Where To Study 隐私政策

一、账号与教务请求

你输入的学号和密码保存在操作系统的受保护凭据存储中。应用会在你主动获取课表、空教室或课程作业时，按下述用途通过 HTTPS 使用这些凭据。课表和空教室请求会发送到 jwglweixin.bupt.edu.cn；保存有效凭据且开启“自动检测当前学期”后，应用还会在启动时自动刷新一次个人课表，用于校验学期号和第一周周一。当天空教室还可能在启动、回到前台，或平台允许的每日约 07:00 后台任务中自动刷新。项目维护者无法读取这些凭据，设置接口也不会返回已保存的密码。

The account and password you enter are stored in the operating system's protected credential storage. The app uses them over HTTPS when you request schedules, empty classrooms, or assignments as described below. After valid credentials are saved and automatic term detection is enabled, the app also refreshes the personal schedule once at launch to verify the term identifier and first Monday. Schedule and classroom requests are sent to jwglweixin.bupt.edu.cn. The current day's classroom availability may additionally refresh at launch, on returning to the foreground, or around 07:00 where the platform permits background work. The maintainer cannot read these credentials, and settings APIs never return a saved password.

二、本地数据

个人课表、空教室结果、校区、学期和功能开关会缓存在设备上，以减少重复请求。收藏活动时，应用还会在设备上保存该日程的完整快照，使其在来源关闭、失败或删除条目后仍能显示；收藏不会上传或跨设备同步。受支持系统上的课程小组件只读取本地课表快照。你可以取消单条收藏，或在设置中使用“清除本地数据”删除应用保存的凭据、课表、空教室和节假日缓存、收藏、偏好设置及应用管理的提醒任务。

Schedules, classroom results, campus, term, and feature preferences are cached on your device to reduce repeated requests. Favoriting an event also stores its complete snapshot on that device so it remains visible if its source is disabled, unavailable, or removes the item; favorites are neither uploaded nor synchronized between devices. Course widgets on supported systems read only a local schedule snapshot. You can remove individual favorites or use “Clear local data” in Settings to remove saved credentials, schedule, classroom and holiday caches, favorites, preferences, and app-managed reminder tasks.

三、节假日数据

应用可能通过 unpkg 获取固定版本 holiday-calendar@1.3.3 中的中国法定节假日与调休数据；Android 在已获得日历权限时也可能读取系统提供的“中国节假日”日历。远程请求仅包含 CN 地区和年份，不包含凭据、课表或空教室数据。iOS 不会仅因日期名称像节日就将其标记为休息日，只有权威休息日数据才显示“休”。

The app may retrieve Chinese statutory holiday and transfer-workday data from the pinned holiday-calendar@1.3.3 dataset through unpkg. Android may also read the OS-provided “Chinese holidays” calendar when calendar permission has already been granted. Remote requests contain only the CN region and year, never credentials, schedules, or classroom data. On iOS, a festival-like date name alone does not mark a day as a rest day; only authoritative rest-day data does.

四、天气、黄历与公开活动

天气功能通过 UAPI 按所选校区对应的海淀或昌平行政区获取今日、明日天气，不读取 GPS 或精确位置。黄历功能通过 UAPI 获取基础农历信息，并可能通过 Timeless API 补充“宜/忌”。Contest DDL 的 GitHub Pages 主源提供学科竞赛、学术会议、期刊专题、夏令营、预推免和黑客松数据，主源不可用时可能访问 where-to-study.cn 上的固定 HTTPS 备用接口。校内竞赛通知由服务器脚本从学校内部网站的公开通知页提取整理，再由同域名下的固定 HTTPS API 提供。教学日历中的学科竞赛、学术会议、校内通知、夏令营和黑客松分别由对应开关控制；独立的“重要事件”查询页始终允许用户主动搜索这些公开数据，不包含课程作业或自定义日程。

Weather uses UAPI to request today and tomorrow for the Haidian or Changping administrative district associated with the selected campus; it does not read GPS or precise location. Almanac data comes from UAPI, with optional 宜/忌 advice from the Timeless API. Contest DDL's GitHub Pages source provides competitions, academic conferences, journal special issues, summer camps, pre-admission events, and hackathons, with a fixed HTTPS backup on where-to-study.cn when the primary source is unavailable. School competition notices are extracted and organized by a server-side script from public notice pages on the university's internal website, then exposed through a fixed HTTPS API on the same domain. Calendar display switches separately control competitions, conferences, school notices, summer camps, and hackathons. The user-opened Important Events query remains searchable independently and contains neither assignments nor custom-feed items.

