NextStep 隐私政策

1. 用途与数据处理方式

NextStep 在浏览器侧栏中保存工作进度、下一步行动、交接内容和原文证据，帮助你继续工作并找回来源。NextStep 无需自身账户，普通版没有开发者后端、分析、遥测、直接调用人工智能服务的接口或云端同步。持久工作数据使用口令保护的本机加密保险箱。

“本机加密存储”不代表所有操作中的内容都不会离开设备。你主动复制、导出、打开网站，或在 ChatGPT 中使用原生搜索辅助找回原文时，存在下文说明的外部边界。

2. 处理哪些数据，为什么处理

• 你输入或粘贴的工作内容：项目、任务、目标、进度、规则、等待状态、下一步、目的地、交接正文及备注，用于展示、编辑、搜索和继续工作。相关记录可包含完成／归档状态、结束快照、交接复制时间和内容指纹。
• 你保存的原文证据：选中或粘贴的文字、来源标题和网址、可用的规范网址、捕获时间、前后文、原始证据及修订历史，用于保留摘录并重新定位。编辑原文会保留首次证据及旧版本，直至你删除该原文记录。
• 额外定位信息：页面摘录或你明确请求刷新上下文时，强锚点可保存结构和位置提示、文字摘要指纹、邻近块指纹、质量信息，以及证据片段。证据胶囊中的正文片段最多 16,384 个 UTF-8（字符编码）字节，前后片段各最多 4,096 字节；这些片段可能包含选区以外的文字。用于文字匹配的短前后文也会另行保存。并非每条原文都有这些信息。
• 临时页面处理：经你启用页面处理并主动捕获或定位后，NextStep 会临时检查已呈现的页面文字，包括选区外及视窗外文字。打开原文可能自动滚动，以查找已保存段落。完整扫描模型不作为页面档案持续保存；上一项的已保存证据片段属于例外。
• 标签页和界面信息：主动使用当前页面时读取其标题与网址；主动打开原文时可在同一浏览器的多个窗口中检查已授权来源站点的候选标签页，复用匹配页面或打开新页面。定位过程中处理必要的标签页／框架／文档标识和页面变化，以保持任务范围或停止任务。界面语言、记录关联、标识和时间戳用于运行这些功能。
• 本地保险箱口令：在设备上用于派生加密密钥和解锁数据。NextStep 不把口令发送给开发者，也无法恢复遗忘的口令。解锁期间，派生密钥保留在仅受信任扩展上下文可访问的浏览器会话内存中。

你选择的网页、聊天、交接或手工内容可能包含个人身份、私人通信、健康、财务或其他敏感信息；本机保存仍属于数据处理。NextStep 不读取浏览器密码库、认证 Cookie（网站会话凭据）或整套浏览历史，也不提供后台收集个人资料的功能。

3. 存储、保留与安全

持久工作数据保存在浏览器扩展的本机存储中，使用 AES-GCM（认证加密算法）加密，密钥由你的口令通过 PBKDF2（口令密钥派生算法）与随机盐生成。普通版不使用浏览器同步存储。

解锁后，界面和正在执行的任务会在内存中持有可读数据。授权后的待处理摘录和保存失败的恢复记录可能临时以可读形式保留在仅扩展可访问的浏览器会话内存中，不使用保险箱加密；它们可包含摘录、标题、网址及必要标签页／框架标识。完成或取消相应待处理摘录会移除它。锁定会清除待处理摘录、恢复数据、未保存草稿及派生会话密钥；浏览器重启会清除会话数据，之后需重新解锁。锁定时不会排队新的页面选区。

已保存记录一直保留到你删除、由恢复备份替换，或移除扩展／浏览器配置数据。结束和归档不是删除。删除工作流会保留并解除原文与交接包的关联；删除原文会移除其原始证据和修订。此加密保护不能防护已被控制的浏览器或操作系统；旧版已下载的明文文件和你复制出去的文字不受保险箱保护。

4. 哪些操作会交付给外部

复制和导出

点击复制时，所选摘录、交接或快照以可读文字写入系统剪贴板；你随后粘贴到的应用或网站按其自身规则处理这些内容。导出生成本地加密备份文件，需要口令恢复。NextStep 不自动上传备份；你自行存储、同步或分享文件会使该文件进入你选择的渠道。恢复读取你选择的备份，在本地验证后经明确确认替换当前数据。

打开来源或目的地

点击打开来源、原页面或目的地时，浏览器会打开或激活你指定的网站。正常导航会向网站及其服务发出网络请求，网址及其中包含的信息、浏览器通常发送的信息，以及网站根据你的登录状态处理的信息，受该网站的政策约束。NextStep 没有替网站接管账户、认证或网络请求。

