Brook — 隐私与阅读数据

更新日期：2026-11-07

Brook 由独立开发者维护。本政策说明 App、本地阅读数据及 Brook 在线 AI 网关的数据处理方式。隐私请求可发至 support@readwithbrook.com，也可通过“设置 → 帮助与支持”的联系入口提出。

设备上的数据

导入书籍、阅读位置、生词、标注、笔记、已保存释义和本地音频缓存保存在你的设备上。Brook 不自动上传整本原始书籍；你请求在线 AI 时，仅发送所需的部分文字。

本地朗读在设备上完成。部分离线语音资源需通过 Apple 下载，下载后在本地使用；具体资源和状态以 App 的资源页面为准。下载受 Apple 的隐私政策约束。你可以在“个人数据”中使用 iCloud 备份。书籍文件和阅读记录的完整副本保存在你的个人 iCloud 账户，占用你的 iCloud 储存空间；本地书库独立保留，退出或更换 iCloud 账户不会因此清空。服务凭据、语音缓存和诊断报告不参与备份。重装后，可使用同一账户选择已完成的备份恢复到空书库。自动备份在应用打开时进行，最近备份之后的新更改可能尚未保存到云端。关闭备份不会删除已有云端数据。原始书籍按内容复用，数据库备份由本次安装的最新完整版本替换；若要清除全部云端数据，请使用系统 iCloud 储存管理。

在线 AI 由你选择

在线释义与翻译、独立在线发音服务分别授权，默认关闭。已选择自带 Key 的云端朗读时，跟随同一提供商和音色的单词发音不再重复询问授权。首次允许对应服务前，Brook 会说明发送内容和接收方。拒绝后仍可使用适用的本地阅读、已有词义和本地朗读功能；其他订阅和体验条件仍然适用。

允许后，在线释义、词条详解和翻译可能发送所选词句、附近上下文，以及必要的书名、作者、章节和目标语言。Brook 网关将请求转发给 DeepSeek、DeepInfra 或阿里云通义千问，不向模型服务转发 Apple 交易或设备证明。独立在线发音服务需单独授权。选择跟随云端朗读音色时，所选词句与音色会使用已保存的 Key，直接发送给当前选中的云端朗读提供商。在“音频 → 单词发音”切换为本地模型后，单词发音不发送在线请求。连续本地朗读不会上传朗读正文。

可在“设置 → 个人数据 → 隐私政策”分别关闭在线释义与翻译、在线发音。关闭后停止对应服务的新请求，排队请求也会在发送前重新检查许可。已发送的请求无法撤回，本地已生成词义不会被删除。

服务商按各自政策处理数据，其处理地域和保留规则可能不同。Brook 不承诺所有服务商对输入零保留或都不用于模型改进。请参阅 DeepSeek 隐私政策、阿里云百炼隐私说明、DeepInfra 隐私政策。DeepInfra 的服务处理可能发生在美国。

订阅用户可另行启用自带 API Key 的云端朗读。该选项默认关闭，Key 保存在本机钥匙串，不参与 iCloud 钥匙串同步。启用后，设备直接将朗读片段、必要的前后文和 Key 发送给用户选择的 HTTPS 服务地址；Brook 网关不接收这些请求、Key 或音频。音频与时间戳可在本机缓存，用户可在音频设置的高级选项中清除缓存、删除 Key，或将提供商切回 Kokoro。服务商费用由用户另行承担；ElevenLabs 或用户指定服务商按各自条款处理收到的数据，参阅 ElevenLabs 隐私政策。

权限、用量与安全

Brook 使用 Apple 已验证交易和设备证明校验访问权限。网关处理并保存账号标识、设备公钥或证明、交易和权益状态、体验起止时间、请求编号与摘要、任务类别、状态、用量和费用保护计数，用于提供服务、防重复请求或重复领取体验、执行额度、恢复和安全处理。Brook 不取得你的 Apple 账户密码或银行卡资料。

网关不在业务状态数据库或常规日志中保存阅读原文、整本书籍或模型生成正文，提供服务期间仍需在内存中处理请求内容。必要记录保存在受保护服务器中，异机备份在上传前加密。防止重复体验和重复请求所需的最少标识会持续保留；其他记录依服务、安全和适用法律的必要范围保留。可提出查阅、更正或删除请求；涉及权益、反欺诈和法定保留义务的记录按实际要求处理。

Brook 不提供广告跟踪，不出售阅读内容，不将使用数据用于跨 App 广告追踪。App Store 购买、TestFlight 反馈和 Apple 资源分发由 Apple 按其规则处理。

诊断、反馈与移除

诊断记录操作类别、耗时和错误，不含书籍正文、音频或服务凭据。本地运行诊断按时间和容量滚动清理，不会整份自动上传。主动点击“反馈”时，Brook 会发送本次问题的技术摘要，包括功能、错误类别、受控错误码、请求编号、App 与系统版本，以及是否使用本地结果，并通过 Apple 验证的身份关联账号。不会附带阅读正文、书名、音频、截图或服务凭据。

未送达的反馈最多在本机保存 7 天、20 份，可在帮助与诊断中查看或移除。已绑定账号的反馈会在下次联网打开 App 时继续发送，身份无法验证时需恢复身份后主动发送。服务端反馈明细在收到后保留 30 天，随后删除；加密备份随既有备份周期到期清除。你仍可选择通过系统分享菜单导出更多诊断。联系支持时，维护者会收到你主动提供的联系方式、说明与附件，仅用于处理请求及必要的后续支持。

“个人数据”可导出阅读记录和生词本。记录包含书籍元数据、标注、笔记及其历史和位置，不含原始书籍或凭据，不是完整书库备份。可在书库删除书籍、在生词本删除词条；删除来源书籍不会自动删除生词。

删除书籍或卸载 App 不会自动取消订阅，也不会自动删除权益、体验与防重复请求的服务器记录。订阅请在 Apple 账户中管理，服务器数据请求请通过帮助与支持联系维护者；第三方数据请求也可依服务商政策提出。

本轮公测面向成年人，不面向儿童招募。实质改变数据接收方或用途时将更新政策；需要新的分享许可时会再次征求选择。

Brook — Privacy and Reading Data

Updated: 2026-11-07

Brook is maintained by an independent developer. This policy covers the app, local reading data and the Brook online AI gateway. Contact support@readwithbrook.com or use Settings → Help & support for privacy requests.

