如两种文本存在歧义，以英文版本为准。 If there is any discrepancy, the English version prevails.
流光（XFMC）隐私政策
生效日期：2026 年 9 月 28 日
适用软件：XFMC 桌面客户端（界面品牌字样「流光」）以及 https://xfmc.net/ 网站
数据控制者：XFMC 软件开发者（位于中国大陆的独立开发者）
1. 概述
本隐私政策说明我们在你购买、激活和使用 XFMC 桌面客户端及相关网站服务时，会收集哪些信息、如何使用与保存、与谁共享，以及你可以行使哪些权利。我们只收集为提供授权、交付与售后支持所必需的信息，不投放广告、不出售数据。
2. 我们收集的信息
| 类别 | 具体内容 | 用途 | 保留期限 |
|---|
| 账号与联系信息 | 邮箱地址、账号标识、登录会话令牌、登录与登出时间 | 创建账号、登录、交付授权码、续期提醒、售后与退款沟通 | 账号存续期间；账号注销后 30 天内删除或匿名化 |
| 订单与授权记录 | 订单号、购买的方案与天数、金额与货币、支付状态、Creem 返回的交易标识、授权码、激活 / 续期 / 解绑 / 换绑记录 | 发放与续期授权、核对付款、处理退款与拒付、履行税务与会计留档义务 | 账号存续期间；财务与税务相关记录自交易发生之日起 5 年 |
| 激活设备信息 | 安装 ID 的哈希值、设备名称、操作系统与版本、应用版本、激活时间、授权校验（心跳）时间、来源 IP 地址 | 执行单设备租约、防止授权码滥用与盗用、排查激活失败等技术问题 | 激活与心跳记录 12 个月；IP 地址在安全日志中保留 6 个月 |
| 网站偏好与必要日志 | 浏览器本地保存的网页语言与法律页阅读语言、必要的安全与错误日志（时间、请求路径、结果码） | 记住你的语言选择、保障服务安全与稳定 | 本地偏好保存在你的浏览器中，直到你清除；安全日志 6 个月 |
计票与场次数据在你的本机处理与保存，服务器不保存你的直播明细。
3. 我们不收集什么
- 不接触 TikTok 账号凭据：我们不会要求或收集你的 TikTok 账号、密码或登录会话，也不需要通过 TikTok 账号登录。
- 不采集直播内容用于广告：我们不会为广告投放或用户画像收集、分析你的直播内容、聊天原文或礼物明细。
- 不含广告追踪器：本网站不使用第三方广告 Cookie、像素或跨站追踪脚本。
- 不保存完整支付卡信息：卡号、有效期与安全码由 Creem 及其支付服务商直接处理，我们不接收、不存储这些信息。
- 不出售或出租数据：我们不会将你的个人信息出售、出租或交换给第三方用于其自身营销。
4. 处理目的与法律依据
我们基于以下目的与依据处理你的信息：
- 履行合同：创建账号、交付与续期授权、执行单设备租约、提供技术支持与退款处理。
- 法定义务：保存交易与税务记录、响应监管或司法机关的合法要求。
- 合法利益：防止欺诈、盗用授权码与滥用服务，保障服务安全与稳定。
- 你的同意：在你选择网页语言或法律页阅读语言时，我们会在你的浏览器中保存该偏好；你可以随时清除。若你位于欧洲经济区或英国，上述依据分别对应 GDPR 第 6(1)(b)、6(1)(c)、6(1)(f) 与 6(1)(a) 条。
5. 第三方处理者与共享
- Creem（creem.io）：作为 Merchant of Record（法定卖家）处理结账、支付卡信息、代收代缴全球税费并处理退款。Creem 会向我们返回订单与交易状态、邮箱地址等你完成交付所需的信息。
- 云服务器托管商：承载官网、后台管理与接口，服务器位于中国香港。
- 邮件服务商：用于发送授权码、续期提醒与售后通知。
我们仅在为完成上述目的所必需的范围内与处理者共享信息，并要求其按合同与适用法律保护这些数据。除法律要求或为保护合法权益所必需外，我们不会向其他第三方披露你的个人信息。
6. 数据保留
我们只在必要期限内保留信息（见第 2 节的保留期限列）。期限届满后，我们会删除或匿名化这些信息。若你注销账号，我们会在 30 天内删除或匿名化账号与联系信息，但依法必须保留的交易与税务记录除外。
7. 数据安全
我们采取合理的技术与组织措施保护你的信息，包括传输加密（HTTPS）、访问控制、最小权限与操作日志。但没有任何系统能保证绝对安全，请使用强密码并妥善保管你的授权码。
8. 数据跨境传输
我们的服务器位于中国香港，Creem 及其支付服务商可能在香港、美国、爱尔兰或其他地区处理数据。当你在中国大陆使用本服务时，相关信息的跨境提供依据《中华人民共和国个人信息保护法》第三章的规定进行，我们会采取必要的保障措施；若法律要求单独同意，我们会另行征得你的同意。如果你位于欧洲经济区、英国或瑞士，跨境传输依据 GDPR 第 46 条规定的适当保障措施进行。
9. 你的权利
你可以随时通过 support@xfmc.net 行使以下权利，我们会在 15 个工作日内答复（最迟不超过 30 天）：
- 查阅与复制：了解我们持有哪些与你有关的信息，并获取副本。
- 更正：要求更正不准确或不完整的信息。
- 删除：在法定保留义务之外，要求删除你的账号与个人信息。
- 导出：以常用机器可读格式导出订单与授权记录。
- 限制或反对处理：在特定情形下要求限制处理或反对基于合法利益的处理。
- 撤回同意：随时撤回对语言偏好等作出的同意，不影响撤回前已进行的处理的合法性。
- 注销账号：申请注销账号并停止使用本服务。
- 投诉：向所在司法辖区的监管机构提出投诉。若你位于欧洲经济区或英国，你享有 GDPR 项下的访问、更正、删除、限制、可携、反对与不受自动化决策约束等权利；若你位于中国大陆，你享有《个人信息保护法》第四章规定的权利。
10. Cookie 与 localStorage
- 必要的会话 Cookie：用于在后台管理保持你的登录状态，使账号与授权信息可以正确显示。
- 本地偏好（localStorage）：
liuguang:website-language:v1 保存你选择的网页语言；liuguang:legal-language:v1 保存你在本页选择的正文语言。这些数据仅保存在你的浏览器中，不会发送到服务器，清除浏览器数据即可删除。
- 我们不使用广告或跨站追踪 Cookie。禁用 Cookie 可能导致无法登录后台管理，但浏览本页不受影响。
11. 未成年人
