沪公网安备31011302009914号重要提示：本文件中免除或者限制责任、约定适用法律与争议解决等与您有重大利害关系的条款，已以加粗并放大的字体显示，请您务必审慎阅读、充分理解。
本隐私政策说明 Meowport（亦称“喵护照”或“本 App”）在你使用 iOS、iPadOS、macOS、tvOS、小组件、App Intents、快捷指令、本地文档、导出数据包，以及面向中国大陆的 meowport.cn 和面向中国大陆以外地区的 meowport.app 相关网站时如何处理信息。
喵护照由居于中华人民共和国上海市的个人开发者 Wentao Zhu 运营（“运营者”“我们”）。对于直接发送给运营者的信息（例如支持或法律往来），运营者在适用法律规定的范围内属于个人信息处理者或控制者。本版本自上述“最近更新”日期起适用。
喵护照采用本地优先设计。我们目前不运营接收你猫咪记录的一般开发者服务器，也不运营自有的 AI 推理服务。除非你选择使用 Apple iCloud / CloudKit、共同照护分享、导出数据包、Apple 私有云计算、自定义 AI API、Mac MCP Hub、公开卡片功能或支持渠道，大部分数据会留在你的设备上。
对于已启用的私有 iCloud 功能，你自己的 Apple iCloud / CloudKit 账户是本 App 使用的云端记录来源；喵护照不会再把这些记录复制到一套由开发者运营的平行猫咪记录数据库中。公开卡片使用另一条范围严格限定的路径：App 只把端侧加密后的密文存入 Apple CloudKit 公用数据库，解密密钥随完整链接携带，而不存入由喵护照运营的记录服务。
本隐私政策仅提供简体中文和英文版本，两个版本拟赋予相同权利。地区性条款按照你居住或使用喵护照的地区适用，而不是按照你阅读的语言适用。如两个版本存在冲突，中国大陆地区以简体中文版本为准，其他地区以英文版本为准，但强制性法律另有规定的除外。喵护照不提供其他语言的机器翻译法律文本。其他语言的 App 标签、按钮、摘要、商店本地化文本或客服说明，仅用于产品导航或便利理解，不会修改、翻译或替代本隐私政策。
仅存储在你设备上的数据，由你通过设备和本 App 控制。
iCloud / CloudKit 数据由 Apple 提供基础设施，并由你的 Apple ID 按 Apple 条款、iCloud 设置、CKShare 分享和地区服务安排控制访问。
通过 Apple 私有云计算处理的请求，由 Apple 作为其平台的一部分按 Apple 条款提供处理。喵护照不运营该基础设施，也不会取得该请求的副本。
自定义 AI API 数据由你配置的提供商按其条款和隐私政策处理。
你通过支持邮件或直接消息发送给我们的信息，由我们用于回应和处理请求。
取决于你使用的功能，喵护照可能存储或处理：
除非确有必要且合法，请不要录入人类医疗信息、政府身份证件号码、金融账户号码、密码或其他敏感信息。
喵护照将 App 状态存储在 App 本地容器中，并可能在 App Group 容器中存储小组件快照或动作队列。当你启用或使用相关功能时，Spotlight、日历、提醒事项、通知、文件、照片和快捷指令等本地 Apple 系统服务也可能存储相关项目。
当 Apple 账户变化要求喵护照替换与账户绑定的迁移检查点时，一个范围严格限定、仅位于本机的账户迁移恢复隔离区可能保留已退役检查点，避免崩溃把替换过程静默变成不可逆删除。喵护照使用 Apple CryptoKit 的 AES-GCM 密封该检查点，以 HMAC-SHA256 指纹保护账户和迁移绑定，将安装级本地密钥及隔离账本置于 Apple 文件保护下，并把隔离目录排除在设备备份之外。该恢复辅助数据不是通用猫咪记录数据库，不能替代用户备份，也不会上传到 CloudKit 或喵护照服务器。
如果启用，喵护照可能将当前同步快照、逐条记录的智能同步数据、备份包、CKShare 共同照护数据和相关元数据存储到你的 iCloud / CloudKit 账户。Apple 及适用地区的 iCloud 合作伙伴运营该基础设施。喵护照不声明这些记录受到额外 App 自有加密层保护。
家庭共同照护使用 Apple 的私有 CKShare。创建者建立家庭前，会在可见的逐猫清单中审阅拟提交的现有自有猫咪；这些猫咪可以默认勾选，但创建者可在明确确认前取消。受邀编辑者的猫咪保持私有，只有在其主动逐猫选择“提交至共同照护”后才进入家庭；查看者不能提交。接受邀请本身不会提交成员的私有猫咪。打开、取消或关闭 Apple 分享界面不会构成提交；只有用户明确确认且私有分享成功建立后，猫咪才会提交。只有已提交猫咪的记录和附件会因共同照护进入 iCloud 分享；未提交猫咪不会仅因用户创建、加入或编辑某个家庭而自动上传。
一个共同照护家庭可能由家庭管理分享和多位猫咪所有者分别控制的逐猫私有分享共同组成。加入时，受邀人可能先接受家庭管理分享，再分批接受一个或多个已提交猫咪的私有分享。受 Apple 服务、账户、网络、设备、存储和各猫咪所有者设备状态影响，这些步骤可能部分成功、延迟或需要重试；一个逐猫分享失败不会撤销已经成功接受的其他分享。当前受支持版本按设计显示等待、失败或部分同步状态，而不把尚未完成的家庭表述为完整同步。
为完成私有分享，喵护照可能处理 Apple 提供的不透明账户、记录、zone 和分享标识，以及仅供指定收件人接受分享所需的邀请元数据和邀请 URL。这些邀请不会设置为公开分享，邀请 URL 本身不会单独授予访问权限，也不会因被持有就成为“持有即授权”的凭证；实际访问仍取决于 Apple 账户、受邀参与者身份、接受状态和有效权限。当前受支持版本按设计不把原始邀请 URL 或 CloudKit token 写入 App 生成的诊断信息，也不将其作为公开目录或公开链接发布。
接收到共享猫咪的设备会在成员保有访问权期间保留该猫咪记录的本地副本，与角色无关。在此之上，授予或接受编辑权限时，受支持的编辑者设备还会自动下载并保留附件的离线副本，以支持离线共同照护和记录写作。这会占用编辑者设备存储空间，并在由其他参与者控制的设备和 Apple 账户上形成猫咪数据副本。缓存可能因空间、网络、账户、权限、Apple 服务或附件可用性而不完整；当前受支持版本按设计显示缓存状态，而不把不完整副本称为完整。我们在当前实现可用范围内采用 Apple 平台文件保护，并在系统支持且副本可重建时避免不必要的重复备份，但不声明额外 App 自有加密层。
如果前编辑者对其他参与者拥有的猫咪有未发送修改，App 会要求其选择保留本地、可另行导出的原家庭副本，或仅删除 App 控制的外来家庭副本和未发送的共同照护草稿。该选择绝不会删除成员自己拥有的猫咪，包括已经移回仅自己管理的已提交猫咪。删除自有猫咪须另行提出，并经过知情确认。
受支持客户端会执行更严格的 owner/editor/viewer 业务角色。查看者仅对有权访问的家庭猫咪保持只读；其自有猫咪和无关功能仍按普通免费版或 Pro 规则使用，查看者身份不会使整个 App 进入只读。已提交猫咪始终归提交者所有；提交者可以将其移回仅自己管理，家庭创建者不能据为己有、转移所有权或单方面撤回他人提交的猫咪。发起移回操作的受支持客户端在记录该选择后，会及时从本机家庭范围中隐藏并停止该猫咪的相关访问，同时保留提交者本地猫咪；其他受支持客户端在取得这一变更状态后跟进，Apple 层面的跨账户撤回可能稍后完成。移回仍在处理期间，受支持客户端会同时暂停该猫咪的共同照护和个人智能同步自动传输，避免通过两个路径重复发送。只有安全交接得到确认且用户有 Pro 时，个人智能同步才可恢复；没有 Pro 时，该猫咪仅保留在本机，或由用户手动进行 iCloud 备份或导出。Apple CKShare 的平台权限和喵护照业务角色并不完全相同；没有经验证的创建者撤权审计时，喵护照只会中性说明“CloudKit 确认此账户不再具有共同照护访问权限”，不会推断具体操作者或原因。