ChatGPT 原生搜索

当你在 ChatGPT 来源上主动选择“打开原文”，且本地定位未找到段落时，NextStep 可能打开 ChatGPT 的原生搜索窗口，并填入由已保存摘录生成的搜索词。当前普通版使用摘录中的最多 96 个 Unicode（统一字符编码）码点作为首次搜索词。这些词会交给 ChatGPT 网站，可能由其服务处理；这一操作不是纯本地文字搜索，也不能保证搜索词留在设备上。

原生搜索由 ChatGPT 网站处理，适用 OpenAI 隐私政策。NextStep 可以强调经核验属于原文来源会话的结果行，可能有多条；这不代表确认了唯一的具体消息，仍由你选择对应消息。搜索准备完成不等于已自动完成原文定位。NextStep 不通过自身后端或直接人工智能接口执行这一搜索。

5. 权限与控制

页面处理可选，首次使用前会展示说明并征求明确同意。手工工作流、原文和交接内容可在本地保险箱中使用。捕获和定位需要保险箱解锁及当前页面处理说明的同意。

安装时需要本机存储、浏览器侧栏、右键菜单、主动标签页临时访问和运行打包页面脚本等权限。“使用当前页面”按需申请可选标签页元数据权限；“打开原文”按来源协议和主机名请求可选网站访问权限，而非一次授权全部网站。授权覆盖该主机名下的页面，浏览器匹配规则可能覆盖其端口；不是只授权某一篇页面。你可拒绝这些请求，并在设置中移除标签页或网站权限。移除权限不会删除已保存的摘录。

你可以在界面查看、编辑和删除记录，锁定保险箱、导出加密备份，或在验证并确认后恢复备份。卸载或清除本地扩展数据可能删除唯一副本；备份文件、系统剪贴板内容和已经交给外部网站的内容需通过各自渠道管理。

6. 使用范围与第三方

NextStep 仅为上述工作继续和来源找回功能使用数据，不为广告、出售资料或信用评估使用数据。普通版不存在向开发者自动上传工作数据的通道。由你发起的来源导航、原生网站搜索、复制或文件分享，按第 4 节所述将必要信息交给对应网站或你选择的渠道。

NextStep 对从浏览器接口取得的信息的使用遵守 Chrome Web Store（Chrome 网上应用店）用户数据政策，包括 Limited Use（有限使用）要求。数据仅用于已披露的单一用途；不会为了个性化广告、资料经纪或信用／借贷目的使用、出售或转移数据。

7. 联系与变更

有关 NextStep 隐私的问题，请联系 Ahaloom Studio · 灵织工作室：c399475130@live.com。与 ChatGPT 或其他来源网站的数据有关的问题，需要联系该网站的服务方。数据实践有实质变化时，应同步更新本政策、商店声明及产品内说明，并在适用时再次征求同意。

8. 帮助网站与邮件联系

这些帮助和隐私页面不包含统计脚本、登录或反馈表单。如果部署在 GitHub Pages（静态网页托管）上，GitHub 会为安全目的记录访问者的 IP（网络地址）；这是访问网页的托管处理，不是扩展上传工作数据。详情见 GitHub Pages 说明及 GitHub 隐私声明。

点击邮箱链接只会打开你的邮件应用，不会自动发送邮件。你主动发送的邮件由邮箱服务处理，我们仅为回复支持或隐私请求使用所收到的信息。请勿发送保险箱口令、完整保险库或不必要的私人原文。

NextStep Privacy Policy — English

Publisher display name: Ahaloom Studio. Chinese brand: 灵织工作室. Product: NextStep. Support and privacy contact: c399475130@live.com. Last updated: October 13, 2026. This policy applies from its publication date.

Purpose and information handled

NextStep keeps workflow progress, next actions, handoff content and source evidence in a browser side panel to help you continue work and return to a source. It has no NextStep account, developer backend, analytics, telemetry, direct AI-service API or cloud synchronization in the normal build. Persistent working data is kept in a local, passphrase-protected encrypted vault.

The extension handles work text you enter or paste; saved excerpts, titles, source and destination URLs, capture times, original evidence and revisions; completion or archive state, closure snapshots, copy receipts and fingerprints; and language and record links. Authorized page capture or context refresh can also store structural and position hints, text fingerprints and evidence fragments: a block excerpt of up to 16,384 UTF-8 bytes and before/after excerpts of up to 4,096 bytes each, in addition to short quote context. These fragments may include text outside the selection. Not every source contains these fields.

