Room layout stays on-device

Room-layout camera images, live AR frames, scene meshes, and raw RoomPlan room models are processed on the device and are not persisted, uploaded, sent to AI or terrain services, or included in ordinary layout sharing. An unfinished quick layout is not a saved project. To recover from an interruption or relaunch, the app automatically keeps at most one encoded local recovery draft, limited to 1 MB (1,048,576 bytes), in its private Application Support directory. Saving the layout to a space project, explicitly discarding the draft, or replacing it with a newer draft clears or replaces that recovery copy. The draft is never uploaded. Only when you explicitly save to a space project does the app retain local parameterized room geometry, reviewed dimensions, connections, calculations, and layout plans. A whole-home USDZ is created only when you explicitly request an export.

After you mark a door or window, you may attach up to six photos or short videos to that feature. Videos are limited to 60 seconds and are kept in the app's protected local storage; they are not sent to AI, logs, analytics, or ordinary layout sharing. You can add or delete this media later, and it leaves the device only through an explicit share action.

The separate, optional Furniture 3D Scan saves multi-angle source images in the app's private local storage only while capture or reconstruction is in progress. Source images are removed after the reduced USDZ is generated. The local USDZ and its reviewed collision dimensions remain until you delete the asset or its project, and leave the device only when you invoke the iOS share sheet.

In empty-room planning, the app can hide movable existing furniture while retaining doors, windows, fixed installations, structural obstacles, and main aisles as planning constraints. A shared layout omits floor-plan geometry by default and includes only selected furniture, orientation, and written advice.

Local records and optional map analysis

Birth details, calculated charts, almanac results, compass readings, saved site projects, notes, journal entries, photos, audio notes, retests, generated PDFs, and recent Fengshui Map places are stored only on the device unless you explicitly use a documented connected feature or the iOS share sheet.

Fengshui Map can use a searched place, a point you select on the map, or your current location after you tap the current-location control. Before any Apple map is instantiated, the app asks for separate, versioned map-display permission. If you allow it, Apple MapKit may receive the map request time; device, software, configuration, and input-language information; the boundaries of the visible map area; and interactions with the map under Apple's privacy practices. The visible area may reflect a coordinate you selected or saved locally. Tianji does not receive this map-display traffic. This permission is separate from MapKit place-search permission and Tianji terrain-analysis permission. Selecting or moving the map does not by itself call Tianji's terrain service.

After a separate disclosure is accepted, Fengshui Map sends the selected point's precise latitude and longitude, a fixed 2 km radius, and the Home, Shop, and Grave purpose codes. Space Survey may send precise latitude and longitude, a selected 2/5/10/20 km radius, room width and depth, and true-north building and entrance bearings. Remote Candidate Screening may send each selected candidate's precise latitude and longitude, the selected radius, and the cemetery-site type code (single, family, or memorial). These requests exclude search text, place and candidate names, address text, people, charts, journals, project names, notes, photos, audio, advertising identifiers, and user or device identifiers.

Tianji's terrain service derives only the bounded grid or map area needed for the request, then queries OpenTopoData for elevation and OpenStreetMap Overpass for waterway and road evidence. Request-derived terrain results and public-provider responses may be cached for reliability and duplicate-request reduction for no longer than 24 hours, outside the public web root. Public providers may keep operational logs under their own policies. Precise location is not linked to an account and is not used for tracking, advertising, analytics, or product personalization.

Your choice before a connected transfer

Before the first use of each materially different AI transfer, terrain transfer, MapKit place search, or Apple map display, the app shows a versioned disclosure with no preselected choice. It lists the fields made available, fields excluded, route, named provider, processing and retention boundary, and a link to this policy. Canceling or dismissing the disclosure sends nothing and, for map display, keeps the Apple map uninstantiated. If you allow it, the app remembers that permission only for the same disclosure version.

You can revoke all saved connected-feature permissions under More → Privacy and data → Reset connected-feature permissions. Revoking immediately unloads any displayed Apple map, and the affected feature will ask again before its next transfer or map display. Revoking permission does not delete a request already processed by a provider; contact privacy support below for deletion help.

