隐私政策 / Privacy Policy

学知云课记（XZY Notes）浏览器扩展

适用浏览器：Google Chrome / Microsoft Edge / Mozilla Firefox

生效日期：2026-09-23 ｜最近更新：2026-09-25 ｜联系方式：xxj@xzynet.com

本页同时发布中英文两版，内容一致；如有歧义以中文版为准。

Published in both Chinese and English; in case of ambiguity, the Chinese version prevails.

中文版

1. Limited Use 声明（Chrome Web Store 用户数据政策）

本扩展对用户数据的处理符合 Chrome Web Store 用户数据政策（Chrome Web Store User Data Policy）中的 Limited Use 要求：

允许的用途：通过权限获得的任何数据，仅用于本扩展的唯一用途与面向用户的功能——在网课视频旁做笔记（截图与标注、字幕全文检索、本地离线语音转写、章节大纲、Markdown 导出）。不用于任何其他目的。
允许的传输：除「为提供上述功能所必需」的情形外，不向任何第三方传输用户数据。唯一的例外见第 6 节：只有当用户自行配置了 AI 端点并主动点击生成时，该门课程的字幕文本才会由用户的浏览器直接发往用户自己指定的地址；开发者不接收、也无法访问该数据。
禁止广告：绝不将用户数据用于或转让给个性化、再定向或兴趣定向广告。
禁止人工读取：开发者无法读取用户数据（数据不经过开发者服务器），也不会允许任何人人工读取，法律要求或安全调查等政策允许的例外除外。

2. 一句话概括

本扩展没有服务器、没有账号体系、没有任何统计或遥测。开发者不接收、不存储、无法访问你的任何数据。你的课程、笔记、截图、字幕与转写文本全部保存在你自己的电脑上。

唯一会离开你设备的数据，是你在设置里自行填写并授权的大模型端点——只有当你主动点击生成时才发送，接收方是你自己指定的服务。

3. 扩展在你的设备上保存什么

以下数据全部存储在浏览器为扩展分配的本地数据库（IndexedDB，库名 kedaibiao）中，扩展卸载时由浏览器一并清除：

数据	内容	存放位置与用途
课程	课程标题、平台标识、页面地址	本地数据库；用于把笔记归到同一门课
笔记	你输入的文字、时间戳、收藏标记	本地数据库；截图笔记携带截图引用
截图	你主动截取的视频画面（含标注后的图片）	本地数据库；以图片数据形式保存
字幕	从课程页取得的字幕文本	仅在你的浏览器内使用（检索、跟随高亮、点击回跳），不写入数据库、不上传
转写	本地语音识别生成的带时间戳文本	本地数据库；供检索、回跳、生成章节与导出
章节	由规则或 AI 生成的大纲与摘要	本地数据库
设置	快捷键、主题、语言、截图质量、导出偏好、AI 端点配置（含 API Token）	本地数据库；Token 仅存本机（见第 7 节）

另有少量临时状态：

browser.storage.session：只存活于本次浏览器会话的界面状态（例如「刚截图后应聚焦哪条笔记」），关闭浏览器即消失；
一个 localStorage 条目：记录本地转写的标点恢复开关；
语音识别模型文件缓存在本机另一个独立数据库（kedaibiao-asr）中，可在设置页删除。

