Privacy comes from the architecture.

1. File access

Guizhi Box processes only folders you select through the system folder picker. The Mac version may store a macOS security-scoped bookmark locally so that it can restore your permission later; the Windows version stores necessary settings in the local app-data directory.

Undownloaded iCloud Drive, OneDrive, and other cloud placeholders are not read by default, avoiding an unexpected bulk download during a scan.

2. Scan history and operation records

Scan history, organization receipts, rename receipts, and the operation ledger are stored locally to show previous results and support undo. Full folder paths are not retained in scan history or the operation ledger by default.

If you explicitly enable full paths in history, those paths still remain on your device. Turning the option off removes previously saved plain-text paths.

Windows 1.1 keeps at most 200 ledger entries and 200 detail entries. Recovery information needed for the most recent undoable operation may be retained temporarily and is cleared after undo, confirmation, or a later operation of the same type.

3. Usage data and network access

Guizhi Box Mac 2.0 and Windows 1.1 do not collect or send usage analytics and do not include crash-reporting, advertising, or third-party behavioral analytics SDKs.

The current public releases contain no anonymous analytics control. Legacy consent and pending counters from internal test builds are cleared after an upgrade and are not sent.

4. Cloud-synced folders

Downloaded files in Baidu Netdisk, iCloud Drive, OneDrive, and other folders visible in Finder or the Windows file system are handled as ordinary local files.

Moving, renaming, or recycling a file in a synced folder may propagate to the cloud and other devices. Cloud trash, version history, and recovery rules are controlled by the relevant provider.

4A. Mac workflows and local intent parsing

Mac 2.0 can parse a Chinese or English description into a workflow draft on-device, and can export and import workflow templates. Descriptions are not sent to the developer's servers. A template contains rule definitions only: no folder permission, security-scoped bookmark, real folder path, filename, scan history, or operation record.

Imported workflows are disabled until you choose and authorize a folder again. Every run still requires a preview and your explicit confirmation before files change.

5. Cleanup and undo

Guizhi Box does not silently permanently delete files. Mac cleanup moves files to the macOS Trash. Windows cleanup uses the Windows Recycle Bin only on a local fixed drive where Windows confirms that recycling is supported; other volumes are rejected before modification.

The app stores local records when possible to support undo. Undo may no longer work after Trash or Recycle Bin is emptied, files are moved again, a drive goes offline, or another app changes the files.

6. Purchases

The Mac lifetime purchase is processed by Apple App Store and StoreKit. Guizhi Box reads only the product information and valid entitlement provided by Apple. Windows 1.1 is distributed as a one-time paid Microsoft Store app with no in-app purchase.

Guizhi Box never receives or stores bank-card numbers, Apple Account passwords, or Microsoft account passwords.

7. Third-party services

Guizhi Box does not use a developer-operated account system, advertising SDK, third-party behavioral analytics, or cloud AI file analysis, and does not sell personal information.

The website is delivered by hosting and network providers. Their infrastructure may process necessary network logs for security and operations; Guizhi Box does not use those logs for advertising, cross-app tracking, or user profiling.

8. Retention and deletion

Local history, operation records, and authorization information remain on your device. You can clear relevant records in the app or remove them by uninstalling the app and deleting its local app data.

9. Contact

Questions about this policy or Guizhi Box data handling can be sent to support@guizhi.cc.