本服务面向 TikTok 直播团队与从业者，不面向未成年人设计。若你未满 18 周岁，请在监护人同意与指导下使用本服务并完成购买。我们不会主动收集未满 14 周岁儿童的个人信息；如发现此类情况，我们会尽快删除相关数据。
12. 第三方链接
本网站可能链接到 TikTok、Creem、OBS 等第三方页面。这些页面由第三方独立运营，其信息处理适用各自的隐私政策，我们不对其内容或做法负责。请在提供个人信息前阅读其隐私政策。
13. 政策更新
我们可能更新本政策，并在本页公布新的生效日期。涉及重大变更时，我们会通过官网公告或邮件通知。变更后继续使用本服务，即视为接受更新后的政策。
14. 联系我们
XFMC ("Liuguang") Privacy Policy
Effective date: September 28, 2026
Applies to: the XFMC desktop client (shown in the interface as "流光 / Liuguang") and the website https://xfmc.net/
Data controller: the developer of XFMC, an independent developer based in mainland China
1. Overview
This Privacy Policy explains what information we collect when you buy, activate and use the XFMC desktop client and the related website, how we use and keep it, who we share it with, and what rights you have. We collect only the information needed to provide your licence, deliver it and support you afterwards. We do not run advertising and we do not sell your data.
2. Information we collect
| Category | What it includes | Why we use it | Retention |
|---|
| Account and contact | Email address, account identifier, login session tokens, sign-in and sign-out times | Create your account, sign you in, deliver your licence code, send renewal reminders, handle support and refunds | While the account exists; deleted or anonymised within 30 days of account closure |
| Order and licence records | Order number, plan and period purchased, amount and currency, payment status, transaction identifier returned by Creem, licence code, activation / renewal / unbind / rebind records | Issue and renew licences, reconcile payments, process refunds and chargebacks, meet tax and accounting obligations | While the account exists; finance and tax records for 5 years from the transaction date |
| Activation device data | Hash of the installation ID, device name, operating system and version, application version, activation time, licence check-in (heartbeat) times, source IP address | Enforce the one-device lease, prevent misuse or theft of licence codes, diagnose activation failures | Activation and heartbeat records for 12 months; IP addresses in security logs for 6 months |
| Website preferences and essential logs | Website language and legal-page reading language stored in your browser, plus essential security and error logs (time, request path, result code) | Remember your language choice, keep the Service secure and stable | Local preferences stay in your browser until you clear them; security logs for 6 months |
Tally and session data are processed and stored locally on your machine. We do not keep your live-show detail on our servers.
3. What we do NOT collect
- No TikTok credentials: we never ask for or collect your TikTok account, password or login session, and you never need to sign in with a TikTok account.
