Lantern Files 提燈 — 隱私權政策
最後更新：2026 年 9 月 21 日
開發者：AI_yang
聯絡：chcheaply@gmail.com
（English below.）
一句話
Lantern Files 不收集你的任何資料。它不連網、沒有帳號、沒有伺服器、沒有分析工具、沒有廣告。你的檔案、你講的話、鏡頭裡的畫面，全部留在你自己的電腦上。
這個程式做什麼
它在你的電腦上找檔案、幫檔案改名、把檔案加密，另外有一個可以關掉的桌面寵物。讀你那句話、看圖片、講話用的 AI 模型，是隨程式一起安裝、在你這台電腦上跑的；程式不會把任何內容送到我們或任何第三方的伺服器。
它會碰到哪些資料，怎麼處理
你的檔案。 搜尋時程式會讀你電腦上的檔名、資料夾、日期，必要時讀檔案內容（例如 PDF 第一頁、文件的文字、圖片的畫面），用來比對你打的那句話。這些內容只在記憶體裡用一下，答完就丟，不建立索引、不上傳。改名和加密都只動你選中的檔案，而且只改名字或內容的加密形式，不搬移、不刪除、不覆蓋。
麥克風。 預設關閉。你自己打開後，聲音只送到你電腦上的本機語音辨識程式（whisper），辨識完就丟，不存音檔、不上傳。
鏡頭。 預設關閉。你自己打開後，畫面只送到你電腦上的本機模型，看完就丟，不存影像、不上傳。
螢幕。 預設關閉。打開後程式只讀目前在用的程式名稱（例如「瀏覽器」），另一個獨立的開關才會讀視窗標題；兩者都只給本機模型用，不存、不上傳。
密碼。 加密檔案用的密碼不會被儲存。忘了就打不開，我們也打不開。
它會存在你電腦上的東西
全部在 %APPDATA%\lantern 這個資料夾裡，你可以隨時打開或刪除：
config.json：你的設定（語言、開關、模型選擇）。folders.json：你搜尋過的資料夾路徑和裡面的檔案類型比例，用來下次找得快。沒有檔名、沒有內容。rename-undo.json：批次改名的復原記錄（舊名字 → 新名字），讓你可以一鍵改回來。加密的批次不會記錄在這裡。viewing.json：加密搜尋時暫時打開過的預覽清單，只有暫存檔的位置，不含真實檔名。glance-vectors.json：只有在你打開「記住」這個開關時才會有。每張圖存 512 個數字（圖片的數學特徵），沒有縮圖、沒有文字；設定裡一顆「忘掉」就全部刪掉。
區域網路
「開裂縫送走他」和「讓區網其他機器也能用這顆腦子」這兩個功能，會在你自己的區域網路內、在你按下按鈕之後，跟另一台跑 Lantern Files 的電腦通訊。預設關閉，不經過網際網路。
你自己接的模型
設定裡可以改用你自己指定的模型端點（例如你已經在跑的 Ollama 或 OpenAI 相容伺服器）。如果你把它指向網路上的伺服器，你打的字和給模型看的內容就會送到那台伺服器；那是你的選擇，也受那台伺服器的規則約束，不是這份政策的範圍。預設是內建的本機模型，不會有這個情況。
AI 生成的內容和回報
搜尋對你那句話的理解、加密檔案的註解、桌面寵物講的每一句，都是本機模型即時生成的，可能出錯或不妥。程式裡有「回報 AI 內容」按鈕：它只會打開你電腦上的郵件程式、把那一句填進一封寄給 chcheaply@gmail.com 的信，你看過決定寄不寄。程式本身不會自動送出任何東西。你寄來的信我們只用來改進程式，不會轉給第三方。
兒童
這個程式不是為 13 歲以下兒童設計的，也不會刻意向兒童收集資料（它對任何人都不收集資料）。
變更
政策有改會更新這一頁和上面的日期。有問題寫信到 chcheaply@gmail.com。
關於這個網站
這一節講的是這個網站，不是程式。上面關於程式的每一句都還是成立。
這個網站沒有帳號、沒有表單，不問你任何個人資料，也沒有裝分析工具——我們不知道你讀了哪幾段、待了多久。網站放在 Cloudflare Pages 上，像所有網站一樣，主機會保留一般的連線記錄（IP、時間、你要的網址）用來擋攻擊和算流量；那是 Cloudflare 的記錄，不是我們建立的資料庫。
一件事會被記錄：你有沒有按下載。 這一頁一打開，Google Ads 的代碼就會載入，並在你的瀏覽器裡放一個 cookie，讓 Google 判斷你是不是從它的廣告來的。但只有在你按下「從 Microsoft Store 取得」那顆按鈕的時候，才會送出一次「有人按了」的訊號——你在這一頁讀了什麼、停多久，不會被送出去，這個網站上也沒有第二個地方會觸發它。送出的是這次點擊、你所在頁面的網址和語言，以及 Google 從連線本身看到的東西（IP、瀏覽器版本這類）。我們在後台看到的只有「今天有幾個人按了」這種總數，看不到是誰按的。
我們用它只為了一件事：知道廣告有沒有帶來真的下載。它不會跟著你進程式——程式裡沒有任何代碼、任何識別碼。你按下去之後的事在 Microsoft Store 那邊，受他們的隱私權政策約束。
歐盟和英國的訪客會先被問過。 在那裡，頁面底下會出現一條橫幅；答應之前那個 cookie 不會放，Google 只會收到一個不帶 cookie 的訊號。其他地區不會被問，因為當地沒有這項要求。答應了想反悔，頁尾的「Cookie 選擇」隨時可以改。
不想被記錄：瀏覽器的擋廣告或反追蹤功能擋掉這段代碼就好，擋掉之後那顆按鈕照樣會把你帶到 Store。Google 怎麼使用它收到的資料，寫在 https://policies.google.com/technologies/partner-sites
Lantern Files — Privacy Policy
Last updated: 21 September 2026
Developer: AI_yang
Contact: chcheaply@gmail.com
In one sentence
Lantern Files collects no data about you. It does not go online, has no accounts, no servers, no analytics and no ads. Your files, what you say, and what the camera sees stay on your own computer.
