Arounder — 隱私權政策 / Privacy Policy

帳號是自選的

不登入的話，你建立的行程、旅行回憶、設定和草稿全部只存在這一台手機上（使用 iOS 的本機儲存），我們看不到，伺服器上也沒有副本。

你可以用「透過 Apple 登入」建立帳號。Apple 會告訴我們一個代表你的帳號識別碼；第一次登入時，如果你願意，也會提供你的名字和電子郵件地址——Apple 允許你隱藏真實地址、改用轉寄地址，那樣我們收到的就只有轉寄地址。我們看不到你的 Apple ID 密碼。

你在「我的」頁填的「稱呼」會存在帳號裡，是一起規劃的人看到的名字。

你的行程

一個行程裡放的是你放進去的東西：標題、日期、目的地，以及每一個站點的名稱、地點座標、抵達時間、預計停留多久，還有你寫在上面的筆記；如果你加了住宿，也包括酒店的名稱、地址、座標和住哪幾天；如果你記錄旅行支出，也包括同行者的名字（你自己填的）、每筆支出的項目、金額、幣別、類別、誰付款和誰分攤，以及你記錄的成員之間的付款。

登入後，行程的這些內容會存放在我們的資料庫（由 Supabase 代我們存放），這樣換手機或重新安裝後還在，也能讓你邀請的人看到。資料庫的權限設定，使得一個行程只有它的成員能讀取，只有建立者和「可編輯」的成員能修改，只有建立者能刪除。

行李清單、航班資料和旅行回憶，即使登入了也只存在你的手機上，不會上傳。

一起規劃

行程的建立者可以產生一條邀請連結，選擇對方「可以一起編輯」或「只可以查看」。連結裡是一組隨機代碼，14 天後失效；任何拿到連結、並用 Apple 登入的人，都可以用那個權限加入行程，所以請只分享給你想邀請的人。

加入後，所有成員都看得到這個行程的內容、每個成員的「稱呼」和權限，以及行程的最新修改。成員的電子郵件地址不會給其他成員看到。建立者可以把人移出行程，成員也可以自己離開；建立者刪除行程，所有成員那邊的這個行程也會一起刪除。

用 AI 規劃行程

當你按「AI 幫我排」，App 會透過我們的伺服器，把你輸入的目的地、天數、你選的偏好，以及你正在閱讀的語言，送去 Google 的 Gemini 模型來產生行程。不會送出你的名字、電子郵件或任何識別碼。我們的伺服器不會保存送出去的內容；我們使用 Gemini 付費服務，Google 不會用這些內容訓練或改善它的模型，只會為偵測濫用而短暫保留。

AI 規劃每個人可以免費用一次，之後是訂閱功能，所以 App 會同時送出一個訂閱識別碼（未登入時是 RevenueCat 產生的匿名識別碼，登入後是你的帳號識別碼）。我們的伺服器用它向 RevenueCat 確認你有沒有訂閱，並記下你當天用了幾次 AI 規劃，以設定每日上限、防止濫用；這個次數只有識別碼和數字，大約一天後自動刪除。另外會記下這個識別碼已經用過免費的那一次，沒有期限，只用來不讓免費次數重複使用。

地圖、地點與路線

搜尋地點、修正座標、計算各站之間的車程時間，是透過我們的伺服器向 Google 的地圖服務（Places 與 Routes）查詢，送出的是地點的文字或座標，講的是「那個地點」，不是你；為了省下重複查詢，我們的伺服器會把查詢結果（不含任何關於你的資料）暫存最多 30 天。把國家／地區名稱轉成你的語言，則是透過 Apple 的地圖服務。App 裡的地圖由 Google 地圖繪製，繪製時 Google 會收到地圖要顯示的範圍和你的網路位址。

「顯示我的位置」是選用的：你按下按鈕並同意手機的位置許可後，App 只在你看地圖時使用你的位置，用來在地圖上標出你在哪裡，以及計算離最近一站的距離。位置只在你的手機上處理，不會傳到我們的伺服器或任何第三方，也不會儲存；離開地圖就停止。App 不會在背景使用位置，也不會記錄你去過哪裡。你可以隨時在手機的「設定」裡關閉。

天氣、匯率、提醒與日曆

行程每一天的天氣預報，是由我們的伺服器向挪威氣象局（MET Norway）查詢；送出的只有那一天第一個景點的大概座標（四捨五入到約 10 公里），不含你的任何資料，伺服器暫存查詢結果約一小時。