以上数据都不会上传到任何开发者控制的服务器，也没有云同步（扩展不使用 storage.sync）。

4. 扩展申请的权限及用途

权限	用途
`activeTab`	在你点击图标/右键菜单/快捷键后，对当前这一个标签页执行截图、读取视频与字幕信息、注入页面脚本。未主动操作过的页面无法访问。
`scripting`	同上，向已授权标签页按需注入扩展自带的内容脚本（支撑「任意含 HTML5 video 的网页」通用模式），不做批量注入。
`tabs`	识别当前课程、在已打开的标签页之间定位并切换课程页、监听标签切换与地址变化以更新侧栏上下文。不读取浏览历史。
`tabCapture`	课程拿不到视频直链时，捕获当前标签页正在播放的音频用于本地语音识别。音频仅在本机实时识别，不保存、不上传，且仍正常回放给你（不会被静音）。
`offscreen`	提供不随侧栏关闭而终止的本地转写运行环境。
`sidePanel`	扩展主界面（与视频并排显示）；不打开时不显示任何内容。
`storage`	保存上述临时界面状态。
`contextMenus`	提供一个右键菜单项，用于在页面上激活扩展。
`declarativeNetRequestWithHostAccess`	仅为智慧树（zhihuishu.com）代取本页课程已加载的字幕/视频数据补上 Referer 头，规则限定只作用于扩展自身发出的请求（`tabIds: [-1]`），不影响页面与其他网站。

主机权限：

*://*.zhihuishu.com/*（必需）：仅用于智慧树平台的字幕与视频源接口代取（该接口校验 Referer 且无 CORS 头）。
<all_urls>（可选，默认不授予）：仅在下面两种由你主动点击触发的场景下申请，不触发则不授予：
1. 你在设置页填写 AI 端点地址并保存时，申请该地址的访问权，用于把字幕文本发往该端点（见第 6 节）；
2. 本地语音转写需要跨域读取课程媒体源（例如课程视频 CDN）时，申请该源的访问权，用于下载或流式读取该媒体文件（见第 5 节）。

内容脚本运行的站点：bilibili.com（视频页）、icourse163.org、xuetangx.com、youtube.com（watch 页）、zhihuishu.com。在部分平台，扩展会在页面自身的运行环境中接管该页面的 fetch / XMLHttpRequest，只读取与字幕地址匹配的响应内容（即该页面自己已经请求过的字幕），用于生成字幕时间轴；不修改页面数据、不改变页面行为、不影响页面与其他站点的任何请求。

5. 本地语音转写：模型下载与课程媒体文件

识别模型：本地转写所需的识别模型（.onnx 权重与 tokens.txt 词表）在首次使用时从 Hugging Face 官方源（huggingface.co，不可达时回退镜像 hf-mirror.com）下载并缓存于本机。下载的是纯数据文件，不含任何可执行代码；下载过程只发生一次，之后完全离线可用，下载源不会因此获得你的课程或笔记内容。
课程媒体文件：当扩展解析到课程视频文件的直链时，整段/流式转写会先把该媒体文件读取到本机内存中解码（不写入本地数据库、不上传），以便不播放一遍即可完成转写。该请求发往课程平台自身的 CDN，属于访问你正在观看的课程资源；为跨域读取，扩展会在你点击后申请该媒体源的访问权（见第 4 节）。
标签页音频（Chrome）：拿不到媒体直链时，改用 tabCapture 捕获当前标签页正在播放的音频，同样只在本机实时识别，不保存、不上传。

6. 唯一的数据外传情形：AI 章节与总结（默认关闭）

该功能默认不可用，需要你自己填写一个 OpenAI 兼容接口地址（baseUrl）、模型名与密钥（apiToken）并保存。
只有当你主动点击生成时，才会发起请求。发送内容为：该门课程的字幕/转写全文（按长度分块，可能分多次请求发送）、课程标题，以及生成指令本身。不含截图或图片、不含页面地址、不含浏览器或设备信息。
你填写的密钥只保存在本机数据库，仅作为 Authorization 请求头随上述请求发往你自己填写的地址，不会发送给开发者或任何其他方。
数据在接收方的处理方式取决于你选择的服务商，请参阅其隐私政策。若你填写的是本地自建服务（如本机运行的推理服务），数据不会离开你的设备。
授权方式：Firefox 140+ 使用浏览器内置的数据收集同意机制，扩展在用户点击时会申请 websiteContent 同意；Chrome / Edge 无此机制，仅在你保存配置时由浏览器弹出该域名的访问授权提示。不填写地址、未获授权时，扩展不会发起任何此类请求。

