Privacy policy隐私政策

This policy explains the public browser demonstration and the separate locally operated Cafe Replenishment application, including the local application’s optional Gmail connection.本页说明公开浏览器演示与另行安装的本机应用如何处理资料，包括本机应用可选的 Gmail 连接。

Effective date: 22 October 2026 · Application: Cafe Replenishment生效日期：2026年10月22日 · 应用：Cafe Replenishment

1. The project and this website1. 项目和公开网站

Cafe Replenishment is an independently maintained café replenishment demonstration project. The public website provides project information and a browser-based simulated café at /demo/. The demo does not require an account or owner password. Its simulated inventory, weather context, quantity changes, approval snapshots and audit records are saved in localStorage in the current browser profile. Visitors using other browser profiles or devices have separate demo state; people sharing the same browser profile share that profile’s demo state. The demo does not collect OAuth credentials or connect to the local owner workbench.Cafe Replenishment 是独立维护的咖啡店补货演示。公开演示无需账户或密码；模拟库存、天气、修改、审批及日志保存在当前浏览器。同一浏览器配置的使用者共享该份资料，其他设备或浏览器配置各自独立；公开演示不收集 Google 凭据，也不连接本机老板工作台。

The hosting provider may process ordinary request information such as IP addresses, browser information, access logs or platform session data. The site does not add its own advertising trackers or analytics scripts.托管服务商可能处理 IP、浏览器、请求日志或平台会话资料。网站没有额外广告追踪器或分析脚本。

The public demo requests Kuala Lumpur weather directly from Open-Meteo when real weather is selected; that provider receives ordinary network request information, the fixed city coordinates and the chosen target date. The request does not use your actual location or ask for geolocation permission. On failure or when a scenario is selected, weather is explicitly marked as simulated. The demo has no sales-data upload, Gmail, Runpod or supplier-send API. Drafts are generated in the browser and downloaded only when the visitor asks. Do not enter private business information. Use “Reset demo” to clear this site’s demo state; downloaded files and browser history are not removed. Browser storage can be unavailable or cleared by the browser. Hosting request logs are separate from demo state.选择实时天气时，浏览器直接向 Open-Meteo 发送固定吉隆坡坐标和目标日期，不读取你的实际位置或请求定位权限。失败时明确使用模拟情景。演示没有销量上传、Gmail、Runpod 或供应商发送接口；草稿只在点击时下载。请勿填写真实机密资料；重置仅清除本网站模拟资料，不删除下载文件或浏览记录。

2. Information in the separate local application2. 独立本机应用的资料

The application currently uses synthetic sales and inventory for demonstrations. On the operator’s computer it stores recipes, ingredient stock, supplier contact details, demand forecasts, procurement lists, approval history, supplier draft contents and API export status. The operator controls this local runtime directory.另行安装的本机应用使用模拟销量和库存，并在操作者电脑保存配方、供应商资料、需求预测、采购清单、审批、草稿及导出状态；本机运行目录由操作者控制。

3. Google information and Gmail permissions3. Google 资料与 Gmail 权限

Connecting Gmail is optional and begins from the local owner workbench. The application requests https://www.googleapis.com/auth/gmail.compose. This Google permission includes managing drafts and sending email. The current application uses it to check connectivity and create procurement drafts; it has no email-sending operation.以下 Gmail 功能仅属于另行安装的本机应用。连接可选，并从本机老板工作台开始；gmail.compose 权限包含管理草稿和发送邮件，但当前程序只有连接检查和草稿创建，没有发送操作。

A connection check requests a list containing at most one draft’s identifiers. It does not fetch message bodies. Creating a draft submits the owner-approved supplier recipient, email subject and message body to Google. Gmail returns draft and message identifiers, which are stored locally with export status. The application does not import the inbox or read received email content.连接检查最多读取一份草稿的标识，不读取邮件正文。创建草稿时，已批准的供应商地址、主题及正文会发送给 Google，返回标识保存在本机用于避免重复；程序不读取收件箱。

