AI-Tools Privacy Policy

Translation notice: This English translation is provided for convenience only. In case of any inconsistency or conflict, the Chinese version shall prevail.

This Policy is governed by the Chinese version. We may provide translations in other languages; where a translation is inconsistent with the Chinese version, the Chinese version shall prevail, except where applicable law mandatorily provides otherwise.

1. Scope and Roles

1.1 This Policy explains how we collect, use, store, share, and protect personal information when you download, install, and use AI-Tools (the "Software") and use related online services (collectively, the "Services"), and the rights you enjoy. We process personal information in accordance with the Personal Information Protection Law of the People's Republic of China (《中华人民共和国个人信息保护法》), the Cybersecurity Law (《网络安全法》), the Data Security Law (《数据安全法》), and other applicable laws. In this Policy, "we" means the Operator identified at the beginning of this Policy, and "you" means the natural person or organization using the Services.

1.2 The Software is a local configuration management tool and is not a provider of generative artificial intelligence services. The Software is used to browse, install, edit, and back up MCP Server configurations and Agent Skills, and to assist you in writing configurations into the AI clients already installed on your local machine. The Software does not provide AI model services and does not upload to us your conversations, prompts, or model outputs in your AI clients.

1.3 Role distinctions:

• The AI-Tools client and official website: we process local data generated when you use the client, and the client activation information submitted when you activate or re-verify a license (see Section 2.1).
• The billing platform: account registration/login, orders, payments, refunds, subscriptions, the checkout page, and the account management page are independently operated by the billing platform, and its Billing Platform Privacy Policy applies. AI-Tools does not receive or store your payment account or card information.
• Processed only on your device: your client configurations, MCP Server environment variables and keys, Skills content, historical backups, runtime environment information, etc. are by default processed only on the local machine and are not uploaded by us, unless you actively push them to a cloud destination you have designated yourself through the "Cloud Sync" feature.
• Cloud destinations you designate yourself: Cloud Sync supports Git repositories and SFTP servers, with the destination address and credentials provided by you. We provide only the transmission tool and do not handle or store your synced content; the operator of that cloud destination processes information under its own terms and privacy policy.
• Independently processed by third parties: MCP/Skills store data sources, GitHub, AI clients and model providers, third-party payment institutions, advertising service providers, font and DNS service providers, etc. process information independently, and their respective privacy policies apply. Our own email service is not governed by a third-party policy; its processing is governed by this Policy.

1.4 This Policy does not apply to third-party websites, third-party AI clients, third-party MCP Servers or Skills, third-party cloud storage/code hosting services, or any external links you access through the Software.

1.5 If you are a minor, please read this Policy and the Terms of Service together with your guardian before using the Services.

2. What Information We Collect

We follow the principles of lawfulness, legitimacy, necessity, and good faith, and process only the information necessary to achieve specified purposes.

2.1 Information Uploaded to Us

The AI-Tools client submits "client activation information" when you activate or re-verify a license, and reports pseudonymous daily activity statistics. Account, order, payment, refund, and subscription data are processed by the billing platform and are not covered by this section.

We collect only client activation information and pseudonymous client activity statistics, not your account profile, configuration, conversation content, or page behavior.

Note: When you open the billing checkout page from the client, the link may contain a machine code hash as a query parameter. That URL may be recorded by your browser, your network service provider, or the checkout page's server; a machine code hash is device identifier information and may constitute personal information. The billing platform's processing of checkout data is governed by its Billing Platform Privacy Policy.

Activity statistics use only HMAC-SHA256 digests salted per product; no email, license key, configuration, conversation content, or IP address is uploaded to the console, and the console cannot use them for cross-product association or to recover plaintext.

2.2 Information Processed Primarily on Your Local Machine

The following information is read, generated, or stored by the Software on your device to provide local functionality. Except for data transmitted to the extent necessary to perform functionality you have actively requested, such as account access tokens and Cloud Sync credentials, we do not actively collect or upload this information:

1. Client detection information: the AI clients installed on the local machine, common paths of configuration files, and installation status; to complete detection, the Software may read common installation directories, configuration files, or relevant system registry entries.
2. Client configuration content: MCP configuration files (JSON/TOML/YAML, etc.) read, edited, or written through the Software, which may contain commands, parameters, environment variables, API Keys, access tokens, request headers, etc. that you have entered. This content is processed only on the local machine.
3. Skills content: Skills files and SKILL.md content that you install, import, edit, or export; local .zip/.skill files or folders that you actively select.
4. Historical backups: local backups automatically generated by the Software before modifying configurations (by default, a maximum of 50 are retained), which may contain the above configuration content and keys. Backups are stored only on the local machine.
5. Credentials and keys: platform API tokens, Cloud Sync credentials, account access tokens, the license ledger, etc. We store sensitive credentials in encrypted form; account access tokens are used only when making requests to our account service.
6. Runtime environment information: the versions and executable paths of local runtimes such as Node.js, Python, and Git, used only for environment detection and display.
7. Device hardware factors (raw values): raw factors such as CPU, disk, motherboard, and operating system installation identifier are used locally only to derive the machine code; raw hardware serial numbers are not uploaded. The derived salted hash (machine code) is the license and device binding information described in Section 2.1. Raw factors may be cached on the local machine.
8. Preferences and cache: theme, interface language, store list cache, installation status, etc.
9. Local logs: runtime logs are written only to the local console/local environment, and sensitive fields are redacted; the Software does not automatically upload logs. If you actively send logs to us for troubleshooting, we will use them only for that purpose.
10. Inspector debugging content: the parameters and returned results of the MCP Tools/Resources/Prompts you invoke are displayed and recorded only locally and are not uploaded to us; a remote MCP Server will process your requests under its own privacy policy.

Tip: Content written into AI client configuration files is usually stored in the format required by that client and may be in plain text. Please properly protect your device account, disk encryption, and backup media. Historical backups may also contain keys, so please clean them up yourself before exporting, sharing, or disposing of the device.

2.3 Information Received Directly by Third Parties

When you use the following features, your device or our services will interact with the corresponding third parties. Third parties process information under their privacy policies; we receive only the result information necessary to complete the feature (if any):

The above third parties may be located outside your country/region. We cannot control their information processing activities, and we recommend that you read their privacy policies before use; if you do not wish the relevant third parties to receive information, please stop using the corresponding features. Our own email service is deployed in Hong Kong, China; see Section 6.2 for details.

2.4 Information We Do Not Collect

Other than information you actively provide or that is necessary for the above features, we do not collect:

• the content of your conversations, prompts, and model outputs in AI clients;
• your contacts, text messages, call records, precise geographic location, biometric information, or health information;
• your full bank card number, CVV, or payment password;
• your complete browsing history in your browser;
• advertising identifiers or cross-app tracking identifiers created by us.

The Software does not enable page-level behavioral analytics or event-tracking SDKs, and does not collect your configuration, conversation content, or page events; it collects only the client activation information and pseudonymous client activity statistics described in Section 2.1 (device/account digests, client version, plan type, active time), used for daily active statistics and product improvement. For information processing by the third-party advertising component (Overwolf, which may load only in specific free versions and when not activated), see Section 2.3.

We do not sell your personal information, and we do not provide your account email or order information to advertising partners.

2.5 Sensitive Personal Information

Account passwords are processed by the billing platform under its privacy policy. Sensitive information processed locally by the Software includes client access tokens, license keys, Cloud Sync credentials, and API Keys in MCP configurations, which may constitute sensitive personal information or highly sensitive data. We process them only for license verification or functionality you actively use, and we adopt measures such as encrypted transmission, encrypted storage, access control, and log redaction. Where applicable law requires us to obtain your separate consent for the processing of sensitive personal information, we will obtain it separately.

2.6 Circumstances in Which Consent Is Not Required

Under applicable law, we may process personal information without your consent in the following circumstances: where necessary to conclude or perform a contract to which you are a party; where necessary to perform statutory duties or legal obligations; where necessary to respond to public health emergencies or to protect the life, health, and property safety of natural persons in emergency situations; where processing information you have made public yourself or other information lawfully made public within a reasonable scope; and other circumstances prescribed by laws and administrative regulations.

3. Purposes and Legal Bases for Processing

We do not engage in automated decision-making based on your account profile, nor do we make decisions that significantly affect your rights solely through automated means. Advertising targeting (where applicable) is carried out by third-party advertising service providers under their own policies and applicable law; in jurisdictions that require prior consent, we will load advertising components or display personalized advertising only after obtaining consent.

