语音桥VoiceBridge VoiceBridge
隐私政策Privacy policy

我们收集得越少，能泄露的就越少。 The less we collect, the less we can leak.

这份政策覆盖试点期间涉及儿童的一切数据处理。它以"默认不收集"为设计前提，而不是靠承诺来约束。 This policy covers all handling of children's data during the pilot. It is built on "collect nothing by default" as an architectural premise, not as a promise.

草案 v0.1 · 待法律复核Draft v0.1 · Pending legal review 更新：2026-10-28Updated: 28 Oct 2026
Status: draft. This document has not yet been reviewed by a lawyer or a child-protection specialist in the country of operation. Until it is, we cite it as a draft and do not claim compliance.

1. Scope and stance

This policy covers every person who touches the system: centre coordinators, engineers, content reviewers and partner staff. Three principles, in this order:

  1. The child's interest outranks project efficiency. When they conflict, we switch the device off first and discuss afterwards.
  2. Collect nothing by default. If we can answer a question without data, we do not collect the data.
  3. Explainable and withdrawable. A guardian can stop their child's use and ask for deletion at any time.

2. What we collect

DataCollected?Notes
Child's nameNoDevices carry only an anonymous code such as C-07. In the shared-hub configuration no device is assigned to any child, so no code-to-name mapping exists at all. If handheld units are added later, any such mapping stays on a paper register at the centre and is never uploaded.
Raw audioNoStreamed, transcribed, discarded. Never written to disk.
Transcript textMetadata onlyDuration, topic category, whether a filter fired. Not the words.
Usage logYesDevice ID, timestamp, duration, session count.
LocationSite level onlyWhich centre, never device-level positioning.
Guardian contactYes, on paperHeld by the centre for consent and emergencies. Not uploaded.
Photos or videoNoNot part of the system. Publicity material requires separate written consent.

3. What we never collect

  • Raw or derived voice recordings.
  • Biometric templates of any kind, including voiceprints.
  • Profiles built for advertising, scoring or commercial use.
  • Any data sold, shared or licensed to a third party. We have no commercial revenue and intend to keep it that way.

4. Third-party services

Transcription, language generation and speech synthesis run on external APIs. Before a service enters the pilot it must meet all three conditions:

  • It does not retain request content or use it for model training.
  • Identifiers are stripped on our side before the request leaves.
  • The provider is disclosed publicly on this site.

A service that fails any condition is not used, regardless of cost or quality.

5. Consent

  • Written guardian consent in the local language before first use, covering: what the device is for, that the system hears the child speak, that nothing is recorded, and that they can stop at any time.
  • A verbal explanation to the child, by the coordinator, before first use.
  • Consent forms stay with the partner; we keep only an aggregate count.
  • No consent, no device. This is not negotiable for a partner.

6. Retention and deletion

DataRetentionThen
Session metadata12 months after pilot endAggregated, then detail deleted
Filter alerts (category only)24 monthsArchived as annual counts
Server logs (incl. IP)30 daysAutomatic rotation
Diagnostic audio samplesMaximum 30 daysAuto-deleted; separate consent required

Deletion requests go through the centre and are completed within 7 working days, with written confirmation.

7. Incident response

  1. Found — anyone reports a suspected leak, loss or unsafe output to the coordinator immediately.
  2. Contain — affected devices disabled remotely within 2 hours; the site pauses if needed.
  3. Assess — within 24 hours: does it involve children's personal data, and how many.
  4. Inform — guardians and the partner within 48 hours; authorities as local law requires.
  5. Review — written review within 7 days, public summary without identifying details, policy updated.

8. Contact and changes

Data protection contact: liangz2210@gmail.com

Every version of this policy is kept in public version control, with the change and the reason for it. We do not silently weaken it.

状态：草案。本文件尚未经执业地律师或儿童保护专家复核。在复核完成前，我们对外只以"草案"引用，不声称已合规。

1. 适用范围与立场

本政策覆盖所有接触该系统的人：中心协调员、工程人员、内容审核人员与合作方员工。三条原则，按此优先级：

  1. 儿童利益优先于项目效率。冲突时先停设备，再讨论。
  2. 默认不收集。能不靠数据回答的问题，就不收集数据。
  3. 可解释、可撤回。监护人可随时要求停止子女使用并删除记录。

2. 我们收集什么

数据是否采集说明
儿童姓名否设备侧只用匿名编号（如 C-07）。中心式阶段不把设备分配给任何儿童个人，因此根本不存在编号与姓名的对应；后续若部署手持机，该对应也只存在于中心纸质名册，从不上传。
原始录音否流式传输、转写后即弃，从不落盘。
转写文本仅元数据时长、话题类别、是否触发过滤；不保留逐字内容。
使用记录是设备编号、时间、时长、会话次数。
位置仅站点级只记所属中心，不做设备级定位。
监护人联系方式是（纸质）由中心保管，用于知情同意与紧急联络，不上云。
照片或影像否不属于系统功能。宣传素材需单独书面授权。

3. 我们绝不收集什么

  • 原始或派生的语音录音。
  • 任何生物特征模板，包括声纹。
  • 用于广告、评分或商业用途的用户画像。
  • 出售、共享或授权给第三方的数据。项目无商业收入，并打算一直如此。

4. 第三方服务

语音识别、生成与合成依赖外部 API。某个服务进入试点前必须同时满足三条：

  • 不留存请求内容，不用于模型训练。
  • 请求发出前，我方已剥离标识信息。
  • 服务商名单在本站公开。

任一条不满足即不接入，无论成本或效果多好。

5. 知情同意

  • 首次使用前的监护人书面同意（当地语言），说明：设备用途、系统会听到孩子说话、不做录音留存、可随时退出。
  • 首次使用前，协调员向儿童本人做口头说明。
  • 同意书由合作方保管，我方只保留汇总数量。
  • 没有同意，就没有设备。这一条对合作方没有商量余地。

6. 保留与删除

数据保留期到期处理
会话元数据试点结束后 12 个月聚合为统计值后删除明细
过滤告警（仅类别）24 个月归档为年度计数
服务器日志（含 IP）30 天自动轮转
诊断音频样本最长 30 天自动删除，需单独同意

删除请求通过中心提出，7 个工作日内完成并书面回执。

7. 事件响应

  1. 发现——任何人发现疑似泄露、丢失或不当内容，立即报协调员。
  2. 止损——2 小时内远程停用相关设备，必要时全站暂停。
  3. 评估——24 小时内判断是否涉及儿童个人信息及人数。
  4. 告知——48 小时内告知监护人与合作方，并按当地法律上报。
  5. 复盘——7 天内书面复盘，公开摘要（不含身份信息），并修订本政策。

8. 联系与修订

数据保护联系人：liangz2210@gmail.com

本政策的每个版本都保留在公开的版本库中，并记录改动与原因。我们不会悄悄把它改弱。