4. Authorization credentials and automatic refresh4. 凭据与自动刷新

OAuth client credentials, access tokens and refresh tokens are stored by the local server. On Windows they are protected using current-user DPAPI. Other supported platforms use a file with restricted permissions; this is not described as encryption. Credentials are not returned to the phone workbench, embedded in this website, included in supplier messages, or intentionally recorded in application logs.Google 客户端密钥、访问及刷新令牌由本机服务保管。Windows 使用当前用户 DPAPI；其他支持平台使用受限权限文件。令牌不会回传手机、放进公开网站、供应商消息或有意记录在日志中。

When needed for a connection check or draft creation, the local server sends the refresh token to Google’s token service to obtain an access token. Authorization is not permanent: Google test-mode limits, revocation, password changes or account policies may require another browser authorization. The owner can configure service credentials through environment variables; those overrides are managed separately.本机服务在检查连接或创建草稿时按需向 Google 申请新访问令牌。测试模式限制、撤销、改密或账户政策仍可能要求重新授权；环境变量覆盖由操作者另行管理。

5. Other services and AI processing5. 其他服务与 AI 处理

If enabled, Runpod receives selected forecasting inputs: product identifiers, demand estimates, permitted adjustment limits and selected weather and holiday context. The current application does not send Google-derived Gmail information, Google OAuth credentials, supplier contacts or procurement email bodies to Runpod, and does not use Google user data to train AI models.本机应用启用 Runpod 后只提交选定预测输入、允许调整范围及天气假日情景，不提交 Gmail 数据、Google 凭据、供应商联系方式或邮件正文；Google 用户数据不用于训练 AI。

Weather requests use the configured city or coordinates with the weather provider. A WhatsApp prefilled link includes the supplier phone number and draft text when the owner opens that link. Sending a WhatsApp message remains the owner’s action. Google, Runpod, the weather provider and WhatsApp process submitted information under their own policies.本机天气请求使用设定城市或坐标。WhatsApp 预填链接包含供应商号码和草稿文字，发送仍由操作者确认；第三方按各自政策处理资料。

6. Google API Limited Use6. Google API 限制使用

Cafe Replenishment’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. Google user data is used to provide the requested Gmail draft functionality. It is not sold, used for advertising, or used to train generalized AI models.Cafe Replenishment 使用和向其他应用传输 Google API 数据时遵守 Google API Services User Data Policy 及 Limited Use 要求。数据仅用于所请求的 Gmail 草稿功能，不出售、不用于广告或训练通用 AI。

7. Retention, disconnection and deletion7. 保留、断开和删除

Local procurement and approval records remain in the runtime directory until the operator deletes them. Successful draft identifiers and export statuses remain so the application can avoid duplicate creation. There is no scheduled automatic purge.本机采购与审批记录保留到操作者删除，成功草稿标识及导出状态用于避免重复，没有定时自动清除。

“Disconnect Gmail” attempts to revoke the Google authorization and clears locally saved access and refresh tokens. It retains desktop client settings, local procurement records and draft content. If Google revocation cannot be confirmed, the workbench reports that uncertainty. Credentials supplied by environment variables must also be removed from the launch environment.断开 Gmail 会尝试撤销 Google 授权并清除本机访问和刷新令牌；保留客户端配置、本机采购和草稿。无法确认撤销时会明确提示；环境变量凭据仍需自行移除。

You can revoke the application from Google Account third-party connections. Revocation does not delete drafts already saved in Gmail. Delete those in Gmail, and remove local records from the runtime directory when no longer needed. Close the local server before deleting its runtime files.可在 Google 账户第三方连接撤销授权。撤销不会删除 Gmail 已有草稿；需要自行在 Gmail 删除。删除本机记录前请先关闭服务器。

8. Contact and policy changes8. 联系与政策更新

Contact the application owner using the developer support email shown on Google’s authorization screen.联系方式请参考 Google 授权页显示的开发者支持邮箱。

Policy changes will be reflected on this page with an updated effective date. Material changes to how the application uses Google data require an updated disclosure and any authorization required by Google.政策变化会在本页更新生效日期。涉及 Google 数据用途的重大变化会更新披露并取得 Google 要求的授权。