iCloud 智能同步是可选功能（属于喵护照 Pro），在登录同一 iCloud 账户的你自己的设备之间同步单条记录、宠物档案和家庭设置，并将这些记录存储在你的 iCloud 私有数据库中。共同照护在每个参与账户上都需要喵护照 Pro，加入家庭以及之后持续接收和同步家庭猫咪均以此为条件；其范围仅包括有权访问的外来家庭猫咪和该成员已明确提交的自有猫咪。如果成员的 Pro 失效，该成员的设备会暂停共同照护同步并保留设备上已有的家庭猫咪数据，恢复 Pro 后同步继续。没有 Pro 时，其他未提交私有猫咪只在本机使用，或通过手动 iCloud 备份或导出迁移。记录内容字段通过 Apple 的 CloudKit 加密字段机制保存，该机制由 Apple 按其条款运营和管理密钥；如果你的 Apple 账户启用了高级数据保护，则按 Apple 文档适用 Apple 扩展的端到端保护。智能同步使用 CloudKit 静默变更通知来得知数据有更新；这些通知只表示有变化，不会把你的记录内容传送给我们。关闭智能同步会停止私有记录同步，但不会删除你的本地数据或已有的 iCloud 数据，也不会自行停止已接受家庭的授权共同照护同步；该同步在账户持有 Pro 期间继续进行。
个人手动 iCloud 备份和普通个人导出只包括用户自己拥有的猫咪；所有仍在共同照护中的外来家庭猫咪（无论可编辑或只读），以及撤权后保留的原家庭副本，均不会进入这些个人数据包。另行授权的编辑者或前编辑者家庭副本导出可以包含本地已有的外来家庭内容，但会保留外来来源、列明不可用或未下载附件，并可能是部分导出。它不会使这些内容变成自有内容、获得个人智能同步资格或可提交至家庭。
当你导出 .meowportpkg、PDF、应急卡、家庭副本包或分享文本后，导出的文件或文本由接收或保存它的人控制。在导出或形成之后，喵护照无法控制受控导出流程之外的导出文件、截图或副本。旧版 .mewportpkg 数据包可能仍会为兼容性保留恢复能力。
AI 管家有三条处理路径，具体适用哪一条，取决于你所选的模型和一项由你控制的设置。
选择 Apple 模型时，喵护照使用 Apple 端侧模型，该次请求在你的设备上处理。
Apple 私有云计算（Private Cloud Compute）是一项独立的可选能力。除非你在 AI 管家设置中自行开启，该能力始终保持关闭；选择 Apple 模型不会开启它，喵护照也不会代你开启。在其可用时，我们可能建议你开启，因为它有助于在隐私与模型能力之间取得更好的平衡，但是否开启由你决定。你的选择会被保存：该设置保持开启期间，在 Apple 授权资格、设备、地区、系统、账户、网络、额度以及喵护照当前适配条件允许的范围内，后续 Apple 模型对话会直接尝试通过私有云计算处理，不会再就每一条消息请求你确认。这是喵护照执行你此前选择并保存的处理偏好，而不是端侧模型判断自身能力不足后自行将请求升级至云端。
某次请求通过私有云计算处理时，对话内容、与该请求相关的宠物档案信息，以及回答该请求所需的其他上下文，会通过 Apple 私有云计算处理，而不再仅限于你的设备。喵护照无法事先告知某一次请求会在设备上完成还是通过私有云计算完成；该设置开启期间，也请不要认为全部数据都始终留在设备上。
私有云计算能否使用，取决于 Apple 授权与开发者资格、设备型号与操作系统版本、Apple 智能及相关系统设置、地区、语言、账户与网络状况、Apple 服务状态与额度及使用限制、Apple 政策/开发者计划/技术接口的调整，以及你已安装的喵护照版本是否仍满足适用的适配要求。上述条件均可能发生变化。
如果私有云计算暂时不可用，或某次请求未能通过私有云计算完成，喵护照可能改由 Apple 端侧路径完成该次请求。此类失败不会自动关闭你已保存的偏好，喵护照也不会因此将请求转交第三方模型提供商。如果你关闭该设置，Apple 模型将恢复为端侧处理。
私有云计算由 Apple 作为 Apple 平台的一部分运营。它不是喵护照的服务器，也不是下文所述的自定义 API；喵护照不运营自有的 AI 推理服务。Apple 在该环节如何处理数据，适用 Apple 自身的条款和隐私说明；我们仅在 Apple 现行官方文档可支持的范围内加以描述。
无论由哪条路径作答，喵护照自身的本地权限校验、共同照护角色和记录规则仍然适用。只读共同照护参与者不能借助 AI 写入记录。AI 管家保存记录前多久询问你一次，由你在 AI 管家设置中选择：每条记录都询问；仅对看诊、化验结果、疾病以及在回答问题时提出的内容询问（默认）；或日常记录不询问。无论你如何选择，AI 管家在修改你已有的记录、保存看起来不合理的数值、保存其回复要求你再次核对的记录，或记录你已说明并未发生的事情之前，都会先询问你。AI 管家不会删除记录。它保存的记录可以在保存该记录的对话中撤销；在更改实际发生前，回复不得表述为已经完成更改。
自定义 AI 提供商与上述两条路径相互独立：只有在你配置并选择该提供商后，内容才会发送给第三方。如果你配置自定义 AI 提供商，相关内容会发送到你提供的端点。你在 AI 管家中附加的照片和扫描件会在你的设备上转换为该次请求使用的页面图片；文件会在本机准备为提取的文字、页面图片，或（化验结果文件）你核对过的数值表，并随消息一起发送给提供商；请求完成后，喵护照不会存储该文件或页面图片。你的提供商可能按其政策存储、使用、训练、保留、审查、转移或删除数据。使用前请阅读该提供商条款。接入自定义 AI 提供商 前，请自行确认可信API模型服务合规性与数据处理规则。你需对提供给 AI 管家的 API 服务以及你通过其发送的请求（包括请求内容）自行负责。
在你选择相应端点时，AI Butler 可通过 HTTP 或 HTTPS 连接你私有局域网中的自定义 LLM API。HTTP 请求未经加密传输；HTTPS 使用系统证书校验。本地网络权限用于你选择的局域网 AI 端点，不用于发现 Mac。上文自定义 AI 提供商的发送内容与确认规则继续适用。
Mac MCP 维护 Hub 是由 Mac 承载的 Pro 功能。你可授权 Mac 本机的 AI Agent 和 Harness，在已授权的工具范围与资料访问权限内维护猫咪资料。变更经已启用的相应 iCloud / CloudKit 同步回其他客户端。现有共同照护角色与资料权限仍然适用；同步取决于账户权限、设置、网络和 Apple 服务状态，不保证即时完成。
服务启停、客户端授权、工具范围、日志和运行时权限应在 Mac 上管理。iPhone、iPad 和 tvOS App 不运行 MCP 服务器。iOS 说明页不发现 Mac，也不控制 Mac 服务或授权。关闭此页面不会删除猫咪记录、iCloud 数据、备份包、Mac 授权或日志。
你授权的 Agent 或 Harness 可以取得获准工具在授权范围内返回的猫咪记录及其他信息。根据该客户端的配置，这些信息可能被发送给第三方模型提供方或其他服务。相应接收方按照各自的条款和隐私规则处理信息。请在授权前检查客户端及提供方设置。喵护照不控制其存储、保留、训练或进一步使用方式。暂停或撤回 Mac 授权会停止该授权下的后续访问，但不能收回已经返回、导出或留存在喵护照控制范围外的信息。
当喵护照显示化验参考区间、疫苗节奏或其他公开参考信息时，App 可能内置或存储来源标识、来源 URL、发布日期/更新日期和最后复核日期。这些公共来源元数据用于展示出处和免责声明，独立于你的私有猫咪记录。
我们当前的网站为静态页面，不设置喵护照分析或广告 Cookie，不运行喵护照分析或广告脚本，也不包含向我们提交数据的表单。我们运营 meowport.app，并面向中国大陆运营 meowport.cn。其网站托管方（meowport.app 当前为 Cloudflare；meowport.cn 为中国大陆境内的托管服务商）可能为交付和保护页面而处理普通访问信息，例如请求 IP 地址、时间、User-Agent 和错误信息。在线应急卡和猫咪归家卡页面在浏览器中解密卡片内容；位于 URL 片段中的解密密钥通常不会随标准请求发送给托管方。
喵护照使用信息以：
在隐私法律要求合法依据的地方，依据可能包括提供你请求的服务、你的同意、履行法律义务、保护安全和防止滥用等合法利益，或处理索赔与支持请求。
