Privacy policy

Privacy policy

Version 2026-10-26.1 · Effective 26 October 2026. Applies to SandGull (SandGull.exe) for Windows and this product information, download and image recognition trial website. This English rendering describes the same processing as the Chinese policy.

0. How the software works

Local offline recognition processes images on your computer. Online recognition sends images to the selected recognition service. Account information is handled when you sign in; local files remain under your control. The web trial has separate processing and retention rules below.

1. Provider and website

An independent individual developer develops, maintains and provides this software and is responsible for its personal information processing. The developer’s real name is not published for personal privacy; verified identity information is supplied to filing services, distribution platforms and competent authorities as required. Contact the privacy email in section 11 for privacy, account data and security matters.

The website offers information, downloads and recognition trials without account registration, login, comments or public posting. Trial images are sent to SandGull. Anonymous identifiers, IP addresses and necessary access records support access control, rate limits and troubleshooting. There are no analytics, advertising or third-party tracking scripts, or identity cookies. Other platforms through which you share links apply their own rules. Site content and installers are original or authorized.

Website image recognition trial

When you select an image, accept the upload notice and select “Start recognition”, it is sent over HTTPS to SandGull’s own recognition service for OCR, table reconstruction and Excel generation. The website and Skill share this service. The web trial does not call additional third-party OCR or use images or results for model training.

• Images: memory and temporary space are used during processing; images are not kept as a long-term archive.
• Results: text, table coordinates and Excel files expire about 30 minutes after task creation and are deleted by periodic cleanup. Quota counters and task metadata are retained for about two days; cleanup may be delayed.
• Anonymous access: the browser stores a random anonymous identifier for task ownership and quota. It is not a name, email address or SandGull account. Short-lived tokens stay in page memory. The current tab’s session stores task receipts for recovery, without persisting source images or full results in browser storage. A language preference may be stored separately; it does not change your anonymous identity or quota.
• Access records: necessary IP, time, path and task status data are processed. Quota ledgers use an IP-derived identifier. Access logs may include raw IP addresses; they rotate daily with 14 rotated files retained, depending on rotation execution. Business logs exclude image bodies, recognized text and access tokens.
• Your control: before submitting, cancel selection or leave consent unchecked. Closing the page stops browser polling, but accepted tasks may continue. Results expire as described. Downloaded Excel files remain under your control. Do not upload unauthorized images or unrelated sensitive information.

The website and Skill share the promotional quota. Current limits are 10 accepted tasks per anonymous identifier per day, 50 per IP and 200 across the service, resetting at 08:00 Beijing time (UTC+8, 00:00 UTC), subject to actual server policy. Accepted tasks count even if they fail or contain no table. Querying, downloading or resuming the same task does not count again. An anonymous identifier is not a unique natural person; shared networks may share the IP limit.

The remaining image and cache terms concern the desktop software. Contact allen_tai@126.com about privacy.

To manage the shared free pool, task metadata and daily counters record the actual request entrance (Skill, website or unclassified legacy traffic). Limits or reception may be adjusted by entrance. This label does not verify caller identity and adds no browser fingerprint. The tab's task receipt records its original API path so existing tasks can still be queried after an entrance change; access tokens remain only in page memory.

Quota and reception changes retain the operation ID, administrator ID, reason, time, policy version and before/after values for reconciliation and auditing, excluding images and recognized content. Gateway operation receipts persist separately from task metadata subject to the two-day cleanup, with a maximum of 10,000 receipts. The backend also retains management audit records for the period needed for security and auditing.

2. Desktop images and recognition content

2.1 Online recognition

Images travel over HTTPS. Free trial recognition uses Tencent Cloud OCR, falling back to Baidu AI Cloud when unavailable. The limited-time iFlytek experience uses iFlytek OCR. Professional recognition uses the developer’s service and may fall back to Tencent or Baidu. These routes relay images through server memory, without writing original images to disk, databases or object storage. Images are used only for the recognition you initiate.

With your own API key, your computer connects directly to the configured Baidu, Tencent or iFlytek service without our relay. Your relationship with that provider is governed by its terms and privacy policy.

2.2 Results and duplicate requests

Recognized text from desktop free trial, limited-time experience, registration onboarding and professional channels is not written to our server database. Only request and image digests, completion and response status, quota or accounting associations and necessary timestamps are retained for concurrency control, duplicate request handling and reconciliation. These records cannot reconstruct the image or recognized text.

Successful online results are cached in your configured local cache directory for seven days, protected with Windows current-user encryption. Expired files are cleaned on the next run; you can clear the cache in Settings. Image digest, channel and account scope determine reuse. If the server completes recognition but the response is interrupted before local caching, the server can confirm completion but cannot recover the text; the same request is not executed again. Results are not used for model training, algorithm improvement or data analysis.

