“自动删除文件”对在线工具意味着什么
在线媒体工具的文件留存与隐私承诺，应该做到什么程度。
正文当前提供英文版本，标题与摘要已翻译。
Bottom line: “We respect your privacy” is not a file handling policy. A useful policy says where bytes travel, whether they are stored, how long storage lasts, who can access them, whether staff inspect content, and how automated deletion is implemented. AIMP6 distinguishes local browser jobs from cloud and AI jobs because those systems have different risk profiles.
Tier 1 tools do not create a server copy in normal operation. The web application and WASM assets are delivered to the browser, but the selected media is processed locally. This minimizes hosting cost and privacy exposure, though it is still important to use HTTPS, honest UI labels and secure browser APIs.
Tier 2 and Tier 3 jobs may need temporary cloud storage. R2 objects should be private, accessed through signed URLs or a controlled out endpoint, associated with a job record, and covered by lifecycle expiration. The current AIMP6 policy states 24 hours for free jobs and seven days for Pro, with manual deletion available.
Lifecycle deletion is preferable to relying on cleanup code that may fail. The application can also mark a job deleted in D1, but the storage bucket policy is the durable backstop. Logs should avoid recording signed URLs, full transcripts or sensitive scripts.
No platform should promise that staff can never access a file if abuse review or legal process may require access. The credible claim is narrower: content is not used for profiling or training by default, temporary objects are private, retention is limited, and users can inspect the policy before processing.