更新日期：2026 年 10 月 30 日
本政策适用于 Better Day USA Inc 提供的补货本（Restock），包括 iPhone、iPad 与 Android 版本；iOS Bundle ID 与 Android 包名均为 org.zqnative.restock。隐私联系邮箱：[email protected]。
本地账本、照片与备份
商品、供应商、报价、采购订单和实际收货记录保存在您的设备上。日常本地记账无需注册或登录，也不会自动把整份账本同步到服务器。您拍摄或选择的原图、照片组和待核对资料保存在本机。
您可通过系统文件选择器导入 CSV，并保存或恢复 ZIP 完整备份。备份可能包含账本、照片组及引用原图，不包含云端登录会话。您决定保存位置；另存至网盘或分享给他人后，相关副本受保存方或收件方处理规则影响。请妥善保管备份。
可选账号连接
云端照片服务使用您已有的 ProductPal 账号。选择连接时，App 通过 HTTPS 发送登录邮箱和密码完成验证，并处理账号标识、权限和会话。App 在设备受保护的存储中保留会话，不把密码写入本地账本。服务器会保留账号及会话所需的记录，包括会话标识摘要、客户端信息、创建时间、最近访问时间和有效期。
App 当前不提供账号注册、注册引导或订阅支付。无需连接账号也可使用本地账本。退出或断开连接会清除设备上的对应会话，不等于删除 ProductPal 账号或已经上传的照片。
您主动使用的云端照片处理
支持 OpenAI API 的版本默认推荐 OpenAI；您已明确保存的服务选择会保留。每组照片发送前会显示接收服务并取得确认，失败不会自动改用另一服务。Gemini 仍需明确确认已满 18 岁。请以应用内的实际可用性和确认提示为准；本地账本和手工录入不依赖识图服务。
选择云端识图并确认后，App 会把该组照片的分析副本发送给现有 ProductPal 照片服务，并交给您选择的识别供应商处理。相关包装文字、条码和商品属性也可能随请求发送。识图不会自动上传整份账本、采购订单或供应商报价。请勿在商品照片和查询中放入身份证件、付款资料、他人面孔或其他不必要的个人信息。
选择 OpenAI 后，本组分析副本及必要的包装文字通过 ProductPal 发送到 OpenAI API。接口密钥仅保存在服务端受保护配置中，不嵌入 App；服务使用独立 API 项目额度，不使用 ChatGPT 对话额度。服务根据 Cloudflare 从网络推断的国家检查 OpenAI 支持地区，不请求设备 GPS 或定位权限。
OpenAI API 数据默认不用于模型训练，除非项目管理员另行选择分享。我们发送 store:false，不要求保存 Responses 对话，但这不等于零留存：OpenAI 的滥用监测数据通常可保留最多 30 天，法律或安全需要等例外以其政策为准。详见 OpenAI API 数据政策。本次 OpenAI 接入不启用付费网页搜索。
Gemini 临时识图由 Google 的 Gemini API 处理。使用前须明确确认已满 18 岁并同意相关云端处理；我们不要求您提交出生日期。服务会根据 Cloudflare 从请求网络推断的国家检查地区资格及适用计费条件，不请求设备 GPS 或定位权限。这种网络推断仍属于地区信息处理。部分地区或项目条件不满足时，Gemini 不可用。
Google 对输入、输出和运行信息的使用与保留取决于实际项目、付费状态、地区及条款。未付费服务可能使用输入和输出改进产品，并可能由人工审核。我们不承诺所有处理均不用于改进模型，也不承诺 Google 完全不保留数据。详见 Gemini API 条款与 Google 隐私政策。Google Search 联网补全目前保持关闭。
Cloudflare 模型推理和 Sign in with ChatGPT 当前保持关闭。公开资料查询限于应用内已开放的商品目录；选择条码查询时，有效条码会发送给 Open Food Facts 等界面注明的目录服务；这类公开目录查询不需要 ProductPal 登录，也不等于已提供全网搜索。目录未覆盖的资料可由您手工补充。您主动打开引用网页时，网页运营方会依其政策处理访问。
安全、保留与删除请求
App 的服务请求使用 HTTPS。ProductPal 照片服务采用按账号授权读取和加密存储；加密不代表没有收集，也不等于匿名或自动删除。上传副本及相关防滥用计量记录目前没有统一的自动到期删除期限。关闭 App、退出页面、断开连接或卸载不会自动删除云端副本。账号会话会到期，但到期不代表所有服务器记录立即物理删除。
服务及基础设施还会处理请求所需的网络地址、时间、客户端信息、请求标识与错误信息。具体基础设施日志保留受运行配置与服务方规则影响；我们不会把它描述成完全不记录。
本地资料由您管理，通常保留至您在设备上清除数据、卸载或通过恢复替换。您另行保存的 ZIP 文件不会随卸载一并删除。未上传给我们的本地账本，无法由我们远程访问或删除。
如需了解、更正或请求删除我们控制的 ProductPal／照片服务数据，请访问数据请求说明，或发邮件至 [email protected]。请说明关联邮箱、请求范围和大致使用时间，不要发送密码、会话、API key 或完整账本。我们将核验身份并处理相关请求；若因安全、法律义务或其他正当原因保留部分资料，会说明原因。第三方独立保留的数据可能需要按其流程另行请求。
权限、广告与结果核对
