How I Handle Your Data

The principle in one line: what you can see, I open up; what you can't, I keep my word on.

This document covers three things: which data never leaves your computer, which data leaves only when you actively trigger it, and how I handle it once it's gone. The formal compliance document is the Privacy Policy (effective Aug 11, 2026)—it carries the full detail and prevails where they differ; this page is the plain-language telling.

Three Hard Commitments

These three won't change because of a vendor switch, a contract revision, or my own momentary convenience.

1. Where Your Artwork Data Goes

The vast majority of features are fully local. Tagging, image-to-image and text-to-image search, style classification, watermarking, AI-credential detection, file operations, batch processing—all run on your computer, and keep working offline. The source code is right there in your desktop install directory; anyone can open it and verify.

Digital Certification sends only a fingerprint. A "digital fingerprint" (SHA-256 hash) of your artwork is computed locally; only that fingerprint goes to a third-party timestamping authority—the original never leaves your hard drive. The timestamp token stays on your machine and verifies with public tools, no Nephele servers involved. Even if Nephele disappears tomorrow, every timestamp you've issued remains valid.

Images that must go to the cloud slim down first. When the cloud needs to see an image (cloud AI vision, reverse search), it's scaled down, re-encoded as JPEG, and stripped of EXIF and other metadata before leaving your computer—GPS coordinates, camera serial numbers, and edit history don't travel with it.

Reverse search is an outbound transfer you trigger. Most engines receive the slimmed-down copy via my temporary storage, auto-deleted within 24 hours. The exception is Baidu Image Search—local browser automation uploads the original directly to Baidu (no compression, no metadata stripping). Booru exact matching sends only the image's fingerprint (MD5, direct from your computer); library comparison is fully local. (One edge case: animated GIFs are transmitted as-is due to format constraints.)

2. Where Your Conversations With the AI Go

Only natural-language conversation with Nephele (having it understand, analyze, act) goes to the cloud; local features like tagging, search, watermarking, and Digital Certification keep working offline.

The boundaries once it's there:

• Your message is forwarded through my server to the AI inference service; the conversation's system prompt carries your home directory path (which contains your system username) and a summary of the local memory index—the Agent needs these to operate on your local files
• I use a paid-tier API; per the contract terms, your data is not used for training. Even if I switch vendors someday, the principles don't change
• I temporarily retain conversation content, only for bug diagnosis and product iteration, accessible to me alone. Retention lives in two places: pipeline trace records auto-delete after 30 days and stop being collected once you turn off "Anonymous Statistics"; the AI gateway's forwarding logs are unaffected by that switch and rotate on a rolling capacity cap, deleting the oldest records first

3. Identity, Device, and Payment

• Registration takes only an email: no phone number, no real-name verification, no address
• Artist subscriptions: only the creator handles you follow are stored; unsubscribing removes them
• Device fingerprint: irreversibly hashed; no MAC addresses, serial numbers, or any hardware identifier that could track you long-term
• Payment: WeChat Pay, Alipay, and Creem handle transactions directly; your card number and payment credentials never pass through Nephele's servers
• Refund data is retained long-term: order number, device fingerprint hash, payer identifier—backing the one-refund-per-account / per-device / per-payer-for-life anti-fraud rule

4. Telemetry and Usage Statistics

Usage statistics are on by default and can be turned off in one click (Settings → Appearance & Behavior). They're de-identified—no names or emails, but they carry an identifier that can be matched to your account.

Only event-level data is collected: which feature ran, whether it succeeded, how long it took—never message content, image content, or file paths. The one exception: error events carry the first 300 characters of the exception, which may include partial file paths.

Once off, no events are sent at all, and cloud conversation trace collection stops with it (gateway infrastructure logs are separate—see Section 2).

One more: the installer sends a single anonymous record while it runs—version, language, OS version, how long it took, whether the AI models downloaded, and whether you quit partway. It uses a one-time random identifier that matches nothing—not your account, not your other installs. That switch above doesn't govern it, because the app isn't running yet during installation. It exists because people who can't finish installing never get in, so their problem is invisible everywhere else.

5. Server Access Logs

Like every internet service, my server logs IPs, account IDs, endpoints called, and timestamps—never message content, image content, or request bodies. Used for health monitoring, abuse prevention, and billing reconciliation.

6. What You Can Control

Every item corresponds to a button you can actually click in the desktop app.

• Turn off telemetry: Settings → Appearance & Behavior → turn off "Anonymous Statistics"
• Use local features only: the vast majority of work doesn't need cloud AI
• Delete conversation history / clear the memory system: both live under ~\.nephele_workshop\ on your machine—delete the files, or just say "forget this" in conversation
• Get a copy of your data / delete specific server-side data: email [email protected]; answered within 15 business days at the latest
• Delete your account: email [email protected] from your registered address; manual review and purge within 7 business days (refund audit records and financially required data are retained). There's no one-click delete because deletion is irreversible—manual review stops phishing and misclicks, and gives you a cooling-off period

7. If Nephele Shuts Down

• Your timestamps remain valid: issued by independent third-party authorities, verifiable without Nephele
• The evidence package (.nep) is self-contained: it holds all the evidence, and the verifier is a single-file web page (verify.arisfusion.com)—save it locally and it works forever
• Watermarks remain extractable: pure local computation; keep your seed and configuration
• Local tools remain usable: local features are a one-time purchase, and the desktop app you've installed won't be remotely disabled—that's written into the license-system code, not a verbal promise

Closing

This document will keep being revised as the product and industry norms evolve; each revision is noted in the version changelog. If you find anything ambiguous or contradictory, email [email protected] directly.

—— CreatorAris