Privacy and Security Boundaries隐私与安全边界说明

1. Entity, scope and contact1. 主体、范围和联系方式

M&C Nebulae Australia Pty Ltd is responsible for the software and business information described here. Contact: info@mcnebulae.com.au. This notice covers PrivacyCut, PrivatyVault, this software website and information voluntarily sent to software support.M&C Nebulae Australia Pty Ltd 负责本说明所述软件及业务信息处理。联系方式：info@mcnebulae.com.au。本说明适用于 PrivacyCut、PrivatyVault、本软件网站，以及主动发送给软件客服的信息。

2. What the software protects2. 本软件负责保护什么

The protection target is to prevent these apps and their controlled children from sending user content over a network or writing originals, thumbnails, preview frames, audio/video fragments or content-bearing caches to the computer's internal disk. Content handling is confined to bound directly attached storage and controlled memory. The computer itself may remain online.保护目标是阻止本软件及其受控子进程经网络外传用户内容，并阻止它们把原素材、缩略图、预览帧、音视频片段和含内容缓存写入本机内部硬盘。内容处理限制在绑定直连外接盘及受控内存中；电脑本身可以保持正常联网。

Copies placed in a vault are protected by vault mechanisms. Ordinary usage traces and non-content information such as version and signature/integrity status differ from media residue. We do not promise the absence of every Windows trace of software use.锁进保险库的副本由库机制保护。普通程序使用痕迹、版本号、签名／完整性状态等不含素材内容的信息，与素材残留不同；不承诺 Windows 上完全没有软件使用痕迹。

3. Local content processing3. 完全本地的内容处理

Photos, videos, audio and document content are processed locally by protected software processes. No cloud AI, built-in stock-media service or cloud file synchronisation is connected.照片、视频、音频及文档内容由受保护的软件进程在本地处理，不接云端 AI、内置素材服务或云端文件同步。

Software licensing uses a separate module for necessary licensing metadata. Website, payment and licensing connections do not grant the protected content process network access. Store package updates and purchased-feature entitlements are handled separately.软件授权由独立模块处理必要许可信息。网站、支付及授权连接不会给受保护的素材进程增加联网权限；商店软件包更新与已购功能权益分别处理。

4. Meaning of external-storage checks4. 外接盘校验的含义

The current software accepts directly attached NTFS USB storage that satisfies binding/path rules. Allowed locations, paths and controlled access are checked, and ineligible internal/network or boundary-bypassing targets are rejected. This does not certify that a drive is malware-free, has never been networked/synchronised or is immune to hardware attacks.当前仅接受符合绑定和路径规则的直连 NTFS USB 存储。会校验允许位置、路径和受控访问，并拒绝不合格的内部盘、网络路径及绕过边界的目标。该检查不等于证明 U 盘没有恶意软件、不曾联网、不曾被同步或不存在硬件攻击。

The default vault name becomes a visible 'name.pvv' directory name; optional random naming hides that name. Volume labels, directory existence and encrypted-object counts/sizes may remain visible. Not all storage metadata is concealed.库名默认成为可见的“库名.pvv”目录名；可选随机命名用于隐藏库名。卷标、文件夹存在、加密对象数量和大小等外部特征仍可能可见，不能承诺隐藏所有存储元数据。

5. Imports, originals and copies5. 导入、原件与副本

Place files on bound USB storage yourself before import. Import creates an encrypted copy in the current vault; it does not automatically delete, move, rename or make outside originals read-only. You decide whether to remove originals. If you want to avoid their continued exposure, handle them yourself after verifying usable vault copies and backups.需先自行把待导入文件放到绑定外接盘。导入会在当前库内生成加密副本；库外原文件不自动删除、移动、改名或设置只读。是否移除库外原件由您决定；若要避免原件继续暴露，请在确认副本和备份可用后自行处理。

Original names, categories and source paths are stored in encrypted vault metadata and displayed as needed after unlock. The current software has no remote-original sending, automatic cloud backup or external-office-app editing of vault content.文件原名、分类及原始路径等目录信息保存在加密库元数据中，解锁后按功能显示。当前程序不提供远程发送原件、自动云备份或通过外部办公软件编辑保险库内容的功能。