房间布局数据只在本机

房间布局的相机画面、实时 AR 帧、场景网格和原始 RoomPlan 模型只在设备上处理，不会持久化、上传、发送给 AI 或地形服务，也不会包含在普通布局分享中。未完成的快捷布局不是已保存项目。为应对中断或重新打开 App，App 会在私有 Application Support 目录自动保留最多一份编码后的本机恢复草稿，上限为 1 MB（1,048,576 字节）。将布局保存到空间项目、明确丢弃草稿，或由较新的草稿替换时，这份恢复副本会被清除或替换；恢复草稿绝不会上传。只有你明确保存到空间项目时，App 才在本机保留参数化房间几何、复核尺寸、连接关系、计算结果和布局方案。全屋 USDZ 只会在你主动要求导出时生成。

标注门或窗后，你可以为这个门窗附加最多 6 项照片或短视频；视频最长 60 秒，并保存在 App 的本机受保护目录。它们不会发送给 AI、写入日志或分析，也不会进入普通平面图分享。之后可以继续补充或删除，只有你主动分享时才会离开设备。

独立、选用的“家具 3D 扫描”会在捕获或重建期间，把多角度源照片临时保存在 App 本机私有目录；生成精简 USDZ 后即删除源照片。USDZ 与经复核的碰撞尺寸会保留到你删除该资产或所属项目，且只有你打开 iOS 分享面板后才会离开设备。

“空房规划”可以隐藏现有可移动家具，但门窗、固定设施、结构障碍和主要通道仍会保留为布局约束。默认分享不包含房间平面几何，只包含所选家具、朝向与文字建议。

本机记录与选填地图分析

出生信息、计算出的命盘与黄历、罗盘读数、已保存的现场项目、备注、日记、照片、录音、复测结果、生成的 PDF 和“风水地图”最近地点，除非你明确使用已说明的联网功能或 iOS 分享面板，否则只保存在当前设备。

“风水地图”可以使用搜索结果、你在地图上选择的点，或你点击当前位置控件后取得的当前位置。在创建任何 Apple 地图实例前，App 会另行请求带版本的地图展示许可。允许后，Apple MapKit 可能依据 Apple 的隐私规则接收地图请求时间，设备、软件、配置和输入语言信息，可见地图区域的边界，以及与地图的交互；可见范围可能反映你在本机保存或选定的坐标。天机不会接收这类地图展示流量。该许可与 MapKit 地点搜索许可、天机地形分析许可彼此独立。选点或移动地图本身不会调用天机地形服务。

你接受单独披露后，“风水地图”会发送所选点的精确经纬度、固定 2 公里半径，以及住宅、商铺、墓地三个用途代码；空间勘察可能发送精确经纬度、所选 2／5／10／20 公里半径、房间宽深和建筑/入口真北方向；远程候选点初筛可能发送各候选点精确经纬度、所选半径和墓地类型代码（single、family 或 memorial）。这些请求不包含搜索词、地点或候选点名称、地址文字、人物、命盘、日记、项目名、备注、照片、录音、广告标识或用户/设备标识。

天机地形服务只推导本次请求需要的有限坐标网格或地图范围，再向 OpenTopoData 查询高程、向 OpenStreetMap Overpass 查询水系和道路证据。为提高可靠性并减少重复请求，由请求生成的地形结果和公开数据源响应最多缓存 24 小时，且缓存位于公开 Web 根目录之外；公开数据服务可能按其自身政策保留运行日志。精确位置不与账号关联，也不用于追踪、广告、分析或产品个性化。

联网传输前由你决定

每一类实质不同的 AI 传输、地形传输、MapKit 地点搜索或 Apple 地图展示首次使用前，App 都会显示带版本的披露，且不会预选同意。页面会列明可能提供的字段、排除字段、路径、具体服务商、处理和保留边界，以及本政策链接。取消或关闭披露不会发送任何数据；对于地图展示，也不会创建 Apple 地图实例。允许后，App 只会为同一披露版本记住该许可。

你可以在“更多 → 隐私与数据 → 重置联网功能许可”撤回全部已保存许可。撤回会立即卸载正在展示的 Apple 地图，相关功能下次传输或地图展示前会再次询问。撤回不会删除服务商已经处理的请求；如需删除帮助，请联系下方隐私支持。