匯率是由我們的伺服器向 ExchangeRate-API 查詢，送出的只有兩種貨幣的代碼，結果暫存約六小時。

「出發前提醒」只使用手機的本機通知，由手機在指定時間顯示，沒有任何資料傳到我們的伺服器；你可以隨時在行程選單關閉，或在手機「設定」關閉通知。

「加入日曆」會把行程做成一個日曆檔，交給手機的分享選單，由你決定要不要加入日曆；App 不會讀取你的日曆。

地點照片

景點卡上的照片是那些「地點」的照片，來自維基媒體（Wikimedia Commons／維基百科）。我們的伺服器只負責找出對應的圖片網址和出處；實際的圖片是你的手機直接向維基媒體載入的，維基媒體的伺服器會看到發出請求的網路位址。那些不是你的照片。

你的相片（旅行回憶）

旅行回憶會把你自己的旅行照片排進行程裡。為此 App 會開啟你的照片圖庫，第一次使用時 iOS 會先問你的許可，你可以拒絕；拒絕的話它一張都不會讀，App 其他部分完全照舊。

它從一張照片讀的，是你手機在拍照當下就已經存好的拍攝時間與位置，只在你的手機上拿去跟行程的站點比對。照片本身、照片的位置與時間，全部不會離開你的手機、不會上傳到任何地方，即使你登入了、行程是跟別人共享的也一樣。

訂閱與付款

訂閱透過 App Store 銷售，由 Apple 收款。這個 App 從頭到尾看不到你的信用卡、帳單地址或 Apple ID。要取消訂閱，是在你的 Apple 帳號裡管理。

我們使用 RevenueCat 讓 App 知道你的訂閱有沒有生效。RevenueCat 收到的是一個識別碼（未登入時是隨機的匿名識別碼，登入後是你的帳號識別碼，這樣訂閱能跟著帳號到另一部手機）和 Apple 給它的購買資訊（買了哪個方案、何時到期）。它不會收到你的名字或電子郵件。

沒有分析、沒有廣告、沒有追蹤

這個 App 裡沒有任何第三方分析服務、沒有當機回報、沒有廣告，也沒有廣告識別碼。它不會要求追蹤許可，也不會把你跟你在其他 App 或網站上做的事連在一起。

網路位址

跟任何透過網際網路提供的服務一樣，我們的伺服器，以及下面提到的服務，在處理請求時會看到請求是從哪個網路位址來的。那是用來讓服務運作與防止濫用的，不會拿來為你建立輪廓。

你的資料會到誰那裡

留在你手機上的東西

以下資料留在你這一台手機上：你的行程（登入後是雲端行程的一份副本，讓你離線也能看和修改，連線後再同步）、行李清單、航班、旅行回憶與裡面照片的副本、你的設定（稱呼、出發城市、語言、最近搜尋過的目的地）、登入工作階段，以及 RevenueCat 的識別碼和訂閱狀態。把 App 移除，這些就一起沒有了。

你可以做的事

• 在 App 裡刪除任何一個你建立的行程，或離開別人邀請你加入的行程。
• 隨時登出：雲端上的行程會從這部手機移除（仍保存在帳號裡），只存在手機上的行程會保留。
• 在「我的」頁刪除帳號：你的帳號、稱呼、你建立的雲端行程（包括與別人共享的）和你的成員身分會從我們的資料庫刪除；只存在手機上的行程會保留。
• 在手機「設定」裡更改或關閉照片權限，立即生效。
• 把 App 移除，所有留在手機上的資料就一併清除。

異動與聯絡

本政策若有異動，更新後的版本就會出現在 App 裡的這一頁。對本政策有任何疑問，或想知道我們持有你的哪些資料，請來信：

An account is optional

Without signing in, the trips you build, your trip memories, settings and drafts live only on this phone (iOS on-device storage). We cannot see them and there is no copy on a server.

You can create an account with Sign in with Apple. Apple gives us an ID that represents you and, on the first sign-in and only if you agree, your name and email address — Apple lets you hide your real address behind a relay address, in which case that relay is all we receive. We never see your Apple ID password.

The name you enter on the Me page is stored in your account; it is the name the people you plan with see.

Your trips

A trip holds what you put in it: a title, dates, a destination, and each stop’s name, coordinates, arrival time, planned stay and any note you write; if you add where you stay, also the hotel’s name, address, coordinates and which days; if you record trip expenses, also the names you enter for the people on the trip and each expense’s description, amount, currency, category, who paid and who shares it, plus the repayments you record between them.

When you are signed in, this content is stored in our database (hosted for us by Supabase) so it is still there after a phone change or reinstall, and so the people you invite can see it. The database rules let only a trip’s members read it, only its creator and members who can edit change it, and only its creator delete it.

Packing lists, flight details and trip memories stay on your phone even when you are signed in; they are not uploaded.

Planning together

A trip’s creator can make an invite link that lets the other person either edit or only view. The link contains a random code and expires after 14 days; anyone who has the link and signs in with Apple can join with that permission, so only share it with people you mean to invite.

