隐私政策Privacy Policy

• 你用 Mirage 打开了哪些网站、应用或地址；
• 你收发的内容；
• 你连到加速服务器时的来源 IP、连接时刻和连了多久。

加速服务器上没有连接日志。每月流量额度只靠一个数：这个账号本月一共用了多少字节，它和任何访问记录都不挂钩。

• 没有广告、统计分析或第三方追踪组件；
• 不读取通讯录、位置、照片、短信这类个人内容；
• 手机 App 通过系统提供的网络扩展接口，在你的设备和 Mirage 服务器之间建立加密连接，传输的内容不会被读取或改动；
• 登录凭证放在设备自己的加密存储里。

每次连接前，App 会核对线路配置的数字签名，确认连的是 Mirage 自己的服务器。

我们不出售你的个人信息。只有下面几家服务商会拿到完成工作所需的最少数据：

• Resend：替我们发验证码邮件，只拿到你的邮箱和邮件正文；
• Cloudflare：网站和登录接口的请求经它转发（加速线路不经过它），它会看到发起请求的 IP；
• 开通核对服务：确认一次开通是否完成，只拿到开通编号和凭证编号，看不到你的邮箱或其他个人信息；
• 机房：我们的服务器放在第三方数据中心。

即使有法律要求，我们能交出的也只有第 02 条列出、而且确实存在的数据。

• 账户数据保留到你删除账户为止；
• 在 App 的「账户」页，或登录网站用户中心，都可以自己删除账户。删除后邮箱、密码哈希、登录凭证、账户状态和流量统计马上清空；
• 账户删掉以后，开通记录和你的邮箱之间就没有任何对应关系了。

网站和 App 之间全程使用 TLS 加密，App 和加速服务器之间的连接也全程加密。密码只以加盐哈希的形式保存。

Mirage 不面向 13 岁以下的儿童，也不会有意收集他们的信息。

这份说明有实质改动时，我们会更新顶部的生效日期。有疑问，或需要帮忙删除数据，写信到 support@mirage.tours。

• The websites, apps or addresses you open through Mirage;
• The content you send or receive;
• Your source IP address, connection times and how long you stayed connected.

Our boost servers keep no connection logs. The monthly data allowance relies on one number: how many bytes the account used this month, which is not tied to any browsing record.

• No ads, analytics or third-party tracking components;
• No access to contacts, location, photos, messages or similar personal content;
• The mobile apps use the system's network extension interface to create an encrypted connection between your device and Mirage's servers. What you send is never read or altered;
• Session tokens live in the device's own encrypted storage.

Before each connection the app checks the digital signature on the line configuration, so it only ever connects to Mirage's own servers.

We do not sell your personal information. Only these providers receive the minimum they need to do their job:

• Resend sends our verification emails and receives only your email address and the message;
• Cloudflare forwards requests to our website and sign-in API, and sees the IP address those requests come from. Boost lines do not go through it;
• An activation lookup service confirms that an activation went through and receives only the activation ID and reference numbers, never your email or other personal details;
• Data centers host our servers.

Even when the law requires it, all we can hand over is data listed in section 02 that actually exists.

• Account data is kept until you delete your account;
• You can delete your account yourself from Account in the app or from the account page on this site. Your email, password hash, session tokens, account status and usage data are wiped right away;
• After deletion, activation records are no longer linked to your email in any way.

Traffic between the website and the apps is encrypted with TLS, and so is the connection between the apps and our boost servers. Passwords are stored only as salted hashes.

Mirage is not meant for children under 13, and we do not knowingly collect their information.

If this policy changes in a meaningful way, we update the effective date at the top. For questions, or help deleting your data, write to support@mirage.tours.