7. 数据安全

传输：所有涉及外部通信的请求均使用 HTTPS（AI 端点、模型下载、平台接口）。若你自行填写的 AI 端点使用明文 http://，则该次传输的安全性由你选择的服务决定，建议使用 HTTPS。
本地存储：上述数据保存在浏览器为扩展分配的本地数据库与缓存中，其保护取决于你设备上的操作系统账户与浏览器配置文件本身；扩展不做额外加密，也不将这些数据发送到任何开发者可控的位置。
密钥：你填写的 API Token 以明文形式保存在本地数据库中，仅用于向你填写的地址发请求；导出备份或导出课程时会被自动置空。
代码：本扩展不使用远程代码。所有可执行代码——包括 sherpa-onnx 的 WebAssembly 运行时、Emscripten 胶水脚本、音频 worklet 与各 Worker——都随安装包一同分发，并在运行时从扩展自身的本地文件加载。代码中不存在 eval、new Function 或任何动态引入远程脚本的写法；CSP 仅额外允许 'wasm-unsafe-eval'，用于编译包内的 .wasm。运行期唯一的下载是识别模型的数据文件，不含可执行逻辑。

8. 我们不做什么

不收集、不上传：浏览历史、账号密码、位置、通讯录、健康或财务信息，也不读取页面上的表单、密码或账号字段。
不做统计分析、崩溃上报、设备指纹或广告投放。
不出售、不共享、不转让你的任何数据给第三方。
不使用你的数据评估信用或用于借贷目的。
除识别课程身份（标题、封面）与读取视频/字幕所必需的数据外，不读取你所访问网站上的其他内容；页面数据仅在你的浏览器内用于生成本地笔记。

9. 数据的留存与删除

所有数据由你自己掌控，保留多久由你决定。
在扩展内可随时删除单门课程及其笔记、截图；设置页可删除已下载的模型文件以释放空间。
设置页提供完整备份导出（zip，由你自行保管）与恢复；导出的文件不经过任何服务器。
卸载扩展或在浏览器中清除扩展数据，将删除上述全部本地数据，且不可恢复。

10. 儿童隐私

本扩展是面向网课学习者的通用笔记工具，不面向儿童设计，也不会有意收集儿童的个人信息（事实上不收集任何人的个人信息）。

11. 政策变更

若本政策发生实质性变更（例如新增需要外传数据的功能），我们会在本页面更新并修改顶部「最近更新」日期；涉及数据外传的新功能，会在扩展内以显式授权的方式征得你的同意后才会启用。

12. 联系我们

对本政策或数据处理方式有疑问，请联系：xxj@xzynet.com

English

1. Limited Use Disclosure (Chrome Web Store User Data Policy)

This extension handles user data in compliance with the Chrome Web Store User Data Policy, including the Limited Use requirements:

Allowed use. Any data obtained through extension permissions is used solely for the extension's single purpose and its user-facing features — taking notes on online-course videos (screenshots and annotation, full-text subtitle search, on-device offline speech transcription, chapter outlines, Markdown export). It is not used for any other purpose.
Allowed transfer. No user data is transferred to third parties except where necessary to provide those features. The single exception is described in Section 6: only when the user has configured an AI endpoint themselves and explicitly clicks to generate is that course's subtitle text sent from the user's browser directly to the address the user chose. The developer neither receives nor has access to that data.
Prohibited advertising. User data is never used or transferred to serve personalised, re-targeted or interest-based advertisements.
Prohibited human interaction. The developer cannot read user data (it never passes through any server controlled by the developer) and does not allow humans to read it, apart from the exceptions permitted by policy such as complying with applicable law or investigating abuse.

2. Summary

This extension has no server, no accounts and no analytics or telemetry. The developer never receives, stores or has access to any of your data. Your courses, notes, screenshots, subtitles and transcripts stay on your own computer.

The only data that can leave your device is what you send to an AI endpoint that you configure and authorise yourself — and only when you explicitly click to generate. The recipient is the service you chose.

