From e3a04858b4488726f859d850f9f87a8360697709 Mon Sep 17 00:00:00 2001
From: DrSmoothl <1787882683@qq.com>
Date: Fri, 19 Jun 2026 01:14:55 +0800
Subject: [PATCH] add EULA

---
 EULA.md    |  90 ++++++++++++++++++++++++++++++++
 PRIVACY.md | 149 +++++++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 239 insertions(+)
 create mode 100644 EULA.md
 create mode 100644 PRIVACY.md

diff --git a/EULA.md b/EULA.md
new file mode 100644
index 00000000..1e74fb72
--- /dev/null
+++ b/EULA.md
@@ -0,0 +1,90 @@
+# SnowLuma 最终用户许可协议（EULA）/ End-User License Agreement
+
+- **生效日期 / Effective date:** 2026-06-19
+- **版本 / Version:** 1.0
+- **许可方 / Licensor:** SnowLumaDevs（联系方式 / Contact: motricseven@foxmail.com）
+
+> 本协议以中文与英文两种语言提供。如两版本有冲突，**以中文版本为准**。
+> This Agreement is provided in Chinese and English. **In case of any conflict, the Chinese version prevails.**
+
+---
+
+## 中文版
+
+### 1. 定义与接受
+1.1 "**本软件**"指 SnowLuma 软件及其官方发行包，包括可执行文件、原生模块（`snowluma-*.node`）、文档及相关组件。
+1.2 "**您**"指下载、安装、运行或以其他方式使用本软件的个人或实体。
+1.3 下载、安装、运行或使用本软件，即表示您已阅读、理解并同意受本协议约束。**若您不同意本协议，请勿使用本软件并删除其全部副本。**
+
+### 2. 授权范围
+2.1 本软件的**源代码**依据 GNU Affero General Public License 第 3 版（AGPL-3.0）及其第 7 条附加许可（原生模块链接例外）授权，详见随附的 `LICENSE` 文件。
+2.2 本协议是针对**发行包（二进制）**的补充条款，就 AGPL 未涵盖之事项（接受方式、可接受使用、免责、专有组件、争议解决等）作出约定。
+2.3 **本协议不减损 AGPL 授予您的任何权利。** 对于您依 AGPL 单独获取、使用、修改或分发源代码的行为，本协议不附加任何限制。
+2.4 专有组件（见第 5 条）不属于 AGPL 授权范围，依其各自条款授权。
+
+### 3. 免责声明
+3.1 **非官方、无隶属**：本软件是独立的第三方互操作性项目，与腾讯公司（Tencent）及 QQ **无任何隶属、合作、授权或背书关系**。"QQ""腾讯"等名称及标识为其各自所有者的商标。
+3.2 **用途**：本软件**仅供学习、研究与技术互操作之目的**提供。
+3.3 **合规义务**：您须自行确保对本软件的使用符合一切适用法律法规，以及您所接入平台的规定（包括但不限于《QQ 用户协议》与相关服务条款）。
+3.4 **按"现状"提供**：本软件按"**现状（AS-IS）**"及"**现有（AS-AVAILABLE）**"提供，不附带任何明示或默示的担保，包括但不限于对适销性、特定用途适用性、不侵权、可用性、准确性或不中断的担保。
+3.5 **责任限制**：在适用法律允许的最大范围内，对于因使用或无法使用本软件而导致的任何直接、间接、偶然、特殊、惩罚性或后果性损害（包括但不限于账号封禁或限制、数据丢失、利润或业务损失、服务中断），SnowLumaDevs **概不承担责任**。
+3.6 **风险自负**：您理解，使用非官方协议工具接入第三方平台**可能违反该平台条款并导致账号风险**，您**自愿承担**该等风险。
+
+### 4. 可接受使用
+您**不得**将本软件用于：(a) 任何违法犯罪活动；(b) 未经授权访问、干扰或破坏任何系统或网络；(c) 发送垃圾信息、实施骚扰、欺诈或传播恶意内容；(d) 侵犯他人隐私、知识产权或其他合法权益；(e) 任何违反所接入平台服务条款的行为。
+
+### 5. 专有组件
+5.1 本软件可能包含或依赖**非开源的专有组件**，包括但不限于 **SnowLuma 原生模块**（`snowluma-*.node`），以及其中可能包含的任何授权、激活或技术保护措施。
+5.2 此类专有组件的**源代码不依 AGPL 提供**，受本条款约束。
+5.3 除适用法律强制性规定明确允许外，您不得对专有组件进行逆向工程、反编译或反汇编，亦不得规避、破解或绕过其授权或激活机制。
+5.4 `LICENSE` 第 7 条的链接例外仅允许将本软件与该原生模块**组合并分发**，**并不**向您授予该原生模块本身的源代码权利。
+
+### 6. 终止
+若您违反本协议任何条款，本协议项下授予您的权利（**不含**您依 AGPL 单独享有的权利）将自动终止。终止后，您应停止使用并删除发行包中的专有组件。
+
+### 7. 适用法律与争议解决
+本协议的订立、效力、解释、履行及争议解决，均适用**中华人民共和国大陆地区法律**（不含其冲突法规则）。因本协议引起或与之相关的任何争议，双方应首先友好协商解决；协商不成的，任何一方可向**有管辖权的人民法院**提起诉讼。
+
+### 8. 协议的变更
+SnowLumaDevs 可不时更新本协议。更新后的版本将随发行包发布并注明生效日期。在更新生效后继续使用本软件，即视为您接受更新后的条款。
+
+---
+
+## English Version
+
+### 1. Definitions and Acceptance