Authorized capture and relocation temporarily inspect rendered text, including text outside the selection and viewport, and may scroll. Complete page models are not retained as a browsing archive, although the saved evidence fragments above are retained. Use Current Page reads its title and URL. Open Original can inspect candidate tabs for the authorized source site across windows of the same browser, reuse a matching tab or open a new tab. Task-specific tab, frame and document identifiers and changes support the requested operation and cancellation.

Content you choose can contain personal identifiers, private communications, health, financial or other sensitive information. Local processing still handles user data. NextStep does not read the browser password manager, authentication cookies or the full browsing history.

Local storage and retention

Persistent work data is encrypted with AES-GCM using a key derived locally from your passphrase with PBKDF2 and a random salt. The normal build does not use browser sync storage. Your passphrase is not sent to the developer; NextStep cannot recover it.

Readable data exists in memory while unlocked. Authorized pending captures and save-recovery records can temporarily contain readable selected text, titles, URLs and necessary tab/frame identifiers in trusted-extension-only browser session memory; they are not vault-encrypted. A derived key is also cached in trusted session memory while unlocked. Completing or cancelling a pending capture removes it. Lock clears pending captures, recovery records, unsaved drafts and the session key. Browser restart clears session data and requires unlocking again. New selections are not queued while locked.

Saved records remain until deleted, replaced through a confirmed backup restore, or removed with extension/browser-profile data. Completion and archiving do not delete records. Deleting a workflow preserves and unlinks sources and handoffs; deleting a source removes its original evidence and revisions. Local encryption does not protect a compromised browser or operating system. Existing plaintext files and copied text remain outside vault protection.

External boundaries

Copy buttons write readable excerpts, handoffs or snapshots to the system clipboard. Applications or websites where you paste them handle them under their own policies. Export creates a local encrypted backup requiring its passphrase; NextStep does not automatically upload it. Your chosen storage or sharing channels handle files you place there. Restore reads and validates your selected file locally and replaces current data only after explicit confirmation.

Opening a source, original page or destination activates or navigates to the selected website. Ordinary browser navigation makes network requests and exposes the URL and normal browser information to that website and its services under its policies, including its handling of your existing login state.

On a ChatGPT source, if you choose Open Original and local relocation cannot find the passage, NextStep may open ChatGPT's native search and fill words derived from the saved excerpt. The normal build currently uses up to 96 Unicode code points from the excerpt for its first search query. The query is provided to ChatGPT's website and may be processed by its service under the OpenAI Privacy Policy. This search is not purely local; the words cannot be promised to remain on your device. NextStep may emphasize result rows verified as belonging to the source conversation; there may be more than one row. This does not identify a unique saved message, and you choose the relevant message. Preparing search is not automatic completion of relocation. No NextStep backend or direct AI API performs this search.

Permissions, choices and use limits

Page processing is optional and requires an unlocked vault and affirmative agreement to the current in-product explanation. Required permissions support local storage, the side panel, selection menus, temporary access after an explicit invocation and bundled page scripts. Use Current Page requests optional tab metadata access. Open Original requests optional access for the selected source protocol and hostname, not all sites at once. The browser grant covers that host's pages and may cover its ports, rather than only one document. You can decline or revoke optional permissions in Settings without deleting saved excerpts.

You can view, edit and delete records, lock the vault, export an encrypted backup, and explicitly confirm a verified restore. Uninstalling or clearing extension data may delete the only copy. Backup files, clipboard data and information already given to an external service must be managed through those channels.

NextStep uses information only for the disclosed work-continuation and source-recovery purpose. The normal build has no automatic channel uploading work data to the developer. User-initiated website navigation, native search, clipboard use and file sharing have the external boundaries stated above. NextStep's use of information received from browser APIs complies with the Chrome Web Store User Data Policy, including Limited Use requirements. It does not use, sell or transfer data for personalized advertising, data brokerage or credit/lending purposes.

For NextStep privacy questions, contact Ahaloom Studio (灵织工作室) at c399475130@live.com. Questions about ChatGPT or another website's handling must be directed to that service. Material data-practice changes require corresponding policy, store and in-product updates, with renewed consent where applicable.

Help website and email contact

These help and privacy pages have no analytics scripts, login or feedback forms. When hosted on GitHub Pages, GitHub records visitor IP addresses for security. This is website hosting activity, not an upload of work data by the extension. See GitHub Pages documentation and the GitHub Privacy Statement.

An email link opens your email application; it does not send automatically. Email you choose to send is handled by email services, and we use received information to respond to your support or privacy request. Do not send vault passphrases, a complete vault or unnecessary private excerpts.