喵护照可能按以下方式披露或提供数据：
我们不会为了跨情境行为广告而出售或分享个人信息。
App Store 购买由 Apple 处理。喵护照可能接收用于解锁功能的交易状态、产品标识、权益状态和订阅信息，但付款详情、账单地址、退款、税费、家庭共享资格和取消由 Apple 处理。
喵护照会保留本地记录，直到你按设备和系统行为编辑、归档、导出、删除、替换、还原、清除或卸载。iCloud 当前快照可能为了保持新鲜而被覆盖。iCloud 智能同步在你的 iCloud 中的记录会随你的修改被新增、更新或移除；删除标记可能保留一段时间，以便你的其他设备得知删除。共同照护编辑者的受支持设备会在编辑权限有效期间自动保留共享记录和附件的离线副本；撤权后的保留、导出或删除按 App 提供的流程处理，但外部副本不受 App 控制。iCloud 备份版本设计为只保留有限数量的可选版本。AI 会话历史和附件可能在 App 中受限，以减少存储和上下文大小。
如果你在 App 内提交账户删除请求，清理开始前可能存在宽限期；若 Apple 服务不可用，部分云端清理步骤可能重试。本地删除不会移除已导出、分享、截图、由共同照护参与者保留、存储在 Apple 非喵护照 App 级控制范围内备份中的副本，也不会移除由自定义 AI 提供商处理的数据。
对于提供 90 天恢复入口的删除，当前受支持版本按设计核验受控本地副本和 CloudKit 副本，并显示恢复截止日期以及“受保护、降级或不可用”状态。恢复入口不是保证或独立备份：设备丢失、账户丢失、用户删除 CloudKit zone、加密密钥重置、存储损坏、Apple 服务不可用，或所有受控副本同时不可读取，都可能导致 90 天内提前无法恢复。删除前，App 按设计提示你导出独立备份，并要求你在知悉这些限制后自行确认是否继续。90 天恢复截止日是受控可恢复内容的清理到期点，不代表 Apple 或 CloudKit 服务器已在该时刻精确完成删除。如果届时没有获授权的受支持喵护照客户端获得执行机会，或 Apple 账户、网络或 CloudKit 不可用，受控 CloudKit 内容和受控备份的清理会在下一次可执行机会重试。完成前，当前受支持版本按设计显示“待处理或部分完成”，不得表示 CloudKit 清理已经完成。清理完成后，为防止受支持客户端复活旧数据，可能继续保留不含猫咪内容的删除屏障元数据。外部副本、已导出文件、参与者副本、超出 App 级控制的 Apple/系统备份及任意旧版或被修改客户端不在此流程控制范围内。
支持邮件和法律请求可能保留至回应、遵守法律、解决争议和维护安全记录所需的期限。
在线应急卡是与离线二维码和共同照护分离的自愿公开投影。宠物主人选择开启并确认字段后，App 会在设备上压缩所选头像、构建最小化投影，并使用认证加密写入 Apple CloudKit 公用数据库。公开记录包含密文、随机 nonce、格式/代数信息及有限运行字段；完整二维码或链接的 URL 片段携带解密密钥，片段通常不会随标准 HTTP 请求发送给 meowport.app 或 meowport.cn。Apple 的 CloudKit 响应仍可能附带创建者标识、时间戳或其他系统元数据，网站托管方也可能处理请求 IP、时间、User-Agent 和错误日志。中国大陆的宠物主人默认使用 meowport.cn 链接，其他地区使用 meowport.app；该选择按 App Store 地区自动确定，也可由宠物主人在设置中更改。两个地址显示同一页面、读取同一条加密记录，更改选择不会改变已打印或已写入标签的链接。
持有完整二维码或链接的人可以读取并继续分享卡片。通过消息服务发送链接可能也会把完整链接提供给该服务。公开投影可能包括猫咪姓名、去除来源元数据并压缩的头像、品种、脱敏 ID 后四位、血型、过敏/禁忌、未标记康复的重要病史、当前关键用药，以及你有权提供的兽医或紧急联系人；不会主动征求人类健康资料、主人住址、完整猫咪 ID 或保险信息。自由文本按输入内容显示，可能不完整、过时或未经兽医核实。
宠物主人还可以为每只猫咪单独勾选默认关闭的“近 90 天概况”。勾选后，投影可包含日期范围、每天至多一个合理体重点、已记录服药次数和至多三个药名、就诊和检验计数、最近就诊标题和日期、明确持续的状况计数、有界异常检验标记和症状观察、疫苗或驱虫日期，以及在所含异常指标存在数字记录时每项至多六个带日期的记录值、记录单位、事实标记和来源报告中保存的参考上下限。App 不会为此投影完整的 90 天原始记录、记录标识、记录备注、附件、地点、机构/人员、费用或精确事件时间，也不会把数值序列描述为好转、恶化、稳定、诊断或治疗建议。该汇总仅来自同一只猫咪的宠物主人记录，可能不完整、过时、受录入或单位错误影响，或未经兽医核验；取消勾选后，后续成功发布会移除该汇总，但无法收回外部副本。
页面显示最近一次成功发布的内容和受保护的发布时间。启用后，既有字段集内的数据、头像和 App 主题变化可能继续自动发布。首次开启、字段扩展和更换链接要求当前设备确认；法律或披露版本变化不自动撤下既有投影或阻断其既有字段自动更新，但 App 会在下次管理或预览时要求重新确认。
撤销或更换链接会尝试删除旧公开记录；在 Apple 服务、账号、网络或设备暂不可用时，可能显示撤销处理中并继续重试。Meowport 无法收回其他人已经保存、截图、打印、缓存、导出或转发的副本。共同照护成员关系的变化不会自动修改在线应急卡，反之亦然。
数据导出可包含在线卡状态、所选字段 ID、披露版本、同意记录摘要、最近成功发布时间和待清理代数，但不包含完整链接、记录名、密钥或 nonce；导入不会自动恢复公开发布。删除猫咪或账号时，当前受支持版本按设计先记录可重试清理意图，再尝试删除受控公开记录和私密控制记录；在 CloudKit 确认删除或确认记录不存在前，界面按设计显示为待处理或部分完成。
轻触应急卡是在线应急卡的可选实体载体功能。仅在宠物主人主动开始操作、所选猫咪的在线应急卡仍有效、当前设备具备所需能力且法律确认有效时，App 才会通过 Apple Core NFC / NFC Forum NDEF 接口尝试检查一个标签的可写状态、容量和现有消息类别，将该猫咪现有的完整在线应急卡 HTTPS 链接作为单条 NDEF URI 记录写入，并从同一标签读回比对。检查、写入、覆盖、读回和重写属于基础功能，不要求 Meowport Pro，也不读取订阅状态。标签上不会另行写入猫咪姓名、头像、健康记录、联系方式、账户资料或 Co-Care 信息；此功能也不新增 CloudKit 记录类型或喵护照服务器。
标签检查和读回在设备上的短时会话中处理。当前受支持版本的此功能按设计不收集、保存、上传、导出标签 UID、序列号或产品唯一标识，也不将其用于分析。App 将标签中原有内容作为不可信输入，仅进行有界分类，不主动打开或上传该内容；对于不属于未设置官方轻触牌或当前同一链接的非空内容，会先要求宠物主人确认是否覆盖。系统、设备或底层标签技术仍可能处理其正常运行所需的信息，并受 Apple、设备和标签提供方各自条款约束。
写入成功后，能够读取实体标签的人可能取得、复制和转发完整的在线应急卡链接，其风险与持有完整二维码或链接相近。标签不证明读取者身份、猫咪所有权、标签真伪、信息最新性或专业核验。撤销或更换在线链接不会远程改写已经离开宠物主人控制的实体标签；CloudKit 删除确认、设备、网络、标签、保护壳、金属表面、放置位置、容量、只读状态和操作时机都可能影响结果。链接变化后，宠物主人需要决定是否重新写入标签；二维码继续作为备用方式。
未设置的官方物料可以使用同一条、无产品唯一值的 https://meowport.app/tap/setup?v=1 邀请链接；面向中国大陆的物料使用 https://meowport.cn/tap/setup?v=1。该静态页面不请求 CloudKit、不接收猫咪记录，也不包含账户、宠物、订单、激活或推荐标识；网站托管仍可能按本政策处理普通请求日志。有效 Universal Link 只把 App 导向设置引导，不会自动选择猫咪、开启在线发布、发起购买或启动 NFC 会话。购买可选实体轻触牌不会解锁或改变数字订阅权益。