- No live content for advertising: we do not collect or analyse your live-stream content, chat logs or gift detail for advertising or profiling.
- No ad trackers: this website uses no third-party advertising cookies, pixels or cross-site tracking scripts.
- No full card data: card numbers, expiry dates and security codes are handled directly by Creem and its payment providers. We neither receive nor store them.
- No selling or renting of data: we do not sell, rent or trade your personal information to third parties for their own marketing.
4. Purposes and legal bases
We process your information for the following purposes and on the following bases:
- Performance of a contract: creating your account, delivering and renewing licences, enforcing the one-device lease, providing technical support and handling refunds.
- Legal obligations: retaining transaction and tax records, and responding to lawful requests from regulators or courts.
- Legitimate interests: preventing fraud, licence-code theft and abuse, and keeping the Service secure and stable.
- Your consent: when you choose a website language or a legal-page reading language, we store that preference in your browser and you can clear it at any time. If you are in the EEA or the UK, these bases correspond to Articles 6(1)(b), 6(1)(c), 6(1)(f) and 6(1)(a) GDPR respectively.
5. Processors and sharing
- Creem (creem.io) acts as the Merchant of Record: it handles checkout, card data, the collection and remittance of taxes worldwide, and refunds. Creem returns order and transaction status, your email address and similar details that we need to deliver your licence.
- Cloud hosting provider: hosts this website, the account centre and our APIs. The servers are located in Hong Kong.
- Email service provider: used to send licence codes, renewal reminders and support notices.
We share information with processors only as far as needed for the purposes above, and require them to protect it under contract and applicable law. We do not disclose your personal information to other third parties except where the law requires it or where necessary to protect our legitimate rights.
6. Retention
We keep information only for as long as necessary (see the retention column in section 2). When a period ends, we delete or anonymise the information. If you close your account, we delete or anonymise the account and contact information within 30 days, except for transaction and tax records we are legally required to keep.
7. Security
We use reasonable technical and organisational measures to protect your information, including encryption in transit (HTTPS), access controls, least privilege and operational logging. No system can be perfectly secure, so please use a strong password and keep your licence code safe.
8. International transfers
Our servers are located in Hong Kong, and Creem and its payment providers may process data in Hong Kong, the United States, Ireland or other regions. Where you use the Service from mainland China, such cross-border provision of information is carried out in accordance with Chapter III of the Personal Information Protection Law of the People's Republic of China, and we apply the necessary safeguards; where the law requires separate consent, we will ask for it. If you are in the EEA, the UK or Switzerland, transfers rely on the appropriate safeguards set out in Article 46 GDPR.
9. Your rights
You can exercise the following rights at any time by emailing support@xfmc.net. We respond within 15 business days and in any event within 30 days:
- Access and copy: learn what information we hold about you and obtain a copy.
- Rectification: ask us to correct inaccurate or incomplete information.
- Erasure: ask us to delete your account and personal information, subject to legal retention duties.
- Export: receive your order and licence records in a common machine-readable format.
- Restriction and objection: in certain circumstances, ask us to restrict processing or object to processing based on legitimate interests.
- Withdraw consent: withdraw consent (for example for language preferences) at any time, without affecting the lawfulness of processing carried out before withdrawal.
- Close your account: request closure and stop using the Service.
- Complain: lodge a complaint with the supervisory authority in your jurisdiction. If you are in the EEA or the UK you have the GDPR rights of access, rectification, erasure, restriction, portability, objection and not to be subject to solely automated decisions; if you are in mainland China you have the rights set out in Chapter IV of the Personal Information Protection Law.
10. Cookies and localStorage
- Essential session cookie: keeps you signed in to the account centre so your account and licence details display correctly.
- Local preferences (localStorage):
liuguang:website-language:v1 stores the website language you chose; liuguang:legal-language:v1 stores the reading language you chose on this page. This data stays in your browser and is never sent to our servers; clearing your browser data removes it.
- We use no advertising or cross-site tracking cookies. Disabling cookies may prevent you from signing in to the account centre, but browsing this page still works.
11. Minors
The Service is built for TikTok live teams and professionals and is not directed at minors. If you are under 18, please use the Service and make purchases only with the consent and guidance of a parent or guardian. We do not knowingly collect personal information from children under 14; if we learn that we have, we will delete it promptly.
12. Third-party links
This website may link to third-party pages such as TikTok, Creem and OBS. Those pages are operated independently and their information practices are governed by their own privacy policies. We are not responsible for their content or practices; please read their privacy policies before providing personal information.
13. Changes to this policy
We may update this policy and publish a new effective date on this page. For material changes we will post a notice on this website or email you. Continuing to use the Service after a change takes effect means you accept the updated policy.
14. Contact us