中文
梗仓 MemeVault(下称「本扩展」)是一个第三方 Chrome 扩展,与哔哩哔哩(bilibili.com)无任何官方关联。本扩展高度重视你的隐私,设计上「本地优先」:你的收藏默认只存在你自己的浏览器里,只有你主动开启的功能才会让数据离开设备。
我们存储什么、存在哪里
- 你收藏的评论:仅当你在 B 站评论区主动点击「⭐ 收藏」时,本扩展才把该条评论的文本、所在视频标题/链接、UP 主、点赞数、你添加的标签,以及(分析后的)AI 结果,保存在你本机浏览器的 IndexedDB 中。
- 你的设置:若你选择自带 Key,DeepSeek API Key 及自动检测到的模型名保存在本扩展自身 origin 的私有 IndexedDB 中;B 站页面上的内容脚本无法直接读取。
- 设备标识与 Pro 激活状态:商业版会在首次需要时生成一个本机随机设备标识(一串随机 UUID,与你的身份、账号、收藏内容无关),用于免费额度计数、Pro 设备绑定,以及你主动选择附带的故障诊断。若你购买并激活 Pro,激活码与我们服务端签发的授权令牌也会保存在本扩展自身 origin 的私有 IndexedDB 中。解绑会清除本机激活码和令牌;卸载扩展或清除扩展数据会清除全部本地数据。
以上数据默认只存在你的本地浏览器,无需注册任何账号,卸载扩展即清除。只有你主动使用下面写明的「收藏夹云同步」或提交故障反馈时,相应数据才会离开设备。
什么数据会离开你的设备
1. AI 分析(你点「分析此梗 / 重新溯源 / 仿写」时)
本扩展会将该条评论的文本 + 该视频标题发送给 AI 模型(DeepSeek)进行分析:
- 免费通道(默认):请求经我们运行的 Cloudflare Worker 代理转发给 DeepSeek。该代理仅记录用于排障的最小日志(请求 ID、状态码、耗时),以及匿名的聚合用量计数(哪类分析动作、成功与否、耗时),不记录评论内容,也不记录任何可识别你身份的信息。我们不持久化你的评论文本。
- 自带 Key 通道(BYOK):请求由你的浏览器直连 DeepSeek(api.deepseek.com),使用你自己的 Key。你的评论文本与 API Key 只存在你本机,绝不上传给我们。每次分析我们会额外收到一条不含内容与身份的计数(动作类型、成功与否),用于统计产品使用情况,该项不可关闭。
无论哪个通道,评论文本最终都会到达 DeepSeek 进行处理,适用 DeepSeek 的隐私政策。
2. 免费额度计数
使用免费通道时,请求会带上前述随机设备标识,仅用于统计「这台设备今天用了几次」以实施每日免费额度。该标识是随机生成的,不含任何身份信息,我们不会用它关联你的收藏内容,也不会用它跨站追踪你。
3. 购买与激活(仅当你购买 Pro)
支付由 Stripe 处理。我们的服务器不接触也不存储你的银行卡号、微信/支付宝账号等支付凭据,适用 Stripe 隐私政策。为便于你日后找回激活码,我们的服务器会保存结账时你在 Stripe 填写的邮箱与激活码的对应关系,以及该激活码已绑定的设备标识列表。这些信息仅用于售后找回与设备解绑,不用于营销,不对外提供。
4. 收藏夹云同步(仅 Pro,且仅当你手动点击「同步到云端」)
这是本扩展中唯一会把你的收藏内容留存在我们服务器上的功能。请仔细阅读:
- 会上传什么:你收藏的评论正文、所在视频的标题与链接、UP 主名、点赞数、你添加的标签与纠错提示。
- 不会上传什么:AI 分析结果(梗谱系、公式拆解、模版)不上传。换设备后重新点一次分析即可。
- 删除记录:为了让你在一台设备上删掉的收藏也能在另一台消失,同步包里会带一条删除标记(只有被删条目的编号和删除时间,不含评论内容)。它会在 180 天后自动过期。
- 存在哪、怎么关联:数据以你激活码的指纹为键存放,不与你的邮箱或任何身份信息关联。我们的服务器对它不做解析、不建索引、不写入日志——对服务端而言它就是一段不透明的数据。
- 加密说明(请注意):当前版本以明文形式存储。我们不会去读取它,但我们不会声称这是"端到端加密"或"我们看不到"——那样的说法在当前实现下站不住脚。我们宁可如实告诉你。
- 绝不自动同步:不点那个按钮,你的收藏内容就永远不会离开你的设备。本地始终是主数据。
- 你随时可以删除:设置页的「删除云端副本」会立即删掉服务器上那一份,本机收藏不受任何影响。此外,超过 400 天未同步的云端副本会被自动清除。
5. 故障反馈(仅当你主动提交)
点击「报 Bug」时,扩展会先在本机展示一段诊断信息,包括随机设备标识、请求编号、扩展版本与构建号、AI 通道与模型、浏览器/系统信息和时间,以及最近 20 条 AI 请求的白名单事件(阶段、结果类别、耗时、状态码、请求编号、结束原因与输出 token 数)。这些事件只存在浏览器内存会话中,扩展重载/更新或浏览器重启后清空。不包含评论内容、prompt、响应正文、错误全文、API Key、激活码或授权令牌。扩展只会把这段文字复制到剪贴板并打开飞书表单;只有你将其粘贴并提交后,它才会发送给飞书并进入我们的反馈表。你也可以选择「不附带诊断,直接打开」。这些信息仅用于定位你报告的故障。