6. Encryption, unlock and preview6. 加密、解锁和预览

The current vault uses chunked AES-256-CBC with HMAC-SHA256 authentication and encrypted directory metadata; encrypted chunks are checked before being returned for reading. Password derivation uses PBKDF2-HMAC-SHA256 with 600,000 iterations, and recovery keys are independently generated. This describes implementation, not independent cryptographic certification.当前库采用分块 AES-256-CBC 与 HMAC-SHA256 认证，加密目录信息；读取前校验所读加密块。密码经 PBKDF2-HMAC-SHA256（600,000 轮）派生，恢复密钥独立生成。该描述是实现说明，不是算法或产品经过独立密码学认证的声明。

After unlock, content needed for preview/editing enters application and decoder memory and is shown on screen or played through speakers. Encryption at rest does not eliminate plaintext memory or prevent screen/audio recording. Locking revokes controlled content access and old media addresses and attempts to clear held keys and buffers.解锁后，预览和编辑所需内容会进入程序及解码器内存，并显示在屏幕、播放到扬声器。加密存储不意味着使用中不存在明文内存或别人不能拍屏、录音。锁定时会撤销受控内容访问和旧媒体地址，尽可能清理软件持有的密钥与缓冲区。

7. Cache and cleanup boundaries7. 缓存与清理边界

Application-generated content-bearing session caches must remain in the current vault or its controlled workspace on bound USB storage. Standby workspaces may hold non-content runtime files. Normal locking/exiting cleans relevant temporary data. Do not treat the entire .localcut-private directory as disposable: older versions may retain recovery projects or encrypted media there.软件生成的含内容会话缓存须留在绑定外接盘的当前库或其受控会话工作区；待机工作区可含不涉及素材的运行文件。正常锁定／退出会清理相应临时数据。不能把整个 .localcut-private 目录当成可随意删除的临时目录，历史版本可能在其中保留恢复工程或加密素材。

Not every category of external-drive session cache is individually encrypted. Power loss, forced termination, unplugging, deletion failure or system behaviour can leave sessions for later cleanup. Ordinary deletion is not forensically verified physical erasure; flash/SSD wear levelling and system snapshots may preserve old data.不承诺每一类外接盘会话缓存都逐文件加密。异常断电、强制结束、存储拔出、删除失败或系统行为可能留下需后续清理的会话目录。正常删除不等于经过取证验证的物理擦除，闪存／SSD 磨损均衡和系统快照也可能保留旧数据。

8. Quick editing, projects and export8. 简单编辑、工程和导出

Quick edits default to a named encrypted copy in the current vault, preserving the original. Unfinished editing projects save encrypted there automatically. Complete vault data and keys are still required to reopen edits and referenced media.简单编辑默认另存可命名的加密副本到当前库，不覆盖原文件；未完成剪辑工程默认在当前库自动加密保存。编辑内容和素材引用仍需完整库文件及密钥才能再次读取。

Plaintext extraction/export requires an explicit outside-vault destination on bound USB storage. That copy is no longer vault-encrypted; subsequent copying, uploading or synchronisation is controlled by you and other software. Covers and PDF redaction require review. Pixelation/blur do not guarantee irreversible anonymisation. Review rebuilt sensitive PDF output and page content; visual coverage alone does not establish removal of underlying information.明文取出或明文导出须由用户明确选择绑定外接盘上的库外位置。该副本不再受库加密保护，之后的复制、上传或同步由您及其他软件控制。打码和 PDF 脱敏需要复核；像素化或模糊不是不可逆匿名化保证，敏感 PDF 应核对重建输出及页面内容，不能把视觉遮盖自动当作彻底删除底层信息。

9. Locking, trash and recovery9. 锁定、垃圾箱和恢复

The current apps support manual locking and locking when minimised or the current inactivity condition is reached; the current inactivity threshold is five minutes. Locking cannot defeat an attacker controlling the operating system or revoke content already copied by someone else.当前支持手动锁定，并在最小化或闲置达到当前自动锁定条件时锁定；当前闲置阈值为 5 分钟。锁定不能阻止有系统控制权的攻击者，也不能撤销已经被其他程序或人复制的内容。

Vault deletion first moves items to trash. Emptying trash initiates permanent object deletion, which storage locks/faults may delay or prevent; follow the reported result. This is not a system-level anti-deletion tool and cannot require a vault password before Explorer deletes the whole .pvv directory. An independent complete offline backup remains important for deletion and storage-failure protection.库内删除先进入垃圾箱；清空后发起对象永久删除，存储占用或故障可能导致延后或失败，须按界面结果处理。软件不是系统级防删工具，不能要求资源管理器必须先输入库密码才可删除整个 .pvv 文件夹。完整离线备份是防误删与介质故障的重要措施。

