偷师 · 隐私政策Toushi · Privacy Policy

生效日期 / Effective date: 2026-07-11

偷师（以下简称“本扩展”或“Toushi”）是一款 Chrome 浏览器扩展，用于帮助用户对其主动选择、上传或粘贴的图片进行 AI 提示词反推，并将生成的提示词用于复制、整理或跳转到 PixPix 生成页面。

中文

1. 本扩展处理的数据

为了提供图片提示词反推、历史资产、本地设置和基础统计功能，本扩展可能处理以下数据：

• 用户主动选择的图片：包括网页图片、用户上传的图片、粘贴到扩展中的图片，以及在必要时由用户主动触发的可见区域截图裁剪结果。
• 提示词和生成参数：包括反推得到的提示词、负面提示词、语言、图片比例、图片类型、风格标签等。
• 本地扩展数据：包括用户的智谱 API Key、扩展设置、反推历史、缩略图、分类、收藏记录、本地匿名设备 ID。
• 匿名使用事件：包括安装、首次成功使用、反推成功或失败、自动精修成功或失败、点击“一键生成同款”等事件。

2. 本扩展不会收集的数据

• 姓名、身份证件、手机号、邮箱等个人身份信息；
• 浏览历史或用户未主动选择的网页正文内容；
• 用户电脑中的本地文件列表；
• 用户完整图片库；
• 智谱 API Key 的明文副本到 PixPix 或 Toushi 自有服务器；
• 用于出售、广告画像或跨站跟踪的数据。

3. 图片如何被使用

当用户主动点击网页图片上的反推按钮、使用右键菜单反推、上传图片或粘贴图片时，本扩展会读取并压缩该图片，以便调用 AI 服务生成提示词。

• 图片处理仅发生在用户主动操作之后。
• 图片会从用户浏览器发送给智谱 AI（BigModel / GLM）进行图像理解和提示词生成。
• Toushi 和 PixPix 不会在自有服务器上保存、查看或保留用户选择的原始图片。
• 如果用户保存到本地历史或资产库，扩展会在浏览器本地保存缩略图、提示词和分类信息。

4. 智谱 API Key

本扩展采用 BYOK（Bring Your Own Key）模式，由用户自行提供智谱 API Key。

• API Key 存储在浏览器的扩展本地存储中（chrome.storage.local）。
• API Key 仅用于用户主动反推或精修图片时，从用户浏览器请求智谱 API。
• API Key 不会发送到 PixPix 或 Toushi 自有服务器。
• 用户可以在扩展设置页清空 API Key，也可以通过卸载扩展删除本地扩展数据。

5. PixPix 跳转与参数传递

当用户点击“一键生成同款”时，本扩展会打开 PixPix 生成页面，并可能通过 URL 参数传递当前提示词、负面提示词、语言、图片比例，以及公开可访问的参考图 URL。本扩展不会在该过程中传递智谱 API Key、用户身份信息或本地历史资产。

6. 匿名统计

为了了解功能是否正常、提升稳定性和产品体验，本扩展会通过 Google Analytics 4 Measurement Protocol 发送匿名使用事件。

• 统计事件可能包括安装、激活、反推成功或失败、自动精修成功或失败、点击生成入口等。
• 统计事件不包含 API Key、图片内容、完整提示词、网页正文、浏览历史、本地历史资产或可直接识别个人身份的信息。
• 本扩展不会将匿名统计用于出售用户数据、广告画像或跨站跟踪。

7. 第三方服务与数据共享

本扩展只在实现核心功能、提升稳定性或完成用户主动操作所必需的范围内与第三方服务交互：

• 智谱 AI（BigModel / GLM）：用于分析用户主动选择的图片并生成提示词。发送的数据可能包括图片内容、图片类型、用户选择的参数和必要的 API 请求信息。
• Google Analytics 4：用于匿名使用统计和稳定性分析。发送的数据为匿名事件和基础事件参数。
• PixPix：当用户主动点击“一键生成同款”时，用于接收提示词和生成参数并打开生成页面。
• Google Chrome / Chrome Web Store：用于扩展分发、安装、运行和浏览器扩展能力。

8. 权限用途说明

• contextMenus：在用户右键网页图片时提供“反推提示词”等菜单入口。
• storage 和 unlimitedStorage：在本地保存 API Key、设置、历史资产、缩略图、提示词和分类数据。
• activeTab：在用户主动触发时，对当前页面的可见图片进行必要的读取或截图裁剪兜底。
• declarativeNetRequestWithHostAccess：在用户主动反推时，临时处理部分网站图片的防盗链请求，以便读取用户选择的图片。
• <all_urls>：让扩展可以在网页图片上显示悬浮操作入口，并在用户主动点击后读取所选图片。

9. 数据保存与删除

• API Key、设置、历史资产、缩略图、提示词、分类和收藏记录默认保存在用户浏览器本地。
• 用户可以在扩展内删除 API Key 或本地历史资产。
• 用户卸载扩展后，Chrome 会删除该扩展的本地扩展数据。
• 第三方服务的数据保存期限由对应第三方的政策和用户账号设置决定。

10. 安全措施

• 本扩展通过 HTTPS 与第三方服务通信。
• API Key 保存在浏览器本地扩展存储中，不发送到 PixPix 或 Toushi 自有服务器。
• 统计事件避免包含图片内容、完整提示词、API Key 或可直接识别个人身份的信息。
• 本扩展对用户数据的使用遵守 Chrome Web Store 用户数据政策，包括 Limited Use（有限使用）要求；用户数据仅用于提供或改进本扩展明确披露的单一用途和相关运行目的。

11. 儿童隐私

本扩展不面向儿童设计，也不会有意收集儿童的个人信息。如果你认为儿童向本扩展提供了个人信息，请通过下方联系方式与我们联系。

12. 政策更新与联系方式

如果本隐私政策发生重要变化，我们会更新本页面的生效日期。若有问题、数据删除请求或隐私相关请求，请联系：[email protected]

English

Toushi is a Chrome browser extension that helps users reverse-engineer AI prompts from images they actively select, upload, or paste, and use those prompts for copying, organizing, or opening the PixPix generation page.

