent to a zhangjijun server, this website or an AI provider.
Local reply content is stored as ordinary database fields. Token encryption does not mean the whole database or all email content is encrypted. Protect your Windows account, disk, local configuration and backups. An administrator or malicious software with access to your device may still access local data.
Local data persists across restarts and application upgrades. Uninstalling the application normally retains the user data directory; uninstall is not a data-deletion action.
Sending and external communication
For sending, your locally authored template and selected contact information are rendered in the application, checked against your campaign settings, and sent through the Google Gmail API to your selected recipient. Gmail message and thread identifiers returned by Google are saved locally for status and reply matching.
Local processing does not mean the application is entirely offline. Google authentication and API requests communicate with Google over HTTPS, and your outgoing email content reaches Google and the recipient's email service. Those providers process the communication under their own terms. The application does not route Gmail content or credentials through an issuer-controlled proxy.
AI is separate from Gmail data
Gmail message and reply content is not sent to AI services. AI reply classification has been removed from the updated implementation. Gmail-sourced replies, subjects, bodies, threads, headers, attachments and OAuth credentials are excluded from AI inputs.
Optional AI email personalization can send user-authored templates, product descriptions and selected imported/public contact and company fields to OpenAI when you configure and enable it. That feature is separate from Gmail reply synchronization. Only approved template and contact inputs may cross the AI boundary; Gmail reply objects are rejected.
Do not paste received Gmail messages, replies, credentials or other sensitive mailbox data into templates, AI instructions, product descriptions or imported fields used for AI. The application cannot reliably identify the original source of text you manually copy into those fields. AI is optional and is not required for ordinary email sending or local contact management.
Your choices, retention and deletion
Open Settings → Privacy & Google Data in the updated Windows application. These actions are available to the workspace owner or administrator and require confirmation:
- Disconnect Google Account: stop synchronization for that account, remove locally saved access and refresh tokens, and clear local authorization and synchronization state. Previously saved replies remain.
- Delete Local Google Data: also remove locally synchronized reply content and associated Gmail message/thread links and synchronization records for the selected account. It does not delete imported contacts, user-created templates, campaigns or sequences.
- Manage access at Google: visit Google's third-party connections page to revoke Google's grant. Local disconnect does not itself revoke the Google-side grant.
Local Gmail records remain on your device until you delete them. Business records, authored outgoing content, account email/display identity, sent-history deduplication records and reply/stop/unsubscribe safety flags remain to protect business history and prevent repeat sending. Already received Google replies and your existing backups are not remotely accessible to us for deletion.
Deletion affects active local database records, not Gmail cloud messages, backups, exports, database recovery logs/old pages, browser or operating-system caches, or disk remnants. It is not secure disk erasure. Restoring a backup can restore deleted data; reconnecting Google and enabling sync can download matching replies again. See Data Deletion for the full procedure and safety conditions.
Website visits and support
This informational website does not connect to your local database, ask you to sign in, request Google authorization, or collect Gmail messages or OAuth tokens. We have not added advertising pixels, analytics scripts or a contact form. Pages use locally served styles and system fonts, not third-party font or script services.
The website hosting and network providers (Sites and its Cloudflare delivery infrastructure) may process standard access and security information such as IP address, request time, requested URL and browser details to serve and protect the site. Such hosting-level processing is separate from the desktop Gmail data flow. Provider-controlled retention follows their policies; do not put tokens or private message content into website URLs.
If you contact support by email, your chosen email provider and our support mailbox process your email address and the information you voluntarily send. We use that information to respond and resolve your request, and retain correspondence as needed for support and applicable legal obligations. For a support-record deletion request, email the same support address. Never send OAuth tokens, passwords, complete mailbox exports or full local databases. Redact screenshots and diagnostics before sharing.
Changes and contact
This page will be updated if the product's data practices change; the date above identifies the latest revision. Material changes must be reflected here and in the software's user disclosures before they take effect.
For questions about access, privacy or deletion, email zjj3517164771@gmail.com. Because your desktop data is stored on your device, support cannot remotely erase it on your behalf.