猫咪归家卡是一项可选公开投影，与医疗用途的在线应急卡、离线二维码、PDF 和共同照护相互独立。NFC 是其唯一发布入口和载体，但卡片仍需联网加载。宠物主人选择一只由自己管理的猫咪、预览确切字段、确认有权公开自然人联系方式与地址、接受当前法律文本并确认独立归家卡披露后，App 才会建立最小化投影，以认证加密写入 Apple CloudKit 公开数据库中的独立记录类型。
所选投影可以包含猫咪姓名、已移除元数据并压缩的头像、品种、毛色、性别、近似年龄、掩码宠物 ID 后缀、一个必填的第一归家联系人、一个可选的第二归家联系人、可选地区或完整地址，以及有界的主人归家备注。完整地址默认隐藏并要求另行确认。医疗记录、完整宠物标识、保险、支付、共同照护成员关系和实时位置不会进入该投影。公开记录包含密文、随机 nonce、格式和 generation 以及有限运行字段；完整链接的 URL fragment 携带解密密钥，在标准 HTTP 请求中通常不会发送给 meowport.app 或 meowport.cn。Apple 仍可能附加创建者、时间戳或其他系统元数据；网站托管方可能处理请求 IP、时间、User-Agent 与错误日志。
任何能够读取项圈标签或取得完整持有者链接的人都可能查看、保存、复制或转发所选资料。电话、短信和地图操作会把主人选择的值交给发现者选择的设备处理程序，之后可能受第三方条款和隐私做法约束。页面不是公开目录；本功能不收集发现者身份、标签扫描分析、地理位置或向主人发送“已扫描”通知。主人填写的文字可能不完整或已过期；感谢金备注不是由喵护照提供的支付服务或保证。
NFC 检查、写入、覆盖和读回仅在主人主动开始操作后进行。App 只对现有 NDEF 内容作有界分类，不收集、保存、上传或导出标签 UID、序列号或产品唯一标识。标签只保存一条完整归家卡 HTTPS 链接，不另行保存猫咪姓名、联系人、地址、备注或医疗记录。确认后写入可能替换原内容；撤销或更换在线卡无法远程改写主人控制范围之外的实体标签。
更新所选值时可能继续使用当前随机记录与密钥。更换链接或撤销会尝试删除受控记录，外部副本无法收回。删除猫咪和账户时会对归家卡公开记录、私有控制记录和受保护本地凭据执行可重试清理。可携带状态导出可以包含宠物绑定、generation、所选字段标识、披露版本、联系人/地址存在性标记与最后成功发布时间，但不包含完整链接、记录名、密钥、nonce、联系人值、地址值、归家备注或解密后的发现者页面内容；导入状态不会恢复或开启发布。
你可以：
iCloud、CloudKit、App Store 购买、设备备份、家庭共享和 Apple 账户数据等设置由 Apple 控制。
取决于你所在地，你可能拥有访问、更正、删除、导出、限制、反对或撤回同意等个人信息权利。由于大部分喵护照数据是本地数据或存储在你自己的 iCloud 账户中，许多权利可以直接在 App 或 Apple 设置中行使。
对于你通过支持或法律联系方式直接发送给我们的数据，中国大陆地区请联系 legal@meowport.cn。我们可能需要验证你的请求。我们不会因你行使隐私权而歧视你。
中国大陆地区用户：在适用情况下，你可以请求访问、复制、更正、删除、解释、撤回同意或注销账户。iCloud 服务基础设施和地区合作伙伴可能受 Apple 及地区 iCloud 条款约束。
其他地区用户：你所在地的强制性隐私、消费者保护或数据保护法律可能适用。请通过 legal@meowport.app 联系我们。
我们在可用范围内使用 Apple 平台安全能力，例如 App 沙盒、用于自定义 API 密钥的钥匙串、已实现的文件保护、用于上述有限账户迁移恢复隔离区的 Apple CryptoKit、iCloud / CloudKit 访问控制、StoreKit 和通过 Apple 登录。隔离区的安装级本地文件密钥与存放在钥匙串中的自定义提供商 API 密钥相互独立。我们不保证绝对安全。
在适用法律允许范围内，若因本地副本、CloudKit zone、账户访问、设备、存储、Apple 服务或加密密钥不可用而无法恢复，我们不能保证或承担法律强制要求之外的恢复责任。本政策不排除或限制依法不得排除、不得限制的消费者、隐私、数据保护或其他法定权利。
你需要负责设备密码、Apple ID 安全、iCloud 分享、Mac 安全、API 提供商安全、导出数据包以及你选择分享的对象。
喵护照不面向未满 14 周岁的中国大陆儿童，也不面向其居住地法律规定的其他最低年龄以下儿童（美国通常为 13 周岁，欧洲经济区成员国适用年龄为 13 至 16 周岁）。儿童不应在没有适当父母或监护人监督和同意的情况下提交个人信息。如果你认为儿童通过支持渠道直接向我们提供了个人信息，中国大陆地区请联系 legal@meowport.cn，其他地区请联系 legal@meowport.app。
Apple、iCloud、Apple 私有云计算、自定义 AI 提供商、支持工具和网站托管方可能根据你的账户、位置、提供商和服务设置在不同地区处理数据。如果你选择境外提供商，你的数据可能按该提供商条款转移至相应地区。
本隐私政策仅提供简体中文和英文版本，并适用上述权威语言规则。我们不提供其他语言的机器翻译法律文本，因为未经审阅的法律翻译可能改变法律含义并造成不必要风险。若法院、监管机构、应用商店或平台要求其他语言文本，该文本仅在强制性法律要求范围内适用。
喵护照当前开发和运营人员位于中国上海。在法律允许的最大范围内，与本隐私政策相关的争议应先通过下方联系方式提交给我们；若无法友好解决，应由中国上海有管辖权的法院处理，或在双方另行同意或存在可执行仲裁约定时，以中国上海为仲裁地处理，除非法律另有规定。
当 App、法律、平台要求或数据流发生变化时，我们可能更新本隐私政策。当前版本会在本 App 及适用的法律网站中标明。对于要求接受当前法律文本的操作，本 App 可以在操作继续前要求你接受当前版本。适用法律另行要求通知或同意的，从其规定。
https://meowport.cnsupport@meowport.cnlegal@meowport.cn若您在中国大陆以外的地区使用喵护照，请访问全球网站 https://meowport.app，并通过 support@meowport.app 或 legal@meowport.app 查询适用于您所在地区的信息、获取支持或提交法律与隐私请求。
This Privacy Policy explains how Meowport, also known as 喵护照 ("Meowport" or "the App"), handles information when you use Meowport on iOS, iPadOS, macOS, tvOS, widgets, App Intents, Shortcuts, local documents, export packages, and related websites under meowport.app and, for Mainland China, meowport.cn.
Meowport is operated by Wentao Zhu, an individual developer based in Shanghai, People's Republic of China (the "Operator", "we", "us", or "our"). For information sent directly to the Operator, such as support or legal correspondence, the Operator is the personal-information handler or controller to the extent applicable law provides. This version applies from its Last updated date.
