Privacy Policy

Introduction

Welcome to Nephele Workshop. To protect your personal information while you use the Software and related services, 杭州余杭澈韵网络科技工作室 (Hangzhou Yuhang Cheyun Network Technology Studio, Unified Social Credit Code 92330110MAEJ52Y33R, hereinafter “ArisFusion Studio” or “we”/“us”) has established this Privacy Policy (this “Policy”) to explain how we collect, use, store, share, and protect your personal information, and how you can manage it.

Please read this Policy carefully before using the Services, paying particular attention to the clauses in bold. By agreeing to this Policy or using the Services, you indicate that you fully understand and agree to our handling of your personal information as described here.

This Policy applies to the Nephele Workshop desktop application, the Wisp browser extension, and the Nephele Aura mobile application (collectively, the “Software”).

Three special commitments (these commitments are part of this Policy and binding on us):

1. We do not train any AI model, and none of your data is used for any model training. The upstream AI inference services we use are all paid-tier APIs that are contractually barred from training on paying customers' data.
2. We do not sell your personal information. Data monetization is not part of our business model.
3. Except where legally compelled, we do not proactively share your personal information or artwork content with any third party.

This Policy covers: 1. Definitions and scope; 2. How we collect and use personal information; 3. How we entrust, share, transfer, and disclose personal information; 4. How we store and protect personal information; 5. Your rights; 6. Protection of minors; 7. Updates to this Policy; 8. Miscellaneous; 9. Contact.

Article 1 — Definitions and Scope

1. Personal information: information recorded electronically or otherwise that, alone or combined with other information, can identify a specific natural person, excluding anonymized information.
2. Local features: features that run entirely on your device and do not transmit your artwork content to servers.
3. This Policy applies to all forms of the Software and related website services. Third-party services (reverse-image-search engines, timestamp authorities, payment processors, etc.) handle information under their own privacy policies, each listed in Article 3.

Article 2 — How We Collect and Use Personal Information

2.1 Account and authentication

When you register, we collect your email address for login, Seal and order management, service notices, refunds, and account deletion. Emails are stored in plain text and are not linked to any additional identity information. We do not collect your phone number, government ID number, real name, or mailing address.

For device binding (at most 2 devices per license) and anti-fraud, we collect a device identifier (produced by irreversible hashing; it cannot be reversed into your device information). We do not collect hardware serial identifiers such as MAC address, CPU ID, disk serial number, BIOS serial number, or IMEI.

2.2 Version and diagnostics

We collect the app version and operating system type for compatibility checks and fault diagnosis.

2.3 Cloud features (content is processed only when you actively use them)

• Cloud AI (Axioma chat — including the “?” guide's free-form input — and cloud analysis such as Evaluation, Style DNA, and publishing copy generation): the text you send, and images compressed locally to at most 1536px JPEG with EXIF metadata stripped, are forwarded through our server interface to the AI inference service. The Axioma chat system prompt includes your device home directory path (which contains your system username), the current time, and a local memory index summary (up to 4,000 characters; individual memory entries can be loaded on demand during a conversation).
• Reference-image matching: when you describe the references you need and the Agent finds at least 3 candidate images, either through a search or by extracting images for individual selection from a webpage you specify, thumbnails of some candidates (including third-party images) are compressed on your device to JPEG with a longest edge of up to 384 pixels and forwarded through our server to an AI inference service to assess relevance to your request. For Agent searches across sources, this may also reorder candidates. Reference images you supply, if any, may also be sent as JPEGs with a longest edge of up to 512 pixels. These images are not uploaded to the temporary storage described under Reverse image search below; AI gateway logs for these requests are handled as described in (b) below. This step is not a content-safety review.
• Artist subscriptions: the creator handles you subscribe to are stored server-side so the server can fetch their public updates; unsubscribing deletes them.
• Reverse image search: for SauceNAO / iqdb / Google Vision, images are compressed locally, EXIF-stripped, and temporarily uploaded to our storage (auto-deleted within 24 hours) for the engines to fetch via a temporary link; for Baidu Image Search, the original file is uploaded directly to Baidu via local browser automation, and its retention is governed by Baidu's terms; booru lookups (danbooru / yande.re / konachan) send only the file's MD5 hash — no image is uploaded — directly from your client, so your IP is visible to those sites. Note: animated GIFs are transmitted as-is (no compression or metadata stripping) due to format constraints.
• Digital certification: only the file's 256-bit SHA-256 hash is sent to third-party timestamp authorities; the original file never leaves your device.
• Remote announcements: on startup the app fetches in-app announcements and version-compatibility information via an anonymous request with no identity markers.
• Architect Showcase submissions (if you use the feature): the cropped artwork image, byline, title, and homepage link you actively submit are used for review and display, governed by the Architect Showcase Submission License Terms.