App 通过设备相机和系统照片选择器准备您明确选择的照片；iPhone／iPad 使用设备上的相机界面，Android 可调用外部相机。App 不请求整个媒体库的访问权限，系统文件选择器用于导入和备份。通知权限仅用于您开启的本机检查提醒，打开 App 时可根据本地资料更新提醒。当前 App 不含广告或 App 内购买，也未集成广告投放 SDK。
补货本面向店主与采购人员。识图和网页信息只作为待核对建议，不能保证商品身份、库存、营养、医疗用途、有效期或供应商现货。建议须您确认后才能加入本地商品，不会生成库存数量或供应商报价。
更新与联系
处理方式发生变化时，我们会更新本页，并在需要时于 App 内提示和取得确认。支持与隐私问题请联系 [email protected]。
Privacy policy
Updated October 30, 2026
This policy covers Restock (补货本) for iPhone, iPad and Android, provided by Better Day USA Inc. Its iOS bundle ID and Android package are org.zqnative.restock. Privacy contact: [email protected].
Local records, photos and backups
Products, suppliers, quotes, purchase orders and actual receipts are stored on your device. Local bookkeeping requires no account and does not automatically synchronize the full ledger to a server. Original photos, submission groups and review drafts remain on the device.
You may import CSV and save or restore complete ZIP backups through the system document picker. A backup may contain the ledger, photo groups and referenced originals, but excludes cloud login sessions. You choose its destination. Copies placed in cloud storage or shared with another person are subject to that provider's or recipient's handling. Keep backups secure.
Optional account connection
Cloud photo processing uses an existing ProductPal account. If you connect, the app sends your email and password over HTTPS for verification and handles account identifiers, permissions and sessions. The device keeps the session in protected storage, not the password in the ledger. The server retains account and session records needed for access, including a session-token digest, client information, creation, last-seen and expiry times.
The app currently offers no account registration, registration referral or subscription payment. Local bookkeeping works without connecting. Disconnecting clears the corresponding device session; it does not delete the ProductPal account or previously uploaded photos.
Cloud processing you choose
Versions that support OpenAI API recommend OpenAI by default and preserve a service you explicitly saved. Each photo group identifies its recipient and requires confirmation before sending; failures do not switch providers automatically. Gemini still requires explicit adult confirmation. Follow the actual availability and confirmation messages; local bookkeeping and manual entry do not depend on recognition.