3. What the extension stores on your device

Everything below is stored in the browser's local extension database (IndexedDB, database name kedaibiao) and is removed by the browser when you uninstall the extension:

Data	Contents	Where it lives and what it is for
Courses	Course title, platform identifier, page URL	Local database; used to group notes under one course
Notes	Text you type, timestamps, bookmarks	Local database; screenshot notes reference an image
Screenshots	Video frames you captured, including annotated ones	Local database; stored as image data
Subtitles	Subtitle text obtained from the course page	In your browser only (search, follow-playback highlighting, click-to-seek); never written to the database and never uploaded
Transcripts	Timestamped text produced by on-device speech recognition	Local database; used for search, seek-back, chapter generation and export
Chapters	Outlines and summaries produced by rules or by AI	Local database
Settings	Shortcuts, theme, language, screenshot quality, export preferences, AI endpoint configuration (including the API token)	Local database; the token is stored locally only (see Section 7)

A small amount of transient state also exists:

browser.storage.session: UI state that lives only for the current browser session (for example "which note should receive focus after a screenshot"); it disappears when the browser closes;
one localStorage entry recording the punctuation-restoration toggle for local transcription;
speech-recognition model files, cached in a separate local database (kedaibiao-asr), which can be deleted from the settings page.

None of this is uploaded to any server controlled by the developer, and there is no cloud sync (the extension does not use storage.sync).

4. Why each permission is used

Permission	Purpose
`activeTab`	After you click the icon, a context menu item or a shortcut, perform a single action on that one tab: capture a frame, read video/subtitle state, inject the page script. Pages you have not acted on are not accessible.
`scripting`	Injects the extension's own content script on demand into an authorised tab (generic support for any page with an HTML5 video element). No bulk injection.
`tabs`	Identifies the current course, locates and switches to an already-open tab for a course, and listens to tab/URL changes to refresh the side panel context. Browsing history is not read.
`tabCapture`	When a course's video file cannot be resolved to a direct URL, captures the audio the current tab is playing for on-device recognition. Audio is recognised locally in real time, never saved, never uploaded, and still played back to you (it is not muted).
`offscreen`	Provides a transcription environment that keeps running when the side panel is closed.
`sidePanel`	The extension's main interface, shown next to the video; nothing is displayed when it is closed.
`storage`	Stores the transient UI state described above.
`contextMenus`	Provides one right-click menu item to activate the extension on a page.
`declarativeNetRequestWithHostAccess`	Only sets the Referer header when fetching, on your behalf, the subtitle/video data that the Zhihuishu (zhihuishu.com) course page has already loaded. Rules are restricted to requests the extension itself makes (`tabIds: [-1]`) and never affect pages or other sites.

Host permissions:

*://*.zhihuishu.com/* (required): used only to fetch Zhihuishu's subtitle and video-source endpoints, which validate Referer and send no CORS headers.
<all_urls> (optional, not granted by default): requested only in the two situations below, each triggered by your own click; if you never trigger them, it is never granted:
1. when you enter an AI endpoint address in the settings page and save it, to send transcript text to that endpoint (see Section 6);
2. when local transcription needs to read a course media source cross-origin (for example a course video CDN), to download or stream that media file (see Section 5).

Sites where content scripts run: bilibili.com (video pages), icourse163.org, xuetangx.com, youtube.com (watch pages) and zhihuishu.com. On some platforms the extension takes over the page's own fetch / XMLHttpRequest only to read responses whose URL matches a subtitle endpoint — that is, subtitles the page has already requested itself — in order to build the subtitle timeline. It does not modify page data, does not change page behaviour, and does not affect any request made by the page or by other sites.

