Privacy Policy
Effective date: 2026-10-06. Operator: 北京清青远程科技店（个体工商户）, contact: contact@thugroup.org. This English text is a translation; if it differs from the Chinese version, the Chinese version prevails.
This policy explains what personal information the Cirrus app (卷云) on all platforms, this website (https://cirrus.routeforge.zone) and its licence server collect, why, how long it is kept and what rights you have. We collect as little as possible.
1. The Cirrus app
- Cloudflare credentials stay on your device. API tokens, API keys and OAuth tokens are stored only on your device, in the system keychain (Apple Keychain, Android Keystore, Windows Credential Manager or the Linux Secret Service) or, where no keychain is available, in a local file readable only by your user account. They are never sent to us.
- Direct connection to Cloudflare. The app talks directly to the Cloudflare API and Cloudflare's sign-in pages. No developer server sits in between, and we never see your Cloudflare data. Cloudflare's handling of that data is governed by Cloudflare's own privacy policy.
- Lists such as your accounts and zones are cached on your device so the app starts quickly. You can clear them by removing the credential or uninstalling the app.
- No analytics, ads or tracking SDKs. The app contains no analytics, advertising or tracking code.
- Licence activation (Windows, Linux and directly downloaded Android builds only). When you activate, validate (at most once every 7 days while online) or deactivate a licence, the app sends the licence key, a device id, the device name, the platform and the app version to our licence server. The device id is a SHA-256 hash of your system's machine identifier; the identifier itself never leaves your device.
2. App Store and Google Play purchases
Purchases in the App Store and Google Play versions are processed by Apple and Google under their own terms and privacy policies. We receive no payment card data and no contact details from those purchases.
3. What the website and licence server collect
| Information | Why |
|---|---|
| Your email address | To deliver your licence key, verify self-service device resets, resend lost keys and answer support requests. |
| Order records: product, amount, payment method, time and payment reference (for example the Alipay trade number or the note on a manual transfer) | To process your purchase, confirm payment, handle refunds and keep the transaction records required by law. |
| Licence activation data: hashed device id, device name, platform, app version, activation and last check time | To enforce the device limit of your licence and show you which devices use it. |
| IP addresses in server logs and the licence audit log | To prevent abuse (rate limiting, fraud and attack detection) and keep the service secure. |
Payments are made through Alipay or WeChat Pay. We do not receive your bank card or account credentials; we only learn that a payment for an order was made, its amount and its reference.
The website uses only necessary storage: a cookie remembering your language choice, and your browser's local storage to keep the number and token of an order in progress so the purchase page can resume it. There are no tracking cookies and no third-party scripts, fonts or CDNs.
4. Legal basis
We process this information because it is necessary to conclude and perform the contract with you (selling and supporting the licence), to meet legal obligations such as keeping transaction records, and to keep the service secure.
5. How long we keep it
- Email, licence and activation data: as long as needed for the licence. Activation data of a device is deleted when the device is deactivated or reset.
- Transaction records of paid orders: as required by law (for example, at least three years after the transaction under the PRC E-Commerce Law).
- Unpaid orders: deleted 90 days after they expire.
- IP addresses: removed from the audit log after 180 days; server logs are rotated automatically and kept for a short time.
6. Sharing
We do not sell or rent your personal information and do not share it with third parties, except: with payment processors (Alipay, WeChat Pay) to process your payment; with our email delivery service, to send your licence key; with our hosting provider, which stores the data on servers in mainland China; and where required by law or by a competent authority.
7. Security
The website uses HTTPS, the admin area is protected by a password, licences are cryptographically signed, and we keep only the minimum data described above.
8. Your rights
You can ask to access, copy, correct or delete your personal information, or withdraw consent, by writing to contact@thugroup.org. We reply within 15 working days. Deleting your email address means self-service device resets and key recovery no longer work for your licence; transaction records that the law requires us to keep are retained for the required period.
9. Children
Cirrus and this website are not directed to children under 14, and we do not knowingly collect their personal information. If you believe a child has given us personal information, contact us and we will delete it.
10. Changes
We will post any change to this policy on this page and update the effective date above. Material changes will be highlighted on the website.
11. Contact
北京清青远程科技店（个体工商户） · contact@thugroup.org