中文
梗仓 MemeVault(下称「本扩展」)是一个第三方 Chrome 扩展,与哔哩哔哩(bilibili.com)无任何官方关联。本扩展高度重视你的隐私,设计上「本地优先」:你的收藏默认只存在你自己的浏览器里,只有你主动开启的功能才会让数据离开设备。
我们存储什么、存在哪里
- 你收藏的评论:仅当你在 B 站评论区主动点击「⭐ 收藏」时,本扩展才把该条评论的文本、所在视频标题/链接、UP 主、点赞数、你添加的标签,以及(分析后的)AI 结果,保存在你本机浏览器的 IndexedDB 中。
- 你的设置:AI 通道选择,以及(若你选择自带 Key)你的 DeepSeek API Key,保存在你本机浏览器的 chrome.storage.local 中。
- Pro 激活状态(仅当你购买并激活):你的激活码、我们服务端签发的授权令牌,以及一个本机随机生成的设备标识(一串随机 UUID,与你的身份、账号、收藏内容无关),同样保存在你本机浏览器的 chrome.storage.local 中。解绑或卸载即清除。
以上数据默认只存在你的本地浏览器,无需注册任何账号,卸载扩展即清除。唯一的例外是下面写明的「收藏夹云同步」——那是一个仅 Pro 用户可用、且需要你每次手动点击才会发生的功能。
什么数据会离开你的设备
1. AI 分析(你点「分析此梗 / 重新溯源 / 仿写」时)
本扩展会将该条评论的文本 + 该视频标题发送给 AI 模型(DeepSeek)进行分析:
- 免费通道(默认):请求经我们运行的 Cloudflare Worker 代理转发给 DeepSeek。该代理仅记录用于排障的最小日志(请求 ID、状态码、耗时),以及匿名的聚合用量计数(哪类分析动作、成功与否、耗时),不记录评论内容,也不记录任何可识别你身份的信息。我们不持久化你的评论文本。
- 自带 Key 通道(BYOK):请求由你的浏览器直连 DeepSeek(api.deepseek.com),使用你自己的 Key。你的评论文本与 API Key 只存在你本机,绝不上传给我们。每次分析我们会额外收到一条不含内容与身份的计数(动作类型、成功与否),用于统计产品使用情况,该项不可关闭。
无论哪个通道,评论文本最终都会到达 DeepSeek 进行处理,适用 DeepSeek 的隐私政策。
2. 免费额度计数
使用免费通道时,请求会带上前述随机设备标识,仅用于统计「这台设备今天用了几次」以实施每日免费额度。该标识是随机生成的,不含任何身份信息,我们不会用它关联你的收藏内容,也不会用它跨站追踪你。
3. 购买与激活(仅当你购买 Pro)
支付由 Stripe 处理。我们的服务器不接触也不存储你的银行卡号、微信/支付宝账号等支付凭据,适用 Stripe 隐私政策。为便于你日后找回激活码,我们的服务器会保存结账时你在 Stripe 填写的邮箱与激活码的对应关系,以及该激活码已绑定的设备标识列表。这些信息仅用于售后找回与设备解绑,不用于营销,不对外提供。
4. 收藏夹云同步(仅 Pro,且仅当你手动点击「同步到云端」)
这是本扩展中唯一会把你的收藏内容留存在我们服务器上的功能。请仔细阅读:
- 会上传什么:你收藏的评论正文、所在视频的标题与链接、UP 主名、点赞数、你添加的标签与纠错提示。
- 不会上传什么:AI 分析结果(梗谱系、公式拆解、模版)不上传。换设备后重新点一次分析即可。
- 存在哪、怎么关联:数据以你激活码的指纹为键存放,不与你的邮箱或任何身份信息关联。我们的服务器对它不做解析、不建索引、不写入日志——对服务端而言它就是一段不透明的数据。
- 加密说明(请注意):当前版本以明文形式存储。我们不会去读取它,但我们不会声称这是"端到端加密"或"我们看不到"——那样的说法在当前实现下站不住脚。我们宁可如实告诉你。
- 绝不自动同步:不点那个按钮,你的收藏内容就永远不会离开你的设备。本地始终是主数据。
- 你随时可以删除:设置页的「删除云端副本」会立即删掉服务器上那一份,本机收藏不受任何影响。此外,超过 400 天未同步的云端副本会被自动清除。
我们不做的事
- 除购买 Pro 时由 Stripe 收集、用于找回激活码的邮箱外,不收集你的姓名、账号等身份信息;免费用户全程无需提供任何身份信息。
- 不使用第三方分析(如 Google Analytics),不投放广告;只在自有服务端保留匿名、不含内容与身份的聚合用量统计(两个通道均适用,不可关闭)。
- 不出售、不交换、不转让你的任何数据。
- 不批量抓取评论——只处理你逐条主动点击收藏的评论。
权限说明
本扩展申请的权限仅用于上述功能:sidePanel(收藏管理界面)、storage(存设置/Key/激活状态)、对 bilibili.com 视频页的内容脚本访问(注入收藏按钮)、对 api.deepseek.com 与我们代理域名的网络访问(AI 分析、额度、激活与云同步)。
联系方式
如有隐私相关问题,请通过 [email protected] 联系我们。
English
MemeVault is an independent Chrome extension and is not affiliated with or endorsed by Bilibili (bilibili.com). It is designed to be local-first: your saved comments live in your own browser by default, and data leaves your device only through features you actively turn on.