10. Explicit system-control limits10. 明确排除的系统控制范围

A desktop app cannot comprehensively control Windows paging, hibernation, memory dumps, system caches, security tools or other applications. These mechanisms may write sensitive memory to the system disk. This is an explicit disclosed system risk, not a guarantee that no media bytes can ever physically reach internal storage in every environment.桌面软件不能全面控制 Windows 分页、休眠、内存转储、系统级缓存、安全软件及其他应用的行为。这些机制可能把内存中的敏感内容写入系统盘。这里明确披露该系统风险，不能把它改写成已保证任何环境下本机物理磁盘绝无素材字节。

A host controlled by malware, an administrator or a kernel attack; other apps accessing outside originals, screen/clipboard/sync capture; camera recording; hardware attacks; and deliberately extracted plaintext fall outside what this app alone can protect. Responsibility for defects in our own implementation remains subject to applicable law.已被恶意软件、管理员或内核攻击控制的电脑，其他应用自行读取库外原件、录屏／剪贴板／同步，摄像头拍摄、硬件攻击以及用户主动取出的明文文件，不属于本软件可独立保障的范围。对本软件自身实现缺陷的责任仍依适用法律处理。

11. Website help and access data11. 网站客服与访问数据

Cloudflare serves this public website and processes ordinary web-request metadata needed to deliver and secure pages, such as IP addresses and request times. This does not give the website access to files in your local vault.本公开网站由 Cloudflare 提供页面服务，并处理提供和保护网页所需的普通请求信息，例如 IP 地址与请求时间。这不会使网站获得本地保险库文件的访问权限。

The help assistant matches the knowledge base in your browser. It does not send your question to a cloud AI or persist the conversation. The website does not include advertising scripts, third-party analytics, file upload or automatic log collection. Do not enter passwords, recovery keys or private content.客服助手在你的浏览器内检索知识库，不向云端 AI 发送问题，也不持久保存对话。网站不包含广告脚本、第三方分析、文件上传或自动日志收集。不要输入密码、恢复密钥或私密内容。

12. Purchase, licensing and activation information12. 购买、授权与激活信息

Commercial purchasing and activation will process only product/order details, contact email, billing country/region and necessary state/province/postcode, payment status, licence and device-identification information needed for transactions and licence administration. Exact fields, providers, locations, retention and validation connectivity must be disclosed before payment. Unselected providers are not presented as already connected.正式购买与激活将处理履行交易和许可管理所必需的产品、订单、联系邮箱、账单国家／地区及必要的州省或邮编、付款状态、许可证和设备识别信息；具体字段、服务商、处理地点、保存期限与验证联网要求须在付款前公开。我们不把尚未选定的平台当作已经接入。

Commercial licensing is isolated from protected content processes. Vaults, projects, file names, media paths, thumbnails and audio/video content are not activation, replacement, refund or fraud-screening data. Checkout-country selection does not imply continuous tracking of software-use location. Purchasing and customer activation are not open yet.商业许可模块与受保护素材进程隔离，不将保险库、工程、文件名、素材路径、缩略图或音视频内容作为激活、换机、退款和反欺诈资料。网站结账选择国家不代表持续跟踪软件使用位置。当前预发布软件尚未启用这些商业处理。

13. Email support and refund contact13. 邮件客服与退款联系

When you email info@mcnebulae.com.au, we and the email provider receive your address, message, attachments and email metadata for responses, order verification, refunds, complaints, security issues and necessary records. Provide an order number/purchasing email and only necessary redacted information.您联系 info@mcnebulae.com.au 时，我们及邮箱服务商会收到您的邮箱、邮件、附件及邮件元数据，用于回复、核对订单、处理退款、投诉或安全事件及必要记录。请只提供订单号或购买邮箱和必要脱敏信息。

The 30-day no-reason commercial refund does not require a reason, defect proof or private media. Passwords, recovery keys and complete vaults are not ordinary support prerequisites. Voluntary issue feedback should use synthetic/non-sensitive examples.30 天无理由商业退款不要求说明原因、证明缺陷或提交私密素材。我们不以提供密码、恢复密钥或完整库文件作为正常售后条件；如用户自愿反馈问题，优先使用合成或非敏感样例。

