空境 隐私政策
生效日期：2026 年 10 月 24 日
空境（Kongjing）提供新标签页、书签与可选的多设备同步。数据默认保存在本机；配对与同步由你主动开启。
1. 数据与本机存储
| 数据 | 来源与用途 | 存放位置 |
|---|---|---|
| 书签、分组、图标 | 你添加、导入，或点击收藏时读取的网页网址和标题 | 本机；开启配对后可端到端加密同步 |
| 昵称、头像、设置 | 你填写、上传或选择，用于个性化界面 | 本机；开启配对后可端到端加密同步 |
| 搜索记录 | 空境搜索框中的输入，用于本机搜索记录功能 | 仅本机，不随书签同步上传 |
| 可选接力数据 | 在支持接力的版本中，你主动开启的页面发送、标签页或浏览记录功能 | 本机；按你开启的功能端到端加密传到配对设备 |
基础新标签页、书签和搜索不要求浏览记录（history）权限。支持浏览记录或标签页接力的版本，只在你主动开启相应功能并授予可选权限后读取这些数据。空境不采集网页正文用于统计或广告。
2. 网络请求与服务选择
配对与同步：默认公共同步服务是 https://kongjing.inc.re/，由 Cloudflare 提供基础设施。你也可以在同步设置中选择 EdgeOne Makers 或自己部署的服务，填写自己的 HTTPS 来源地址。同步与图标请求会使用你选定的服务地址；自建运营者负责其服务的日志、保留与基础设施政策。
书签、设置、个人资料及开启的接力内容在设备上使用 AES-256-GCM 端到端加密。解密密钥留在配对设备上，服务端无法读取内容明文。服务端会处理随机房间/设备标识、配对公钥及协议元数据、密文、数据大小和请求时间。请求 IP 用于网络传输和防滥用；应用限流使用加盐哈希，基础设施提供方仍可能按其政策处理 IP 等网络元数据。
Chrome 商店版使用 HTTP/WebSocket 同步，不使用点对点直连。支持直连的安卓或非商店版本在配对后可能通过 WebRTC 与其他设备连接，并向 STUN 服务发送连通性探测；STUN 服务与对端可能获知你的公网 IP。无法直连时，可按同步模式经所选服务转交密文。
网站图标：优先使用本机图标缓存；缺失时将书签网站的域名（例如 github.com，不含页面路径）发给所选图标服务，以获取公开图标。域名查询本身不受书签端到端加密保护，服务也会接触必要的网络元数据。
网页搜索与打开网站：提交网页搜索时，搜索词交给浏览器默认或你选择的搜索引擎；打开书签时连接对应网站。这些网站依其隐私政策处理请求。保存在本机的搜索记录不代表搜索引擎无法收到你提交的搜索词。
3. 权限与程序代码
空境栏默认关闭。仅在你主动开启时，申请可选 scripting 与 HTTP(S) 网站权限，用随包代码在普通网页中显示个人书签入口；不读取网页正文。悬停或点击展开，移开自动收回。你可关闭空境栏、按网站隐藏，或在浏览器中撤销权限。
电脑扩展在你确认自建服务地址时申请访问该来源的可选主机权限，用于同步与图标请求。你可以拒绝或在浏览器扩展设置中撤销权限；拒绝后该自建服务将无法连接。权限不会自动授权读取其他网站。
扩展的可执行代码随安装包分发；同步、图标与部署服务不会下发或执行远程程序代码。空境不含广告、分析或追踪 SDK，不出售或出租你的数据，也不将其用于信用评估或放贷。
从 Chrome 扩展 API 获得的信息仅用于你开启的功能，并遵守 Chrome Web Store User Data Policy（包括 Limited Use 要求）。
4. 保留、删除与离线使用
你可在「设置 → 数据」导出数据、清除本机搜索记录，或离开配对组停止后续同步。离开配对组保留本机书签，不等同于立即删除所有服务器密文或其他设备的副本。卸载扩展会删除浏览器为该扩展保留的本机数据。
默认服务按数据类型设置到期清理，长期不活跃的配对组按 180 天期限回收；清理可能在后续访问时执行。接力等短期密文按相应功能期限清理。自建服务的实际保留与备份由运营者决定。
离线时，本地书签与本地搜索仍可使用，网络恢复后同步继续。外部网页搜索、图标获取和远端同步需要网络。
5. 联系与更新
问题与源码：GitHub 开源仓库。隐私问题可发邮件至 vrhjio4405@gmail.com。
政策变更将在本页公布，并更新生效日期。
Kongjing Privacy Policy
Effective date: October 24, 2026
Kongjing provides a new tab page, bookmarks and optional device sync. Data stays on your device by default. You choose whether to pair devices and enable sync.
