docs: add privacy

PRIVACY.md

@@ -0,0 +1,208 @@
+# Privacy Policy
+
+**Applies to:** the Clash Verge Rev desktop application for Windows, macOS and
+Linux, distributed from
+<https://github.com/clash-verge-rev/clash-verge-rev/releases>.
+
+**Last updated:** 2026-09-09
+
+Clash Verge Rev is a free and open-source graphical client for the
+[mihomo](https://github.com/MetaCubeX/mihomo) proxy core, maintained by
+volunteers. The project has no company behind it, no user accounts, and no
+server of its own that the application talks to.
+
+## 1. Summary
+
+- The project **collects nothing**. There is no telemetry, no analytics, no
+  crash or usage reporting, no advertising or tracking SDK, and no registration.
+  No data of any kind is sent to the maintainers or to infrastructure operated
+  by this project.
+- Your configuration, credentials and logs are stored **only on your own
+  device**, in plain files you can read, back up or delete at any time
+  (Section 3).
+- The application connects only to endpoints that you configure (proxy servers,
+  subscription URLs, backup server) or to the third-party services listed in
+  Section 4. None of them are operated by this project.
+- Two connections are enabled by default and are not part of your own proxy
+  configuration: the **application update check** (Section 4.3) and the **IP
+  information card** on the Home page (Section 4.5). Both are described below,
+  and Section 6 explains how to turn them off.
+
+## 2. Who is responsible
+
+The Clash Verge Rev maintainers, reachable through the project's issue tracker
+at <https://github.com/clash-verge-rev/clash-verge-rev/issues>. Because the
+application performs no data collection, there is no data controller
+relationship, no processing agreement, and no data to request or erase from us.
+
+## 3. Data stored on your device
+
+All application data lives in a single directory:
+
+| Platform | Location |
+| --- | --- |
+| Windows | `%APPDATA%\io.github.clash-verge-rev.clash-verge-rev` |
+| macOS | `~/Library/Application Support/io.github.clash-verge-rev.clash-verge-rev` |
+| Linux | `$XDG_DATA_HOME/io.github.clash-verge-rev.clash-verge-rev` (usually `~/.local/share/…`) |
+
+It contains:
+
+- `verge.yaml` — application settings. If you configure WebDAV backup, the
+  server URL, user name and password are stored here **in plain text**.
+- `config.yaml`, `profiles.yaml` and `profiles/` — your proxy configuration and
+  downloaded subscriptions. These normally contain **subscription URLs (which
+  often embed a personal token), proxy server addresses, ports, passwords and
+  UUIDs**.
+- `logs/` and `service-logs/` — application and privileged-service logs. Core
+  logs can contain requested domain names, IP addresses and connection metadata,
+  depending on the log level you select.
+- Core runtime files (for example mihomo's `cache.db` and GeoIP/GeoSite
+  databases) used by the proxy core.
+
+None of this leaves your device unless you enable WebDAV backup (Section 4.9),
+export a backup yourself, or attach these files to a bug report.
+
+Application logs are deleted automatically after a retention period you choose
+in *Settings → Miscellaneous → Auto Log Clean* (default: 7 days; `Never Clean` keeps
+them indefinitely). Uninstalling the application and removing the directory
+above deletes everything else.
+
+**When reporting a bug**, review logs and configuration before attaching them:
+they may reveal your proxy servers, subscription tokens and browsing
+destinations.
+
+## 4. Network connections the application makes
+
+### 4.1 Proxy traffic
+
+Traffic you route through the application is handled by the bundled mihomo core
+and goes to the proxy servers **you** configured. It is not inspected, recorded
+or forwarded anywhere by this project. Your proxy provider can see this traffic
+to the extent any proxy operator can; their privacy policy applies.
+
+### 4.2 Subscription (profile) updates
+
+When you add a remote profile, the application downloads it from the URL you
+supplied, sending a `User-Agent` of `clash-verge/v<version>` unless you set a
+different one for that profile. If you enable automatic updates for a profile,
+this request repeats on the interval you choose. The subscription provider sees
+your IP address and this request; it is the same request your browser would
+make. Requests can be sent directly, through the system proxy, or through the
+application's own proxy port, as configured per profile.
+
+### 4.3 Application update check — *enabled by default*
+
+On startup the application asks whether a newer release exists, in order, from:
+
+- `https://update.hwdns.net/…` and `https://gh-proxy.org/…` (third-party GitHub
+  mirrors, used for reachability in restricted networks)
+- `https://github.com/clash-verge-rev/clash-verge-rev/releases/…`
+
+The request carries only what any HTTP request carries: your IP address, the
+`User-Agent` and the requested file. No identifier is generated or sent, and no
+result is reported back to the project. Downloaded updates are verified against
+a Minisign public key compiled into the application.
+
+Disable it in *Settings → Miscellaneous → Auto Check Update*.
+
+### 4.4 Proxy core update — *user-initiated*
+
+Updating the mihomo core downloads it from GitHub Releases
+(`https://github.com/MetaCubeX/mihomo/releases/…`) only when you start the
+update.
+
+### 4.5 IP information card — *enabled by default*
+
+The Home page shows your apparent public IP address and its geolocation. To do
+this it queries one randomly chosen service from:
+`api.ip.sb`, `ipapi.co`, `api.ipapi.is`, `ipwho.is`, `ip.api.skk.moe`,
+`get.geojs.io`. The query is refreshed about every 5 minutes while the card is
+visible and the window is shown; it is not sent while the window is hidden or
+the Home page is not in view.
+
+By design these services see and return the IP address the request came from —
+that is the feature. If a proxy is active, they see the proxy's address.
+Each service is operated by an independent third party under its own privacy
+policy; the project has no agreement with any of them. Keep the Home page
+closed (or the application minimised) if you do not want these requests.
+
+### 4.6 Latency tests — *user-initiated*
+
+Testing a proxy or group sends an HTTP request through that proxy to
+`http://cp.cloudflare.com/generate_204`, or to the test URL you configure.
+
+### 4.7 Streaming availability test — *user-initiated*
+
+The unlock test sends requests through your local proxy port to the streaming
+and AI services being tested (Netflix, Disney+, YouTube, Spotify, OpenAI and
+similar). It runs only when you start it, and only through the proxy you have
+selected.
+
+### 4.8 DNS
+
+The generated core configuration uses public DoH resolvers by default
+(`doh.pub`, `dns.alidns.com`), and your proxy configuration may define others.
+Resolvers see the domain names being resolved. You can change or replace them in
+the DNS settings and in your own configuration.
+
+### 4.9 WebDAV backup — *disabled until you configure it*
+
+If you set up backup, the application uploads a ZIP archive to the WebDAV server
+you specify. The archive contains your profiles, `profiles.yaml`, `config.yaml`,
+the DNS configuration and `verge.yaml`; **WebDAV credentials are stripped from
+`verge.yaml` before upload, but proxy servers, passwords and subscription URLs
+inside your profiles are not**. Treat a backup as sensitive and use a server you
+trust. Backups are only transferred to that server.
+
+### 4.10 Local listeners
+
+The proxy ports and the internal control port bind to `127.0.0.1` only. They are
+not exposed to your network unless you deliberately configure the core to allow
+LAN access.
+
+## 5. Third-party components and services
+
+The application bundles or depends on software with its own behaviour and
+policies:
+
+- **mihomo (Clash.Meta) core** — <https://github.com/MetaCubeX/mihomo>.
+  Performs the actual proxying and DNS resolution.
+- **Tauri and the system WebView** — the user interface renders in the
+  operating system's web engine: Microsoft Edge WebView2 on Windows (subject to
+  the [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement)),
+  WKWebView on macOS, WebKitGTK on Linux.
+- **External dashboards** — opening a web dashboard (metacubexd, Yacd, Zash
+  Board) loads a third-party site in your browser; it then talks to your local
+  core.
+- **GitHub** — hosts the source, releases and update metadata; it sees download
+  requests, and anything you post in issues is public.
+- **Your proxy and subscription providers**, and any WebDAV or DNS provider you
+  configure, are independent of this project and govern their own data handling.
+
+## 6. Your controls
+
+- *Settings → Miscellaneous → Auto Check Update* — turn off the update check.
+- *Settings → Miscellaneous → Auto Log Clean* — set log retention, or `Never Clean`.
+- Per-profile update interval — turn off automatic subscription refresh.
+- WebDAV backup is inactive until you enter server details, and can be cleared
+  at any time.
+- The IP information card only queries while the Home page is visible
+  (Section 4.5).
+- Everything else is a plain file on your disk: delete the application data
+  directory to remove all stored data.
+
+## 7. Children
+
+The application is a network tool with no content directed at children and no
+data collection of any kind.
+
+## 8. Changes
+
+Changes to this policy are made in the repository and are visible in its Git
+history. The date at the top reflects the most recent change.
+
+## 9. Contact
+
+Open an issue at
+<https://github.com/clash-verge-rev/clash-verge-rev/issues>. Please do not
+include logs or configuration files containing credentials in public issues.

README.md

@@ -127,6 +127,13 @@ Clash Verge rev was based on or inspired by these projects and so on:
 - [Fndroid/clash_for_windows_pkg](https://github.com/Fndroid/clash_for_windows_pkg): A Windows/macOS GUI based on Clash.
 - [vitejs/vite](https://github.com/vitejs/vite): Next generation frontend tooling. It's fast!
 
+## Privacy
+
+Clash Verge Rev 不收集任何用户数据，配置与日志仅保存在本地。详见[隐私政策](./PRIVACY.md)。
+
+Clash Verge Rev does not collect any user data; configuration and logs stay on
+your own device. See the [Privacy Policy](./PRIVACY.md) for details.
+
 ## License
 
 GPL-3.0 License. See [License here](./LICENSE) for details.

docs/README_en.md

@@ -125,6 +125,11 @@ Clash Verge Rev builds on or draws inspiration from these projects:
 - [Fndroid/clash_for_windows_pkg](https://github.com/Fndroid/clash_for_windows_pkg): A Clash GUI for Windows and macOS.
 - [vitejs/vite](https://github.com/vitejs/vite): Next-generation frontend tooling with blazing-fast DX.
 
+## Privacy
+
+Clash Verge Rev does not collect any user data; configuration and logs stay on
+your own device. See the [Privacy Policy](../PRIVACY.md) for details.
+
 ## License
 
 GPL-3.0 License. See the [license file](../LICENSE) for details.