14. Purposes, disclosure, retention and transfers14. 使用目的、披露、保存和跨境

Business information actually received should be processed only for specified lawful purposes: order performance, support, security, accounting and legal obligations. Disclosures to necessary providers, advisers or legally entitled authorities should be limited accordingly. Use of the local apps does not grant permission to sell vault content or train AI on it.我们仅应为明确且合法的订单履行、支持、安全防护、财税记录及法定义务处理实际收到的业务信息。必要服务商、专业顾问或依法有权机关的披露应限于相应目的；不因您使用本地软件而取得出售库内容或将其用于 AI 训练的许可。

Business records should be retained for necessary periods and legal recordkeeping obligations, with periods or understandable criteria published. Exact periods and provider countries remain unverified. Cross-border processing must meet applicable safeguards; we do not promise that all website, email and payment data always stays in Australia.业务信息保存应按必要期限及法定记录义务确定，届时公布保存期限或可理解的标准；目前具体期限和服务商所在国家尚待核实。跨境处理须满足实际适用的规则及保障安排，不能承诺所有网站、邮件和支付数据永远只在澳洲。

15. Information rights, consent and international scope15. 信息权利、同意和国际适用

Contact the email above to seek access, correction, deletion/restriction of personal information we actually hold, raise privacy complaints or exercise other applicable rights. Conditions, deadlines and retention exceptions depend on law. Identity verification must be proportionate and must not require vault keys for privacy requests. We cannot remotely delete or recover a vault existing only on your device.可联系上述邮箱申请访问、更正、删除或限制我们实际持有的个人信息，提出隐私投诉，或依法行使其他权利；具体条件、期限和保留例外依适用法律。我们会采用相称的身份核实，不索取保险库密钥来处理个人信息请求。我们不能远程删除或恢复只存在您本地的库。

Acknowledging this notice is not consent to all processing. Processing requiring consent must be requested separately, specifically and voluntarily; marketing/unrelated processing must not be bundled as a condition of offline editing. Orders and emails relating to EU/UK users may fall under local data-protection rules. No media upload does not automatically exempt all business processing. Applicability, lawful bases, transfers and necessary representatives require completion before launch.知悉本说明与同意所有数据处理不是同一回事。依法需同意的处理应单独、具体、自愿征求，不能把营销或无关处理捆绑为离线剪辑条件。面向欧盟／英国等用户的订单及邮件信息可能适用当地数据保护规则；本地素材不上传不表示所有业务处理自动豁免。上线前须完成适用性、合法依据、跨境及必要代表安排。

16. Incidents, improvements and statement limits16. 事件、改进与声明边界

Report a suspected security problem to info@mcnebulae.com.au using a non-sensitive description. Do not email real vault files, passwords or recovery keys.发现可能的安全问题，请向 info@mcnebulae.com.au 提供不含私密内容的描述，不要发送真实库文件、密码或恢复密钥。

A software signature identifies the publisher and checks package integrity; it does not prove the absence of defects. No independent third-party security certification is claimed. Material changes to protection or business-data handling will be reflected in this notice and communicated where required.软件签名用于核验发行者和包完整性，不代表软件没有缺陷；本软件不宣称已取得独立第三方安全认证。保护范围或业务信息处理发生实质变化时，将更新本说明，并按适用要求告知。

Licensing metadata and local storage授权信息与本机存储

The licence module stores only credentials, signed leases, opaque device ID and validation time, protected with the current Windows user’s DPAPI under LocalAppData/MCNebulae/PrivacyCut-Licensing. This is licensing metadata, not content cache, and contains no media, file names, paths, vault passwords or recovery keys.授权模块仅保存授权凭据、签名租约、不透明设备编号和校验时间。它们使用当前 Windows 用户的 DPAPI 保护，存于本机 LocalAppData 的 MCNebulae/PrivacyCut-Licensing 目录；这是许可元数据，不是素材缓存，不含素材内容、文件名、路径、库密码或恢复密钥。

The backend keeps necessary opaque user IDs, hashed licence codes, products, order references, device digests, entitlement status and licensing events. It does not retain request bodies or media. Production providers, processing locations, retention and account-request procedures must be disclosed before launch; customer activation is not open yet. Existing system boundaries, including Windows paging/hibernation and malware-compromised computers, still apply.后台只保留必要的匿名用户编号、授权码摘要、产品、订单引用、设备摘要、有效状态和授权事件；不保留请求正文或素材。生产服务商、处理地点、保存期限及账户请求方式须在正式上线前公布。该授权服务尚未对公众上线。Windows 分页、休眠及已受恶意软件控制的环境等既有系统边界继续适用。