ChefJeff 隐私说明与反馈

English · 模型连接说明

这一页说明 ChefJeff 存了什么、存在哪里、保存多久、怎样删除，以及怎样联系我们。更细的技术说明见 GitHub 仓库里的 docs/privacy-and-costs.md 和 docs/hosted-deployment.md。

在线版

• API Key：默认只在当前页面的内存里，刷新或关闭页面即消失。勾选「记住此设备」后，Key 和所选转发方式以明文保存在这个浏览器的 localStorage；在「设置 → 连接」点「清除配置」即删除。
• 模型请求：默认由浏览器直接发给你选的模型服务，费用记在你的账号上。只有你为 Jev 明确勾选「同意通过试玩服务器调用 Jev」时，Key 和模型请求才经 HTTPS 通过我们的服务器转发给 TypeSafe；服务器只在处理这次请求时使用 Key，不写入配置、日志或对局记录。
• 对局：游戏状态和你的操作在服务器内存中处理。关闭页面或闲置 10 分钟后清除，不写磁盘对局日志。跨局记忆默认开启，最近三局的有限摘要按模型和关卡保存在当前浏览器；可在「设置 → 协作记忆」关闭或清空。摘要会随请求发送给所选模型，Jev 转发也会在内存中处理，但服务器不持久保存。
• 使用统计：为改进游戏，服务器保存访问、试玩、关卡完成、退出、满员情况及游玩时长的汇总；浏览器用本地标记估算访问／试玩的浏览器数量，估算不代表真实人数。统计不保存 IP、账号、Key 或逐局明细，不生成唯一访客编号或指纹。汇总数据私有保存，在服务运营期间保留，与下述自愿贡献的 30 天记录分开。清除网站数据可删除本地标记。
• 数据贡献（自愿）：第一次开局前会问你一次，可以选「同意每局自动贡献」或「暂不贡献，继续」，没有默认选项，之后可在「设置 → 数据导出」更改；选「暂不」时，也可在结算画面「更多」中点「贡献本局」只贡献那一局。
  • 会保存：本局模型服务与模型 ID（含自定义模型，注明浏览器上报、未经独立核验）、游戏事实、物品/工位/订单与动作决策关联、实际地图菜谱规则和种子、结算及结束原因、记忆开关与局数。开局前同意后，另保存每秒及关键事件的状态变化、每 10 秒检查点。可单独勾选浏览器自报请求耗时和受控错误；token 报告不是账单。
  • 不会保存：API Key、IP 与账号身份、模型接口地址、旧局记忆内容和预设偏好沟通。游戏没有玩家聊天输入框；游戏状态、候选动作、模型选项和执行结果按结构化字段保存，不另存完整 API 请求或响应。
  • 用途：改进游戏，研究人机协作的评估方法；不公开原始数据。
  • 保存：私有保存在统一数据服务（腾讯云，中国上海），国内与海外站共用记录；海外站经加密连接提交和访问记录。30 天后自动删除，不做备份。历史记录迁移保留原到期时间及删除凭证。
  • 删除：每份贡献的删除凭证保存在你的浏览器里，在「设置 → 数据导出 → 删除已贡献数据」即可提前删除；也可以下载凭证备份。凭证只交给你，服务器只存它的哈希；凭证丢失时我们无法认出哪条记录是你的，只能等 30 天自动删除。
• 自动贡献在每局开局前由服务器确认，开局创建记录，提前结束也更新；突然崩溃可能只留下未完成的开局记录。不依赖页面退出后上传。没有开局前同意时不额外采集连续局面；事后贡献会明确标注只有已有事实和首尾状态。旧自动贡献选择须重新确认。关闭自动贡献会撤回本局未结束记录并停止新增过程状态，已结束的贡献需凭证删除。
• 浏览器里的其他设置：界面语言、音量、数据贡献选择和删除凭证，都只保存在这个浏览器；清除本网站的数据即可全部删除。
• 网络：云服务商和网络运营商会按各自政策处理连接信息；我们提供的反向代理关闭了访问日志。

本地版

本地版不连接 ChefJeff 的服务器。Key 默认只在你电脑上的后端内存里；勾选记住后以明文保存在本地文件 .player-api.json。跨局记忆在 .player-memory.json，对局日志在 logs/ 文件夹，都只在你的电脑上，可以随时删除。

数据导出与问题反馈

「设置 → 数据导出」生成的文件只下载到你的电脑，不会自动上传。文件包含对局数据和本页最近 30 秒的画面诊断（游戏时间、角色位置、按键方向、页面错误、浏览器型号和屏幕尺寸），不含 Key、接口地址和模型回复。附到公开 Issue 之前请先看一遍。

联系我们

• 问题、建议和隐私疑问：在 GitHub 提 Issue：github.com/belchingleo/ChefJeff/issues。
• 安全漏洞：请按仓库里 SECURITY.md 的说明私下报告，不要在公开 Issue 里发 Key、删除凭证或利用细节。
• 删除数据不需要联系我们：用浏览器里保存的删除凭证即可。

English

模型连接说明 · Model connection guide

What ChefJeff stores, where, for how long, how to delete it, and how to reach us. Technical details are in docs/privacy-and-costs.md and docs/hosted-deployment.md in the GitHub repository.

