# Privacy Policy — 魔法工具 小红书工作台 Effective date: October 14, 2026 Last updated: October 18, 2026 Applicable extension version: 2.1.2 This statement replaces the version written for extension 1.2.9. The product name is now 魔法工具 小红书工作台. The public address of this page is unchanged. ## 1. Purpose and scope 魔法工具 小红书工作台 is a browser extension for collecting Xiaohongshu keyword results, single notes, account-matrix notes, comments, favorites, and images after the user starts a task. Results stay in the browser. This version does not upload collected notes, comments, images, or favorites to Feishu, Lark, or any other third party. It does not connect to a local companion program. It does not provide speech transcription, analytics, or advertising, and it does not download or run remote executable code. ## 2. Information processed locally The extension may process note identifiers, titles, descriptions, author names and identifiers, engagement counts, publication times, image addresses, video addresses included in a collected note, note links, search keywords, account-profile addresses the user supplies, and comments or replies actually returned for a note the user chooses to collect. Missing counts are not filled in as zero. Author names and comments may contain personal information even when they are publicly visible. This information is saved in the local browser profile with IndexedDB. Task progress, cached image files, and import staging records are also stored locally. Frequency and quota settings, a randomly generated installation UUID, and the license credential returned by the licensing server are stored in chrome.storage.local. The activation code itself is sent only for an activation request and is not written into extension storage. These stores are not synchronized by this extension to a developer server. The developer does not receive, inspect, sell, or automatically upload collected note, comment, image, favorites, or account-matrix data. These browser stores are not an encrypted vault. Anyone with access to the user's browser profile or device may be able to read what is stored there. ## 3. What the extension reads on Xiaohongshu pages This version does not use the Chrome debugger permission and does not use the Chrome DevTools Protocol. On Xiaohongshu pages, the extension runs scripts in the page's own context. Those scripts observe the page's existing fetch and XMLHttpRequest calls, limited to Xiaohongshu search-suggestion responses, search-note responses, and the note feed, and they read note fields already present in the page for a note the user is collecting. From those responses they keep suggestion words, search progress, and the note fields needed for the task. They do not create a separate signed request, and they do not extract or save cookies, Authorization headers, or the website login session. Observed page responses are passed to the extension and stored locally. They are not sent to the licensing server or to any other developer-controlled server. The extension does not monitor unrelated sites. Opening developer tools on a collection tab may interrupt a task. Closing the popup does not by itself stop a task that is already running. ## 4. Remote licensing: the only developer-controlled connection The extension connects to https://meng985211.cn over HTTPS only to activate or revalidate a license. Activation sends the activation code, the random installation UUID, the extension version, and a one-time request nonce. Revalidation sends the license ID, the server-issued validation credential, the installation UUID, the extension version, and a nonce. These values are not Xiaohongshu cookies or login tokens. Collected notes, comments, images, favorites, browsing history, Xiaohongshu cookies, and account session credentials are never included in licensing requests. Requests omit browser credentials, reject redirects, and have a timeout. The UUID identifies an extension installation, not a person or a hardware device. It is not derived from a disk, network card, or hardware fingerprint. Uninstalling the extension or clearing its data can create a new UUID. The licensing service necessarily receives ordinary connection metadata such as the source IP address and request time. Retention of authorization records, logs, and backups is described in Section 9. No telemetry and no upload of collected content is implemented. ## 5. Website and image connections The website continues to make its own browser requests. The extension does not bypass login, verification, access controls, or rate limits. When the user collects or caches images, the extension requests the image address from Xiaohongshu's image hosts (xhscdn.com and xhscdn.net). That access is declared in the extension and is not a separate optional permission. Image files are cached locally. A content host may see ordinary connection metadata for these requests. These requests are not an upload of the user's collected database. ## 6. Local exports and user control The user can export an Excel workbook, an HTML reading file, or a JSON backup to a local download location, download cached images, or clear the local collection database. Exports contain the locally collected information selected by that action. Restoring a JSON backup imports allowlisted local content. It does not import the activation code or start a task by itself. The clear action stops the current keyword task, deletes the local note and word library, deletes cached images, and discards the current matrix task. It does not delete the separate Favorites collection or the local sync queue. License expiration does not block viewing, exporting, or deleting data already stored locally. Uninstalling the extension may permanently remove local data. Export a backup first. ## 7. Limited Use and purpose limitation Use of user data is limited to the extension's user-facing collection, local organization, local export, and licensing functions. User data is not used for advertising, profiling, credit decisions, sale, or transfer to data brokers. The developer does not review collected content. Use of user data complies with the Chrome Web Store User Data Policy, including the Limited Use requirements. This statement is not a Chrome Web Store approval and is not permission from Xiaohongshu to collect any particular content. ## 8. Licensing availability and security boundaries The first activation requires a network connection. A signed cached license can be used until the server-specified revalidation time and short offline grace period, and never after the license expires. Revocation, expiry, or an installation mismatch blocks new collection. An offline installation cannot immediately learn of a server-side revocation. Private signing keys and administrator credentials are not included in the extension. Local verification does not make the extension impossible to modify. ## 9. Operator, licensing service and contact Developer/operator legal name: 孟奇然 Licensing server origin: https://meng985211.cn Service location: The licensing service runs on a virtual machine whose public address is in Hong Kong. The hosting provider for this authorization server is 云蜂互联. Nginx on that machine reverse-proxies HTTPS requests to the application, and the database runs on the same machine. Backup storage: Once a day, a backup of the production database, which includes these authorization records, is uploaded to Tencent Cloud Object Storage (COS) in Hong Kong. Tencent Cloud Object Storage (COS) is the database backup storage service only. It is not the hosting provider of the virtual machine. After a successful upload, the copy on the virtual machine is deleted. The backup program does not delete older copies in object storage. The bucket has no automatic expiry rule, so backups do not expire on their own and remain until the operator deletes them. Object storage is not keeping historical versions of those backup files. Licensing-record retention: Activation codes and installation records are not deleted automatically. Disabling a license or unbinding an installation changes its status only. It does not erase the license, the installation record, or the first-activation log. There is no self-service deletion. Disabling or unbinding is not complete deletion. Requests to look up or delete authorization records: Open 激活／授权 in the workbench. The screen shows a shortened installation identifier, and it is available before the extension is activated. The 复制 button copies the full identifier. Email that identifier to mjlpdj@gmail.com to ask the operator to look up or delete the related authorization records. The identifier is used to find the records. It is not, by itself, proof of who is making the request, and the operator may make further checks when needed. You are not asked to send the full license token. The service does not store your name, email address, or Xiaohongshu account. The website and the extension have no control that deletes these records. This policy does not promise that a request will result in deletion, or how long any deletion would take. The license record and the installation record stay because the server uses them to decide whether that installation may run. The first-activation log and the request counters below are not removed by an email request. Copies already stored in a database backup are not removed from that backup. Those backup files remain until the operator deletes them. Operational logs: The first activation that starts a license records the source network address and browser information in an application log. Later activations of a license that has already started, and revalidation, do not add that log entry. Those log entries are not deleted on a schedule. Activation and revalidation also update a short-period counter of repeated requests. That counter does not keep the network address in a readable form, and those counters are not deleted on a schedule. Nginx access and error logs for this website are not deleted automatically and remain until the operator removes them. Privacy/support contact email: mjlpdj@gmail.com Public policy URL: https://meng985211.cn/privacy/ale-xhs-workbench.html Material changes to data practices require an updated policy and the same disclosure in the Chrome Web Store listing.