4. Sharing, Entrusted Processing, and Disclosure

4.1 Entrusted Processing

The AI-Tools official website and download page may use cloud hosting providers; license, account, order, payment, and refund services are provided by the billing platform, whose entrusted processing and sharing arrangements are described in the Billing Platform Privacy Policy. Client activity statistics are processed by our self-hosted console (console.ywhome.top), which receives only the digests, version, plan, and active time described in Section 2.1. Verification code and notification emails are sent by our own email service. We require entrusted parties to process information in accordance with our instructions, this Policy, and applicable law, and to adopt confidentiality and security measures.

4.2 Independent Third Parties

As described in Section 2.3, store data sources, GitHub, font and DNS service providers, advertising service providers, third-party payment institutions, the cloud destinations you designate, and others are independent third parties, and their information processing is governed by their own policies. We do not provide them with your account password, account access token, or order details, except where necessary to complete functionality you have actively requested (for example, a payment institution processing an order).

4.3 Statutory Disclosure

We may disclose information in accordance with laws and regulations or mandatory requirements of judicial or administrative authorities. Where permitted by law, we will review the lawfulness of the request and limit the scope of disclosure to the minimum necessary.

4.4 Merger, Acquisition, or Asset Transfer

In the event of a merger, acquisition, reorganization, or asset transfer, your information may be transferred as part of the assets. We will require the recipient to remain bound by this Policy; if the purpose of processing changes materially, we will provide separate notice and obtain consent in accordance with law.

4.5 No Sale or Rental

We do not sell or rent your personal information, and we do not provide your account information to third parties for cross-context behavioral advertising.

4.6 Public Disclosure

We will not publicly disclose your personal information except with your separate consent or as otherwise provided by laws and regulations.

5. Cookies and Local Storage

5.1 The desktop client mainly uses local storage (such as localStorage and local encrypted files) to store login state, theme, language, cache, and settings. This storage is necessary to provide functionality.

5.2 The official website and download page may use Cookies or similar technologies (such as localStorage) to remember preferences such as language; we do not place our own advertising Cookies on these pages. The checkout page and account management page are operated by the billing platform, whose Cookie/local storage rules are described in the Billing Platform Privacy Policy.

5.3 The advertising component in overseas versions (Overwolf) may use identifiers or similar technologies in its advertising container; such processing is carried out by Overwolf under its own policy.

5.4 You can manage Cookies and local storage through client settings, by clearing local data, or through browser settings. After clearing, you may need to log in again or may lose some settings.

6. Storage Location and Cross-Border Transfer

6.1 Your local configurations, Skills, backups, credentials, etc. are stored on your device by default.

6.2 AI-Tools client data is stored on your device by default. The license service, the billing platform (accounts, orders, payments, refunds), and the console activity-statistics service are deployed in the mainland People's Republic of China (Alibaba Cloud); the billing platform's personal information processing and cross-border arrangements are described in its privacy policy. The email service used to send verification codes and notifications is deployed in Hong Kong, China. When you use that email service, your email address, email verification code, and email content are transmitted to the mail server located in Hong Kong, China, which constitutes provision of personal information outside the mainland PRC. We will, in accordance with applicable law, provide notice, obtain separate consent, conduct security assessments, or adopt other statutory safeguards.

6.3 Overseas third-party services that you access directly (such as GitHub, Google Fonts, Overwolf, and overseas store data sources) process information independently, and such access usually does not constitute our provision of personal information overseas; however, you should understand the risks of the relevant cross-border processing.

6.4 If you need to understand the specifics of our provision of personal information overseas, you may contact us through the means set out at the end of this Policy.

7. Retention Periods

We retain personal information only for the shortest period necessary to achieve the purposes of processing, unless otherwise provided by law:

After the retention period expires, we will delete or anonymize the relevant information; if deletion is not immediately possible for technical reasons, we will cease processing other than storage and necessary security protection. We may retain statistical data that has been anonymized or aggregated and cannot be used to identify you.

8. Security Measures

We adopt reasonable technical and organizational measures appropriate to the risks to protect information, including:

• encrypting network transmission via TLS/HTTPS;
• storing sensitive data such as account access tokens saved locally by the client, platform API tokens, Cloud Sync credentials, and the license ledger using safeStorage or encryption such as AES-256-GCM; the storage method for login tokens on billing web pages is described in the Billing Platform Privacy Policy;
• uploading only a salted hash of the machine code, and not uploading raw hardware serial numbers;
• redacting logs to avoid recording complete tokens, keys, and machine codes;
• isolating the main process, preload scripts, and renderer processes in layers, so that the renderer layer can access capabilities only through allowlisted IPC channels;
• allowing external links to be opened in the system browser only via http/https;
• enabling secure DNS (DoH) to reduce the risk of DNS poisoning;
• implementing identity authentication, permission control, rate limiting, and security auditing for the license service (billing platform), as described in its privacy policy;
• applying least-privilege and confidentiality requirements to internal personnel.