Once joined, every member can see the trip’s content, each member’s name and permission, and the latest changes. Members’ email addresses are never shown to other members. The creator can remove people and members can leave; if the creator deletes the trip, it is deleted for every member.

Planning with AI

When you tap “Plan with AI”, the app sends — through our server — the destination you typed, the number of days, the preferences you picked and the language you are reading in, to Google’s Gemini model to generate the trip. Your name, email and any identifier are not sent. Our server does not keep what was sent; we use Gemini’s paid service, so Google does not use it to train or improve its models and keeps it only briefly to detect abuse.

Everyone gets one free AI plan, after which it is a subscription feature, so the app also sends a subscription ID (an anonymous ID created by RevenueCat when signed out, or your account ID when signed in). Our server uses it to ask RevenueCat whether you are subscribed, and counts how many AI plans that ID made today to enforce a daily limit and prevent abuse. The count holds only the ID and a number and is deleted after about a day. We also record that the ID has used its free plan, with no expiry, only so the free plan cannot be reused.

Maps, places and routes

Searching for places, correcting coordinates and working out travel times between stops are done by our server asking Google’s map services (Places and Routes). What is sent is a place’s text or coordinates — it is about the place, not about you — and to avoid repeat lookups our server keeps the results (with nothing about you) for up to 30 days. Turning country/region names into your language is done through Apple’s map service. The map inside the app is drawn by Google Maps, which receives the map area to show and your network address when it draws it.

“Show my location” is optional: once you tap it and allow your phone’s location permission, the app uses your location only while you look at the map, to mark where you are and to work out the distance to the nearest stop. Your location is handled on your phone only; it is not sent to our server or to any third party, and it is not stored. It stops when you leave the map. The app never uses location in the background and does not record where you have been. You can turn it off any time in your phone’s Settings.

Weather, exchange rates, reminders and calendar

The forecast for each trip day is requested by our server from MET Norway; all that is sent is the approximate coordinates of that day’s first stop (rounded to about 10 km), nothing about you. Our server keeps the result for about an hour.

Exchange rates are requested by our server from ExchangeRate-API; only the two currency codes are sent, and the result is kept for about six hours.

“Trip reminders” use local notifications on your phone only: the phone shows them at the set times and nothing is sent to our server. You can turn them off in the trip menu or in your phone’s Settings.

“Add to Calendar” turns the trip into a calendar file and hands it to your phone’s share sheet, and you decide whether to add it; the app never reads your calendar.

Place photos

The photo on a stop card is a photo of that place, from Wikimedia (Wikimedia Commons / Wikipedia). Our server only finds the matching image URL and its credit; the image itself is loaded by your phone directly from Wikimedia, whose servers see the requesting network address. These are not your photos.

Your photos (Memories)

Memories arranges your own travel photos into a trip. For that the app opens your photo library; the first time, iOS asks your permission and you may decline. If you decline, it reads nothing and the rest of the app is unchanged.

What it reads from a photo is the capture time and location your phone already saved with it, matched against the trip’s stops on your phone. The photo itself, and its time and location, never leave your phone and are never uploaded — even when you are signed in or the trip is shared.

Subscriptions and payment

Subscriptions are sold through the App Store, and Apple takes payment. This app never sees your card, billing address or Apple ID. To cancel, you manage it in your Apple account.

We use RevenueCat so the app knows whether your subscription is active. RevenueCat receives an ID (a random anonymous ID when signed out, or your account ID when signed in, so the subscription follows your account to another phone) and the purchase information Apple gives it (which plan, when it expires). It does not receive your name or email.

No analytics, no ads, no tracking

There is no third-party analytics, no crash reporting, no advertising and no ad identifier in this app. It does not ask for tracking permission and does not link you to what you do in other companies’ apps or on other websites.

Network address

As with any service delivered over the internet, our server and the services below see which network address a request came from while handling it. That is used to run the service and prevent abuse, not to build a profile of you.

Who your data goes to

What stays on your phone

The following stays on this phone: your trips (when signed in, a copy of your cloud trips so you can view and edit them offline and sync later), packing lists, flights, trip memories and a copy of their photos, your settings (name, home city, language, recently searched destinations), your sign-in session, and RevenueCat’s ID and subscription status. Remove the app and they are gone.

What you can do

• Delete any trip you created, or leave a trip someone invited you to.
• Sign out at any time: cloud trips leave this phone (they stay in your account); trips stored only on the phone are kept.
• Delete your account on the Me page: your account, name, the cloud trips you created (including shared ones) and your memberships are deleted from our database; trips stored only on the phone are kept.
• Change or turn off photo permission in your phone’s Settings, effective immediately.
• Remove the app to erase everything kept on the phone.

Changes and contact

If this policy changes, the updated version appears here, on this page in the app. For any question about this policy, or to ask what we hold about you, write to: