官网访问说明 / Website visits

本官网为静态页面，不设置分析追踪、广告追踪或登录 Cookie。访问时，承载页面的服务器会处理提供 HTTPS 页面所必需的 IP 地址、请求路径及浏览器请求信息。本官网站点配置关闭访问日志，不接收扩展中的收藏、截图或点击统计。通过邮箱联系时，邮件服务会处理你主动提供的邮箱和消息。以下正文说明浏览器扩展及可选同步服务的数据处理。

This static website uses no analytics, advertising trackers or login cookies. The hosting server processes IP addresses and request information needed to serve HTTPS pages. Access logging is disabled for this site. It does not receive extension bookmarks, screenshots or usage statistics. Contact emails are processed by the email service.

隐私说明 / Privacy Policy

适用版本 / Applies to: KuoPage (阔页收藏) 0.1.0 · 最后更新 / Last updated: 2026-10-29

简体中文

一句话概述

永久收藏、分组和缩略图默认只保存在设备上；只有你主动选择中国大陆服务区域、完成账户登录并确认首次合并，才会开启这些内容的同步。登录操作会向同步服务器发送你输入的邮箱或手机号、验证码及必要的请求校验信息；仅在相应通道开通后可用。邮箱验证码使用腾讯企业邮箱（Tencent Exmail）发送，腾讯会接收用于投递验证码的邮箱地址和消息；短信通道尚未启用。微信扫码入口保留，审核期间不启用。启用后，永久收藏同步会通过 HTTPS 将下文所列数据传输至 sync.kksd.cc（北京服务器）。没有统计分析（analytics）或远程代码。

1. 保存了什么、保存在哪里

自定义壁纸：你选择的本地 JPG、PNG 或 WebP 在设备内解码并重新编码为 JPEG，长边最多 2560 像素、编码后不超过 1 MB；输入文件最多 12 MB。处理后的图片保存在 chrome.storage.local 的 settings.customWallpaper，选用时也镜像到 localStorage 的 speeddial.appearance 以减少首屏闪烁。图片不上传；设置中可以移除。切换到内置壁纸会保留自定义图片供再次选择，直到你移除它。内置精选壁纸随扩展打包，预览和使用均不从图库网站加载。搜索框常驻开关也保存在本地设置中。

补充说明：

• 删除站点或分组时，记录会被标记为「已删除」而不是立刻物理移除，因此已删除站点的标题与网址仍会留在 IndexedDB 中，直到你卸载扩展（或清除该扩展的站点数据）。已删除站点的缩略图与点击记录则会在标记后 7 天内（以便撤销）保留，之后在打开新标签页、空闲时被清理。
• 内置的推荐图谱与预置站点是随扩展打包的静态文件，不是联网获取的。

2. 统计功能统计什么

• 仅在你于新标签页上点击已保存站点的图标、或在工具栏弹窗的「跳转」搜索中打开已保存站点时，记录一条：该站点的内部 ID 与点击时间（从弹窗打开稍后看页面只标记为已读，不记录点击）。不记录搜索内容（包括你在弹窗中输入的搜索词）、浏览历史、你在其他网站上的行为，也不记录页面内容。
• 用途仅限本地：在「统计」面板显示近 7 天点击数与常用站点、用于「久未访问」提示，并在「我的空间」中根据近期点击频率和访问日期汇集常用收藏、显示推荐依据标签。关闭统计后，「我的空间」改用最近收藏且不显示访问频率标签；清空统计后会重新计算。关联网站推荐仍只基于已保存的站点和随扩展打包的关系库、分类说明，不联网获取推荐，也不上传点击记录。
• 统计默认开启：在你关闭首次使用提示之前就已开始记录。首次使用提示中有「关闭」按钮；之后可在「设置」或「统计」面板中随时开关；关闭后不再记录。
• 清除：在「设置」或「统计」面板中点击「清除统计」，会删除所有点击记录。在「设置」中关闭统计时会询问是否同时清除已有数据；「统计」面板和首次提示中的「关闭」只停止记录、不会询问，你可随时通过「清除统计」清除。
• 点击记录只含站点 ID 与时间（不含网址）。你之后删除的站点，其点击记录不再计入统计图表和「常用站点」列表；这些记录在站点被删除后 7 天内保留（以便撤销），之后在打开新标签页、空闲时被清理。「清除统计」会立即删除全部点击记录。