2.3 Local offline recognition

Local components perform inference on your computer. Images and results remain on your computer and are not sent to us or third parties. Components are downloaded from object storage on first installation or update.

3. Accounts and account data

You may skip login and use limited guest features. Signed-in use involves your email address (account identity, login codes, service notices and rights requests), short-lived login codes, session and refresh tokens, an irreversible device digest, a device name for your device list, client version, quota and entitlement records, and necessary timestamps.

The device identifier is generated locally; the server stores only a further hash, not raw hardware serial numbers. It is a pseudonymous identifier for device distinction and account protection, not a real identity. Login uses email codes only: no password, phone number, identity document number, real name, address or social account is collected.

After login, necessary account status requests at startup and periodically update device activity, remote configuration and authorization. They exclude recognized content, images, templates and anonymous usage analytics. A synchronization failure does not immediately block use. Client behavioral analytics are currently disabled; enabling them would require a policy update and renewed consent.

4. Local data

• Source images, templates and exports stay in locations you choose. Relayed online recognition results use the encrypted seven-day local cache.
• Session and user information are stored in local app data with Windows user encryption.
• Your API keys remain local and use Windows user encryption where supported; they are not uploaded to our server.
• Interface preferences include theme, cache path, default recognition channel and language.
• Processing images are saved locally only if you enable that option; it is off by default.
• Crash logs stay local and record exception stacks and version, not images or recognized results. They are not automatically uploaded; you choose whether to send them for diagnosis.
• Local recognition components, update installers and verification files may be cached.

Settings provides cache and log cleanup. You may also remove the relevant app data directories yourself.

5. Third-party processors

Tencent Cloud supports desktop free trial OCR, professional fallback, update distribution and component downloads. Baidu AI Cloud supports desktop free trial and professional fallback. iFlytek supports its limited-time experience. These providers receive images for relevant OCR routes; Tencent object storage also receives manifest and component download requests. Their policies apply to data they receive:

• Tencent Cloud privacy statement
• Baidu AI Cloud privacy policy
• iFlytek Open Platform privacy policy

Own-key routes connect directly to the provider under your agreement with it. Outside the described scenarios, we do not sell, rent or share personal information with third parties, except necessary information required by law or valid legal process.

6. Retention and cleanup

• Desktop original images are not stored on our server; web trial temporary processing is described above.
• Desktop relayed result text is not retained server-side. The encrypted local cache lasts seven days and is cleared on the next run after expiry, or by you.
• Minimal request, digest, quota and accounting records exclude images and recognized text and are retained as necessary for security, service obligations and disputes.
• Account data remains during the account’s lifetime. After a verified closure request, it is deleted or anonymized except legally required retention.
• Inactive devices are released after the applicable inactivity period. You control local data and may delete it.

Clearing the cache also removes local online results and processing files irreversibly. Recognition can still run without a cache, but identical content may require another service call.

7. Security

Image and account transfers use HTTPS. Stored sessions, own keys and online result caches use Windows user encryption. Desktop relays process images in memory; web trials use memory and temporary space with the retention stated above. Device digests exclude raw hardware information. Internal access follows least privilege with necessary management and audit logs. No technical measure guarantees absolute security; protect your computer and API keys.

8. Your choices and rights

Use limited guest features without logging in; choose local offline recognition to keep images local; use your own key to bypass our relay; clear local cache and logs; view and unlink devices in device management. Contact the privacy email to request access or a readable copy of account data, corrections, additions, deletion, processing restrictions, withdrawal of consent, legally available transfer, or account closure. Include your account email and the scope of your request. We verify account ownership and respond within legal deadlines. Withdrawal does not affect prior processing.

9. Minors

The software is designed for adults and does not target minors or intentionally collect their data. Minors should use it with guardian consent and guidance. Guardians may contact us if a minor supplied data without consent so we can delete it promptly.

10. Policy updates

Changes in features, providers or legal requirements may require updates to this policy and its version and date. Material changes to purposes, data categories or rights require renewed confirmation in the client before relevant use continues. Review the policy after updates.

11. Contact

The preferred public channel for privacy, account data rights, security concerns and complaints is allen_tai@126.com. General product discussion is available in QQ group 1129106370; do not submit privacy or account requests there, or post account emails, images, results or other personal data publicly. We reply as soon as possible and handle the request or explain progress within 15 working days. Account ownership verification may be required.

12. Terms

Online recognition: channels that send images outside your computer, including trial, limited-time experience, professional and own-key recognition. Local offline recognition: local component inference with images and results staying on your computer. Own API key: a key you obtain from Baidu, Tencent or iFlytek for direct connection. Irreversible device digest: a locally generated pseudonymous device identifier that cannot reconstruct original hardware identifiers. Recognized text: content extracted by OCR, such as cell text; desktop relayed text is not written to our server database. Web trial retention is described separately above.