1. 适用范围 / Scope
本政策说明 RBooks 公共阅读页面、本地 EPUB 阅读器，以及未来启用的云端个人书库如何处理数据。用户上传的 EPUB 不会进入公共书架、公共搜索或 sitemap。
This policy explains data handling for public RBooks pages, the local EPUB reader, and the private cloud library when enabled. User EPUB files are never placed on the public shelf, public search, or public sitemaps.
2. 公共页面 / Public pages
大多数公共书架和公版阅读页面可能使用 Google Analytics 了解汇总访问情况。RBooks 不要求用户为阅读公共图书创建账户。
Most public shelf and public-domain reader pages may use Google Analytics for aggregate usage measurement. An account is not required to read public books.
3. 本地 EPUB 模式 / Local EPUB mode
/my-library/ 的本地模式在浏览器内解析 EPUB。文件不会上传到 RBooks。用户选择“保存到此浏览器”后，EPUB、元数据和阅读位置保存在当前浏览器的 IndexedDB。清理网站数据会删除这些内容，其他设备无法访问。
The local mode parses EPUB files inside the browser. Files are not uploaded to RBooks. If the user saves a book locally, the EPUB, metadata, and reading position are stored in that browser's IndexedDB. Clearing site data removes them, and other devices cannot access them.
本地 EPUB 页面关闭 Google Analytics，并通过响应头阻止 Cloudflare Web Analytics 注入。Local EPUB pages disable Google Analytics and use response headers that prevent Cloudflare Web Analytics injection.
4. 云端个人书库 / Private cloud library
云端书库当前尚未对公众启用。启用后，只有用户明确登录并选择云端保存时，RBooks 才会接收 EPUB。
The cloud library is not currently enabled for the public. Once enabled, RBooks receives an EPUB only after the user signs in and explicitly chooses cloud storage.
Google 登录可能向 RBooks 提供 Google subject、已验证邮箱和显示名称。RBooks 不保存 Google 密码、access token 或 refresh token。RBooks 使用自己的不透明 session Cookie，数据库只保存 session token 的 SHA-256。
Google sign-in may provide a Google subject, verified email, and display name. RBooks does not store Google passwords, access tokens, or refresh tokens. RBooks uses its own opaque session cookie and stores only the SHA-256 hash of the session token.
5. 云端存储数据 / Cloud-stored data
私有 R2 bucket 保存 EPUB 原文件。D1 保存账户、身份映射、图书元数据、文件大小、SHA-256、私有对象 key、阅读进度、书签和上传审计。私有文件只能在验证 session 与所有权后读取。
A private R2 bucket stores original EPUB files. D1 stores accounts, identity mappings, book metadata, size, SHA-256, private object keys, reading progress, bookmarks, and upload audit events. Private files are returned only after session and ownership checks.
6. 安全与限制 / Security and limits
写操作要求同源 Origin 与 session 级 CSRF token。默认单文件上限为 50 MB，默认账户配额为 250 MB，每用户每小时最多 20 次上传尝试。服务端检查 ZIP 路径穿越、加密、ZIP64、异常压缩比、解压体积与标准 EPUB 文件。
Mutations require a same-origin request and a session-specific CSRF token. Default limits are 50 MB per file, 250 MB per account, and 20 upload attempts per user per hour. Server validation checks ZIP traversal, encryption, ZIP64, compression ratios, expanded size, and required EPUB files.
7. 导出、删除与保留 / Export, deletion, and retention
启用后，用户可导出账户元数据、图书列表、进度、书签和身份提供方信息。导出不包含 session hash、OAuth token、内部 R2 key 或 EPUB 文件内容；EPUB 可通过已认证下载接口单独取得。
Users can delete individual books or delete the entire account. Full account deletion first removes private R2 objects and then deletes the D1 user row, which cascades to sessions, identities, progress, bookmarks, and audit rows. Emergency feature rollback disables access without automatically deleting stored user data.
8. 公开与分享 / Public sharing
首版云端书库不提供公开分享、公共下载链接、排行榜或搜索索引。用户文件默认且始终为私有。
The initial cloud library provides no public sharing, public download links, rankings, or search indexing. User files remain private by default and by design.
9. 政策更新 / Changes
如果数据类型、身份提供方、分享能力或保留策略发生实质变化，RBooks 会更新本页的生效日期和说明。
If data categories, identity providers, sharing capabilities, or retention practices materially change, RBooks will update this page and its effective date.
10. 联系 / Contact
隐私或账户删除问题可通过 RBooks 项目主页所列的维护渠道提出。Privacy or account-deletion questions may be raised through the maintenance channel listed by the RBooks project.