2A. 页面截图（缩略图）

• 权限：本版本申请 activeTab 权限（见第 4 节）。弹窗打开时（点击工具栏按钮或按快捷键）默认显示「跳转」搜索，此时不读取当前标签页；只有在弹窗中选择「保存当前页面」后，扩展才读取当前标签页的网址与标题，并截取该标签页的可见部分。扩展不会在后台截图，也不会在你点击之前读取标签页内容。
• 保存：截图在弹窗内压缩成缩略图；只有你在弹窗中点击「保存」，缩略图才写入本机 IndexedDB 的 thumbnails 仓库。关闭弹窗而不保存，截图即被丢弃。
• 截图与缩略图默认保存在本机。若你启用中国大陆同步并确认首次合并，永久收藏的缩略图也会同步至 sync.kksd.cc；稍后看页面的图片不进入同步。
• 删除：「设置」→「缩略图」→「清除全部缩略图」会删除本机保存的全部截图（需在页面中再次确认）。删除站点后，其缩略图保留 7 天（以便撤销），之后在打开新标签页、空闲时被清理。
• 无法截图的页面：浏览器内部页面（如 chrome://、edge://）、本地文件与扩展商店页面无法截图；弹窗会说明原因，你仍可不带缩略图保存。
• 导出：默认不包含截图，见第 5 节。

2B. 稍后看

• 稍后看的页面（网址、标题、到期时间、已读时间）保存在本机 IndexedDB 的 sites 仓库中，不上传。
• 每个页面有一个到期时间（1、3、7 或 30 天，默认值可在「设置」中修改）。到期后页面进入「已过期」列表并保留 30 天，期间可恢复，或点击「永久删除」按钮删除（该按钮与删除站点的操作相同：只将记录标记为已删除，见第 1 节，并可在短时间内撤销，并不会立即物理清除）；超过这 30 天后，在下一次打开新标签页（空闲时）该页面会被标记为已删除，与第 1 节所述的已删除站点相同（标题与网址仍留在 IndexedDB 中，直到卸载扩展）。其缩略图按第 2A 节的规则处理：标记删除后保留 7 天，之后清理。
• 稍后看的页面包含在「导出数据」的文件中。
• 工具栏角标只显示待读数量，不需要额外权限。

3. 网络、统计分析与数据外传

• 同步为可选功能。只有主动点击检查登录方式、发送验证码或登录等操作并授权主机访问后，扩展才连接同步服务。登录会传输认证所需信息；永久收藏和缩略图在确认首次合并后才上传。邮箱优先提供，手机号依短信通道开通情况提供；微信扫码审核期间关闭。
• 启用同步后，传输永久收藏的完整网址、标题、分组、排序、创建/更新时间、删除或恢复状态，以及对应缩略图；数据和缩略图文件存放在北京服务器。传输使用 HTTPS 和账号令牌。
• 稍后看、点击统计、设置、壁纸与其他浏览历史数据继续只保存在本机，不会通过此同步上传。扩展没有 analytics、崩溃上报或远程代码。
• 登出会撤销当前会话并停止同步，不会删除本机数据或解除本地账号绑定。可从界面导出本地恢复快照；恢复快照只在本机生成。服务器保留删除墓碑以传播删除和恢复状态；本说明不提供服务器账号或数据自助删除方式。
• 浏览器关闭时不进行后台同步。浏览器打开且页面位于前台时，扩展会在打开、联网恢复、窗口聚焦时重试，并定期检查待同步内容；失败状态会显示并保留待处理操作。
• 测试阶段同步目标固定为 https://sync.kksd.cc:8443，备案完成后计划切回标准443端口。该主机的可选访问权限应仅限 https://sync.kksd.cc/*，并在用户启用同步时请求。没有内容脚本或后台页面。
• 以下情形由浏览器本身发起导航，不属于扩展的数据上传：你点击站点图标后打开该网站；你在搜索框提交搜索后：若所选为搜索引擎（Google / 百度 / Bing / GitHub），浏览器跳转到该引擎的结果页，搜索词会作为其网址的一部分被该服务接收，适用该服务自己的隐私政策；若所选为 AI 入口（DeepSeek、Kimi、通义千问、腾讯元宝），浏览器只打开该服务的首页，搜索词不会被带入所打开的网址，扩展也不把它发送到任何地方。
• 截图压缩、Speed Dial 2 备份文件的解析、稍后看的到期处理都在本机完成。启用同步时，符合条件的永久收藏与缩略图按上文说明传输。
• 站点图标通过浏览器的本地 _favicon 接口显示（见第 4 节）；扩展本身不发起请求。浏览器如何获取与缓存图标由浏览器控制，不在本扩展控制范围内。
• 自动化测试 build/no-network.test.ts 会静态扫描源码，检查同步服务以外的网络请求路径及远程代码构造；这是启发式检查，不是证明，无法覆盖 HTML/CSS、运行时拼接字符串或依赖项。DevTools Network 面板实测仍可用于核对（见 docs/manual-qa.md）。

4. 权限逐项说明

另外，扩展覆盖新标签页（chrome_url_overrides.newtab），这是其核心功能，不是一项权限。清单中的 commands（建议快捷键 Ctrl+Shift+X，Mac 上为 Command+Shift+X，可在 chrome://extensions/shortcuts 修改）只用于打开工具栏弹窗，也不是一项权限。从弹窗打开站点使用 chrome.tabs.create 新建标签页，不需要 tabs 权限。

5. 导出与删除全部数据

• 导出：「设置」中点击「导出数据」，会在你的设备上生成一个 JSON 文件，内含分组与站点（包括稍后看的页面）。默认不含截图缩略图；在「设置」中勾选「导出时包含缩略图」后，文件才会包含当前站点的缩略图（以 data: 图片形式写入 JSON，文件会变大）。该文件不包含点击统计与设置。可通过「导入 JSON」恢复，文件中若有缩略图也会一并恢复。Speed Dial 2 的备份文件可通过同一入口导入，在本机解析。
• 删除：在 chrome://extensions（或 edge://extensions）中移除本扩展，浏览器通常会一并删除该扩展的存储数据（具体行为取决于浏览器）。仅想清除统计，用「清除统计」。
• 截图：「设置」→「缩略图」→「清除全部缩略图」删除本机保存的全部截图。
• 单个站点或分组可在界面中删除（但见第 1 节关于「已删除」标记的说明）。

6. 同步服务状态

邮箱登录需要配置发信服务，手机号登录需要接入短信服务；微信扫码在审核期间关闭。公开上线尚未完成。未启用同步时，数据仍只保存在本机。AI 入口只会打开对应服务首页，扩展不会把你输入的问题发送给 AI 服务。

账户验证数据 / Account verification data

服务端保存已验证的邮箱或手机号与内部账户ID的关联，用于登录和绑定。验证码本身不存储或记录到日志，只保存基于服务端密钥的摘要；验证码5分钟有效，输错5次失效，一次使用。过期请求会在后续验证码申请时清理（保留不超过约24小时的清理缓冲，服务无请求时可能更久）；防刷计数保留约24小时，包括接收地址和来源IP的哈希及发送时间。数据库内只保存会话令牌摘要；设备本地保存登录令牌，退出会撤销当前会话。退出不会删除账户身份或云端收藏。

The server retains verified email/phone identities linked to an internal account ID. Codes are not stored or logged in plaintext; keyed digests are retained. Codes expire after5minutes, become invalid after5wrong attempts, and are single-use. Expired requests are cleaned on later code requests with roughly a24hour cleanup buffer (longer when no new requests occur). Rate budgets retain hashed destination/IP and send timestamps for roughly24hours. Only session-token hashes are stored server-side; the device keeps the bearer token. Sign-out revokes that session without deleting account identities or cloud favorites.

7. 联系方式

service@kksd.cc

English

In one sentence

Permanent favorites, groups and thumbnails stay on the device until you choose Mainland China, sign in to an account and confirm the initial merge. Code-based sign-in sends authentication information to our server and its configured delivery provider; WeChat QR sign-in remains disabled pending approval. When enabled, optional permanent-favorites sync sends the data described below over HTTPS to sync.kksd.cc, a server in Beijing. There is no analytics or remote code.

1. What is stored and where

Custom wallpaper: a locally chosen JPG, PNG or WebP (up to 12 MB) is decoded and re-encoded on the device as a JPEG with a maximum long edge of 2560 pixels and encoded size of 1 MB. The processed image is stored in chrome.storage.local at settings.customWallpaper; while selected, it is also mirrored in localStorage at speeddial.appearance to reduce first-paint flashing. It is never uploaded and can be removed in Settings. Choosing a built-in wallpaper retains the custom image until you remove it. Curated built-in images are packaged with the extension; previews and backgrounds do not load from a photo website. The pinned-search preference is also stored in local settings.

Notes:

• Deleting a site or group marks the record as deleted rather than physically removing it, so a deleted site's title and URL remain in IndexedDB until you uninstall the extension (or clear its site data). A deleted site's thumbnail and click records are kept for 7 days (so that Undo still works), then cleaned up when a new tab opens while idle. This marker is also what powers the short "Undo" notice shown after you delete a single site.
• The built-in recommendation graph and preset sites are static files packaged with the extension, not fetched online.

2. What the statistics feature counts

• Only when you click a saved site's tile on the new tab page, or open a saved site from the toolbar popup's Jump search, one record is written: that site's internal ID and the click time (opening a read-later page from the popup only marks it read; no click is recorded). It does not record search text (including what you type in the popup), browsing history, your activity on other sites, or page content.
• It is used only locally: the Statistics panel, the "not visited lately" hints, and My Space's frequent favorites and usage labels based on recent clicks and usage days. With statistics disabled, My Space shows recent favorites without usage labels; clearing statistics recalculates the list. Related website recommendations still use saved sites and the bundled relationship catalog and category descriptions, without fetching recommendations or uploading click records.
• Statistics are on by default: recording starts before you dismiss the first-use notice. The notice has a "Turn off" button; you can also toggle it any time in Settings or the Statistics panel; when off, nothing is recorded.
• Clearing: "Clear statistics" in Settings or the Statistics panel deletes all click records. In Settings, turning statistics off offers to clear existing data; the Statistics panel and the first-use notice's "Turn off" button turn recording off without that prompt. You can clear at any time via "Clear statistics".
• Click rows contain only the site ID and time (no URLs). Click rows of sites you later delete are no longer counted in the weekly chart or the Top list; they are kept for 7 days after the deletion (so that Undo works), then cleaned up when a new tab opens while idle. "Clear statistics" deletes all click rows at once.

2A. Page screenshots (thumbnails)

• Permission: this version requests the activeTab permission (see section 4). The popup (opened with the toolbar button or its keyboard shortcut) starts on the Jump search, which does not read the current tab; only after you choose "Save this page" does the extension read the current tab's URL and title and capture the visible part of that tab. The extension does not take screenshots in the background and does not read a tab before you click.
• Saving: the screenshot is compressed to a thumbnail inside the popup; the thumbnail is written to the thumbnails store in IndexedDB on this device only when you press "Save" in the popup. Closing the popup without saving discards the screenshot.
• Optional sync: thumbnails are local by default. After mainland sync and initial merge consent, permanent-favorite thumbnails also sync to sync.kksd.cc. Read-later thumbnails remain local. Clearing the local cache does not delete synced images; they download again while sync is enabled.
• Deleting: Settings → Thumbnails → "Clear all thumbnails" deletes every stored screenshot (after an in-page confirmation). When you delete a site, its thumbnail is kept for 7 days (so Undo still works), then removed when a new tab next opens while idle.
• Pages that cannot be captured: browser pages (such as chrome:// or edge://), local files and extension store pages cannot be captured; the popup says why, and you can still save the site without a thumbnail.
• Export: screenshots are not included by default, see section 5.

2B. Read later

• Read-later pages (URL, title, expiry time, read time) are stored in the sites store in IndexedDB on this device and are not uploaded.
• Each page has an expiry time (1, 3, 7 or 30 days; the default can be changed in Settings). After it expires the page moves to the "Expired" list and is kept for 30 days, during which you can restore it, or delete it with the "Delete forever" button. That button does the same as deleting a site: it only marks the record as deleted (section 1, with a short Undo), and does not physically erase it; once those 30 days have passed, the next new tab opened while idle marks it as deleted, the same as a deleted site in section 1 (its title and URL stay in IndexedDB until you uninstall the extension). Its thumbnail follows the rule in section 2A: kept 7 days after the deletion mark, then cleaned up.
• Read-later pages are included in the "Export data" file.
• The toolbar badge shows only the number of pending pages and needs no extra permission.