Security boundary statement: No system can guarantee absolute security. The security of local data depends to a large extent on your device account, disk encryption, system updates, and operating habits. Client configuration files may be stored in plain text; please avoid storing highly sensitive keys on shared devices and back up important data regularly.

In the event of a personal information security incident, we will promptly take remedial measures as required by applicable law, notify you by email, in-app notification, or public announcement, and report to the regulatory authorities where necessary.

9. Your Rights

To the extent permitted by applicable law, you have the following rights with respect to your personal information:

1. Right to know and decide: to understand how we process your personal information, and to restrict or object to processing (except as otherwise provided by law).
2. Right to access and copy: to obtain a copy of your personal information. For account, license, order, and other billing platform data, please apply under the Billing Platform Privacy Policy; AI-Tools local data can be viewed, exported, or copied by you.
3. Right to rectify and supplement: to request correction of inaccurate or incomplete information.
4. Right to erasure: to request deletion of your personal information under statutory circumstances.
5. Right to withdraw consent: for processing based on consent, you may withdraw your consent at any time; withdrawal does not affect the validity of processing carried out before the withdrawal.
6. Right to data portability: to obtain your information in a structured, commonly used, and machine-readable format under the conditions provided by applicable law.
7. Account cancellation: please apply to cancel your account in the manner described in the Billing Platform Privacy Policy; account-related benefits, order inquiries, and Cloud Sync licenses will terminate under the billing terms. Please delete AI-Tools local data yourself in accordance with Appendix A.
8. Right to explanation: to request that we explain our personal information processing rules.
9. Complaints and reports: to complain to regulatory authorities or raise objections with us.
10. Personal information of deceased persons: to the extent permitted by applicable law, close relatives of a deceased person may, in accordance with law, access, copy, rectify, or delete the deceased person's relevant personal information, except as otherwise provided by law.

How to exercise: Please send an email to service@ywhome.top stating your request and the necessary identity verification information. After verifying your identity, we will respond within 15 business days (or within 1 month where EEA/UK law applies); where an extension is needed due to complexity, we will explain the reasons. We do not charge a fee for reasonable requests; for requests that are repetitive, exceed a reasonable scope, or may harm the rights and interests of others, we may refuse and explain the reasons.

Exceptions: If laws require us to retain certain information (for example, transaction records or network logs), or if deletion would impede the lawful rights and interests of others, judicial proceedings, or public safety, we may be unable to delete the information immediately, but we will cease processing other than storage and necessary security protection.

If you are dissatisfied with our response, you may complain to the personal information protection regulator with jurisdiction; EEA/UK users may also complain to their local data protection authority.

9.1 Additional Notes for EEA, UK, and Swiss Users

If you are located in the European Economic Area, the United Kingdom, or Switzerland, we process your information on the legal bases set out in Section 3 of this Policy, such as performance of contract, legitimate interests, consent, and legal obligations. You have the rights to access, rectification, erasure, restriction of processing, objection to processing, data portability, and withdrawal of consent. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. You have the right to complain to your local data protection authority. If applicable law requires us to appoint a representative in the relevant jurisdiction, we will publish the representative's information on our official website.

9.2 Additional Notes for California Residents

If you are a California resident and the California Consumer Privacy Act (CCPA/CPRA) (《加州消费者隐私法》) applies, we inform you as follows:

1. Categories of information collected: hashed device machine code and client activation information. Account, order, payment, and refund data on the billing platform are described in the Billing Platform Privacy Policy. We do not collect your conversation content or precise location for the purpose of building user profiles.
2. No sale: We do not sell your personal information, and we do not provide your account email or order information to advertising partners. The advertising component in overseas versions is loaded directly by Overwolf, and its collection activities are governed by its privacy policy; if applicable law treats the relevant activities as "sharing", you may contact us to learn more and exercise your right to opt out.
3. Your rights: to know, access, delete, correct, opt out of sale/sharing, limit the use of sensitive personal information, and not be subject to discrimination. You may submit requests via service@ywhome.top; we will respond within 45 days after verifying your identity. You may also make requests through an authorized agent, and we may require proof of authorization.
4. Minors: We do not knowingly sell or share the personal information of consumers under 16 years of age.