1. Data and local storage
| Data | Source and purpose | Storage |
|---|---|---|
| Bookmarks, groups and icons | Added or imported by you, or the page URL and title read when you save it | Local; end-to-end encrypted sync after pairing |
| Nickname, avatar and settings | Entered, uploaded or selected by you for personalization | Local; end-to-end encrypted sync after pairing |
| Search records | Queries entered into Kongjing, for local search history | Local only; not uploaded with bookmark sync |
| Optional continuity data | Pages you send, tabs or browsing history, when you enable these features in versions that support them | Local; end-to-end encrypted transfer to paired devices for enabled features |
The basic new tab page, bookmarks and search do not require browsing history permission. Versions with history or tab continuity read this data only after you enable the feature and grant the optional permission. Kongjing does not collect page content for analytics or advertising.
2. Network requests and your service choice
Pairing and sync: the default public service is https://kongjing.inc.re/, hosted on Cloudflare. In sync settings, you may choose EdgeOne Makers or your own service and enter its HTTPS origin. Sync and icon requests use the selected endpoint. A self-hosted service operator is responsible for that service's logging, retention and infrastructure policies.
Bookmarks, settings, profile data and enabled continuity content are encrypted on your device using AES-256-GCM. Decryption keys remain on paired devices, so the service cannot read the content. The service processes random room/device identifiers, pairing public keys and protocol metadata, ciphertext, sizes and request times. IP addresses are needed for network transport and abuse prevention; application rate limits use salted hashes, while infrastructure providers may process IP addresses and other network metadata under their own policies.
The Chrome Web Store build uses HTTP/WebSocket sync without peer-to-peer transfer. Android or non-store versions supporting peer-to-peer transfer may connect paired devices using WebRTC and send connectivity probes to STUN services. STUN providers and peers may learn your public IP address. If a direct connection is unavailable, encrypted content may pass through the selected service, depending on your sync mode.
Site icons: Kongjing first uses local cached icons. When an icon is missing, it sends the site's domain (for example github.com, without the page path) to the selected icon service to obtain a public icon. The domain lookup itself is not protected by bookmark end-to-end encryption; the service also receives necessary network metadata.
Web search and opening sites: submitting a web search sends the query to your browser's default or selected search engine. Opening a bookmark connects to that site. These services handle requests under their own policies. Local search records do not prevent a search engine from receiving queries that you submit.
3. Permissions and executable code
The optional bookmark dock is off by default. Enabling it requests optional scripting and HTTP(S) site access to show your bookmarks using code bundled in the extension. It does not read page content. Hover or click to expand; moving away collapses it. Disable the dock, hide it on individual sites, or revoke access in browser settings.
The desktop extension requests optional host access to your self-hosted origin only when you confirm that address, for sync and icon requests. You can decline or revoke this permission in the browser's extension settings; that service then cannot be reached. This does not automatically grant access to other websites.
Executable extension code is included in the installed package. Sync, icon and deployment services do not deliver or execute remote code. Kongjing contains no advertising, analytics or tracking SDKs. We do not sell or rent your data, or use it for creditworthiness or lending.
Information received from Chrome extension APIs is used only for features you enable, in accordance with the Chrome Web Store User Data Policy, including its Limited Use requirements.
4. Retention, deletion and offline use
You can export data in Settings → Data, clear local search records, or leave a pairing group to stop future sync. Leaving keeps local bookmarks; it does not immediately erase all server ciphertext or copies on other devices. Uninstalling the extension removes the local data that the browser stores for it.
The default service expires data by type and reclaims groups after 180 days of inactivity; cleanup may run on a later request. Short-lived continuity data expires according to the feature's retention period. Self-hosted operators determine their own retention and backups.
Local bookmarks and local search work offline. Sync continues when the network recovers. Web search, fetching icons and remote sync require a connection.
5. Contact and updates
Source and issues: GitHub repository. Privacy questions: vrhjio4405@gmail.com.
Changes will be published on this page with an updated effective date.