我们不做的事
- 除购买 Pro 时由 Stripe 收集、用于找回激活码的邮箱,以及你在反馈表中自愿填写的联系方式外,不收集你的姓名、账号等身份信息。
- 不使用第三方分析(如 Google Analytics),不投放广告;只在自有服务端保留匿名、不含内容与身份的聚合用量统计(两个通道均适用,不可关闭)。
- 不出售、不交换、不转让你的任何数据。
- 不批量抓取评论——只处理你逐条主动点击收藏的评论。
权限说明
本扩展申请的权限仅用于上述功能:sidePanel(收藏管理界面)、storage(存非敏感的界面状态)、对 bilibili.com 视频页的内容脚本访问(注入收藏按钮)、对我们代理域名的网络访问(AI 分析、额度、激活与云同步)。仅当你主动保存自带 Key 时,扩展才会请求对 api.deepseek.com 的可选访问权限;清除 Key 时会撤销该权限。
联系方式
如有隐私相关问题,请通过 privacy@mrcrabai.com 联系我们。
English
MemeVault is an independent Chrome extension and is not affiliated with or endorsed by Bilibili (bilibili.com). It is designed to be local-first: your saved comments live in your own browser by default, and data leaves your device only through features you actively turn on.
What we store, and where
- Comments you save: only when you click the "⭐ Save" button on a Bilibili comment do we store that comment's text, the video's title/URL, the uploader, like count, your tags, and (after analysis) the AI result — in your browser's local IndexedDB.
- Your settings: if you opt in to bring your own key, your DeepSeek API key and the automatically detected model name are stored in private IndexedDB under the extension's own origin; content scripts running on Bilibili pages cannot read them directly.
- Device identifier and Pro license state: the commercial build generates a random device identifier when first needed (a random UUID unrelated to your identity, any account, or your saved content). It is used for free-quota counting, Pro device binding, and diagnostics that you explicitly choose to attach to a bug report. If you purchase and activate Pro, your license key and the authorization token issued by our server are also stored in private IndexedDB under the extension's own origin. Deactivation removes the local license key and token; uninstalling the extension or clearing its data removes all local data.
By default all of the above stays only in your local browser, requires no account, and is removed when you uninstall. Relevant data leaves your device only when you actively use Vault sync or submit a bug report as described below.
