Drifting 是一款开源、本地优先的长篇写作应用。默认情况下，你的稿件、素材和设置只保存在你的 Mac 上，不需要账号。只有当你登录可选的 Drifting Hosted 服务、创建分享链接、在 App 里提交反馈或给我们发邮件，或者 App 自动发送不含正文的故障报告（可以关闭）时，Drifting 维护者才会收到相应的数据。本政策说明 Drifting App、Hosted 服务以及你选择的第三方服务分别如何处理数据。
本政策适用于官方发布的 Drifting 和由 Drifting 维护者运营的 Hosted 服务（api.drifting.cc）。自行构建或修改的版本若连接其他服务，由该服务的运营者负责自己的数据说明。
我们不做什么
- 不投放广告，不接入第三方分析或跟踪工具，也不进行跨 App 跟踪；
- 目前不收集使用统计或行为分析数据；
- 不出售个人信息；
- 不用你的稿件训练模型，也不把它们用于广告。
本机数据
项目（章节、构想、要素、故事线、批注、TODO 和历史记录）、导入的图片和
PDF、Agent 对话与设置都保存在你的 Mac 上：~/Library/Application Support/cc.drifting.client/。数据库升级前，Drifting
会在同一目录保留数量有限的安全快照。你导入的字体只留在本机。
模型提供商的 API Key、ChatGPT 登录凭据和 Hosted 登录会话保存在 macOS 钥匙串中。每个项目还会在本机生成一个可读的 Markdown 文件夹（位置可在 设定 → 同步与数据 → 本地数据 中查看和更改）；哪些程序可以读取它，由你决定。
可选的 Hosted 账号与同步
Hosted 是可选服务。只有在你登录或注册之后，Drifting 才会连接
api.drifting.cc；连接时，本机已有的项目会上传，账号里的云端项目会下载到本机。Hosted 会保存：
- 账号信息：邮箱、显示名称、可选头像、密码的哈希值，以及登录会话（可能包含登录时的 IP 地址和客户端标识）；
- 同步数据：项目元数据、包含完整正文的检查点与增量、快照、批注、同步的项目记忆、已完成的 Agent 对话及必要的工具结果、你上传的图片和 PDF 等素材，以及用于区分设备的同步标识；
- 账号已用的存储空间。
同步不是端到端加密的。数据通过 HTTPS 传输，但存储在服务器上的同步内容没有用只有你持有的密钥加密，Hosted 的运营者在技术上可以读取。如果你需要更强的保密性，请继续使用本地模式。
Hosted 运行在从腾讯云租用的服务器上（美国硅谷）。较大的同步对象和每晚的数据库备份副本存放在 Cloudflare R2 的私有存储桶中；Cloudflare 同时提供域名解析。注册验证码、登录与找回密码邮件，以及发给维护者的故障提醒，通过 Resend 发送。这些服务商按各自的政策处理提供服务所必需的数据。
公开分享链接
分享链接是 Hosted 功能。分享一章（或构想、要素、故事线、类目）时，Drifting 会上传它的阅读副本：正文和基本格式、标题、章节序号、所属故事线的名称和颜色、字数，以及正文中链接到的要素的名称和摘要。你的批注、TODO、关联和项目里的其他内容不会上传。你停笔几秒后，阅读副本会自动更新。请注意，要素摘要可能透露正文还没写到的内容。
任何持有链接的人都可以阅读，并会看到你的显示名称。评论需要登录 Drifting 账号；评论内容和评论者的显示名称对所有读者可见，并会导入到你的资料库。阅读页不会被搜索引擎收录，不发送 Referer，只在读者登录时使用登录所需的 Cookie。“停止分享”会删除这个链接和服务上的读者评论；已经导入资料库的评论会保留在你的资料库里。
故障与完整性报告
支持 Hosted 的官方版本会在出错时自动发送不含正文的故障报告，例如界面崩溃、未处理的错误、上次运行时的原生崩溃、数据库无法打开、保存失败或同步被阻止。没有登录也会发送。首次启动的引导会说明这一点，你可以随时在 设定 → 隐私 → 自动发送故障诊断 中关闭。
报告包含：错误类型和严重程度、用于归类的指纹、错误名称、脱敏后的错误消息、调用栈位置、App
版本、系统平台、仅用于诊断的随机安装 ID、发生时间，以及少量不含标识或文字的上下文。发送前，Drifting
会截断错误消息，把长段中文、引号里的长文本和长句替换为 [text]，并把用户目录替换为
~。如果你已登录，报告会关联你的账号，方便维护者跟进。
报告发送到 Hosted 服务，90 天后自动删除；严重或首次出现的问题会通过邮件提醒维护者。服务端会用 IP 地址限制发送频率，但不会保存它。删除账号后，已有报告会保留，但不再关联账号。设定 → 隐私 中的“脱敏诊断摘要”只会复制到剪贴板，不会自动上传。
界面崩溃或原生崩溃的报告发出后，下次启动时通知中心会多一条“上次出了故障”。只有你写下当时在做什么并点“发送”，这句话才会作为反馈（见下）发出，并关联到那份报告。
App 内反馈
在账户菜单或 设定 → 关于 中选择“提交反馈”，只有点“发送”时才会发出：你写的内容、你在表单里留下的联系邮箱（默认是账号邮箱，可以清空），以及默认附上、可以先预览也可以关掉的脱敏诊断摘要（版本、平台、功能可用性、同步计数与错误类别）。Drifting 不会附上正文、项目数据、数据库或任何凭据。如果你已登录，反馈会关联你的账号。
反馈发送到 Hosted 服务，并通过邮件转给维护者，以便回复你。它不受“自动发送故障诊断”开关影响。没有 Hosted 服务或没有网络时，同样的内容会在你的邮件 App 里打开一封写给 support@drifting.cc 的邮件。反馈保存 365 天，删除账号时一并删除。
AI 与你选择的模型提供商
Drifting 的 Agent 使用你自己的 API Key，目前支持 DeepSeek、Anthropic 和 OpenAI。你发起请求时，提示词、选中的稿件上下文、对话历史和工具结果会从 App 直接发送到你选择的提供商，不经过 Drifting 的服务器。
实验性的“ChatGPT 订阅”路线通过 OpenAI 的设备码登录使用你本人的 ChatGPT 账号，登录令牌只保存在 App 的原生层和钥匙串中，请求同样直接发往 OpenAI。实验性的设定图生成也使用这条路线；生成的图片先存在本机，只有你选择保留时才会成为素材。
提供商如何保存、使用或用这些数据训练模型，取决于它的条款、你的账号类型和所在地区，Drifting 无法控制；发送私人写作之前请先查看。如果你使用 Hosted 同步，已完成的 Agent 对话会像其他项目数据一样同步。你为 Agent 配置的 MCP 扩展会在你授权后被调用，它们如何处理数据由其提供方负责。
其他网络连接
- 检查更新：官方版本启动时最多每 24 小时自动检查一次，也可以手动检查。它会连接 GitHub Releases 读取更新清单并下载安装包，更新包安装前会校验签名。GitHub 可能按其政策处理 IP 地址和请求日志。
- 支持邮件：发往 support@drifting.cc 的邮件经域名注册商 Namecheap 的邮件转发送达维护者的邮箱。我们会收到你的发件地址、邮件内容和你添加的附件，只用于处理你的请求；你可以通过同一邮箱要求删除支持记录。
- 在 GitHub 上提交 Issue 时，内容是公开的，并由 GitHub 按其政策处理。
本网站
drifting.cc 不含广告、分析脚本或 Cookie，字体、脚本和图片都由 drifting.cc 自己提供，不向其他网站发请求。网站只在你的浏览器里记住你选的语言（localStorage）；你选的明暗主题只在当前标签页里有效（sessionStorage），之后又跟随系统。这些都不会发给任何人。网站由 Vercel 托管；Vercel 可能为内容交付、安全和防滥用处理 IP 地址、请求头和常规访问日志，具体以 Vercel 隐私政策为准。
保留与删除
- 删除的项目先进入“最近删除”，30 天后永久删除，也可以立即删除。在 Mac 上把 App 移到废纸篓不会删除资料库；要删除本机数据，请退出 Drifting 后删除上面的数据文件夹，以及你另选位置的 Markdown 文件夹。
- 在 Hosted 上永久删除项目后，所有设备会立即无法再访问它；服务器保留 30 天，以便在误删时恢复，之后清除；存放在对象存储中的较大对象会在清除后再保留 35 天，使备份仍可恢复，然后删除。
- 退出登录或断开同步会保留本机项目，也不会删除已经上传的副本。
- 服务器每晚生成经过校验的数据库备份，保留 30 天，并在 Cloudflare R2 存一份副本；已删除的数据会随备份过期而消失。
- 删除账号：App 内目前没有删除账号的按钮。请用账号邮箱发邮件到 support@drifting.cc，我们会删除账号、同步数据、分享链接、你发表的评论和你提交的反馈。已有故障报告保留到 90 天期满，但不再关联账号；备份中的副本随备份过期删除。
-
你可以在 App 中导出
.drifting备份（同步开启时需先断开），也可以直接使用本机的 Markdown 文件夹；如需获取我们在 Hosted 上保存的账号信息，可以发邮件。
安全
网络传输使用 HTTPS，正式版本拒绝明文 HTTP；密码以哈希形式保存；API Key 和登录会话保存在 macOS 钥匙串中；同步对象在上传和下载时校验 SHA-256。没有系统是绝对安全的，Hosted 也不是端到端加密。发现安全问题，请按支持页的说明私下报告。
儿童
Drifting 不面向儿童。如果你未达到所在地区可以自行同意处理个人信息的年龄，请不要注册 Hosted 账号。如果你认为有儿童向我们提供了个人信息，请联系我们删除。
联系与变更
隐私问题请联系 support@drifting.cc。政策发生实质变化时，我们会更新本页日期，并在适当情况下通过 App 告知。
Drifting is an open-source, local-first app for long-form writing. By default your manuscripts, materials and settings stay on your Mac, and no account is needed. The Drifting maintainer receives data only when you sign in to the optional Drifting Hosted service, create a share link, send feedback from the app or email us, or when the app sends a content-free crash report (which you can turn off). This policy explains how the Drifting app, the Hosted service and third-party services you choose handle data.
It covers official Drifting releases and the Hosted service the Drifting maintainer
operates at api.drifting.cc. If a self-built or modified version connects to
another service, that service's operator is responsible for its own disclosures.
What we do not do
- No advertising, no third-party analytics or tracking tools, and no cross-app tracking.
- We do not currently collect usage statistics or behavioral analytics.
- We do not sell personal information.
- We do not train models on your manuscripts or use them for advertising.
Data on your Mac
Projects (chapters, ideas, elements, storylines, comments, TODOs and history), imported
images and PDFs, Agent conversations and settings are stored on your Mac in
~/Library/Application Support/cc.drifting.client/. Before a database upgrade,
Drifting keeps a limited number of safety snapshots in the same folder. Fonts you import stay
on your Mac.
Model-provider API keys, the ChatGPT sign-in credential and your Hosted session are kept in the macOS Keychain. Each project also gets a readable Markdown folder on your Mac (see or change its location in Settings → Sync & Data → Local data); which programs may read it is up to you.
Optional Hosted account and sync
Hosted is optional. Drifting connects to api.drifting.cc only after you sign in
or sign up; connecting uploads the projects already on your Mac and downloads the cloud
projects in your account. Hosted stores:
- Account data: email address, display name, optional avatar, a hash of your password, and sign-in sessions (which may include the IP address and client identifier used to sign in).
- Synced data: project metadata, checkpoints and updates containing your full manuscript, snapshots, comments, synced Project Memory, completed Agent conversations with the tool results they need, images, PDFs and other materials you upload, and sync identifiers that tell your devices apart.
- The storage space your account uses.
Sync is not end-to-end encrypted. Data travels over HTTPS, but synced content on the server is not encrypted with a key only you hold, so the Hosted operator can technically read it. If you need stronger confidentiality, keep working in local mode.
Hosted runs on a server rented from Tencent Cloud in Silicon Valley, United States. Larger sync objects and copies of the nightly database backups are kept in a private Cloudflare R2 bucket; Cloudflare also provides DNS. Verification codes, sign-in and password-recovery emails, and crash alerts to the maintainer are sent through Resend. These providers process the data needed to provide their services under their own policies.
Public share links
Share links are a Hosted feature. When you share a chapter (or an idea, element, storyline or category), Drifting uploads a reader copy of it: the text and basic formatting, the title, the chapter number, the name and colour of its storyline, the word count, and the name and summary of each element the text links to. Your comments, TODOs, relations and the rest of the project are not uploaded. The reader copy updates a few seconds after you pause writing. Note that an element summary may reveal what the text has not said yet.
Anyone with the link can read it and will see your display name. Commenting requires a Drifting account; every reader sees each comment and its author's display name, and the comments are imported into your library. The reader page is not indexed by search engines, sends no Referer, and sets only the cookies needed for sign-in when a reader signs in. Stop sharing deletes the link and the readers' comments on the service; comments already imported stay in your library.
Crash and integrity reports
Official Hosted-capable releases automatically send content-free reports when something fails, such as a UI crash, an unhandled error, a native crash from the previous run, a database that cannot open, a failed save, or a blocked sync. Reports are sent even when you are not signed in. The first-launch guide explains this, and you can turn it off at any time in Settings → Privacy → Send fault diagnostics automatically.
A report contains the error kind and severity, a grouping fingerprint, the error name, a
sanitized error message, stack locations, the app version, the platform, a random
diagnostics-only installation ID, the time, and a few context values that contain no
identifiers or text. Before sending, Drifting truncates the message, replaces long runs of
Chinese text, long quoted text and long sentences with [text], and replaces your
home folder with ~. If you are signed in, the report is linked to your account so
the maintainer can follow up.
Reports go to the Hosted service and are deleted after 90 days; fatal or first-seen problems alert the maintainer by email. The service uses IP addresses to rate-limit reports but does not store them. If you delete your account, existing reports remain without the account link. The sanitized diagnostic summary in Settings → Privacy is only copied to your clipboard and is never uploaded automatically.
After a report of a UI crash or a native crash was sent, the next launch adds one notification, “Drifting ran into a problem last time”. Only if you write what you were doing and choose Send does that note go out, as feedback (below) linked to the report.
Feedback in the app
Send feedback, in the account menu or Settings → About, sends only when you choose Send: what you write, the reply-to address you leave in the form (your account email by default; you can clear it), and the sanitized diagnostic summary (versions, platform, feature availability, sync counts and error categories), which is attached by default and which you can preview or switch off. Drifting never attaches manuscript text, project data, the database or credentials. If you are signed in, the feedback is linked to your account.
Feedback goes to the Hosted service and is emailed to the maintainer so they can answer you. It does not depend on the automatic fault-diagnostics switch. Without the Hosted service or a network, the same message opens in your mail app as an email to support@drifting.cc. Feedback is kept for 365 days and deleted with your account.
AI and the model providers you choose
The Drifting Agent uses your own API keys and currently supports DeepSeek, Anthropic and OpenAI. When you send a request, the prompt, the manuscript context you select, the conversation history and tool results go directly from the app to the provider you chose, without passing through Drifting servers.
The experimental ChatGPT subscription route signs in to your own ChatGPT account through OpenAI's device login. Its token stays in the app's native layer and the Keychain, and requests also go directly to OpenAI. Experimental element-portrait generation uses the same route; generated images stay on your Mac and become materials only if you keep them.
How a provider stores, uses or trains on this data depends on its terms, your account type and your region, which Drifting does not control; review them before sending private writing. If you use Hosted sync, completed Agent conversations sync like other project data. MCP extensions you configure for the Agent are called only with your permission, and their providers are responsible for how they handle data.
Other network connections
- Update checks: official releases check automatically at most once every 24 hours at launch, and you can check manually. This contacts GitHub Releases for the update manifest and the installer, and updates are signature-checked before installation. GitHub may process IP addresses and request logs under its own policies.
- Support email: mail to support@drifting.cc reaches the maintainer's mailbox through the email forwarding of the domain registrar, Namecheap. We receive your address, message and any attachments you add, use them only to handle your request, and you may use the same address to ask us to delete support records.
- Issues you open on GitHub are public and handled by GitHub under its policies.
This website
drifting.cc contains no advertising, analytics scripts or cookies, and serves its own fonts, scripts and images without requests to other sites. The site remembers the language you choose only in your browser (localStorage); a theme you choose lasts only for the open tab (sessionStorage), after which the site follows your system again. Neither is sent anywhere. Vercel hosts the site and may process IP addresses, request headers and ordinary access logs for content delivery, security and abuse prevention under the Vercel Privacy Policy.
Retention and deletion
- A deleted project goes to Recently Deleted and is permanently deleted after 30 days, or sooner if you choose Delete now. Moving the app to the Trash does not delete your library; to remove local data, quit Drifting and delete the data folder above and any Markdown folder you placed elsewhere.
- When you permanently delete a project from Hosted, every device loses access at once; the server keeps it for 30 days so a mistaken deletion can be restored, then purges it. Larger objects in object storage are kept another 35 days after the purge, so backups stay restorable, and then removed.
- Signing out or disconnecting sync keeps your local projects and does not delete uploaded copies.
- The server makes a verified database backup every night, keeps it for 30 days and stores a copy in Cloudflare R2; deleted data disappears as backups expire.
- Deleting your account: there is no in-app button yet. Email support@drifting.cc from your account address and we will delete your account, synced data, share links, the comments you posted and the feedback you sent. Existing crash reports remain, without the account link, until their 90 days expire; copies in backups are deleted as the backups expire.
-
You can export a
.driftingbackup from the app (disconnect sync first if it is on) or use the Markdown folder on your Mac, and you can email us for a copy of the account data we keep on Hosted.
Security
Network traffic uses HTTPS and release builds refuse plain HTTP; passwords are stored as hashes; API keys and sessions live in the macOS Keychain; sync objects are checked against their SHA-256 on upload and download. No system is perfectly secure, and Hosted is not end-to-end encrypted. To report a security issue privately, see the Support page.
Children
Drifting is not directed at children. If you are below the age at which you can consent to the processing of your personal information where you live, do not create a Hosted account. If you believe a child has given us personal information, contact us and we will delete it.
Contact and changes
For privacy questions, contact support@drifting.cc. Material changes will be reflected by the date on this page and, where appropriate, communicated in the app.