5. Local speech transcription: model download and course media files

Recognition model. The model needed for local transcription (.onnx weights and tokens.txt vocabulary) is downloaded once, on first use, from the official Hugging Face source (huggingface.co, falling back to the mirror hf-mirror.com) and cached on your device. These are data files only — no executable code. After that the feature works fully offline, and the download source never receives your courses or notes.
Course media file. When the extension resolves a direct URL for the course video file, whole-file or streaming transcription first reads that media file into local memory to decode it (it is never written to the local database and never uploaded), so the lecture can be transcribed without playing it through. That request goes to the course platform's own CDN, i.e. to the course resource you are watching; to read it cross-origin the extension asks for access to that origin after your click (see Section 4).
Tab audio (Chrome). When no direct media URL can be resolved, tabCapture is used instead to capture the audio the current tab is playing — again recognised locally in real time, never saved and never uploaded.

6. The only case where data leaves your device: AI chapters and summaries (off by default)

The feature is unavailable until you enter your own OpenAI-compatible endpoint (baseUrl), model name and key (apiToken) and save them.
A request is made only when you explicitly click to generate. What is sent is: the full subtitle/transcript text of that course (chunked by length, possibly across several requests), the course title, and the generation instructions themselves. It does not include screenshots or images, the page URL, or any browser or device information.
The key you enter is stored on your device only and is sent solely as the Authorization header of the requests described above, to the address you entered; it is never sent to the developer or to anyone else.
How the recipient handles the data is governed by that provider's privacy policy. If you point the extension at a service running on your own machine, the data does not leave your device at all.
How consent is obtained: Firefox 140+ uses the browser's built-in data-collection consent, and the extension requests websiteContent consent when the user clicks; Chrome and Edge have no such mechanism, so the only prompt is the browser's own host-permission dialog when you save your configuration. If you configure no endpoint, or consent is not granted, the extension makes no such request.

7. Data security

Transmission. Every request that involves external communication uses HTTPS (AI endpoint, model download, platform APIs). If the AI endpoint you enter yourself uses plain http://, the security of that transfer is determined by the service you chose; HTTPS is recommended.
Local storage. The data described above lives in the local database and caches the browser allocates to the extension. Its protection depends on the operating-system account and browser profile on your own machine; the extension applies no additional encryption and never sends this data anywhere the developer controls.
Keys. The API token you enter is stored in plain text in the local database and is used only to call the address you entered; it is automatically blanked in any exported backup or exported course.
Code. This extension does not use remote code. All executable code — including the sherpa-onnx WebAssembly runtime, the Emscripten glue script, the audio worklet and every Worker — ships with the installation package and is loaded at runtime from the extension's own local files. There is no eval, no new Function and no dynamic import of remote scripts; the CSP merely adds 'wasm-unsafe-eval' so the bundled .wasm can be compiled. The only runtime download is the recognition model's data files, which contain no executable logic.

8. What we do not do

We do not collect or upload browsing history, credentials, location, contacts, health or financial information, and we do not read form, password or account fields on pages.
We do not run analytics, crash reporting, device fingerprinting or advertising.
We do not sell, share or transfer your data to third parties.
We do not use your data to determine creditworthiness or for lending purposes.
Beyond identifying the course (title, cover image) and reading the video/subtitle data that the features require, we do not read anything else on the sites you visit; page data is used inside your browser only, to build your local notes.

9. Retention and deletion

You are in full control: data is kept for as long as you choose.
Individual courses, together with their notes and screenshots, can be deleted inside the extension at any time; the settings page can delete downloaded model files to free space.
The settings page provides a complete backup export (a zip file you keep yourself) and restore. Exported files never pass through any server.
Uninstalling the extension, or clearing extension data in your browser, deletes all of the local data described above, irreversibly.

10. Children's privacy

This extension is a general note-taking tool for online-course learners. It is not directed at children and does not knowingly collect personal information from children — in fact, it collects no personal information from anyone.

11. Changes to this policy

If this policy changes materially (for example, if a new feature would transmit data off your device), we will update this page and the "last updated" date above. Any new feature that transmits data will be enabled only after you explicitly authorise it inside the extension.

12. Contact

Questions about this policy or about how data is handled: xxj@xzynet.com