Meowport is designed to be local-first. We do not currently operate a general developer server that receives your cat records, and we do not operate an AI inference service of our own. Most data stays on your device unless you choose to use Apple iCloud / CloudKit, co-care sharing, export packages, Apple Private Cloud Compute, custom AI APIs, Mac MCP Hub, public-card features, or support channels.
For enabled private iCloud features, your Apple iCloud / CloudKit account is the cloud system of record used by the App; Meowport does not duplicate those records into a parallel developer-operated cat-record database. Public cards use a separate, narrowly scoped path that stores App-encrypted ciphertext in Apple's CloudKit public database, with the decryption key carried in the complete link rather than stored in a Meowport-operated record service.
This Privacy Policy is provided only in Simplified Chinese and English. Both versions are intended to grant the same rights. Region-specific provisions apply according to where you live or use Meowport, not according to the language you read. If the two versions conflict, the Simplified Chinese version controls for use in Mainland China and the English version controls elsewhere, except where mandatory law requires otherwise. Meowport does not provide machine-translated legal text in other languages. Any other-language app label, button, summary, store-localization text, or support explanation is for product navigation or convenience only and does not amend, translate, or replace this Privacy Policy.
For data stored only on your device, you control it through your device and the App.
For iCloud / CloudKit data, Apple provides the infrastructure and your Apple ID controls access according to Apple terms, iCloud settings, CKShare sharing, and regional service arrangements.
For requests processed through Apple Private Cloud Compute, Apple provides that processing as part of the Apple platform under Apple's terms. Meowport does not operate that infrastructure and does not receive a copy of the request.
For custom AI APIs, the provider you configure processes the data you send to that provider under its own terms and privacy policy.
For support emails or direct messages you send to us, we process the information you choose to provide so we can respond and manage the request.
Depending on what you use, Meowport may store or process:
Do not enter human medical information, government ID numbers, financial account numbers, passwords, or other sensitive information unless truly necessary and lawful.
Meowport stores app state in the app's local container and may store widget snapshots or action queues in an App Group container. Local Apple system services such as Spotlight, Calendar, Reminders, Notifications, Files, Photos, and Shortcuts may store related items when you enable or use those features.
When an Apple-account change requires Meowport to replace an account-bound migration checkpoint, a narrow device-local account-migration recovery quarantine may preserve the retired checkpoint so that a crash does not silently turn the replacement into irreversible deletion. Meowport seals that checkpoint with Apple CryptoKit AES-GCM, uses HMAC-SHA256 fingerprints for account and transition bindings, stores the installation-local key and quarantine ledger with Apple file protection, and excludes the quarantine directory from device backup. This recovery sidecar is not the general cat-record database, is not a substitute for a user backup, and is not uploaded to CloudKit or a Meowport server.
If enabled, Meowport may store current sync snapshots, per-record Smart Sync data, backup packages, CKShare co-care data, and related metadata in your iCloud / CloudKit account. Apple and applicable regional iCloud partners operate that infrastructure. Meowport does not claim that these records are protected by an additional app-owned encryption layer.
Family co-care uses Apple's private CKShare. Before creating a family, the creator reviews a visible per-cat list of existing owned cats proposed for submission. Those cats may be selected by default, but the creator can deselect them before giving explicit confirmation. An invited editor's cats stay private unless the editor actively chooses “Submit to co-care” for each cat; a viewer cannot submit. Accepting an invitation alone never submits a member's private cats. Opening, dismissing, or cancelling Apple's sharing screen does not submit a cat; submission occurs only after explicit confirmation and successful establishment of private sharing. Only records and attachments for submitted cats enter iCloud sharing for co-care, and creating, joining, or editing a family does not by itself upload an unsubmitted cat.
A co-care family may consist of a family-management share together with separate private per-cat shares controlled by each cat's owner. A member may first accept the family-management share and then accept one or more submitted-cat shares in batches. Apple-service, account, network, device, storage, and cat-owner-device conditions can make those steps partial, delayed, or retryable; one failed cat share does not roll back shares already accepted. Meowport is designed to show pending, failed, or partially synchronized status and not to present an incomplete family as fully synchronized.
To complete private sharing, Meowport may process opaque Apple-provided account, record, zone, and share identifiers, together with invitation metadata and invitation URLs needed by designated recipients. These invitations are not configured as public shares, and possession of an invitation URL does not itself grant access; access still depends on the Apple account, invited-participant identity, acceptance state, and effective permissions. The App is designed not to include raw invitation URLs or CloudKit tokens in App-generated diagnostic output or publish them as a public directory or public link.
A device that receives a shared cat retains a local copy of that cat's records for as long as the member keeps access, whatever the role. On top of that, when editor access is granted or accepted, supported editor devices automatically download and retain offline copies of attachments for offline collaboration and record writing. This uses storage on editor devices and creates cat-data copies on devices and Apple accounts controlled by other participants. Caching may be incomplete because of storage, network, account, permission, Apple-service, or attachment availability; the App is designed to report cache state and not to describe an incomplete copy as complete. We use Apple platform file protection where available and avoid unnecessary redundant backup where supported and the cache is recreatable, but we do not claim an additional app-owned encryption layer.
If a former editor has unsent changes for cats owned by other participants, the App asks that former editor to choose between retaining a local, separately exportable former-family copy and deleting only the locally controlled foreign-family copies and unsent co-care drafts. This choice never deletes a cat owned by that member, including a submitted cat already returned to private management. Deleting an owned cat is a separate, informed request.
Supported clients enforce stricter owner/editor/viewer product roles. A viewer is read-only only for authorized family cats; the viewer's own cats and unrelated functions continue under ordinary Free or Pro rules, and viewer status does not make the entire App read-only. A submitted cat remains owned by its submitter. The submitter can return it to private management, while another family creator cannot claim it, transfer it, or independently withdraw it. The supported client where you initiate the return records your choice and promptly hides and stops that cat's family access while preserving the submitter's local cat. Other supported clients follow after they receive that change, while Apple-level withdrawal across accounts may complete later. While return to private management is pending, supported clients pause both co-care and personal Smart Sync automatic transmission for that cat to avoid sending it through two paths. Personal Smart Sync may resume after the handoff is confirmed and only with Pro; without Pro, the cat remains local or moves through manual iCloud backup or export. Apple CKShare platform permissions and Meowport product roles are not identical. Without a validated creator-authored revocation audit, Meowport states neutrally that CloudKit confirms this account no longer has co-care access and does not infer the person or reason responsible.
iCloud Smart Sync is an optional feature (part of Meowport Pro) that syncs individual records, pet profiles, and household settings between your own devices signed in to the same iCloud account. Co-care requires Meowport Pro on each participating account, both to join a family and to keep receiving and synchronizing it afterwards; its scope is limited to authorized foreign family cats and the member's expressly submitted owned cats. If a member's Pro lapses, that member's devices pause co-care synchronization and keep the family cat data already on the device; synchronization resumes once Pro is restored. Without Pro, other unsubmitted private cats stay on-device or move through manual iCloud backup or export. Record content fields are saved through Apple's encrypted CloudKit field mechanism, which Apple operates and keys under Apple's terms; if your Apple account uses Advanced Data Protection, Apple's expanded end-to-end protection applies according to Apple's documentation. Smart Sync uses silent CloudKit change notifications to learn that something changed; those notifications signal freshness and do not deliver your record content to us. Turning Smart Sync off stops private record syncing without deleting local or existing iCloud data, and it does not by itself stop authorized co-care synchronization for an accepted family, which continues while the account holds Pro.
Personal manual iCloud backup and general personal export include only cats you own. All active foreign family cats, whether editable or read-only, and retained former-family copies are excluded from those structured personal packages. A separately authorized editor or former-editor family-copy export may include locally available foreign-family content, keeps its foreign origin, identifies unavailable or not-downloaded attachments, and may be partial. It does not make that content owned, eligible for personal Smart Sync, or eligible for family submission.
When you export a .meowportpkg, PDF, emergency card, family-copy package, or share text, the exported file or text is controlled by whoever receives or stores it. Meowport cannot control exports, screenshots, or copies made outside Meowport's controlled export flow after they are shared or created. Legacy .mewportpkg packages may remain restorable for compatibility.