What the program does
It finds files on your computer, renames them, encrypts them, and has a desktop pet you can turn off. The AI models that read your sentence, look at pictures and talk are installed with the program and run on your machine; nothing is sent to our servers or anyone else's.
What it touches, and what happens to it
Your files. To search, the program reads file names, folders and dates on your computer, and where needed file contents (the first page of a PDF, the text of a document, the pixels of a picture) to compare against what you typed. This is held in memory for the moment and discarded when answered; no index is built and nothing is uploaded. Renaming and encrypting touch only the files you chose, and only change the name or the encrypted form of the contents — nothing is moved, deleted or overwritten.
Microphone. Off by default. When you turn it on, audio goes only to a local speech recogniser (whisper) on your computer and is discarded once recognised; no recordings are kept or uploaded.
Camera. Off by default. When you turn it on, frames go only to the local model on your computer and are discarded once looked at; no images are kept or uploaded.
Screen. Off by default. When on, the program reads only the name of the program in use (for example "a browser"); a separate switch lets it read window titles. Both go only to the local model, and are not stored or uploaded.
Passphrases. The passphrase used to encrypt files is never stored. If you forget it the files cannot be opened — by you or by us.
What it keeps on your computer
Everything lives in the folder %APPDATA%\lantern, which you can open or delete at any time:
config.json: your settings (language, switches, model choice).folders.json: the paths of folders you have searched and the mix of file types in them, so the next search is faster. No file names, no contents.rename-undo.json: the undo record of batch renames (old name → new name) so they can be reverted. Encrypted batches are not recorded here.viewing.json: the list of previews temporarily opened during an encrypted search — temporary file locations only, no real file names.glance-vectors.json: exists only if you turn the "remember" switch on. It holds 512 numbers per picture (a mathematical fingerprint of the image), no thumbnails and no text; a "forget" button in the settings deletes all of it.
Local network
"Send him through a portal" and "let other machines on the network use this brain" talk to another computer running Lantern Files on your own local network, only after you press the button. Both are off by default and never cross the internet.
A model you connect yourself
In the settings you can point the program at a model endpoint of your own (an Ollama or OpenAI-compatible server you already run). If you point it at a server on the internet, what you type and what you show the model is sent to that server; that is your choice and governed by that server's rules, not this policy. The default is the built-in local model, where this never happens.
AI-generated content and reporting
How the search reads your sentence, the notes on encrypted files and every line the desktop pet says are generated on the spot by a local model, and can be wrong or out of line. The "Report AI content" button only opens the mail program on your computer with that line filled into a message addressed to chcheaply@gmail.com; you read it and decide whether to send it. The program never sends anything by itself. Mail you send is used only to improve the program and is not passed to third parties.
Children
The program is not designed for children under 13 and does not knowingly collect data from children (it collects data from no one).
Changes
Changes to this policy are made on this page, with the date above updated. Questions: chcheaply@gmail.com.
About this website
This section is about the website, not the program. Everything said above about the program still holds.
The website has no accounts and no forms, asks you for nothing, and carries no analytics — we do not know which parts you read or how long you stayed. It is hosted on Cloudflare Pages and, as with any website, the host keeps ordinary connection logs (IP address, time, the address requested) to absorb attacks and count traffic; those are Cloudflare's logs, not a database we build.
One thing is recorded: whether you pressed download. Opening this page loads a Google Ads tag, which sets a cookie so Google can tell whether you arrived from one of its ads. Nothing is reported, though, until you press "Get it from the Microsoft Store" — what you read here and how long you stayed is not sent, and there is no second place on this site that triggers it. What is sent is the click, the address and language of the page you were on, and what Google sees from the connection itself (IP address, browser version and the like). What we see is a total — how many people pressed it today — and never who.
It is there for one reason: to know whether the ads bring real downloads. It does not follow you into the program — there is no tag and no identifier of any kind in the program. What happens after the press is Microsoft's, governed by their privacy policy.
Visitors in the EEA and the UK are asked first. There a strip appears at the foot of the page, and until it is answered the cookie is not set — Google receives a signal with no cookie attached to it. Nobody elsewhere is asked, because nothing there requires it. To change your mind afterwards, "Cookie choice" in the footer brings it back.
If you would rather not be counted, any ad or tracker blocker stops this tag, and the button still takes you to the Store. How Google uses what it receives is at https://policies.google.com/technologies/partner-sites