隱私權政策
生效日期：2026-10-30・適用於 Mystory iOS App 與本網站
Mystory（以下稱「本服務」）由個人開發者 許景評（Steven Hsu）及吳若安（Joanne Wu）（以下稱「我們」）提供。本政策說明我們蒐集哪些資料、為什麼蒐集、如何使用與保存，以及你對自己資料的權利。本服務沒有廣告、沒有分析追蹤 SDK，也不會出售你的資料。
1. 我們蒐集的資料
| 類別 | 內容 | 用途 |
|---|---|---|
| 帳號 | 電子郵件；以電子郵件註冊時為密碼（只保存雜湊值）；以 Apple 或 Google 登入時為該服務提供的使用者識別碼 | 建立與登入帳號、找回帳號 |
| 個人檔案 | 使用者 ID、蠟封樣式與字母、個人簡介、時區、介面語言、內容語言篩選 | 顯示你的個人頁、依時區計算「今天」、以你的語言顯示 App |
| 你寫的內容 | 日記、書評、影評、大哉問的文字與評分；公開／私密設定；編輯歷史；每篇文章的書寫開始／結束時間、字數與當地時段 | 提供核心功能、計算書寫成就與連續天數 |
| 社交互動 | 讚、收藏、追蹤、封鎖、隱藏的文章、檢舉（含你填寫的說明） | 提供探索、追蹤與內容管理功能 |
| 通知 | 裝置推播權杖（APNs token）、通知偏好、App 內通知紀錄 | 傳送提醒與社交通知 |
| 使用紀錄 | 公開文章的瀏覽紀錄（哪篇、停留多久）、探索頁的搜尋字串與結果數、成就進度 | 計算公開文章的熱門度、改善搜尋、計算成就 |
| 技術資料 | 連線的 IP 位址（用於防止濫用的速率限制，短暫保存於記憶體）、伺服器請求紀錄 | 維持服務安全與穩定 |
我們不蒐集你的位置、通訊錄、照片、健康資料，也不存取裝置的其他 App。
2. 公開與私密
文章預設私密，只有你看得到。你把一篇文章設為「公開」後，其他使用者（包含未登入的訪客，若 App 提供訪客瀏覽）可以閱讀它、看到你的使用者 ID、蠟封與簡介，並可讚、收藏與檢舉。你可以隨時把文章改回私密；改回後它會立即從探索頁與搜尋結果消失，但已被其他使用者收藏的文章列表會顯示為不可用。
3. 第三方服務
本服務使用以下第三方，各自只收到完成該功能所需的最少資料：
- Apple：Sign in with Apple（登入）、Apple Push Notification service（推播）。
- Google：Google 登入；Google Books API（書庫搜尋——只送出你輸入的搜尋字串）。
- Open Library（Internet Archive）：書庫搜尋——只送出搜尋字串。
- TMDB（The Movie Database）：電影庫搜尋——只送出搜尋字串。本產品使用 TMDB API，但未經 TMDB 背書或認證。
- 主機服務：待定（上線前更新），用於存放資料庫與執行伺服器。
書庫與電影庫的搜尋由我們的伺服器代為發出，不會把你的帳號或裝置資訊交給這些來源。本服務沒有任何廣告或分析 SDK。
4. 保存期限
- 帳號與內容：在你的帳號存續期間保存。
- 你刪除的文章：立即對你與其他人不可見，並於 30 天內自資料庫永久移除。
- 登入權杖：存取權杖短期有效；更新權杖最長 90 天，登出即撤銷。
- 瀏覽與搜尋紀錄：保存至帳號刪除為止，隨帳號一併刪除；熱門度與成就只使用彙總後的計數。
- IP 位址：僅用於速率限制，於限制時窗（分鐘級）結束後自動消失。
5. 刪除帳號
你可以來信 steven50410@gmail.com 要求刪除（App 內的「刪除帳號」功能即將提供）。刪除後我們會移除你的帳號、個人檔案、全部文章、社交互動與通知資料；他人對你公開文章的讚與收藏紀錄會一併失效。備份中的副本最長於 30 天內覆寫。
6. 你的權利
依據中華民國《個人資料保護法》及（如適用）歐盟 GDPR，你可以查詢、複製、更正、限制處理或刪除你的個人資料，或撤回同意。請來信 steven50410@gmail.com，我們會在確認身分後於 30 天內處理。
7. 安全
資料以 TLS 加密傳輸；密碼只保存雜湊值；伺服器僅開發者本人可存取。沒有任何系統能保證絕對安全，若發生資料外洩，我們會依法通知受影響的使用者。
8. 兒童
本服務不以 13 歲以下兒童為對象，也不會明知而蒐集其資料。若你認為有兒童向我們提供了資料，請來信，我們會刪除。
9. 政策變更
本政策若有重大變更，我們會在 App 內或本頁公告並更新生效日期。
10. 聯絡
許景評（Steven Hsu）・steven50410@gmail.com
Privacy Policy
Effective: 2026-10-30 · applies to the Mystory iOS app and this website
Mystory (the "Service") is provided by Steven Hsu (許景評) and Joanne Wu (吳若安), an independent developer ("we"). This policy explains what data we collect, why, how it is used and kept, and your rights over it. The Service has no advertising, no analytics or tracking SDKs, and we never sell your data.
