隐私政策
更新于 2026 年 11 月 6 日
这页写的是 FilmLook 实际怎么处理你的照片和数据。说法都按网站现在的代码来写，代码改了，这页会跟着改。
谁在运营
FilmLook 由一位独立开发者运营，没有公司主体。隐私问题和删除申请请写到：（联系地址尚未设置）。
照片怎么处理
- 只有你按下分析时，照片才会上传。
- 服务器先在内存里把照片转正、缩小到长边最多 2048 像素，存成去掉全部元数据（EXIF、位置、拍摄时间、相机序列号）的 JPEG。原图不写入磁盘。
- 这份缩小的副本会发给视觉模型服务做分析。网站目前用的是 Google 的 Gemini API。
- 为了让你不用重新上传就能生成卡片或切换语言，这份副本在服务器内存里最多留 30 分钟，重启即清空。
- 分析记录里会保存一张长边 320 像素的缩略图、照片的哈希值、文件名和分析文字，用来让同一张照片不必重复分析、生成分享卡片，以及评估分析质量。
- 照片本身只有在你给分析打分时勾选同意，才会以加密形式保存，用于改进 FilmLook。保存的是长边不超过 1600 像素、没有元数据的副本，总量有上限。默认不勾选。
Gemini 怎么使用你的照片
照片发出后，Google 按 Gemini API 附加服务条款 处理它。条款按付费与否区分：
FilmLook 目前使用 Gemini API 的免费层。按 Google 的条款，免费层提交的内容（包括图片）可能被 Google 用来改进其产品，并可能由人工审阅。请不要上传你不想被第三方看到的照片。
FilmLook 目前使用 Gemini API 的付费层。按 Google 的条款，付费层提交的内容不会被用来改进 Google 的产品，但 Google 会为滥用监测在有限时间内保留记录。
按 Google 的条款，免费层提交的内容（包括图片）可能被用来改进 Google 的产品并由人工审阅；付费层不会这样使用，但会为滥用监测在有限时间内保留记录。FilmLook 会在这里注明当前用的是哪一层。在注明之前，请按免费层的条款来考虑要不要上传。
FilmLook 不会把你的照片卖给任何人，也不会交给除视觉模型服务以外的第三方。
我们还记录什么
打分和标签
你打的分数、写的文字、选的照片标签，以及可选的拍摄和后期回答。打分时，原始文件里非识别性的拍摄参数也会一起记下：相机型号、镜头、曝光参数、拍摄时段（如“傍晚”）和后期软件类别。位置、日期和序列号从不读取。这些只用于评估和改进分析，不会发给模型服务。
浏览器 ID 和账号
第一次打开网站时，浏览器会生成一串随机 ID，存在你自己的浏览器里，用来记住你的评分和徽章。注册账号只需要昵称和密码，不需要邮箱或手机号。密码用 scrypt 加盐哈希保存。登录会话 180 天有效，服务器只存会话令牌的哈希。
用量和统计
- 每次调用模型服务，都会记下时间、模型、用的 token 数、估算费用、耗时和是否成功，用来控制成本和设置每日限额。记录里没有照片、提示词或模型回答。你的 ID 只以加密哈希出现；IP 地址只以每天更换的哈希出现，用于同一网络的每日上限。
- 产品统计只记事件名和时间（例如“访问”“完成分析”“生成卡片”），加上一个每月更换的 ID 哈希，用来统计每天和每月有多少人使用，不能跨月追踪同一个人。这些记录保存 400 天。
- 服务器的运行日志可能包含请求的技术信息，日志按大小轮换，总量约 20 MB，满了就覆盖旧的。
Cookie 和本地存储
FilmLook 不设置 Cookie。网站在你的浏览器本地存储里保存这几项：随机浏览器 ID、登录令牌（如果登录）、语言和深浅色选择，以及一个标记“本次访问已计数”的会话值。清除网站数据就会删除它们，之后浏览器 ID 会重新生成，和之前的记录不再关联。
网站目前没有广告，也没有任何第三方统计或广告脚本。如果将来加入广告（例如 Google AdSense），广告服务可能使用 Cookie。上线之前会更新本页，并在法律要求的地区先征得你的同意。
数据存在哪里、存多久
服务器位于新加坡的 Oracle Cloud。照片发给 Google 处理时，可能在你所在国家或地区以外的服务器上处理。
| 数据 | 保存多久 |
|---|
| 上传的原图 | 不保存 |
| 缩小后的照片副本（内存） | 最多 30 分钟 |
| 分析记录、缩略图、打分、标签 | 目前没有固定期限，直到你申请删除 |
| 你同意保存的照片 | 直到你申请删除 |
| 账号 | 直到你申请删除；登录会话 180 天 |
| 产品统计事件 | 400 天 |
| 模型用量记录 | 作为费用记录长期保存，不含个人身份 |
| 数据库备份 | 每晚一份，保留最近 14 份 |
删除和其他请求
想删除你的数据、取回同意保存的照片，或问任何隐私问题，请写到 （联系地址尚未设置）。有账号的话请写上昵称。没有账号时，FilmLook 无法判断哪些记录属于你，因为能关联它们的只有你浏览器里的随机 ID。删除会在 30 天内完成；已经存在的备份会在 14 天内随轮换消失。
这页的修改
处理方式变了，这页会先改，并更新顶部的日期。
回到 FilmLook
Privacy policy
Updated 6 November 2026
This page describes what FilmLook actually does with your photos and data, as the site's code does it today. When the code changes, this page changes with it.