班车查询通过固定接口 https://where-to-study.cn/api/shuttle-bus 获取北京邮电大学后勤部公开通知及官方时刻表的结构化结果。客户端只发送无凭据 HTTPS GET，不上传学号、密码、课表、校区选择、GPS 或其他个人数据；服务端可能按其政策处理 IP 地址、请求时间等普通网络元数据。自动识别结果仅供参考，节假日、停运和临时调整以后勤部原文为准。

Shuttle queries retrieve structured public Logistics Department notices and official timetables from the fixed https://where-to-study.cn/api/shuttle-bus endpoint. The client sends only a credential-free HTTPS GET; no student ID, password, schedule, campus selection, GPS, or other personal data is uploaded. The server may process ordinary network metadata such as IP address and request time under its own policy. Automatically structured results are for reference only; rely on the original Logistics Department notice for holidays, suspensions, and temporary changes.

你可以选择填写公开的 HTTPS JSON 地址作为自定义日程来源。应用不会向该地址附带教务凭据、Cookie、token、课表、教室或作业数据；地址不得含用户信息、片段、回环地址或私网 IP 字面量，客户端拒绝重定向并限制响应大小与请求频率。该服务器仍可能按照自己的政策处理 IP 地址、请求时间等普通网络元数据。接口格式与约束见自定义日程接口规范。

You may optionally provide a public HTTPS JSON URL as a custom schedule source. The app sends no academic credentials, cookies, tokens, schedules, classrooms, or assignments to that URL. URLs containing user information, fragments, loopback hosts, or private literal IP addresses are rejected; redirects, oversized responses, and excessive requests are also rejected. The server may still process ordinary network metadata such as IP address and request time under its own policy. See the custom schedule feed specification for the format and constraints.

五、云课堂作业

日期详情请求课程作业时，应用会从安全存储临时读取已保存的教务账号和密码，只将其通过 HTTPS 提交给 auth.bupt.edu.cn 完成统一认证，再用一次性票据换取仅存于内存的云课堂令牌，并从 apiucloud.bupt.edu.cn 读取课程与作业。应用不读取浏览器 Cookie 或 token，不向 ucloud.bupt.edu.cn 或 apiucloud.bupt.edu.cn 发送密码，也不把认证票据、Cookie、令牌或作业写入磁盘。跨日期查询结果最多在内存复用 10 分钟，并在切换账号或清除本地数据时失效。

When date details request assignments, the app temporarily reads saved credentials from protected storage and submits them only to auth.bupt.edu.cn over HTTPS for unified authentication. It exchanges the one-time ticket for an in-memory UCloud token and reads courses and assignments from apiucloud.bupt.edu.cn. The app does not read browser cookies or tokens, does not send the password to ucloud.bupt.edu.cn or apiucloud.bupt.edu.cn, and does not persist authentication tickets, cookies, tokens, or assignments. Cross-date results may be reused in memory for up to ten minutes and are invalidated when the account changes or local data is cleared.

六、系统日历、通知与小组件

只有在你主动操作并授予相应系统权限后，应用才会写入系统日历或安排本地课程摘要通知。应用仅管理带有 Where To Study 标记的日历事件；课程小组件只在支持该能力的平台提供。相关数据不会上传给项目维护者。

The app writes to the system calendar or schedules local course-summary notifications only after your action and the applicable system permission. It manages only calendar events marked by Where To Study, and course widgets are available only on platforms that support them. This data is not uploaded to the maintainer.

七、不收集的数据与第三方元数据

本项目只运营用于整理公开班车与活动数据的固定接口，不提供用户账户、云端同步、广告、分析或行为跟踪服务，也不收集 GPS 位置、联系人、广告标识符、诊断或使用行为。北邮服务、unpkg、UAPI、Timeless、GitHub Pages、Where To Study 固定公开接口和用户选择的自定义日程服务器可能依据各自政策处理 IP 地址、请求时间等普通网络元数据。

The project operates only fixed endpoints that organize public shuttle and event data. It provides no user accounts, cloud synchronization, advertising, analytics, or behavioral tracking and does not collect GPS location, contacts, advertising identifiers, diagnostics, or usage behavior. BUPT services, unpkg, UAPI, Timeless, GitHub Pages, the fixed public Where To Study endpoints, and a user-selected custom schedule server may process ordinary network metadata such as IP address and request time under their own policies.

八、保留与删除

凭据和缓存保留在你的设备上，直到被替换、在设置中清除或随卸载移除。清除本地数据不会删除北京邮电大学或其他第三方服务持有的记录。

Credentials and caches remain on your device until replaced, cleared in Settings, or removed with the app. Clearing local data does not delete records held by BUPT or other third-party services.

九、安全与联系

安全报告请遵循项目 SECURITY.md。隐私问题可在 GitHub Issues 中提交不含敏感信息的讨论。请勿在公开内容中提供账号、密码、令牌、个人课表或其他敏感数据。重大变更会在本仓库更新生效日期。

Follow the project's SECURITY.md for security reports. Privacy questions may be opened as a non-sensitive discussion in GitHub Issues. Never include accounts, passwords, tokens, personal schedules, or other sensitive data in public content. Material changes will be published in the repository with an updated effective date.