AI Butler has three processing paths, and which one applies depends on the model you select and one setting you control.
When you select the Apple model, Meowport uses Apple's on-device model and that request is processed on your device.
Apple Private Cloud Compute is a separate, optional capability. It is off unless you turn it on yourself in AI Butler settings; selecting the Apple model does not enable it, and Meowport does not enable it for you. Where it is available we may recommend it, because it can offer a better balance between privacy and model capability, but the decision is yours. Your choice is saved. While the setting remains on, later Apple-model conversations attempt Private Cloud Compute directly when Apple eligibility, your device, region, system, account, network, quota, and Meowport's current integration permit it, and you are not asked to confirm again for each message. That is Meowport carrying out a processing preference you chose earlier; it is not the on-device model deciding that it is incapable and escalating your request to the cloud on its own.
When a request is handled through Private Cloud Compute, the conversation content, the pet-profile facts relevant to that request, and other context needed to answer it are processed through Apple Private Cloud Compute rather than only on your device. Meowport cannot tell you in advance whether a particular request will run on your device or through Private Cloud Compute, and while the setting is on you should not assume that all data stays on the device.
Whether Private Cloud Compute can be used at all depends on Apple entitlements and developer eligibility, your device and operating-system version, Apple Intelligence and related system settings, region, language, account, and network conditions, Apple service status, quotas and usage restrictions, changes to Apple's policies, developer programs, or technical interfaces, and whether the Meowport version you have installed still meets the applicable integration requirements. Any of these can change.
If Private Cloud Compute is temporarily unavailable or a request through it does not succeed, Meowport may complete that request on Apple's on-device path instead. A failure of that kind does not switch your saved preference off, and Meowport does not move the request to a third-party model provider. If you turn the setting off, the Apple model returns to on-device processing.
Private Cloud Compute is operated by Apple as part of the Apple platform. It is not a Meowport server, and it is not the custom API described below; Meowport does not run an AI inference service of its own. Apple's own terms and privacy documentation govern how Apple handles that processing, and we describe it only to the extent Apple's current documentation supports.
Whichever path answers a request, Meowport's own local permission checks, co-care roles, and record rules still apply. A read-only co-care participant cannot use AI to write records. How often AI Butler asks before it saves a record is your choice in AI Butler settings: before every record; only for vet visits, lab results, and illnesses, and for anything proposed in reply to a question (the default); or not for everyday records. Whatever you choose, AI Butler asks before it changes a record you already have, saves a value that looks implausible, saves a record its own reply asks you to double-check, or records something you have said did not happen. AI Butler does not delete records. A record it saves can be undone from the conversation in which it was saved, and no reply may state that a change has been made unless it has.
A custom AI provider is a separate path from both of the above. Content is sent to a third party only after you configure and select that provider. If you configure a custom AI provider, relevant content is sent to the endpoint you provide. Photos and scans you attach in AI Butler are converted on your device into page images for that request; files are prepared on your device as extracted text, page images, or — for a lab results file — the table of values you reviewed, and sent to the provider with your message; Meowport does not store the file or the page images once the request completes. Your provider may store, use, train on, retain, review, transfer, or delete data according to its own policies. Review that provider's terms before using it. Before you connect a custom AI provider, please confirm for yourself that the API model service you trust is compliant and check its data-processing rules. You are responsible for the API service you provide to AI Butler and for the requests you send through it, including their content.
AI Butler can connect to a custom local LLM API on your private network using HTTP or HTTPS when you choose that endpoint. HTTP transmits unencrypted requests; HTTPS uses system certificate validation. The local-network permission is used for your selected local AI endpoint, not for Mac discovery. The content and consent rules for custom AI providers above still apply.
The Mac MCP maintenance Hub is a Mac-hosted Pro capability. You can authorize local AI Agents and Harnesses on your Mac to maintain cat records within the tools and record access you have granted. Changes synchronize to other clients through iCloud / CloudKit when the applicable sync is enabled. Existing co-care roles and record permissions continue to apply, and synchronization depends on account access, settings, network conditions, and Apple services; it is not guaranteed to be immediate.
Manage the service, client grants, tool scopes, logs, and runtime permissions on your Mac. The iPhone, iPad, and tvOS apps do not run an MCP server. The iOS information page does not discover Macs or control the Mac service or its grants. Closing this page does not delete cat records, iCloud data, backups, Mac grants, or logs.
An Agent or Harness you authorize can receive the cat records and other information returned by the tools within its granted scope. Depending on that client's configuration, it may send this information to a third-party model provider or other service. Those recipients process information under their own terms and privacy practices. Review the client and provider settings before granting access. Meowport does not control their storage, retention, training or further use. Pausing or withdrawing a Mac grant stops subsequent access under that grant; it cannot recall information already returned, exported or retained outside Meowport's control.
When Meowport displays lab reference interval context, vaccine schedule context, or other public reference information, the App may bundle or store source identifiers, source URLs, publication/update dates, and last reviewed dates. This public reference source metadata is used to show provenance and disclaimers; it is separate from your private cat records.
Our current websites are static pages. They do not set Meowport analytics or advertising cookies, run Meowport analytics or advertising scripts, or contain forms that submit data to us. We operate meowport.app and, for Mainland China, meowport.cn. Their hosting providers (for meowport.app, currently Cloudflare; for meowport.cn, a hosting provider in Mainland China) may process ordinary access information such as request IP address, time, User-Agent, and error details to deliver and secure the pages. Online Emergency Card and Cat Return-Home Card pages decrypt card content in the browser; a decryption key placed in the URL fragment is normally not sent to the host in a standard request.
Meowport uses information to:
Where privacy law requires a legal basis, the basis may include providing the service you requested, your consent, compliance with legal obligations, protecting legitimate interests such as security and abuse prevention, or handling claims and support requests.
Meowport may disclose or make data available as follows:
We do not sell or share personal information for cross-context behavioral advertising.
App Store purchases are handled by Apple. Meowport may receive transaction status, product identifiers, entitlement state, and subscription information needed to unlock features, but Apple handles payment details, billing address, refunds, taxes, family sharing eligibility, and cancellation.
Meowport keeps local records until you edit, archive, export, delete, replace, restore, clear, or uninstall according to device and system behavior. iCloud current snapshots may be overwritten for freshness. iCloud Smart Sync records in your iCloud are added, updated, or removed as you change records; deletion markers may be kept for a period so your other devices can learn about deletions. Participant devices retain local copies of shared records while access remains active, and supported co-care editor devices additionally retain offline copies of attachments while editor access remains active; retention, export, or deletion after revocation follows the App flow, but external copies remain outside App control. iCloud backup versions are designed to keep a limited number of selectable versions. AI conversation history and attachments may be limited in the App to reduce storage and context size.
If you submit an account deletion request in the App, there may be a grace period before cleanup begins, and some cloud cleanup steps may retry if Apple services are unavailable. Local deletion does not remove copies already exported, shared, screenshotted, retained by co-care participants, stored in Apple backups outside Meowport's app-level control, or processed by custom AI providers.
For deletions with a 90-day recovery entry, current supported versions are designed to verify controlled local and CloudKit copies and display the recovery deadline and a protected, degraded, or unavailable state. The recovery entry is not a guarantee or an independent backup. Device loss, account loss, a user-deleted CloudKit zone, reset encryption keys, storage corruption, unavailable Apple services, or simultaneous loss of all controlled copies may make recovery impossible before the 90 days end. Before deletion, the App is designed to advise you to export an independent backup and ask you to decide whether to proceed after learning these limits. The 90-day recovery deadline is the cleanup-due point for controlled recoverable content; it does not mean that Apple or CloudKit servers completed deletion at that exact time. If no authorized supported Meowport client has an execution opportunity at the deadline, or the Apple account, network, or CloudKit is unavailable, controlled CloudKit content and controlled backups are designed to retry cleanup at the next available execution opportunity. Until cleanup finishes, current supported versions are designed to report it as pending or partially complete and does not state that CloudKit cleanup has completed. After completion, minimal deletion-barrier metadata that contains no cat content may remain to keep supported clients from resurrecting old data. External copies, exports, participant copies, Apple or system backups outside App-level control, and arbitrary obsolete or modified clients are outside this App-controlled process.