Cloud AI conversation content (text and the compressed images) is stored on our servers in two forms: (a) pipeline trace records — used for troubleshooting, service-quality evaluation, and product iteration (including internal automated quality-evaluation pipelines), retained for no more than 30 days and automatically deleted thereafter, and no longer collected once the usage-statistics switch (see 2.5) is turned off; (b) AI gateway forwarding logs — infrastructure logs produced as requests pass through our gateway to the inference service (these contain conversation content), unaffected by the statistics switch, with the oldest records automatically deleted once a rolling capacity cap is reached. Access to both is limited to the developer alone; neither is provided to third parties or used for model training. If your work is under NDA or unpublished, organizing, tagging, reverse image search, watermarking, and certification can all be done offline with local features — nothing needs to go to the cloud.

2.4 Server access logs

These contain IP address, account ID, endpoint name, timestamp, and response metadata — never message content or image content — and are used for service health monitoring, abuse prevention, billing reconciliation, and security-incident tracing.

2.5 De-identified usage statistics (on by default, can be turned off anytime)

The app collects de-identified, event-level usage statistics, enabled by default, to understand feature usage, locate faults, and support customers. Collected: feature usage frequency (tool name, duration, success/failure), app launch events (version, OS), and coarse GeoIP location (country/region level). This excludes artwork content, chat text, image content, and file names, as well as direct identifiers such as name or email; events are linked by a statistical identifier that can be matched to your account, used for troubleshooting and customer support. One honest edge-case disclosure: the error field of failure events captures up to the first 300 characters for crash diagnosis and could theoretically include fragments of file paths from stack traces. You can turn this off anytime at Settings > Appearance & Behavior > Anonymous statistics; once off, no further events are sent (the statistics component is not initialized at all from the next launch).

2.6 Anonymous installation record

The desktop installer sends us one anonymous record while it runs, so failed installations can be diagnosed — above all AI model downloads that fail on certain networks. Users hitting that never reach the application at all, which makes their situation permanently invisible to the in-app statistics. Collected: software version and release channel, installer language, operating system version, installation mode (whether it was an unattended silent install), how long the installation took, the outcome (how many AI model files succeeded and failed, whether you chose to skip the download, retry count, and which distribution node served the files), and whether this was a fresh install; if you exit partway, it also records which step you left at (welcome, model download, file copy). Our server additionally records the IP address on receipt and derives a country or region from it. The record uses a one-time identifier generated at random for that run. It carries no device identifier, file path, user name, account, or anything about your work, and cannot be linked to your account or to your other installations. Because the application is not running yet at install time, this record is not governed by the in-app “Anonymous statistics” switch.

2.7 Local features collect nothing

The following features do not transmit your artwork content to servers: digital certification (hashing and certificate generation are local; only the 256-bit hash goes to timestamp authorities, see 2.3), watermarking (visible + invisible), delivery packing, project cleaning, perceptual hashing and similarity analysis, evidence bundles, local Agent tools, direct Eagle library reading, local quick commands, local image tagging / CLIP retrieval / semantic search / AI-trace detection (ONNX local inference), and chat history and preferences (local SQLite and files). The Wisp browser extension communicates with the desktop app over a local channel; page reads are triggered by you.

2.8 Nephele Aura (mobile)

Aura shares the account system and cloud pipeline with the desktop app. When your desktop is online, Aura's assistant requests are handed to your own desktop for execution; original-image transfers between devices pass through our relay nodes solely to complete the transfer, with no retention. The only additional server-side data Aura produces is the device identifier hash and online status needed for multi-device management. Aura's declared system permissions: photo library (image import), camera (QR pairing and photo import), push notifications, receiving system shares, and app self-update installation; it does not request location, contacts, microphone, or phone-state permissions.

2.9 Purpose changes and consent exemptions

We use collected personal information only for the purposes stated in this Policy; uses beyond that scope will require your separate consent. As provided by law, consent is not required where processing is: (1) necessary to conclude or perform a contract to which you are a party; (2) necessary to perform statutory duties or obligations; (3) necessary to respond to public-health emergencies or to protect life, health, or property in emergencies; (4) reasonable processing of information you have disclosed yourself or that is otherwise lawfully public; (5) other circumstances provided by laws and administrative regulations.

Article 3 — How We Entrust, Share, Transfer, and Disclose Personal Information

3.1 Processors and third-party services

3.2 Sharing: apart from the entrusted processing listed in this Policy, we do not share your personal information with any third party without your explicit consent.
3.3 Transfer: if your information is transferred as part of a business transfer or merger, we will inform you and require the new holder to remain bound by standards no lower than this Policy.
3.4 Disclosure: only with your explicit consent, or where compelled by law, legal process, litigation, or government authorities.
3.5 As provided by law, the consent exemptions listed in Article 2.9 also apply to sharing, transfer, and disclosure.

Article 4 — How We Store and Protect Personal Information

4.1 Storage locations and cross-border transfers

Our server infrastructure includes nodes both inside mainland China and overseas (overseas cloud providers, plus domestic relay/acceleration nodes), and your data may be transferred and processed between them: the cloud AI inference service may be located inside or outside mainland China and may change; the usage statistics service is located overseas; temporary reverse-image-search storage uses global nodes. By using the corresponding cloud features, you consent to the cross-border transfers necessary to deliver them. Local features involve no data transfer at all.

