Privacy Policy

WorkGoa ("the product") consists of the desktop client, the mobile supervision companion app, and the account & model-quota service (monthly plans and token packs). We follow a local-first principle: manuscripts, memory, and workspace files stay on your own device by default; the server handles only accounts, quota orders, and the data collaboration requires.

This policy explains what information we collect and use when you use the product, and how we protect it. By using the product you agree to this policy.

Account information: the email address and password hash used to register and sign in. Passwords are stored only as irreversible hashes — nobody, including us, can recover the plaintext.

Orders and quota records: orders for monthly plans and token packs, payment status, and each grant's credit / deduction / expiry-clearing records, used for billing, reconciliation, and your own queries.

We do not collect model keys: a BYOK API key lives only on your machine, and this product does not proxy, store, or forward such credentials; hosted-channel model calls are forwarded by the server to the provider, without retaining request or response content.

Device registration: device name, platform, and version recorded by sign-in and mobile supervision, used for the device list and remote-control authorization.

Manuscript and file contents never leave your machine. When mobile supervision is enabled, only task titles, run status, and decision summaries are relayed through the server to your phone.

The server is a dumb relay: it forwards message frames without parsing or storing business content, and relayed content is never used for model training.

With mobile supervision off, no such messages exist. You can switch off remote control for a device at any time; once off, the phone can no longer link that device.

Telemetry is off by default. It is enabled only with your explicit consent in the first-launch prompt, and can be switched off in settings at any time.

Even when enabled, we collect only anonymous aggregate events (such as feature usage counts and error categories) — never account identity, manuscript content, or conversation content.

Quota purchases (monthly plans and token packs) are paid per single order: there is no cash wallet balance and nothing is billed per call; the unused part of a monthly grant is cleared at expiry, non-refundable and non-convertible. Amounts are shown in CNY, while the server keeps its ledger in cents (1 CNY = 100 cents) as the smallest unit, so no conversion error can creep in.

Local data (manuscripts, memory, workspace) lives in the ~/.workgoa/ directory on your device; its lifecycle is entirely in your hands.

The server records no model requests or responses (the hosted channel only forwards, never stores); it keeps only account, device, and order / quota records. Audit logs are retained for at least six months as required by law.

You can initiate account deletion at any time from the client or the mobile app. Deletion requires confirmation via email, then enters a 7-day cooling-off period; signing in during the cooling-off period automatically withdraws the request.

Once effective, all credentials are revoked and personal data is deleted. Financial ledgers required by law are kept only for the statutory period and never used for any commercial purpose.

When this policy changes, we update the version and effective date at the top of this page. Material changes are additionally announced in the product.