你提交的回答
免费流程会处理你选择的风格和购物回答，以及一条可选备注。只有在你请求结果时，这些内容才会发送到 RingMatcher 服务器，并用于生成和验证结果。
在网站和原生应用中，RingMatcher 服务器都会把这些回答和可选备注转发给 OpenRouter，再由 OpenRouter 路由给 AI 模型提供商来撰写结果。系统会请求零保留和拒绝数据收集设置。随后服务器会检查结果是否遵循你的选择；如果 AI 服务不可用或结果未通过检查，则改为生成基于规则的结果。
可选图片与 AI 处理
照片可选，绝不要求人脸照片。最多三张图片会在浏览器中缩小，并可能经 RingMatcher 服务器传给该次请求所配置的 AI 提供商。RingMatcher 不会有意保存上传的图片文件。系统会请求零保留和拒绝数据收集设置，但提供商的基础设施、条款及法律义务仍然适用。
图片指令只允许分析视觉设计线索，并禁止身份识别或敏感特征推断。上传图片中的文字或指令会被忽略。
分享链接
分享链接会在 URL 片段中包含可见结果、所选钻石路线、预算档位和内容语言，绝不包含上传的图片文件。持有链接的人都能读取编码信息，请在分享前检查。
一个受限片段可以把可见的 Ringprint 字段传给零售商查找器。该片段不会随页面 HTTP 请求发送，并会在导入后从地址栏移除；但持有未导入链接的人仍可读取这些字段。
Native app data, purchases, and recovery (authoritative English disclosure)
This native-app section is the authoritative English disclosure. The surrounding translated text may not yet describe every native-app behavior.
Creating a Ringprint in the native app sends the questionnaire answers, the content locale, and a random installation identifier to RingMatcher for AI matching, including when no photos are attached. If you add up to three photos, the app re-encodes them and includes the device-resized images and their context labels in that request. If AI matching is unavailable, the app can generate a rules-based result on the device. Cookies are omitted. RingMatcher then sends the answers and images to OpenRouter, the configured AI gateway, with zero-data-retention and data-collection-denial settings requested. RingMatcher does not intentionally persist the match request body or uploaded image files, and saved Ringprints never contain a photo file or image payload. OpenRouter, any routed model provider, and their infrastructure, terms, and legal obligations still apply.
The app stores saved Ringprints in AsyncStorage, including the questionnaire answers, optional note, generated result, locale, source, timestamps, and image-analysis counts. Paid-plan snapshots, generated guidance, setup inputs, saved candidate specifications and quote notes, comparison results, and tool activity are also stored in AsyncStorage; source snapshots omit the free-form Ringprint note. These records are app-local but are not encrypted by AsyncStorage. Photo files are excluded. A random installation UUID and purchase capabilities—including draft and access tokens, obfuscated purchase-binding identifiers, and a Google Play purchase token after billing—are stored separately with device-only SecureStore settings.
On Android, RingMatcher disables app backup and excludes its app files, databases, preferences, and device-to-device transfer domains from backup rules. This is intended to keep local Ringprints, plans, and purchase capabilities off Android backup and migration services. Other operating-system, device-administration, forensic, or user-initiated copying behavior is outside RingMatcher's control.
If you choose Report this result, the app sends RingMatcher the result identifier, visible result title, summary and rationale, the selected report reason, an optional note, the content locale, and the random installation identifier in a request header. The service uses the installation identifier and network address to enforce an hourly report limit. It writes the report content, reason, optional note, locale, a generated report identifier, and the receipt time to structured deployment logs so the report can be reviewed. Those report logs do not intentionally include the raw installation identifier or network address; their retention follows the deployment logging configuration. Reporting is optional and does not affect saved Ringprints or paid access.
The app sends limited plan-use events to RingMatcher to measure whether the offers help people buy and use a plan. These events cover quiz progress, visible offers or previews, checkout and price-loading outcomes, resuming purchases, opening or receiving a paid plan, exporting a report, saving a candidate, and refining a plan. Each event contains only its event name, plan type, locale, and Android or iOS platform; a fresh random event-delivery ID may accompany the request to suppress duplicate delivery, and the server adds a receipt timestamp. Events contain no installation or purchase identifiers, answers, photos, notes, candidate details, or report content. Cookies are omitted, and the app does not queue or retry these events. The server uses the network address for temporary rate limiting but does not include it in the structured analytics record. Records follow deployment-log retention. Fixed-label daily totals and hashed event-delivery references are also retained on the server for 90 days and pruned on the next event. Verified payment outcomes are counted separately using hashed payment references to prevent replay; test-provider payments are excluded. Event totals are not unique customer counts. Collection happens automatically during these actions and has no separate in-app opt-out.
Starting a Google Play checkout sends RingMatcher the selected pack, random installation UUID, local Ringprint identifier, and a SHA-256 digest of the Ringprint—not the questionnaire answers, uploaded photos, or generated plan. The server persists a digest of the installation identifier, the Ringprint identifier and digest, generated draft/access identifiers, product and pack identifiers, obfuscated Google Play binding identifiers, capability hashes, and timestamps. Claiming a purchase sends the raw Google Play purchase token to RingMatcher so it can be verified with Google Play. The server persists a digest of that token, and may persist an order-ID digest and purchase-completion timestamp; it does not write the raw purchase or order token to its purchase-state file.
The Android app also initializes Google's Play Billing library when it starts, even if you do not make a purchase. That library sends operational billing diagnostics to Google, including billing results and error details with app and Android-version metadata, to support billing functionality and diagnostics. Its transport can queue events on the device before sending them, so this is not limited to request-lifetime processing. There is no separate in-app opt-out for the billing library's diagnostics. Google's terms, privacy practices, and retention rules apply; RingMatcher does not control Google's retention period. Questions-only Ringprints also use the matching request described above; a local fallback is available when AI matching cannot finish.
The protected Google Play app-review path sends the reviewer access code and random installation UUID to RingMatcher. The server compares a one-way code digest, enforces network and installation limits, and persists only the code digest, installation digest, synthetic draft/claim/access identifiers, pack and product identifiers, and timestamps—not the plaintext review code. It returns signed, expiring plan capabilities to device-only SecureStore. This review path does not open billing or create a charge.
An unclaimed purchase draft expires after 7 days. Retrying an unclaimed, unreserved draft near expiry can renew its 7-day window while preserving the same purchase binding. One prior capability hash may be retained alongside the current hash so an in-flight request can still use its original token until that token expires. After a successful claim, its draft and claim digest mapping are retained through the paid access window so refunds and voided purchases can be reconciled. The draft capability still expires after 7 days. Paid access expires after 30 days for Shortlist or Complete Plan and after 90 days for Together Plan. Refunded grants are marked revoked and retained only through their original access expiry to prevent replay. The enabled production refund worker checks Google at server startup and is scheduled hourly; it receives raw voided purchase tokens transiently and matches their keyed digests without saving the raw tokens. Expired eligible rows are pruned atomically during this maintenance and subsequent purchase-state changes. Unexpired drafts and access records are not evicted to make room for newer records.
Saved Ringprints and completed paid plans remain on the device until you remove them, the bounded local history replaces older Ringprints, app storage is cleared, or the operating system removes the app data. Removing a completed paid plan also asks SecureStore to delete its associated capability. A plan with an unfinished purchase is protected from ordinary removal because the local draft may still be needed for Google Play recovery. RingMatcher has no user account or cross-device plan library: clearing local app data, removing protected credentials, changing devices, or uninstalling can make a consumed one-time purchase or its generated plan impossible to recover. You can choose to export completed reports as PDF in supported languages or portable HTML in every language, including after the editing window ends. Exporting uses the report already on your device and does not grant editing access on another device. Shared Together exports contain the shared alignment; exporting an individual report requires its owner’s permission. Copies you choose to save or share are controlled by their selected destination and are not removed when you delete the app’s local plan. Contact contact@ringmatcher.com for privacy or server-record deletion questions.
请求限制、第一方流程衡量与技术日志
服务器可能根据网络地址生成仅存于内存的临时请求限流键。RingMatcher 会记录落地页、Ringprint 创建、分享与下载、可选结账及付费套餐流程和零售商查找器中的第一方流程里程碑。事件规则只允许事件名称、白名单内的指南 slug，以及固定的来源、渠道、套餐、状态、CTA 目的地、CTA 位置或语言区域值、布尔值和有上限的计数或评分；不包含问卷答案、预算、备注、生成的方向文字、任意 URL 或页面路径、自由文本目的地、付款标识符、错误消息或堆栈、个人信息以及任意文本。
零售商查找器事件还可能包含固定的购买类型，以及 RingMatcher 已审核目录中的零售商 ID。
从指南点击进入测验后，浏览器会话存储可能会保存以下归因值：白名单内的指南 slug、语言区域和 CTA 位置，以及技术版本和到期元数据。归因最长 30 分钟内有效，并在一次带来源归因的 Ringprint 请求中被取用。过期记录会被忽略，并在下次访问时移除；会话存储也会随浏览器标签页或会话结束。其中不含问卷答案、预算、照片、联系方式，也不含账户或用户标识符。
我们统计白名单公开页面的访问、问卷开始及步骤完成，以及结果是个性化还是备用。浏览器会话存储可将固定的入口页面、语言、渠道、活动标签和步骤标记保留最多30分钟；过期数据在下次访问时删除。来源网址在本地分类，不发送完整网址、搜索词或个人标识符。这些统计反映标签页活动，而非独立人数。 网站将问卷选择和免费结果保存在此浏览器的本地存储中，使用后最多保留7天，以便继续。照片文件和备注输入不会保存，但生成的结果可能包含备注中的信息。重新开始会删除此免费会话，清除浏览器数据也会删除它。付费方案另行存储。
事件可能按托管方的保留设置写入部署日志。我们还在服务器保留固定分类的每日汇总，共90个UTC日历日，在下次记录事件时清理更早的汇总。不向第三方分析服务发送这些数据。记录不含答案、照片、联系方式、账户或用户标识符。 我们还分别统计网站和应用的方案展示、结账结果及方案使用操作。已验证的付款、交付和退款总数来自支付服务商，不含测试付款。随机事件编号和经过哈希处理的付款引用仅用于防止重复计数，并在90天分析保留期后删除。这些是事件总数，并非独立客户数或销售增长的证明。
付费套餐与 Stripe
可选付费套餐通过 Stripe 处理一次性付款。RingMatcher 会向 Stripe 发送收据邮箱、所选套餐、服务器设定的金额和币种，以及生成的请求和 PaymentIntent 标识符。付款信息由 Stripe Payment Element 收集；RingMatcher 不会接收或存储完整卡号或安全码。购买验证通过后，RingMatcher 会通过我们的邮件发送服务商 Resend，把方案链接发送到该邮箱；你也可以在方案中把链接发送到自己选择的邮箱。Resend 会收到该邮箱地址和链接，而链接本身包含方案内容（Couple’s Edition 为共同对齐页面）。Resend 的条款和保留规则适用。
Stripe 元数据仅包含生成的标识符、付款与交付状态及用于绑定浏览器访问权限的单向哈希，不包含问卷答案、照片、私人备注或方案内容。每个套餐的 HttpOnly、SameSite Cookie 最长可保留 100 天，待处理付款记录可在该浏览器的本地存储中保留最多 30 天。Stripe 的条款和隐私政策适用。
在正式网站中，付费方案会话存储在受保护的服务器卷上，并可在常规重启和部署后恢复。Shortlist 和 Complete Plan 会话在 30 天后到期，Couple’s Edition 会话在 90 天后到期。如果 RingMatcher 更早完成删除请求，则可提前移除相应会话。 候选戒指资料和审核结果随方案会话保存。编辑会替换现有候选项，不延长访问期限。服务器生成 PDF 需要有效访问权限。若方案仍保存在此浏览器中，到期后可导出本地 HTML 副本；清除浏览器数据可能删除该副本。下载的方案不会恢复付费工具权限。对于在网站上购买的 Complete Plan 和 Couple’s Edition，RingMatcher 会将方案所依据的回答和 Ringprint（不含可选备注）、你的调整请求，以及你填写的候选戒指资料（包括报价备注）发送给 OpenRouter 及其路由的 AI 模型提供商来撰写方案，并请求零保留和拒绝数据收集设置。如果该服务不可用，则改用基于规则的方案。
RingMatcher 不销售的内容
RingMatcher 不销售戒指或个人数据。如果账户、结账、分析、存储或模型提供商发生变化，必须在公开变更后的服务前重新审查本页。隐私问题可发送至 contact@ringmatcher.com。