Privacy Policy / 隱私權政策

English

Effective date: October 28, 2026

This English version is a translation of the Traditional Chinese original. If the two versions conflict, the Traditional Chinese version prevails.

This document describes what the Halfgate app (the “Service”) actually collects, where it sends it, how long it keeps it, and how it is deleted. If any statement here does not match what the Service actually does, that is a defect; please let us know.

Summary

No registration is required: an anonymous account is created the first time you open the app. Linking Apple, Google, or LINE is optional.
We store the birth details you enter (date, time, city) and your conversations with the reading assistant, and use them to draw your Human Design chart and generate readings.
Conversations and daily readings are generated by OpenAI models. The app asks for your permission when you first start it, before anything is sent to OpenAI. What is sent does not include your name, date of birth, or place of birth, unless you type it into a question yourself.
There are no ads, no advertising identifiers, and no behavioral analytics or tracking SDKs, and the app does not request location permission.
If you invite someone, or accept an invitation, to link as a pair, you and that one person can see each other’s name and birth details until either of you cancels (see “Pair links”).
You can delete your account in the app at any time. Your account data in our database is deleted immediately, with no grace period; the few records that are still retained are listed under “Deleting your account.”

Who collects your data

The Service is developed and operated by Coyotech, which collects and controls the data described below. Contact: support@coyotech.app.

What we collect, and why

Account and sign-in

A randomly generated account identifier (shown in the app as “Account ID” under Account → Settings). It is also the purchaser identifier we give to RevenueCat (see “Purchases” below).
Sign-in credentials: the short-lived credential expires after 15 minutes; the long-lived credential expires after 30 days without use. The server stores only a SHA-256 hash of the long-lived credential, never the credential itself.
If you link Apple, Google, or LINE: we store the account identifier that service issues to this app and, if that service provides them, the name and the web address of the profile picture of that account, as of the most recent time you linked or signed in with it. They are shown in the app as the account you are signed in with. Apple does not provide either. We do not store your email address. If you link Apple, we also store a token Apple issues to the Service, used solely to ask Apple to revoke authorization when you delete your account.
If, on a device, you sign in with an identity already linked to another account, the data of the anonymous account on that device (birth details, conversations, purchases, and credits) is merged into that account, and the anonymous account is then deleted. If that account already has birth details, it keeps them and the anonymous account’s birth details are deleted, with their daily readings; their conversations stay in the account, no longer linked to any birth details, and an analysis purchased for them becomes unused again, so you can use it on the account’s birth details. We record the mapping “old identifier → current account” so that purchases made under the old identifier still count as yours.

Birth details

Your account keeps one set of birth details, your own: the name you give, a date of birth, a time of birth (“unknown” is an option), a city of birth, and the latitude, longitude, and time zone derived from that city. The city is chosen from a list built into the app; your device’s location is not used. These data are the sole basis for calculating the Human Design chart. You can change the name at any time in the app under Account → My birth details. The date of birth cannot be changed once saved; the time and city of birth can be corrected there as long as no analysis has been purchased for them.

Conversations

The questions you ask the reading assistant and its answers, together with the number of tokens used and the billing source (trial, subscription, or credits), are stored on the server. We store them to show your conversation history, to let the assistant build on the preceding messages, and to track your usage allowance. Please do not enter in a conversation any information you do not want stored (for example, health conditions or national ID numbers).

Daily readings

Subscribers’ daily readings are stored by date and by the name of the device’s time zone they were written for, so viewing one again on the same day in the same time zone does not require generating it again. A reading states times in that time zone’s local time, so reading on the same day in another time zone (while travelling, or on a second device) gets a reading of its own.

Device time zone

Every request the app sends to the server includes the name of the device’s time zone (for example, Asia/Taipei). It is used to determine which day “today” is and to tell the reading assistant your local date and time; the timing of push notifications is calculated from it as well. It is stored with your daily readings (see “Daily readings”) and with your push token (see “Push notifications”).

Language and country/region

Every request also includes the language the app is displayed in (for example, en). When you ask the reading assistant a question, that request also includes, if the device can tell, a two-letter code for the country or region where the device is (for example, US): on Android, the mobile network’s country, otherwise the SIM card’s country, otherwise the country of the system language setting; on iOS, the Region setting, otherwise the country of the system language setting. No location permission is used, and nothing is sent if the country is unknown. The language determines the language of the content the server returns and of the reading assistant’s answers; daily readings are stored separately for each language, and a push token is stored with the language the app had when it registered, so notifications are sent in that language. The country or region is used only to choose which crisis hotlines the reading assistant provides in a conversation (where we have hotlines for that country; otherwise it points you to a hotline directory and your local emergency number); the server does not store it.

Purchases

We store the reports you have purchased, a record of additions to and deductions from your credits, your subscription plan and period of validity, and store transaction IDs. Payment itself is processed by the App Store or Google Play; we never receive your credit card or payment account details.

Pair links

You can link your birth details with another person’s, through an invitation link or a QR code, to get the pair analyses of the two of you. This is the only way your data is shown to another user of the Service.