Online version

• API key: kept in this page's memory by default and gone on refresh or close. With Remember on this device, the key and chosen transport are saved in plain text in this browser's localStorage; Clear credentials in Settings → Connection deletes them.
• Model requests: sent by your browser straight to the model service you choose and billed to your account. Only if you explicitly tick I agree to call Jev through the demo server do the key and model request pass over HTTPS through our server to TypeSafe; the server uses the key only for that request and never writes it to configuration, logs or game records.
• Rounds: game state and your actions are processed in server memory and cleared when you close the page or after 10 idle minutes. No game journal is written to disk. Cross-round memory is on by default: bounded summaries of the last three completed rounds are stored in this browser, separately by model and level. Disable or clear it in Settings → Cooperation memory. Summaries are sent to the selected model, including in-memory processing by the Jev relay, without persistent server storage.
• Usage statistics: to improve the game, the server keeps aggregate counts of visits, play, level completions, exits and capacity rejections, along with play duration summaries. Local browser flags help estimate visiting and playing browsers, not people. No unique identifier or fingerprint is generated; statistics exclude IPs, accounts, keys and individual-round records. Aggregates remain private and are retained for the service’s lifetime, separately from the voluntary 30-day contributions below. Clearing site data removes the local flags.
• Data contribution (voluntary): before your first round you are asked once, with two explicit choices: Automatically contribute each round or Continue without contributing. Nothing is preselected; change it later in Settings → Data export. After Not now, the result card’s More menu offers Contribute this round for that round alone.
  • Saved: the round’s model service and model ID (including custom models, marked browser-reported and not independently verified), game facts, item/station/order and action/decision links, resolved map/recipes/rules/seeds, outcomes, observed close reasons, reported memory settings and token usage (not a bill). With consent before start, state changes are observed each game second and at events, with ten-second checkpoints. Browser-reported request duration and controlled error categories require a separate optional checkbox.
  • Never saved: API keys, IP address and account identity, model endpoints, past-round memory content and preset preference communication. There is no player chat input. Game states, candidate actions, model choices and execution results are stored as structured fields, without additional verbatim API requests or responses.
  • Purpose: improving the game and researching how to evaluate human-AI cooperation. Raw data is not published.
  • Retention: stored privately by the shared data service on Tencent Cloud in Shanghai, China. The Chinese and overseas sites share records; the overseas site submits and accesses them over an encrypted connection. Records are deleted automatically after 30 days and are never backed up. Migrated records keep their original expiry dates and deletion receipts.
  • Deletion: each contribution's deletion receipt is kept in your browser; Settings → Data export → Delete a contribution removes it early, and you can download the receipts as a backup. Only you get the receipt; the server keeps its hash, so without the receipt we cannot tell which record is yours and it expires after 30 days.
• Automatic contribution is confirmed server-side before each round and starts a private row at opening; early endings update it. A crash may leave only an incomplete opening record. Without pre-start consent, no additional continuous state history is collected; a later one-round contribution labels those gaps. Old standing consent is asked again. Turning it off withdraws the current unfinished record and stops additional state/optional measurements; completed records use their deletion receipts.
• Other browser settings: language, volume, your contribution choice and deletion receipts stay in this browser only; clearing this site's data removes them all.
• Network: hosting and network providers process connection metadata under their own policies; our reverse proxy has access logs disabled.

Local version

The local version never connects to a ChefJeff server. Your key stays in your own backend's memory unless you choose Remember, which saves it in plain text to .player-api.json. Cross-round memory lives in .player-memory.json and game journals in logs/, all on your computer and deletable at any time.

Data export and bug reports

Settings → Data export only downloads a file to your computer; nothing is uploaded. It contains your rounds plus the last 30 seconds of page diagnostics (game time, chef positions, held direction, page errors, browser and screen size), and no keys, endpoints or model replies. Look it over before attaching it to a public issue.

Contact

• Questions, suggestions and privacy concerns: open a GitHub issue at github.com/belchingleo/ChefJeff/issues.
• Security vulnerabilities: report privately as described in SECURITY.md; never post keys, deletion receipts or exploit details in a public issue.
• Deleting data needs no contact: use the deletion receipt kept in your browser.