What leaves your device
1. AI analysis (when you click "Analyze" / "Re-trace" / "Rewrite")
We send that single comment's text + the video title to an AI model (DeepSeek):
- Free channel (default): the request is relayed to DeepSeek through a Cloudflare Worker proxy we operate. The proxy records only minimal troubleshooting logs (request ID, status code, latency) plus anonymous aggregate usage counts (which kind of analysis, success/failure, latency), and does not log comment content or any personally identifiable information. We do not persist your comment text.
- Bring-Your-Own-Key: the request goes directly from your browser to DeepSeek (api.deepseek.com) using your own key. Your comment text and API key are stored only on your device and are never uploaded to us. Every analysis additionally sends us a single content-free, identity-free count (action type, success/failure), used to measure product usage; this cannot be turned off.
In either channel the comment text ultimately reaches DeepSeek for processing, subject to DeepSeek's privacy policy.
2. Free-quota counting
When using the free channel, requests carry the random device identifier described above, solely to count "how many times this device has used the service today" and enforce the daily free quota. The identifier is randomly generated, contains no identity information, is never used to link to your saved content, and is never used to track you across sites.
3. Purchase and activation (only if you buy Pro)
Payment is handled by Stripe. Our servers never touch or store your card number, WeChat/Alipay account, or other payment credentials; Stripe's privacy policy applies. So that you can recover your license key later, our server stores the mapping between the email you entered at Stripe checkout and your license key, plus the list of device identifiers bound to that key. This is used only for support recovery and device deactivation — never for marketing, never shared.
4. Vault sync (Pro only, and only when you click "Sync to cloud")
This is the only feature that stores your saved content on our servers. Please read carefully:
- What is uploaded: the text of the comments you saved, the title and URL of the source video, the uploader's name, the like count, and the tags and correction hints you added.
- What is NOT uploaded: AI analysis results (meme lineage, formula breakdown, templates) are never uploaded. On a new device you simply run the analysis again.
- Where it lives, and how it is keyed: the data is stored under a fingerprint of your license key and is not linked to your email or any identity information. Our server does not parse it, index it, or write it to logs — to the server it is an opaque blob.
- About encryption (please note): the current version stores this data in plaintext. We do not read it, but we will not claim it is "end-to-end encrypted" or that "we cannot see it" — those claims would not hold for the current implementation, and we would rather tell you plainly.
- Never automatic: if you do not press that button, your saved content never leaves your device. Your local copy is always the source of truth.
- You can delete it at any time: "Delete cloud copy" in Settings immediately removes the server-side copy and does not affect your local data in any way. In addition, cloud copies untouched for more than 400 days are deleted automatically.
5. Bug reports (only when you explicitly submit one)
When you click "Report a problem with diagnostics," the extension first displays a diagnostic block locally. It contains the random device identifier, request ID, extension version and build, AI channel and model, browser/OS information, time, and the 20 most recent allow-listed AI request events (stage, result category, latency, status, request ID, finish reason, and output token count). These events live only in in-memory session storage and are cleared when the extension is reloaded or updated, or when the browser restarts. It does not contain comment text, prompts, response bodies, full error messages, your API key, license key, or authorization token. The extension only copies this text to your clipboard and opens a Feishu form; it is sent to Feishu and added to our feedback table only after you paste and submit it. You can instead choose "Open without diagnostics." We use this information only to investigate the problem you reported.
What we do not do
- Apart from the email collected by Stripe when you purchase Pro (used to recover your license key) and contact details you voluntarily enter in a feedback form, we do not collect your name, account, or other identity information.
- No third-party analytics (e.g. Google Analytics), no ads; we keep only anonymous, content-free and identity-free aggregate usage stats on our own server (applies to both channels, not optional).
- We do not sell, trade, or transfer your data to anyone.
- No bulk scraping — only the individual comments you actively click to save.
Permissions
Permissions are used solely for the features above: sidePanel (the management UI), storage (non-sensitive UI state), content-script access to bilibili.com video pages (to inject the save button), and network access to our proxy domain (AI analysis, quota, activation, and vault sync). Access to api.deepseek.com is optional and requested only when you explicitly save your own key; clearing that key removes the permission.
Contact
For privacy questions, contact us at privacy@mrcrabai.com.