9.3 Other Jurisdictions

If your jurisdiction grants you additional personal information rights, we will protect them in accordance with local law. You may contact us through the means set out at the end of this Policy.

10. Protection of Minors

10.1 The Services are primarily intended for professionals with full civil capacity. Children under 14 years of age may not register an account, purchase a subscription, or use features that require an account. Minors aged 14 or older but under 18 should use the Services with the consent and guidance of their guardian; where payment is involved, it should be completed or consented to by the guardian.

10.2 If your jurisdiction sets a higher age for minors, local law shall prevail. We do not knowingly collect children's personal information, and we do not knowingly serve personalized advertising to children. If we discover that we have inadvertently collected children's personal information, we will delete it as soon as possible.

10.3 If you are a guardian and discover that a minor has used the Services without consent or has provided information to us, please contact us at service@ywhome.top.

11. Third-Party Content and External Links

11.1 The Software aggregates and displays MCP Servers, Skills, and their metadata from third-party data sources. We are not the publisher of such content and do not control its privacy practices. When you install, run, or use third-party MCP Servers/Skills, you may send information to third parties or allow them to access local resources; please read their licenses and privacy policies before use.

11.2 External links in the Software are opened in the system browser. Information processing by third-party websites is governed by their own privacy policies, and this Policy does not apply to such websites.

11.3 The Software does not provide AI generation services. The data processing relationship between you and your AI client or model provider is agreed between you and that third party; we do not receive your conversation content.

12. Updates to This Policy

12.1 We may revise this Policy due to business adjustments, legal changes, or feature updates. The revised Policy will be published on the official website or in the client, and the "Last updated" date will be updated.

12.2 For material changes (for example, adding new categories of information collected, changing the purposes of processing, sharing information with new third parties, or materially changing cross-border transfer arrangements), we will notify you in advance through reasonable means such as announcements on the official website, in-client pop-ups, or email; where required by applicable law, we will obtain your consent again.

12.3 If you do not agree with the revised Policy, please stop using the relevant features or cancel your account; continued use constitutes your acceptance of the revised Policy.

13. Contact Us

If you have any questions, comments, complaints, or rights requests regarding this Policy, please contact:

• Operator: 湖南湘江新区晏宁智算科技工作室
• Registered address: Changsha, Hunan, People's Republic of China
• Contact email: service@ywhome.top
• Personal information protection officer: service@ywhome.top
• Response time: within 15 business days (within 1 month where EEA/UK law applies)

If you believe that our processing activities have harmed your lawful rights and interests, you may also complain to regulators such as the cyberspace administration and market regulation authorities, or bring a lawsuit before a people's court with jurisdiction.

Appendix A: Local Data Inventory and Cleanup Methods

A.1 Main Local Directories

• Windows: %USERPROFILE%\.ai-tools
• macOS / Linux: ~/.ai-tools

This directory may contain: settings.json, cache/, backups/, cloud/, license-vault.json, license-anchor.json, machine-code.cache, installed-mcp-licenses.json, console-state.json (encrypted activity-statistics device token/digests), credential encryption files and token metadata, etc.

A.2 Client Configurations and Skills

The Software reads and writes the configuration files of AI clients on your local machine, as well as Skills directories such as ~/.agents/skills/. The specific paths depend on the client and your custom settings. Please confirm before deletion that other tools will not be affected.

A.3 Uninstallation and Deletion

1. Uninstalling the Software does not automatically delete the data under ~/.ai-tools (the installer retains user data by default).
2. To delete it completely, please exit the Software first, back up the content you wish to keep, and then manually delete the above directories.
3. Content synced via Cloud Sync is stored in your own Git repository or SFTP server and must be deleted separately at the corresponding cloud destination.
4. To delete your account and related server-side information, please send an email to service@ywhome.top to apply.

Deleting local data will result in the loss of settings, backups, login state, and the license ledger, and you may need to log in again or reactivate. Please proceed with caution.

Appendix B: List of Third-Party Services

The above third parties may update their names, domains, or privacy policies, and their latest published versions shall prevail. We will update this list when this Policy is updated.

This Policy applies from the Effective Date.