What the other person sees: the name in your birth details, your date of birth, its time of birth (or “unknown”) and its place of birth, and the analyses generated for the two of you. If you change those details, the other person sees the change. They do not see your conversations or the label you give them; they do see whether the analysis of your pair has been unlocked, whether by a purchase or by a subscription of either of you.
Who sees it: only the one person who accepts your invitation, or whose invitation you accept. Before you agree, the app shows you the inviter’s name and nothing else.
What it is used for: only to generate the pair analyses of the two of you.
When it stops: as soon as either of you cancels the link or deletes their account. Both of you then lose the pair and its analyses, including an unlock either of you paid for.
The invitation link contains only a random code: no name and no birth details. The server stores only a SHA-256 hash of it; it expires after 72 hours and is deleted once used, or 7 days after it expires if unused. The web page the link opens collects no data and loads no analytics.

Push notifications

Only after you have allowed notifications on your device does the app obtain the device’s push token and send it to us, together with the platform (iOS/Android) and the time zone name, so that we can send subscribers today’s reading for their birth details during the 8 a.m. hour, local time, and tell you when someone accepts your pair invitation. A daily notification contains the headline of that day’s main item in the reading, plus the identifier of the birth details and the date; a pair notification contains the name of the person who accepted and the pair’s identifier. Either one lets tapping it open the right screen. When the push service reports that a token is no longer valid, we delete it.

Share cards

The share cards (your Human Design or today’s reading as an image) are made on your device, and nothing about them is sent to us. A card never shows your birth date, time or place, and shows your name only if you turn that on. What happens to a card is up to you: it goes only where you send it: Instagram or the system share sheet get the image; LINE and Threads get a short text (your type and authority) with a link to our site, under that service’s own terms. Saving a card to your photos asks for permission to add photos only (on Android 10 and earlier, the system’s storage permission); the app never reads your photo library.

Crash reports

When the release version of the app crashes or hits an unhandled error, it sends a crash report through Firebase Crashlytics. The report contains the error message, the stack trace, and device information (such as device model, operating system, and app version), along with an installation identifier Crashlytics generates to count affected users. We do not set a user identifier. Development builds do not send crash reports.

System logs

When a request fails (for example, an internal server error or a temporary connection failure), and when the hourly scheduled job (daily push notifications, cleaning up timed-out questions and expired pair invitations) encounters an error, the system logs may record your IP address, User-Agent, device time zone, the request path and account identifier, and the error message; the processing status of purchase notifications is also logged. These logs are used for troubleshooting and are kept for the server’s log rotation period, then overwritten. The system logs do not intentionally record the content of your questions or your birth details.

What we do not collect

Device location (GPS or Wi-Fi positioning).
Contacts, photos (the app can add a share card to your photos when you ask, but never reads them), text messages, or data from other apps.
Advertising identifiers, or any cross-app tracking; the Service has no ads.
Usage analytics (what you tap, how long you stay).
Credit card or other payment information.

Where your data goes

OpenAI (generating readings)

When you ask a question, the server sends OpenAI the Human Design chart content calculated from the birth details (for example, your type, authority, profile, defined gates and channels, and whether the time of birth is known), together with your current local date and time (the time zone name itself is not sent), the most recent messages in your conversation, and your question, along with the language to answer in and the names and numbers of the crisis hotlines for your country or region where we have them (see “Language and country/region”); the country or region code itself is not sent. For daily readings, only the reading passages selected for that day, each with how many more of your local days it still holds, and the language to write in are sent. The server does not send names, dates of birth, times of birth, places of birth, or account identifiers; however, anything you type into a question yourself (including any of these details) is sent as is.

When we call OpenAI, we request that the response not be stored (store: false). Under OpenAI’s API data policy, API content is not used to train models by default; regardless of the settings above, however, OpenAI by default retains content in its abuse monitoring logs for up to 30 days, and retains it longer only when required by law or to protect its services or third parties.

Your permission: when you first start the app, its welcome screen explains that answers and daily readings are generated by a third-party AI service and what that service receives, links these terms and this policy, and asks you to agree by tapping “Agree and start.” Nothing of yours is sent to OpenAI before that. To withdraw your permission, stop using the reading assistant and daily readings, or delete your account (see “Deleting your account”).

RevenueCat, the App Store, and Google Play (purchases)

Purchases are managed through RevenueCat. RevenueCat receives your account identifier and store transaction records (item, time, price, transaction ID), as well as the device and app information its SDK needs to operate. RevenueCat and the stores retain these records under their own privacy policies.

Google Firebase (push notifications and crash reports)

Push notifications are delivered through Firebase Cloud Messaging (and, on iOS, then through the Apple Push Notification service); their content is as described above. Crash reports are sent to Firebase Crashlytics. The app does not include the Google Analytics SDK.

Apple, Google, and LINE (sign-in, optional)

When you choose to link one of these, sign-in takes place on that service’s screen, and we receive only the account identifier, name, and profile picture address described above.