What we store, and where
- Comments you save: only when you click the "⭐ Save" button on a Bilibili comment do we store that comment's text, the video's title/URL, the uploader, like count, your tags, and (after analysis) the AI result — in your browser's local IndexedDB.
- Your settings: your AI-channel choice and, if you opt in, your own DeepSeek API key — in your browser's local chrome.storage.local.
- Pro license state (only if you purchase and activate): your license key, the authorization token issued by our server, and a randomly generated device identifier (a random UUID unrelated to your identity, any account, or your saved content) — also in your browser's local chrome.storage.local. Deactivating or uninstalling removes it.
By default all of the above stays only in your local browser, requires no account, and is removed when you uninstall. The one exception is "Vault sync" described below — a Pro-only feature that runs only when you click the button yourself, every time.
What leaves your device
1. AI analysis (when you click "Analyze" / "Re-trace" / "Rewrite")
We send that single comment's text + the video title to an AI model (DeepSeek):
- Free channel (default): the request is relayed to DeepSeek through a Cloudflare Worker proxy we operate. The proxy records only minimal troubleshooting logs (request ID, status code, latency) plus anonymous aggregate usage counts (which kind of analysis, success/failure, latency), and does not log comment content or any personally identifiable information. We do not persist your comment text.
- Bring-Your-Own-Key: the request goes directly from your browser to DeepSeek (api.deepseek.com) using your own key. Your comment text and API key are stored only on your device and are never uploaded to us. Every analysis additionally sends us a single content-free, identity-free count (action type, success/failure), used to measure product usage; this cannot be turned off.
In either channel the comment text ultimately reaches DeepSeek for processing, subject to DeepSeek's privacy policy.
2. Free-quota counting
When using the free channel, requests carry the random device identifier described above, solely to count "how many times this device has used the service today" and enforce the daily free quota. The identifier is randomly generated, contains no identity information, is never used to link to your saved content, and is never used to track you across sites.
3. Purchase and activation (only if you buy Pro)
Payment is handled by Stripe. Our servers never touch or store your card number, WeChat/Alipay account, or other payment credentials; Stripe's privacy policy applies. So that you can recover your license key later, our server stores the mapping between the email you entered at Stripe checkout and your license key, plus the list of device identifiers bound to that key. This is used only for support recovery and device deactivation — never for marketing, never shared.
4. Vault sync (Pro only, and only when you click "Sync to cloud")
This is the only feature that stores your saved content on our servers. Please read carefully:
- What is uploaded: the text of the comments you saved, the title and URL of the source video, the uploader's name, the like count, and the tags and correction hints you added.
- What is NOT uploaded: AI analysis results (meme lineage, formula breakdown, templates) are never uploaded. On a new device you simply run the analysis again.
- Where it lives, and how it is keyed: the data is stored under a fingerprint of your license key and is not linked to your email or any identity information. Our server does not parse it, index it, or write it to logs — to the server it is an opaque blob.
- About encryption (please note): the current version stores this data in plaintext. We do not read it, but we will not claim it is "end-to-end encrypted" or that "we cannot see it" — those claims would not hold for the current implementation, and we would rather tell you plainly.
- Never automatic: if you do not press that button, your saved content never leaves your device. Your local copy is always the source of truth.
- You can delete it at any time: "Delete cloud copy" in Settings immediately removes the server-side copy and does not affect your local data in any way. In addition, cloud copies untouched for more than 400 days are deleted automatically.
What we do not do
- Apart from the email collected by Stripe when you purchase Pro (used to recover your license key), we do not collect your name, account, or any identity information. Free users never provide any identity information at all.
- No third-party analytics (e.g. Google Analytics), no ads; we keep only anonymous, content-free and identity-free aggregate usage stats on our own server (applies to both channels, not optional).
- We do not sell, trade, or transfer your data to anyone.
- No bulk scraping — only the individual comments you actively click to save.
Permissions
Permissions are used solely for the features above: sidePanel (the management UI), storage (settings, key, license state), content-script access to bilibili.com video pages (to inject the save button), and network access to api.deepseek.com and our proxy domain (AI analysis, quota, activation, and vault sync).
Contact
For privacy questions, contact us at [email protected].