4.2 Retention periods

Personal information beyond its retention period is deleted or anonymized.

4.3 Local storage

On your device, ~/.nephele_workshop/ stores settings, chat history (SQLite), certification records, preference memory, skills, and caches; %APPDATA%\Nephele\ and %LOCALAPPDATA%\Nephele\ store component manifests, logs, and caches for features such as the Showcase and process recording. The Windows registry stores the login JWT, license cache, and third-party platform credentials (Pinterest / Pixiv cookies, X access token, etc.). This local data is not additionally encrypted by the app and is protected by OS user permissions; the JWT payload contains your login email — take care on shared devices.

4.4 Security measures

TLS encryption throughout; SSL certificate pinning on primary API endpoints; JWT authentication with automatic refresh; adaptive dual-channel CAPTCHA; Ed25519 license signing (private key held server-side only); API version gating; payments acquired directly by third parties. Given the limits of technology and risk prevention, we cannot guarantee absolute security, but we will keep applying reasonable and necessary protections.

4.5 Security incident notification

If a personal-information breach or similar security incident occurs, we will activate emergency response to contain it and inform you — via in-app announcement, website announcement, or your registered email — of the basic facts, possible impact, measures taken, and precautions you can take; where individual notice is impractical, we will publish a warning announcement, and we will report to regulators as required by law.

Article 5 — Your Rights

1. Access and correction: you can view account information in the app; for corrections, contact [email protected].
2. Turn off usage statistics: Settings > Appearance & Behavior > Anonymous statistics, anytime (this also stops conversation trace-record collection; for gateway infrastructure logs see 2.3).
3. Use local features only: tagging, indexing, watermarking, certification, and more work entirely offline — a “data never leaves the device” option you can exercise at any time.
4. Delete local data: delete chat history (chat_history.db), reset memory (say “clear memory” in a conversation, or delete the memory/ directory), delete certification records in-app, or delete the local directories entirely.
5. Obtain a copy: you may request a copy of the personal information we hold about you.
6. Delete specific server-side data: without deleting your account, you may separately request deletion of specific server-side data (such as cloud conversation records or your artist-subscription list) via the email in item 8.
7. Withdraw showcase licenses: anytime, per Section 4 of the Architect Showcase Submission License Terms.
8. Delete your account: email [email protected] from your registered address; we manually review and clear your account data within 7 business days. Refund audit records and data required for financial compliance are retained for the minimum period legally required or necessary for those purposes.
9. Response time: we respond to requests under this Article within 15 business days at the latest. We may verify your identity first. For unreasonably repetitive requests or requests plainly beyond reasonable limits, we may charge a reasonable cost or decline, with reasons given.

Article 6 — Protection of Minors

The Software is built for creators and is not directed at children under 14; we do not knowingly collect personal information from users under 14. If you are a minor under 18, please use the Services accompanied by, and with the consent of, your guardian. If we discover that personal information of a child under 14 was collected without verifiable guardian consent, we will take steps to delete it as soon as possible. Guardians who become aware of such a situation are welcome to contact us via Article 9.

Article 7 — Updates to this Policy

We may revise this Policy due to changes in laws and regulations, product features, and similar reasons. Material changes will be announced via in-app announcement no less than 7 days before taking effect; other revisions take effect upon publication on the website. Continued use of the Services after a revision takes effect indicates your agreement to the revised Policy; if you disagree, you may stop using cloud features or delete your account per Article 5.

Article 8 — Miscellaneous

1. If any clause of this Policy is held invalid, the remaining clauses remain in force.
2. Clause headings are for convenience only and are not a basis for interpretation.
3. This Policy is provided in multiple languages; in case of discrepancy, the Simplified Chinese version prevails.
4. This Policy is part of the Software License & Service Agreement; its governing law and dispute resolution follow Article 14 of that Agreement (the laws of the People's Republic of China; disputes go to the people's court with jurisdiction at the defendant's domicile).
5. The website also hosts a narrative companion, “How I treat your data”; the two are factually consistent, and this Policy prevails in case of conflict.
6. Additional note for users outside mainland China: if you are in the European Economic Area, the United Kingdom, or another jurisdiction whose law grants you additional data rights, your rights of access, rectification, erasure, restriction of processing, data portability, and lodging complaints with your local supervisory authority are not limited by this Policy; exercise them via Article 9. The identity of the personal information handler (data controller) is stated in the Introduction.

Article 9 — Contact

For questions, comments, or complaints about personal information protection:

• Email: [email protected]
• Discord / QQ group: links in the website footer
• Mailing address for written correspondence: F0864, No. 51 Tong'an Road, Shuangxi Village, Jingshan Town, Yuhang District, Hangzhou, Zhejiang, China

We will handle matters promptly after identity verification, replying within 15 business days at the latest or within the period required by law.

ArisFusion Studio
杭州余杭澈韵网络科技工作室
F0864, No. 51 Tong'an Road, Shuangxi Village, Jingshan Town, Yuhang District, Hangzhou, Zhejiang, China

Published: August 4, 2026
Effective: September 30, 2026