Support emails and legal requests may be retained as long as needed to respond, comply with law, resolve disputes, and maintain security records.
The Online Emergency Card is an optional public projection separate from the offline QR and Co-Care. After the pet owner enables it and confirms the field set, the App compresses any selected profile photo on device, builds a minimized projection, and writes it with authenticated encryption to the Apple CloudKit public database. The public record contains ciphertext, a random nonce, format and generation information, and limited operational fields. The URL fragment in the complete QR or link carries the decryption key and is normally not sent to meowport.app or meowport.cn in a standard HTTP request. Apple's CloudKit response may still attach a creator identifier, timestamps, or other system metadata, and the website host may process request IP address, time, User-Agent, and error logs. Card links use meowport.cn for pet owners in Mainland China and meowport.app elsewhere, chosen automatically from the App Store region or by the pet owner in Settings; both addresses show the same page from the same encrypted record, and changing the choice does not change links already printed or written to a tag.
Anyone who holds the complete QR or link can read and further share the card. Sending the link through a messaging service may also provide the complete link to that service. The projection may include the cat's name, a metadata-stripped compressed profile photo, breed, masked last four pet-ID characters, blood type, allergies or cautions, critical history not marked recovered, current critical medications, and veterinarian or emergency contacts you are authorized to provide. It does not solicit human health data, the owner's home address, the complete pet ID, or insurance information. Free text is displayed as entered and may be incomplete, outdated, or not veterinarian-verified.
The pet owner may also select, separately for each cat, the default-off Recent 90-day context. When selected, the projection may include its covered date range, at most one plausible weight point per day, recorded-dose count and up to three medication names, care-visit and lab counts, latest recorded-care title and day, explicitly ongoing-condition count, bounded abnormal-lab flags and symptom observations, vaccine or deworming dates, and—when an included abnormal marker has numeric entries—up to six dated recorded values per marker, recorded units, factual flags, and reference bounds stored from the source report. The App does not project the complete underlying 90-day records, record identifiers, notes, attachments, locations, providers, costs, or exact event times for this field, and it does not label the numeric sequence as improving, worsening, stable, diagnostic, or a treatment recommendation. The summary is derived only from the same cat's pet-owner records and may be incomplete, outdated, affected by entry or unit errors, or not veterinarian-verified. After deselection, a later successful publication removes the summary, but external copies cannot be recalled.
The page displays the last successfully published content and its protected publication time. Once enabled, changed values, photo, and App theme within the existing field set may continue automatic publication. First enablement, field expansion, and link replacement require confirmation on the current publishing device. A legal or disclosure version change does not automatically remove the existing projection or block automatic updates within its existing field set, but the App will require the user to reconfirm at the next management or preview interaction.
Revocation or link replacement attempts to delete the former public record. If Apple services, the account, network, or device are temporarily unavailable, the UI may show revocation pending and continue retrying. Meowport cannot recall copies another person has saved, screenshotted, printed, cached, exported, or forwarded. Co-Care membership changes do not automatically change the Online Emergency Card, and vice versa.
A data export may include card state, selected field IDs, disclosure version, consent receipt summary, last successful publication time, and pending-cleanup generation count, but it excludes the complete link, record name, key, and nonce; importing the export does not automatically restore publication. When a cat or account is deleted, the App records a retryable cleanup intent before attempting to delete controlled public records and the private control record. Until CloudKit confirms deletion or confirmed absence, the UI is designed to describe the result as pending or partial.
Tap Emergency Card is an optional physical carrier for an existing Online Emergency Card. Only after the pet owner deliberately begins the operation, while the selected cat's online card remains active, the current device supports the required capability, and legal acceptance is current, the App uses Apple Core NFC / NFC Forum NDEF interfaces to attempt to inspect one tag's write status, capacity, and existing-message class, write the cat's existing complete Online Emergency Card HTTPS link as one NDEF URI record, and read it back from the same tag for comparison. Inspection, writing, replacement, read-back, and rewriting are Basic features; they do not require Meowport Pro or read subscription state. The tag does not separately receive the cat's name, photo, health records, contacts, account data, or Co-Care information. This feature adds no CloudKit record type or Meowport-operated server.
Inspection and read-back are handled in a short-lived on-device session. This Meowport feature does not collect, retain, upload, export, or use a tag UID, serial number, or product-unique identifier for analytics. Existing tag content is treated as untrusted input and only classified within bounded limits; the App does not intentionally open or upload it. Nonempty content other than an unconfigured official Tap Tag or the same current link requires the pet owner's confirmation before replacement. Apple, the device, or the underlying tag technology may still process information needed for normal operation under their respective terms.
After a successful write, a person able to read the physical tag may obtain, copy, and forward the complete Online Emergency Card link, with risks similar to holding the complete QR or link. The tag does not prove reader identity, cat ownership, tag authenticity, information freshness, or professional verification. Revoking or replacing an online link does not remotely rewrite a physical tag outside the pet owner's control. CloudKit deletion confirmation, device, network, tag, case, metal surface, placement, capacity, read-only state, and timing may affect results. After a link changes, the pet owner decides whether to write the tag again; QR remains available as a fallback.
Unconfigured official materials may use the same non-unique invitation, https://meowport.app/tap/setup?v=1, or for Mainland China https://meowport.cn/tap/setup?v=1. That static page does not request CloudKit, receive cat records, or contain an account, pet, order, activation, or referral identifier; ordinary hosting request logs may still be handled as described in this Policy. A valid Universal Link only routes the App to setup guidance. It does not select a cat, enable online publication, initiate a purchase, or start an NFC session. Purchasing an optional physical Tap Tag does not unlock or alter digital subscription access.
The Cat Return-Home Card is an optional public projection separate from the medical Online Emergency Card, offline QR, PDFs, and Co-Care. NFC is its only released carrier and entry point; the card still loads online. After the pet owner selects one owner-managed cat, previews the exact fields, confirms authority to publish natural-person contact and address information, accepts the current legal text, and confirms the separate return-home disclosure, the App builds a minimized projection and writes it with authenticated encryption to a distinct record type in the Apple CloudKit public database.
The selected projection may include the cat's name, metadata-stripped compressed profile photo, breed, coat color, sex, approximate age, masked pet-ID suffix, one required primary and one optional backup return-home contact, an optional area or full address, and a bounded owner-provided return note. Full address disclosure starts hidden and requires separate attestation. Medical records, complete pet identifiers, insurance, payment, Co-Care membership, and live location are excluded. The public record contains ciphertext, a random nonce, format and generation information, and limited operational fields. The complete URL fragment carries the decryption key and is normally not sent to meowport.app or meowport.cn in a standard HTTP request. Apple may attach creator, timestamp, or other system metadata; the website host may process request IP address, time, User-Agent, and error logs.
Anyone able to read the collar tag or obtain the complete bearer link can view, save, copy, or forward the selected information. Phone, message, and map actions pass the owner-selected value to the device handler chosen by the finder, which may be governed by a third party's terms and privacy practices. The page is not a public directory and the feature does not collect finder identity, tag-scan analytics, geolocation, or owner scan notifications. Owner-authored text may be incomplete or outdated; a reward note is not a payment service or guarantee operated by Meowport.
NFC inspection, writing, replacement, and read-back occur only after the owner starts the operation. The App classifies bounded existing NDEF content and does not collect, retain, upload, or export a tag UID, serial number, or product-unique identifier. A tag stores only one complete return-home HTTPS link. It does not separately store the cat's name, contacts, address, note, or medical records. Writing may replace prior content after confirmation, and revoking or replacing an online card cannot remotely rewrite a physical tag outside the owner's control.
Updating selected values may reuse the current random record and key. Link replacement or revocation attempts controlled-record deletion; external copies cannot be recalled. Cat and account deletion include retryable cleanup of the return-home public record, private control record, and protected local credential. A portable status export may include pet binding, generation, selected field identifiers, disclosure version, contact/address-presence flags, and last successful publication time, but excludes the complete link, record name, key, nonce, contact values, address values, return note, and decrypted finder content. Importing that status does not restore or enable publication.
