Privacy Policy

隐私政策

SJTU jAccount 验证码助手（SJTU-Autologin）

最后更新：2026-07-03 Last updated: July 3, 2026

中文

1. 概述

SJTU jAccount 验证码助手（下称“本扩展”）是一款适用于 Microsoft Edge、Google Chrome 等 Chromium 浏览器的开源扩展，用于在 jaccount.sjtu.edu.cn 登录页于本机识别并填写验证码，并提供可选的自动登录功能。

核心隐私承诺： 所有处理均在你的浏览器内完成。扩展不会向开发者、第三方服务或任何外部服务器发送、上传或分享验证码、登录凭据或使用数据。

2. 本扩展处理的数据

数据类型 何时产生 用途 存储位置 是否上传
登录页验证码图片 打开 jAccount 登录页且页面显示验证码时 在本机识别验证码文本并回填输入框 仅短暂存在于内存，识别后即丢弃 否
jAccount 账号与密码 仅当你主动开启“自动登录”并选择加密保存到本机时 在 jAccount 登录页自动填充登录凭据 经 AES-GCM 加密后存于浏览器本地；加密密钥单独存于扩展的 IndexedDB 否
扩展设置 你切换自动填写或自动登录开关时 记住你的功能偏好 浏览器扩展本地存储 否

本扩展不收集浏览历史、Cookie、其它网站内容、设备标识、位置、个人通信、财务或健康信息，也不使用分析、广告或遥测服务。

3. 数据保护

  • 本地验证码识别：使用随扩展内置的 ONNX 模型和 WebAssembly 运行时，验证码图片不会离开浏览器。
  • 凭据加密存储：选择保存的账号密码会先经 AES-GCM 256 位加密，再写入浏览器本地存储。不可导出的加密密钥独立保存在扩展的 IndexedDB 中。
  • 来源校验：后台脚本校验消息来源。只有扩展自身页面可以保存或清除凭据，只有 jaccount.sjtu.edu.cn 上的扩展内容脚本可以获取解密后的凭据用于填写。
  • 无外部请求：扩展不请求外部服务、CDN 或第三方接口。模型和运行时均随扩展本地分发。

4. 数据保留与删除

  • 验证码图片仅在识别期间短暂存在于内存，识别后即被丢弃。
  • 保存的登录凭据保留在本机，直至你在扩展中点击“清除”、卸载扩展，或清除浏览器为本扩展保存的数据。

5. 数据共享与用途限制

本扩展不会出售、转让或分享用户数据，不会将数据用于与扩展单一用途无关的目的，也不会将数据用于广告、信用评估或放贷。由于这些数据不离开设备，开发者无法访问你的账号、密码或验证码。

6. 第三方组件

本扩展内置 ddddocr 验证码识别模型和 ONNX Runtime Web 推理运行时。它们随扩展分发并在本机运行，不会自行联网。许可证信息见仓库中的 第三方声明。

7. 儿童隐私

本扩展面向上海交通大学 jAccount 用户，不面向 13 岁以下儿童，也不会有意收集儿童的任何信息。

8. 政策变更

本政策如有更新，将在本页面和扩展开源仓库中发布，并同步更新页面顶部的“最后更新”日期。

9. 联系方式

如对本政策有疑问，请发送邮件至 admin@sj-tu.com。

Privacy Policy

1. Overview

SJTU jAccount Captcha Helper (“the Extension”) is an open-source extension for Microsoft Edge, Google Chrome, and other Chromium browsers. It recognizes and fills captchas locally on the jaccount.sjtu.edu.cn sign-in page and provides an optional auto-login feature.

Core privacy commitment: All processing occurs inside your browser. The Extension does not send, upload, or share captchas, login credentials, or usage data with the developer, third-party services, or any external server.

2. Data Handled by the Extension

Data When Purpose Storage Uploaded?
Login captcha image When a captcha appears on the jAccount sign-in page Recognize the captcha locally and fill the input Held briefly in memory and discarded after recognition No
jAccount username and password Only when you enable auto-login and choose to save them encrypted on your device Fill credentials on the jAccount sign-in page AES-GCM encrypted in browser-local extension storage; the key is stored separately in the Extension's IndexedDB No
Extension settings When you change the autofill or auto-login switches Remember your feature preferences Browser-local extension storage No

The Extension does not collect browsing history, cookies, content from other websites, device identifiers, location, personal communications, financial or health information. It does not use analytics, advertising, or telemetry services.

3. Data Protection

  • On-device captcha recognition: The bundled ONNX model and WebAssembly runtime process captcha images entirely inside the browser.
  • Encrypted credential storage: Saved credentials are encrypted at rest with AES-GCM 256-bit. The non-extractable key is stored separately in the Extension's IndexedDB.
  • Sender validation: The background process checks message origins. Only the Extension's own pages may save or clear credentials, and only its content script on jaccount.sjtu.edu.cn may retrieve decrypted credentials for filling.
  • No external requests: The Extension does not use external services, CDNs, or third-party APIs. Its model and runtime are distributed with the Extension.

4. Retention and Deletion

  • Captcha images exist in memory only during recognition and are then discarded.
  • Saved credentials remain on your device until you select “Clear” in the Extension, uninstall the Extension, or clear its browser storage.

5. Data Sharing and Purpose Limitations

The Extension does not sell, transfer, or share user data. It does not use data for purposes unrelated to its single purpose, for advertising, or to determine creditworthiness or lending eligibility. Because this data never leaves the device, the developer cannot access your username, password, or captchas.

6. Third-Party Components

The Extension bundles the ddddocr captcha model and ONNX Runtime Web for local inference. They run on-device and do not initiate network activity. License details are available in the third-party notices.

7. Children's Privacy

The Extension is intended for SJTU jAccount users, is not directed at children under 13, and does not knowingly collect information from children.

8. Changes

Updates to this policy will be published on this page and in the Extension's open-source repository. The “Last updated” date above will be revised accordingly.

9. Contact

For privacy questions, email admin@sj-tu.com.