Who runs FilmLook
FilmLook is run by an independent developer, not a company. Write to (contact address not yet set) with privacy questions or deletion requests.
How your photo is handled
- A photo is uploaded only when you tap analyse.
- In memory, the server turns it upright, shrinks it to at most 2048 pixels on the long edge and saves it as a JPEG with all metadata removed (EXIF, location, capture time, camera serial number). The original file is never written to disk.
- That smaller copy is sent to a vision model service for analysis. The site currently uses Google's Gemini API.
- So that you can make a card or switch language without uploading again, the copy stays in the server's memory for up to 30 minutes and is gone on a restart.
- Each analysis record keeps a thumbnail 320 pixels on the long edge, a hash of the photo, the file name and the analysis text. They let the same photo be answered without a second analysis, let cards be made, and let the quality of the analyses be checked.
- The photo itself is kept, encrypted, only if you tick the consent box when you rate an analysis, to help improve FilmLook. What is kept is a copy at most 1600 pixels on the long edge, without metadata, within a fixed storage limit. The box is unticked by default.
How Gemini uses your photo
Once sent, the photo is handled by Google under the Gemini API Additional Terms of Service, which treat paid and unpaid use differently:
FilmLook currently uses the Gemini API's free tier. Under Google's terms, content sent on the free tier, images included, may be used to improve Google's products and may be read by human reviewers. Do not upload a photo you would not want a third party to see.
FilmLook currently uses the Gemini API's paid tier. Under Google's terms, content sent on the paid tier is not used to improve Google's products; Google keeps logs for a limited time to detect abuse.
Under Google's terms, content sent on the free tier, images included, may be used to improve Google's products and may be read by human reviewers; content sent on the paid tier is not used that way, and Google keeps logs for a limited time to detect abuse. FilmLook will state here which tier it uses. Until it does, decide what to upload as if the free tier's terms apply.
FilmLook does not sell your photos and gives them to no third party other than the vision model service.
What else is recorded
Ratings and tags
The score you give, any text you write, the photo tags you choose and the optional answers about how you shot and edited. When you rate, non-identifying shooting settings from the original file are kept too: camera model, lens, exposure, the part of the day (such as "evening") and the kind of editing software. Location, date and serial numbers are never read. These are used only to evaluate and improve the analysis and are never sent to the model service.
Browser id and accounts
On your first visit your browser makes a random id, kept in your own browser, which remembers your ratings and badges. An account needs only a nickname and a password, no e-mail or phone number. Passwords are stored as salted scrypt hashes. A sign-in lasts 180 days, and the server keeps only a hash of the session token.
Usage and statistics
- Every call to the model service is logged with its time, model, token counts, estimated cost, duration and outcome, to control costs and enforce daily limits. The log holds no photo, prompt or model answer. Your id appears only as a keyed hash, and your IP address only as a hash that changes every day, used for the per-network daily cap.
- Product statistics record an event name and time (such as "visit", "analysis completed" or "card made") with a hash of your id that changes every month. That is enough to count people per day and per month, not to follow anyone from one month to the next. These records are kept for 400 days.
- The server's operating logs may hold technical details of requests. They rotate by size, about 20 MB in all, overwriting the oldest.
Cookies and local storage
FilmLook sets no cookies. It keeps these in your browser's local storage: the random browser id, a sign-in token if you sign in, your language and appearance choices, and a session value that marks the visit as counted. Clearing the site's data removes them; a new browser id is then made, with no link to the old records.
The site shows no advertising and loads no third-party analytics or advertising scripts. If advertising is added later (Google AdSense, for example), the advertising service may use cookies. Before that happens this page will be updated, and where the law requires it you will be asked for consent first.
Where data is kept, and for how long
The server is on Oracle Cloud in Singapore. When a photo is sent to Google, it may be processed on servers outside your country or region.
| Data | Kept for |
|---|
| The uploaded original | Not kept |
| The smaller copy (in memory) | Up to 30 minutes |
| Analysis records, thumbnails, ratings, tags | No fixed period yet; until you ask for deletion |
| Photos you agreed to give | Until you ask for deletion |
| Accounts | Until you ask for deletion; sign-ins last 180 days |
| Product statistics events | 400 days |
| Model usage records | Kept as cost records, with no personal identity |
| Database backups | One a night, the newest 14 kept |
Deletion and other requests
To have your data deleted, take back a photo you agreed to give, or ask anything about privacy, write to (contact address not yet set). If you have an account, include its nickname. Without an account FilmLook cannot tell which records are yours, because the only link is the random id in your browser. Deletion is done within 30 days; existing backups age out within 14 days.
Changes
If the handling changes, this page changes first and the date at the top is updated.
Back to FilmLook