You can:
Some settings, such as iCloud, CloudKit, App Store purchases, device backups, family sharing, and Apple account data, are controlled by Apple.
Depending on where you live, you may have rights to access, correct, delete, export, restrict, object to, or withdraw consent for personal information. Because most Meowport data is local or in your own iCloud account, many rights can be exercised directly in the App or through Apple settings.
For data you sent directly to us through support or legal contact, email legal@meowport.app. We may need to verify your request. We will not discriminate against you for exercising privacy rights.
California users: we do not sell or share personal information as those terms are used for cross-context behavioral advertising, and we do not knowingly collect personal information from children under 13.
EEA/UK users: where applicable, you may contact us about access, rectification, erasure, restriction, portability, objection, withdrawal of consent, or complaints. You may also contact your local data protection authority.
China-region users: where applicable, you may request access, copy, correction, deletion, explanation, withdrawal of consent, or account cancellation. iCloud service infrastructure and regional partners may be governed by Apple and regional iCloud terms.
We use Apple platform security where available, such as app sandboxing, Keychain for custom API keys, file protection where implemented, Apple CryptoKit for the narrow account-migration recovery quarantine described above, iCloud / CloudKit access controls, StoreKit, and Sign in with Apple. The quarantine's installation-local file key is separate from custom-provider API keys stored in Keychain. We do not guarantee perfect security.
To the extent permitted by applicable law, we cannot guarantee recovery or accept responsibility beyond liability the law requires when local copies, a CloudKit zone, account access, a device, storage, Apple services, or encryption keys are unavailable. This Policy does not exclude or limit consumer, privacy, data-protection, or other statutory rights that cannot lawfully be excluded or limited.
You are responsible for device passcodes, Apple ID security, iCloud sharing, Mac security, API provider security, exported packages, and who you share data with.
Meowport is not directed to children under 13, or under a higher minimum age that applies where they live (including under 14 in Mainland China and the applicable age from 13 to 16 in EEA member states). Children should not use Meowport to submit personal information without appropriate parent or guardian supervision and consent. If you believe a child provided personal information to us directly through support channels, contact legal@meowport.app or, in Mainland China, legal@meowport.cn.
Apple, iCloud, Apple Private Cloud Compute, custom AI providers, support tools, and website hosts may process data in different regions depending on your account, location, provider, and service settings. If you choose a provider outside your region, your data may be transferred there according to that provider's terms.
This Privacy Policy is provided only in Simplified Chinese and English, subject to the authoritative-language rule above. We do not provide machine-translated legal text in other languages because unreviewed legal translations can change legal meaning and create avoidable risk. If a court, regulator, app store, or platform requires another language, that text applies only to the extent mandatory law requires.
Meowport's current development and operation personnel are located in Shanghai, China. To the maximum extent permitted by law, disputes related to this Privacy Policy should first be raised with us at the contact address below and, if not resolved informally, should be handled in Shanghai, China through the competent court or, where mutually agreed or otherwise enforceable, arbitration seated in Shanghai, unless mandatory law requires otherwise.
We may update this Privacy Policy when the App, laws, platform requirements, or data flows change. The current version is identified in the App and on the applicable legal website. For actions that require current legal acceptance, the App may require acceptance of the current version before the action proceeds. Any additional notice or consent required by applicable law will govern.
https://meowport.appsupport@meowport.applegal@meowport.apphttps://meowport.cnlegal@meowport.cn本补充说明适用于meowport.cn官方在线应急卡（/e/）和猫咪归家卡（/r/），随本项功能正式上线生效。卡片内容由用户提供，喵护照不保证其真实性，请谨防受骗。请勿发布违反适用法律法规、侵犯他人合法权益、欺诈或其他违反相关服务条款而不适宜公开展示的内容。
用户主动公开的卡片以加密记录保存在iCloud/CloudKit。持完整分享链接的浏览器只读取该卡片记录并在浏览器本地解密；这不表示官网可查看或公开用户整个iCloud账户。
本机制不提供逐张卡片的发布前内容审核。网页可打开、记录未命中阻断名单或网站完成ICP备案，均不表示卡片内容已经审核通过或被喵护照认可。
收到举报后，我们会进行人工核实，并根据适用法律法规、相关政策及服务条款，视情况停止指定类型、指定记录的卡片在CN官方网页继续加载和展示；举报邮件本身不自动触发阻断。卡片发布者或相关权利人可通过下列邮箱说明异议、补充必要材料并申请复核。我们按适用要求核验处理，不承诺所有投诉均成立或固定时间内完成审核。
本项网页阻断本身不会删除或修改设备中的本地记录，也不等于删除iCloud/CloudKit源记录。其范围不覆盖国际站、已取得的明文、外部副本和旧版或修改后的客户端；更换记录标识可能不再命中原单卡决定。策略暂时不可用时，正常卡片（包括应急卡）也可能暂停展示并提供重试，这不等于违规认定；主页不因此停用。
为受理投诉与记录人工决定，我们处理主动提供的必要说明、卡片类型/必要标识或其摘要、案件编号、处理时间、负责人及复核记录。公开阻断策略不含解密密钥、卡片明文、联系人或投诉证据；记录标识摘要仍可关联记录，不称匿名数据。请仅提供核实所需的最少信息，不默认提交身份证件、完整能力链接、密钥或无关敏感资料。举报/复核邮箱：legal@meowport.cn或support@meowport.cn。这不是紧急求助渠道。
iCloud由Apple及适用地区的服务方按其条款独立提供。服务方因账户/内容违反适用条款或依法采取的限制访问、移除内容等措施，不属于本项网页阻断；喵护照不能代替其决定、撤销或保证恢复。请通过相应iCloud服务方寻求支持。本说明不排除或限制依法不得排除的喵护照责任、消费者权益、隐私权或其他法定权利。
This supplement applies to the Online Emergency Card (/e/) and Cat Return-Home Card (/r/) on meowport.cn and takes effect when this feature is published. Users supply card content. Meowport does not guarantee its accuracy; be alert to scams. Do not publish unlawful, infringing, fraudulent, or other content that violates applicable service terms and is unsuitable for public display.
Cards that users choose to publish are stored as encrypted records in iCloud/CloudKit. A browser with the complete share link reads that card record and decrypts locally in the browser; this does not give the website access to the entire iCloud account or make it public.
This mechanism does not review each card’s content before publication. A card being accessible, absent from the blocklist, or displayed on an ICP-filed website does not mean that its content has passed review or is endorsed by Meowport.
After receiving a report, we review it manually. Subject to applicable law, relevant policies and service terms, we may stop loading and displaying the specified card type and record on the official Mainland China webpages. A report alone does not automatically cause blocking. Publishers or affected rights holders may explain an objection, supply necessary information and request a review through the addresses below. We assess requests as applicable requirements demand; we do not promise that every complaint is substantiated or reviewed within a fixed period.
This webpage restriction itself does not delete or change records stored locally on your device, and does not mean that the iCloud/CloudKit source record has been deleted. It does not cover the international site, previously obtained plaintext, external copies, or old or modified clients. A new record identifier may fall outside an existing single-card decision. If the policy cannot temporarily be verified, normal cards, including emergency cards, may also pause display and offer Retry. This is not a finding of misconduct and does not disable the homepage.
To handle a report and record a human decision, we process the necessary information voluntarily provided, the card type and necessary identifier or its digest, case reference, processing time, responsible person and review record. The public policy excludes decryption keys, card plaintext, contact values and complaint evidence. Identifier digests can still be linked to records and are not anonymous. Provide only what is necessary for verification; do not send identity documents, complete capability links, keys or unrelated sensitive information by default. Report or request review at legal@meowport.cn or support@meowport.cn. These are not emergency-response channels.
iCloud is provided independently by Apple and the service provider applicable to your region under their terms. Their restrictions on access, removal of content or other measures for account/content violations or legal requirements are separate from this webpage restriction. Meowport cannot control, reverse, or guarantee recovery from those measures on their behalf. Contact the applicable iCloud provider for support. This supplement does not exclude or limit any Meowport liability or consumer, privacy or other statutory rights that cannot lawfully be excluded or limited.