When you choose and confirm cloud recognition, analysis copies of that photo group are sent through the existing ProductPal photo service to the selected recognition provider. Packaging text, barcodes and product attributes may accompany the request. Recognition does not automatically upload your full ledger, orders or supplier quotes. Avoid identity documents, payment details, other people's faces and unnecessary personal information.
If you choose OpenAI, analysis copies and necessary packaging text are sent through ProductPal to OpenAI API. The API key is held in protected server configuration, never embedded in the app. This uses separate API project usage, not ChatGPT conversation allowances. OpenAI country eligibility is checked using the network country provided by Cloudflare, without requesting device GPS or location permission.
OpenAI API data is not used for model training by default unless the project administrator opts in to share it. We send store:false rather than requesting stored Responses conversations. This is not zero retention: abuse-monitoring data may normally be retained for up to 30 days, with legal or safety exceptions governed by the provider policy. See OpenAI API data controls. Paid OpenAI web search is not enabled in this integration.
Temporary Gemini recognition is processed by Google through Gemini API. You must explicitly confirm that you are 18 or older and agree to the cloud processing; we do not ask for your birth date. The service checks country eligibility and applicable billing conditions using the country Cloudflare infers from the request network. It does not request device GPS or location permissions. Network-based country inference is still location-data processing. Gemini is unavailable where region or project conditions are unmet.
Google's handling and retention of inputs, outputs and operational information depend on the project, billing status, region and terms. Unpaid services may use inputs and outputs for product improvement and human review. We do not promise that all processing excludes model improvement or that Google retains no data. See the Gemini API terms and Google Privacy Policy. Google Search grounding is currently disabled.
Cloudflare model inference and Sign in with ChatGPT currently remain disabled. Online product lookup is limited to the directories enabled in the app. If you choose barcode lookup, the valid barcode is sent to the directory identified in the interface, such as Open Food Facts; this public-directory lookup does not require ProductPal sign-in and does not mean full-web search is available. You may enter information missing from a directory manually. External source pages you choose to open process visits under their own policies.
Security, retention and requests
App service requests use HTTPS. The ProductPal photo service uses account-authorized access and encrypted storage. Encryption does not mean data is uncollected, anonymous or automatically deleted. Uploaded copies and abuse-prevention metering records currently have no uniform automatic expiry. Closing, disconnecting or uninstalling does not automatically delete cloud copies. Sessions expire, but expiration does not mean every server record is physically deleted immediately.
Services and infrastructure also process network addresses, timestamps, client information, request identifiers and errors needed for requests. Infrastructure log retention depends on operating configuration and provider rules; we do not describe it as zero logging.
You manage local data, normally retained until you clear app data, uninstall or replace records through restore. Separately saved ZIP files are not removed by uninstalling. We cannot remotely access or delete a local ledger that was never sent to us.
To ask about, correct or request deletion of ProductPal/photo-service data under our control, use the data-request instructions or email [email protected] with the associated email, scope and approximate usage time. Do not send passwords, sessions, API keys or a full ledger. We will verify identity and process relevant requests, explaining any security, legal or other legitimate retention. Independently retained third-party data may require a separate request to that party.
Permissions and review
The app uses the device camera and system photo picker for photos you explicitly choose. iPhone and iPad use an on-device camera interface; Android may launch an external camera app. The app does not request broad media-library access. The system document picker is used for import and backup. Optional notification permission supports the local check reminders you enable; opening the app may update those reminders using local records. The app has no advertising or in-app purchases and includes no ad-delivery SDK.
Restock supports shop owners and purchasing staff. Image and web results are suggestions to review, not guarantees of identity, stock, nutrition, medical suitability, expiry or supplier availability. Confirm suggestions before adding them to the local catalog; they do not create stock quantities or supplier quotes.
Changes and contact
We update this page when processing changes and provide in-app notice and confirmation where needed. Contact [email protected] for privacy or support.