Local data

Books, reading positions, vocabulary, highlights, notes, saved explanations and local audio caches remain on your device. Brook does not automatically upload whole original books. An online AI request sends only the text needed for that request.

Local speech runs on your device. Some offline speech resources download through Apple and work locally afterwards. Available resources and their status are shown in the app. Apple's privacy policy applies to downloads. You can use iCloud backup in Your data. Complete copies of books and reading records are stored in your personal iCloud account and use your iCloud storage. Your working library remains local, including when you sign out of or change iCloud accounts. Credentials, speech caches and diagnostics are excluded. After reinstalling, choose a completed backup from the same account to restore into an empty library. Automatic backups run while the app is open; changes after the latest backup may not yet be protected. Disabling backup does not delete cloud data. Original book files are reused by content; each installation replaces its previous complete database checkpoint. Use system iCloud storage management to delete all cloud data.

Your online AI choice

Online definitions and translation, and the independent online pronunciation service, have separate permissions and are off by default. After you select cloud narration with your own key, word pronunciation using that same provider and voice does not ask for permission again. Before permission for each service, Brook explains the content and recipients. Declining retains applicable local reading, saved meanings and local speech; other subscription and trial conditions still apply.

With permission, explanations, vocabulary details and translations may send selected words or passages, nearby context and necessary book title, author, chapter and target-language information. Brook's gateway forwards requests to DeepSeek, DeepInfra or Alibaba Cloud Qwen, without forwarding Apple transaction proofs or device attestations. The independent online pronunciation service requires separate permission. When word pronunciation follows the cloud reading voice, the selected word or passage and voice are sent directly to the selected cloud read-aloud provider using the saved API key. Selecting Local model under Audio → Word pronunciation stops online requests for words. Continuous local narration does not upload narration text.

Manage each permission in Settings → Your data → Privacy policy. Turning one off stops new requests for that service, including a check before queued requests dispatch. Already-sent requests cannot be recalled. Saved local meanings are retained.

Providers process received data under their own policies, with potentially different locations and retention rules. Brook does not promise zero retention or exclusion from model improvement for every provider. See DeepSeek's policy, Alibaba Cloud Model Studio's notice, and DeepInfra's policy. DeepInfra processing may occur in the United States.

Subscribers may separately enable cloud narration with their own API key. This option is off by default. The key stays in this device’s Keychain and does not sync through iCloud Keychain. Once enabled, the device sends narration passages, necessary neighboring context and the key directly to the selected HTTPS service. Brook’s gateway does not receive these requests, keys or audio. Audio and timestamps may be cached locally. Audio settings let users clear that cache or delete the key under Advanced, or select Kokoro to return to on-device narration. Provider fees are paid separately. ElevenLabs or the chosen provider handles received data under its own terms; see ElevenLabs’ privacy policy.

Access, usage and security

Brook verifies access using signed Apple transactions and device attestations. The gateway keeps account identifiers, device public keys or proofs, transaction and entitlement status, trial dates, request IDs and digests, task categories, state, usage and cost-protection counters. These support service access, duplicate prevention, trial and usage limits, recovery and security. Brook does not receive your Apple Account password or card details.

The gateway does not store reading text, whole books or model output text in its business state database or routine logs; it processes request content in memory while providing the service. Required records use protected server storage and backups encrypted before off-host upload. Minimal identifiers for trial and request deduplication are retained persistently; other records are kept as necessary for service, security and applicable law. You may request access, correction or deletion, subject to actual entitlement, fraud-prevention and legal retention requirements.

Brook does not provide advertising tracking, sell reading content or use your activity for cross-app advertising. Apple handles purchases, TestFlight feedback and Apple-hosted resources under Apple's rules.

Diagnostics, feedback and removal

Diagnostics record action categories, timing and errors, excluding reading text, audio and credentials. Local runtime logs rotate by time and capacity and are not automatically uploaded in full. When you choose Feedback, Brook sends a technical summary of the problem: feature, error category, controlled error code, request references, app and OS versions, and whether a local result was used. An Apple-verified identity associates the report with your account. Reading text, book titles, audio, screenshots and service credentials are excluded.

Unsent reports are kept on your device for up to 7 days, with a limit of 20. View or remove them in Help and diagnostics. Account-bound reports are sent again when you next open the app online; reports without a verified identity require explicit submission after identity recovery. Server feedback details are deleted after 30 days; encrypted backups expire on the existing backup schedule. You can still export additional diagnostics using the system share menu. Support receives the contact information, description and attachments you provide and uses them only to handle the request and necessary follow-up.

Your data offers reading-record and wordbook exports. Records include book metadata, highlights, notes, revisions and positions, excluding original books and credentials. They are not a full library backup. Delete books in Library and words in Vocab; deleting a source book does not automatically remove saved vocabulary.

Deleting books or uninstalling does not cancel subscriptions or automatically erase server access, trial or deduplication records. Manage subscriptions through your Apple Account and contact support for server-data requests. Third-party requests may also be made under provider policies.

This beta recruits adults and is not directed at children. Material changes to recipients or purposes will update this policy. Brook will ask again when a new sharing choice is required.