1. Data Processed by the Extension

• User-selected images: webpage images, uploaded images, pasted images, and visible-page crop results only when the user actively triggers the feature.
• Prompts and generation parameters: generated prompts, negative prompts, language, aspect ratio, image type, style tags, and related parameters.
• Local extension data: Zhipu API Key, settings, reverse history, thumbnails, categories, saved items, and a local anonymous device ID.
• Anonymous usage events: install, activation, reverse success or failure, auto-refine success or failure, and clicks on the generation entry point.

2. Data We Do Not Collect

• Personal identity information such as name, government ID, phone number, or email address;
• Browsing history or webpage body content that the user has not actively selected;
• Lists of local files on the user's computer;
• The user's full image library;
• The user's Zhipu API Key to PixPix or Toushi-owned servers;
• Data for sale, advertising profiling, or cross-site tracking.

3. Image Processing

When the user actively clicks a reverse button, uses the context menu, uploads an image, or pastes an image, the Extension reads and compresses that selected image in order to call an AI service and generate prompts.

• Image processing happens only after a user action.
• The selected image is sent from the user's browser to Zhipu AI (BigModel / GLM) for image understanding and prompt generation.
• Toushi and PixPix do not store, view, or retain the original selected image on their own servers.
• If the user saves an item locally, the Extension stores thumbnails, prompts, and category information in the browser's local extension storage.

4. Zhipu API Key

The Extension uses a BYOK (Bring Your Own Key) model. Users provide their own Zhipu API Key.

• The API Key is stored in local browser extension storage (chrome.storage.local).
• The API Key is used only to call Zhipu API from the user's browser when the user actively reverses or refines an image.
• The API Key is not sent to PixPix or Toushi-owned servers.
• Users can clear the API Key in the settings page or uninstall the Extension to remove local extension data.

5. PixPix Handoff

When the user clicks "Generate Similar," the Extension opens PixPix and may pass the current prompt, negative prompt, language, aspect ratio, and a public reference image URL through URL parameters. The Extension does not pass the Zhipu API Key, identity information, or local history assets during this process.

6. Anonymous Analytics

To understand whether features work correctly and to improve reliability and product experience, the Extension sends anonymous usage events through Google Analytics 4 Measurement Protocol.

• Events may include install, activation, reverse success or failure, auto-refine success or failure, and generation-entry clicks.
• Events do not include API Keys, image content, full prompts, webpage body content, browsing history, local history assets, or information that directly identifies a person.
• The Extension does not use anonymous analytics to sell user data, create advertising profiles, or perform cross-site tracking.

7. Third-Party Services and Sharing

• Zhipu AI (BigModel / GLM): used to analyze user-selected images and generate prompts. Data sent may include image content, image type, user-selected parameters, and necessary API request information.
• Google Analytics 4: used for anonymous usage analytics and reliability analysis. Data sent consists of anonymous events and basic event parameters.
• PixPix: used when the user actively clicks "Generate Similar" to receive prompts and generation parameters and open the generation page.
• Google Chrome / Chrome Web Store: used for extension distribution, installation, runtime, and browser extension capabilities.

8. Permission Use

• contextMenus: provides context menu actions when the user right-clicks webpage images.
• storage and unlimitedStorage: store API Key, settings, local history assets, thumbnails, prompts, and categories locally.
• activeTab: reads or crops visible selected images as a fallback after the user actively triggers the feature.
• declarativeNetRequestWithHostAccess: temporarily handles anti-hotlinking requests for selected images after user action.
• <all_urls>: displays image action controls on webpages and reads selected images after user action.

9. Retention and Deletion

• API Key, settings, local history assets, thumbnails, prompts, categories, and saved items are stored locally in the user's browser by default.
• Users can delete the API Key and local history assets in the Extension.
• When the user uninstalls the Extension, Chrome removes the Extension's local extension data.
• Retention by third-party services is governed by those services' policies and the user's account settings.

10. Security Measures

• The Extension communicates with third-party services over HTTPS.
• The API Key is stored in local browser extension storage and is not sent to PixPix or Toushi-owned servers.
• Analytics events avoid image content, full prompts, API Keys, and directly identifying personal information.
• The Extension's use of user data complies with the Chrome Web Store User Data Policy, including the Limited Use requirements. User data is used only to provide or improve the Extension's disclosed single purpose and related operational purposes.

11. Children's Privacy

The Extension is not designed for children and does not knowingly collect personal information from children. If you believe a child has provided personal information through the Extension, please contact us.

12. Updates and Contact

If this Privacy Policy changes materially, we will update the effective date on this page. For questions, deletion requests, or privacy-related requests, contact: [email protected]