1. Data we collect
| Category | What | Why |
|---|---|---|
| Account | Email address; a password hash if you sign up with email; the user identifier provided by Apple or Google if you sign in with them | Create and sign in to your account |
| Profile | User ID, wax-seal style and monogram, bio, time zone, interface language, content-language filter | Show your profile, work out "today" in your time zone, display the app in your language |
| Your content | Text and ratings of diary entries, book reviews, film reviews and big-question answers; public/private setting; edit history; per-entry writing start/finish time, word count and local hour | Core features; achievements and streaks |
| Social activity | Likes, saves, follows, blocks, hidden entries, reports (including the description you write) | Explore, following and content-moderation features |
| Notifications | Device push token (APNs), notification preferences, in-app notification history | Reminders and social notifications |
| Usage records | Views of public entries (which entry, how long), explore-page search terms and result counts, achievement progress | Rank public entries, improve search, compute achievements |
| Technical | IP address (kept briefly in memory for abuse-prevention rate limiting), server request logs | Security and stability |
We do not collect your location, contacts, photos or health data, and we do not access other apps on your device.
2. Public and private
Entries are private by default. Once you set an entry to public, other users (including signed-out guests, if the app offers guest browsing) can read it, see your user ID, seal and bio, and like, save or report it. You can make an entry private again at any time; it then disappears from the explore feed and search immediately, and shows as unavailable in other users' saved lists.
3. Third parties
The Service uses the following third parties, each receiving only what that feature needs:
- Apple: Sign in with Apple; Apple Push Notification service.
- Google: Google Sign-In; Google Books API for book search (only the search text you type is sent).
- Open Library (Internet Archive): book search — only the search text is sent.
- TMDB (The Movie Database): film search — only the search text is sent. This product uses the TMDB API but is not endorsed or certified by TMDB.
- Hosting: to be determined (updated before launch), where the database and servers run.
Catalog searches are made by our server on your behalf; your account and device details are never passed to these sources. There are no advertising or analytics SDKs in the app.
4. Retention
- Account and content: for as long as your account exists.
- Entries you delete: hidden immediately and permanently removed from the database within 30 days.
- Sign-in tokens: access tokens are short-lived; refresh tokens last at most 90 days and are revoked on sign-out.
- View and search records: kept until the account is deleted and removed with it; popularity and achievements use aggregated counts only.
- IP addresses: used only for rate limiting and expire with the limit window (minutes).
5. Deleting your account
You can delete your account by emailing steven50410@gmail.com (in-app deletion is coming). We then remove your account, profile, all entries, social activity and notification data; other users' likes and saves of your public entries become invalid. Copies in backups are overwritten within 30 days.
6. Your rights
Under Taiwan's Personal Data Protection Act and, where applicable, the EU GDPR, you may access, copy, correct, restrict or delete your personal data, or withdraw consent. Email steven50410@gmail.com; after verifying your identity we respond within 30 days.
7. Security
Data is encrypted in transit with TLS; passwords are stored only as hashes; the servers are accessible only to the developer. No system is perfectly secure; if a breach occurs we will notify affected users as the law requires.
8. Children
The Service is not directed at children under 13 and we do not knowingly collect their data. If you believe a child has given us data, email us and we will delete it.
9. Changes
Material changes will be announced in the app or on this page, with the effective date updated.
10. Contact
Steven Hsu (許景評) · steven50410@gmail.com