+1.1 "**Software**" means the SnowLuma software and its official distribution packages, including executables, native modules (`snowluma-*.node`), documentation, and related components.
+1.2 "**You**" means the individual or entity that downloads, installs, runs, or otherwise uses the Software.
+1.3 By downloading, installing, running, or using the Software, you acknowledge that you have read, understood, and agree to be bound by this Agreement. **If you do not agree, do not use the Software and delete all copies.**
+
+### 2. Scope of License
+2.1 The **source code** of the Software is licensed under the GNU Affero General Public License version 3 (AGPL-3.0) together with its Section 7 additional permission (the native-addon linking exception); see the accompanying `LICENSE` file.
+2.2 This Agreement provides **supplemental terms for the binary distribution packages**, addressing matters not covered by the AGPL (acceptance, acceptable use, disclaimers, proprietary components, dispute resolution).
+2.3 **This Agreement does not diminish any rights granted to you under the AGPL.** It imposes no additional restriction on your acquisition, use, modification, or distribution of the source code under the AGPL.
+2.4 Proprietary Components (Section 5) are outside the scope of the AGPL and are licensed under their own terms.
+
+### 3. Disclaimers
+3.1 **Not official; no affiliation.** The Software is an independent, third-party interoperability project and has **no affiliation, partnership, authorization, or endorsement relationship** with Tencent or QQ. "QQ", "Tencent", and related marks belong to their respective owners.
+3.2 **Purpose.** The Software is provided **solely for learning, research, and technical interoperability**.
+3.3 **Compliance.** You are responsible for ensuring that your use complies with all applicable laws and with the terms of any platform you connect to (including the QQ User Agreement and related terms of service).
+3.4 **AS-IS.** The Software is provided "**AS IS**" and "**AS AVAILABLE**", without warranties of any kind, express or implied, including merchantability, fitness for a particular purpose, non-infringement, availability, accuracy, or uninterrupted operation.
+3.5 **Limitation of liability.** To the maximum extent permitted by law, SnowLumaDevs shall **not be liable** for any direct, indirect, incidental, special, punitive, or consequential damages (including account suspension or restriction, data loss, lost profits or business, or service interruption) arising from use of or inability to use the Software.
+3.6 **Assumption of risk.** You understand that using an unofficial protocol tool to connect to a third-party platform **may violate that platform's terms and carry account risk**, which you **voluntarily assume**.
+
+### 4. Acceptable Use
+You shall **not** use the Software for: (a) any unlawful activity; (b) unauthorized access to, interference with, or disruption of any system or network; (c) spam, harassment, fraud, or malicious content; (d) infringement of others' privacy, intellectual-property, or other lawful rights; or (e) any conduct that violates the terms of service of a connected platform.
+
+### 5. Proprietary Components
+5.1 The Software may include or depend on **non-free proprietary components**, including but not limited to the **SnowLuma native addon** (`snowluma-*.node`) and any licensing, activation, or technical-protection measures it may contain.
+5.2 The **source code of such components is not provided under the AGPL** and is governed by these terms.
+5.3 Except to the extent expressly permitted by mandatory applicable law, you may not reverse engineer, decompile, or disassemble the Proprietary Components, nor circumvent, crack, or bypass their licensing or activation mechanisms.
+5.4 The Section 7 linking exception in `LICENSE` permits only the **combination and distribution** of the Software with the SnowLuma native addon; it does **not** grant you rights to that addon's own source code.
+
+### 6. Termination
+If you breach any term of this Agreement, the rights granted to you hereunder (**excluding** rights you hold separately under the AGPL) terminate automatically. Upon termination you must cease use of and delete the Proprietary Components from the distribution package.
+
+### 7. Governing Law and Disputes
+This Agreement is governed by the laws of the **mainland of the People's Republic of China** (excluding its conflict-of-laws rules). Any dispute arising out of or relating to this Agreement shall first be resolved through good-faith negotiation; failing that, either party may bring an action before a **court of competent jurisdiction**.
+
+### 8. Changes
+SnowLumaDevs may update this Agreement from time to time. Updated versions will be published with the distribution package and bear an effective date. Continued use after an update takes effect constitutes acceptance of the updated terms.
diff --git a/PRIVACY.md b/PRIVACY.md
new file mode 100644
index 00000000..ba0fd87f
--- /dev/null
+++ b/PRIVACY.md
@@ -0,0 +1,149 @@
+# SnowLuma 隐私与数据处理说明 / Privacy & Data Handling Notice
+
+- **生效日期 / Effective date:** 2026-06-19
+- **版本 / Version:** 1.0
+- **责任主体 / Provider:** SnowLumaDevs（联系方式 / Contact: motricseven@foxmail.com）
+
+> 本说明以中文与英文两种语言提供。如有冲突，**以中文版本为准**。
+> Provided in Chinese and English. **In case of conflict, the Chinese version prevails.**
+
+---
+
+## 中文版
+
+### 1. 概述
+SnowLuma 是一款**自托管**软件：它运行在**您自己的设备或服务器**上。**SnowLumaDevs（作者方）默认不收集、不接收、不存储您的任何个人数据**。本软件**不包含**任何需要联网激活、或向作者方回传信息的授权机制。
+本说明唯一例外的数据外发情形，是第 4、5 条所述的两种，且其中遥测受严格限制（第 5 条）。
+
+### 2. 本软件在您设备上存储的数据
+为实现功能，本软件会在您的设备本地（如 SQLite 数据库、配置与日志文件）存储以下类别的数据。**这些数据保存在您本地、由您掌控，作者方无法访问：**
+- **账号与登录凭据**：所登录的 QQ 账号信息、会话/令牌、WebUI 登录口令（以**加盐 scrypt 哈希**形式存储，不保存明文）。
+- **关系数据**：好友、群组及成员的列表与资料。
+- **消息数据**：为实现协议转换而处理或缓存的消息（视您的配置而定）。
+- **运行配置与日志**：适配器配置、运行日志等。
+
+> 说明：因 SnowLuma 是 QQ 协议工具，上述本地数据**必然**包含 QQ 账号及联系人信息。这与第 5 条"遥测绝不采集 QQ 账号/联系人"并不矛盾——本地存储 ≠ 对外传输。
+
+### 3. 您作为数据控制者的责任
+当您运行本软件处理您 QQ 联系人、群成员等他人的个人信息时，**您是该等个人信息的"数据控制者/处理者"**，须自行就该等处理承担合规责任（包括取得必要同意、保障安全、响应数据主体请求等）。作者方仅提供软件工具，不参与您的数据处理活动。
+
+### 4. 数据离开您设备的唯一途径
+除以下两种情形外，本软件不会将您的数据传输至任何外部目的地：
+1. **您自行配置的通知 / Webhook**：当您主动配置通知渠道（如 Webhook）时，相应内容会按**您填写的地址与设置**外发。目的地与内容由您完全掌控，作者方不经手。
+2. **匿名遥测**：见第 5 条。
+
+### 5. 遥测（Telemetry）
+**模式：默认开启（opt-out）。** 您可随时关闭（见 5.3）。
+
+#### 5.1 采集内容（仅匿名、聚合，无法定位到个人）
+- 应用版本、操作系统与 CPU 架构、Node.js 版本；
+- 启动次数、功能使用计数（例如启用了哪些适配器/命令，**不含其参数或内容**）；
+- 匿名化的崩溃栈与错误类型。
+
+#### 5.2 绝不采集（显式负面清单）
+本遥测**在任何情况下都不会**采集或传输：
+- **QQ 账号 / UIN，及好友、群、成员的身份信息**；
+- **消息内容或其元数据**、昵称、头像；
+- 手机号、邮箱或任何联系方式；
+- 凭据、令牌、密码；
+- 用于身份画像的精确 IP 地址（若服务端在传输层偶然可见 IP，将即时丢弃、不入库、不进行关联）；
+- 任何可直接或间接定位到自然人的标识。
+
+#### 5.3 如何关闭与告知
+- **首次运行提示**：软件首次运行时会在控制台与 WebUI 一次性告知遥测已默认开启及关闭方式。
+- **一键关闭**：可通过环境变量 `SNOWLUMA_TELEMETRY=0`、配置项或 WebUI 开关随时关闭，关闭后即刻停止采集。
+
+#### 5.4 用途、共享与保留
+遥测数据**仅用于改进本软件**，**不向任何第三方出售或共享**，仅以匿名聚合形式保留必要期限。
+
+#### 5.5 生效状态（重要）
+本条款完整描述了 SnowLuma 的遥测机制，但**仅对实际包含遥测代码的发行版生效**。
+> **当前生效状态（截至 2026-06-17）**：公开发行版**尚未包含**遥测代码，故本条款目前**处于未生效状态**。一旦某一发行版引入遥测，将在该版本的发布说明中明确告知，并使本条款对该版本生效。
+
+### 6. 数据安全与保留
+本地数据的安全与保留由您（运营者）控制。建议您妥善保护设备访问权限、定期更新 WebUI 口令。
+
+### 7. 第三方组件
+本软件可能捆绑第三方组件（如用于音视频处理的 FFmpeg）。此类组件**在您本地运行**、用于处理本地数据，**不向作者方或第三方外发**数据。
+
+### 8. 未成年人
+本软件面向开发者与技术用户，**不面向未成年人**，作者方不会有意收集未成年人信息。
+
+### 9. 您的权利
+由于作者方默认不持有您的任何个人数据，与您个人信息相关的访问、更正、删除等权利，应在**您本地的数据范围内**由您自行行使。如遥测启用且您有疑问，可通过第 10 条联系我们。
+
+### 10. 联系方式
+隐私相关问询：**motricseven@foxmail.com**。
+
+### 11. 变更
+本说明可不时更新，更新版本将注明生效日期。涉及遥测的重大变更将在发布说明中显著告知。
+
+---
+
+## English Version
+
+### 1. Overview
+SnowLuma is **self-hosted**: it runs on **your own device or server**. **By default, SnowLumaDevs (the authors) collect, receive, and store none of your data.** The Software contains **no** activation that requires network access or transmits information back to the authors. The only data that ever leaves your device is described in Sections 4 and 5, and telemetry is strictly limited (Section 5).
+
+### 2. Data the Software Stores on Your Device
+To function, the Software stores the following categories of data locally (e.g., in a SQLite database, configuration, and log files). **This data stays on your device under your control; the authors cannot access it:**
+- **Account & credentials:** the signed-in QQ account, session/tokens, and the WebUI login password (stored as a **salted scrypt hash**, never in plaintext).
+- **Relationship data:** lists and profiles of friends, groups, and members.
+- **Message data:** messages processed or cached for protocol conversion (depending on your configuration).
+- **Runtime configuration & logs.**
+
+> Note: Because SnowLuma is a QQ protocol tool, this local data **necessarily** includes QQ account and contact information. This does not conflict with Section 5 ("telemetry never collects QQ account/contacts") — local storage ≠ outbound transmission.
+
+### 3. You Are the Data Controller
+When you run the Software to process the personal information of your QQ contacts, group members, or other individuals, **you are the data controller/processor** for that information and are responsible for compliance (obtaining any necessary consent, securing the data, responding to data-subject requests). The authors merely provide a software tool and take no part in your processing.
+
+### 4. The Only Ways Data Leaves Your Device
+The Software transmits your data to an external destination only in these two cases:
+1. **Notifications / webhooks you configure:** when you set up a notification channel (e.g., a webhook), the relevant content is sent to **the address and settings you provide**. You fully control the destination and content; the authors are not involved.
+2. **Anonymous telemetry:** see Section 5.
+
+### 5. Telemetry
+**Mode: ON by default (opt-out).** You can disable it at any time (see 5.3).
+
+#### 5.1 What is collected (anonymous, aggregate, non-identifying only)
+- Application version, OS and CPU architecture, Node.js version;
+- Launch counts and feature-usage counts (e.g., which adapters/commands are enabled — **never their arguments or content**);
+- Anonymized crash stacks and error types.
+
+#### 5.2 Never collected (explicit negative list)
+Telemetry will **never, under any circumstances**, collect or transmit:
+- **QQ account / UIN, or the identity of any friend, group, or member**;
+- **Message content or metadata**, nicknames, avatars;
+- Phone numbers, emails, or any contact details;
+- Credentials, tokens, passwords;
+- Precise IP addresses used for profiling (any IP incidentally visible at the transport layer is discarded immediately, not stored, not correlated);
+- Any identifier that could directly or indirectly identify a natural person.
+
+#### 5.3 How to disable; notice
+- **First-run notice:** on first run the Software gives a one-time notice in the console and WebUI that telemetry is on by default and how to disable it.
+- **One switch off:** disable any time via the `SNOWLUMA_TELEMETRY=0` environment variable, a config option, or the WebUI toggle; collection stops immediately.
+
+#### 5.4 Use, sharing, retention
+Telemetry is used **only to improve the Software**, is **never sold or shared with any third party**, and is retained only in anonymous aggregate form for as long as necessary.
+
+#### 5.5 Effective status (important)
+This Section fully describes SnowLuma's telemetry mechanism but is **effective only for builds that actually contain telemetry code.**
+> **Current status (as of 2026-06-17):** public releases **do not yet contain** telemetry code, so this Section is currently **not in effect**. If a release introduces telemetry, its release notes will say so and this Section will take effect for that release.
+
+### 6. Security & Retention
+Security and retention of local data are under your (the operator's) control. Protect device access and rotate the WebUI password regularly.
+
+### 7. Third-Party Components
+The Software may bundle third-party components (such as FFmpeg for media processing). These run **locally** on your device to process local data and **send nothing** to the authors or third parties.
+
+### 8. Minors
+The Software targets developers and technical users, is **not directed to minors**, and the authors do not knowingly collect minors' information.
+
+### 9. Your Rights
+Because the authors hold none of your personal data by default, rights of access, correction, and deletion are exercised by you **over the data on your own device**. If telemetry is enabled and you have questions, contact us (Section 10).
+
+### 10. Contact
+Privacy inquiries: **motricseven@foxmail.com**.
+
+### 11. Changes
+This Notice may be updated from time to time; updated versions bear an effective date. Material changes affecting telemetry will be prominently noted in release notes.