3. Network, analytics and data leaving the device

• Sync is optional. The extension connects only after an explicit availability check, code request or sign-in action and host permission. Authentication sends the entered email/phone, code and request proof to the sync server. Favorites and thumbnails upload only after initial merge consent. Email is prioritized, phone depends on SMS service availability, and WeChat QR sign-in remains disabled pending approval. Email codes are delivered through Tencent Exmail, which receives the recipient email address and verification message. SMS delivery is not enabled.
• When enabled, sync transmits permanent favorites’ full URLs, titles, groups, ordering, creation/update times, deletion/restoration state, and associated thumbnails. Data and thumbnail files are stored on a Beijing server. Transfers use HTTPS and account tokens.
• Read-later items, click statistics, settings, wallpapers, and other browsing history remain local and are not uploaded by this sync feature. The extension has no analytics, crash reporting, or remote code.
• Signing out revokes the current session and stops sync; it keeps local data and the local account binding. A local recovery snapshot can be exported from the UI. The server retains deletion tombstones to propagate deletion and restoration; this policy does not claim a self-service server account or data deletion feature.
• Sync does not run in the background while the browser is closed. While the browser is open and the page is foregrounded, it retries on open, reconnection and focus, and checks periodically. Failed work remains queued and its status is shown.
• During testing, the sync target is fixed at https://sync.kksd.cc:8443; standard port443 is planned after ICP activation. Its optional host access should be limited to https://sync.kksd.cc/* and requested when the user enables sync. There are no content scripts or background page.
• Screenshot compression, Speed Dial 2 backup parsing and read-later expiry handling happen on the device. When sync is enabled, eligible permanent favorites and thumbnails are transmitted as described above.
• The browser itself navigates when you click a site tile, or submit a search: if the engine you chose is a search engine (Google / Baidu / Bing / GitHub), the browser goes to its results page, and that service receives your query as part of the URL under its own privacy policy. If you chose an AI entry (DeepSeek, Kimi, Tongyi Qianwen, Tencent Yuanbao), the browser only opens that service's home page; the query is not carried into the opened URL and the extension does not send it anywhere. This is navigation you initiate, not data upload by the extension.
• Site icons are shown via the browser's local _favicon endpoint (see section 4); the extension itself makes no request. How the browser obtains and caches icons is controlled by the browser, not by the extension.
• The automated test build/no-network.test.ts statically scans source for network paths outside the sync service and for remote-code constructs. It is a heuristic, not proof: it cannot cover HTML/CSS, strings built at runtime, or dependencies. DevTools Network inspection can still be used as a cross-check (see docs/manual-qa.md).

4. Permissions, one by one

The extension also overrides the new tab page (chrome_url_overrides.newtab); this is its core function, not a permission. The manifest's commands entry (suggested shortcut Ctrl+Shift+X, Command+Shift+X on Mac, changeable at chrome://extensions/shortcuts) only opens the toolbar popup and is not a permission either. Sites opened from the popup use chrome.tabs.create, which needs no tabs permission.

5. Exporting and deleting all data

• Export: "Export data" in Settings creates a JSON file on your device containing groups and sites (including read-later pages). By default it has no screenshot thumbnails; tick "Include thumbnails when exporting" in Settings and the file will contain the thumbnails of your current sites (written as data: images in the JSON, so the file gets larger). It does not contain click statistics or settings. "Import JSON" restores it (and any thumbnails in the file). Speed Dial 2 backup files can be imported through the same entry and are parsed on the device (sites whose URL is longer than 2048 characters are skipped and counted in the result message; names and titles over 40 / 500 characters are shortened).
• Delete: remove the extension in chrome://extensions (or edge://extensions); the browser usually deletes its stored data (browser-dependent behavior). To clear only statistics use "Clear statistics".
• Screenshots: Settings → Thumbnails → "Clear all thumbnails" deletes every stored screenshot.
• Individual sites and groups can be deleted in the UI (but see section 1 on the "deleted" marker).

6. Sync service status

Email sign-in requires a configured delivery service. Phone sign-in needs a separate SMS integration. WeChat QR sign-in remains disabled pending approval. Public launch has not been completed. Without sync enabled, data stays on this device. AI entries only open the corresponding service home page; the extension does not send your question to an AI service.

7. Contact

service@kksd.cc