The app loads your profile picture directly from Google’s or LINE’s servers, so that service receives your device’s IP address and User-Agent when it is shown.

Your device and cloud backups (restoring sign-in)

So that you return to the same account after reinstalling the app or switching phones, the app stores the account identifier and a sign-in credential in: the iOS Keychain (synced to your other Apple devices if iCloud Keychain is turned on); and, on Android, Google Block Store (backed up to Google’s cloud only when end-to-end encryption is supported; otherwise kept only on that device). These data are held by Apple or Google; we cannot read your cloud backups.

Where data is stored

Our servers and database are located in Google Cloud’s us-central1 region (Iowa, United States). OpenAI, RevenueCat, and Firebase may also process data in the United States or other countries. By using the Service, you acknowledge that your data will be transferred outside Taiwan.

Retention and deletion

Data on the server has no automatic deletion period; it is kept until you delete it or delete your entire account.

Birth details

Your birth details are deleted with your account, not on their own. Once an analysis has been purchased for them, they cannot be changed in the app, because the analysis was purchased for those birth details; to correct them, email support@coyotech.app.

Deleting your account

In the app, go to Account → Settings → Delete account. Deletion takes effect immediately, with no grace period, and cannot be undone:

If you have linked Apple, we first ask Apple to revoke authorization; if Apple cannot complete this, the deletion does not proceed at all, and you can try again later.
Then, in a single step, we delete: the account, linked identities (with their names and profile picture addresses), sign-in credentials, your birth details, conversations, daily readings, all of your pairs and pending invitations, purchase and credit records, subscription status, push tokens, and the mappings of old identifiers merged into this account.
The app clears the sign-in credentials on this device, as well as the restore data belonging to this account.
Every pair you are in disappears for the other person too, including a pair they paid for: they lose its analyses and the unlock.

Deleting your account does not cancel your App Store or Google Play subscription; cancel it in the store’s subscription management.

What is still retained after you delete your account:

Transaction records retained by RevenueCat and the stores under their own policies.
The full original text of every RevenueCat purchase notification received on our server, including the account identifier, item, transaction ID, price and currency, country or store region, and store. These have no deletion period; they are used to prevent the same transaction from being used more than once and to process refunds and renewals. Because deleting your account does not cancel a store subscription, renewal and other notifications continue to arrive and are stored after the account is deleted, for as long as the subscription remains active.
Crash reports kept by Firebase Crashlytics for its retention period (we do not set a user identifier).
System logs (which may include your IP address and account identifier; see “System logs”), kept for the log rotation period, then overwritten.
Database backups taken before deployments that include database schema changes. These backups currently have no fixed deletion schedule, so they may still contain data of accounts deleted after the backup was taken; they are used only to restore the database if an update fails, and for no other purpose.

For how to delete your account without the app, see Delete your account.

Prolonged inactivity

If an anonymous account’s app is not opened for 30 days, its sign-in credential expires, and that account can no longer be accessed from any device; its data, however, is not deleted automatically. If you plan to stop using the Service, please delete your account in the app before then.

Security

All communication between the app and the server uses HTTPS.
The server stores only hashes of sign-in credentials.
The server’s keys are stored in Google Secret Manager; the database accepts only local connections.

Your rights

Under Article 3 of Taiwan’s Personal Data Protection Act, you may request to inquire into or review your personal data, to obtain copies of it, to supplement or correct it, to have its collection, processing, or use stopped, and to have it deleted. Correction: you can change the name in your birth details in the app at any time; the date of birth cannot be changed once saved, and the time and city of birth can be corrected in the app as long as no analysis has been purchased for them; otherwise, email us to have them corrected. Deletion: you can do this yourself in the app. For any other request, email support@coyotech.app and include the Account ID shown under Account → Settings in the app; we will handle the request for that account.

Children

The Service is not designed for anyone under 13, and we do not knowingly collect their data. A parent who finds that their child is using the Service may email us to request deletion.

About conversation content

Readings from the Service are for entertainment and self-exploration only and are not medical, psychological, legal, or financial advice. When a conversation mentions self-harm or an emergency, the reading assistant provides crisis hotlines and emergency numbers; the system does not automatically notify any person or organization based on conversation content. The list of hotlines under “Talk to someone” in the app is always available and works without an internet connection.

This web page

This is a static web page: no cookies, no analytics, and no third-party resources are loaded.

Changes to this policy

When we change this policy, we will update the effective date above. If a change means we start keeping a new kind of data, the app tells you where that data is collected, before we collect it.

繁體中文

生效日：2026 年 10 月 28 日

本文件以繁體中文版為原文，英文版為翻譯；兩者如有歧異，以繁體中文版為準。English version

這份文件描述半扇門（Halfgate）這個 app（以下稱「本服務」）實際上蒐集什麼、送到哪裡、存多久、怎麼刪。如果哪一句和實際行為不符，那是缺陷，請告訴我們。

重點

不需要註冊：第一次開啟 app 就會建立一個匿名帳號。綁定 Apple、Google 或 LINE 是選用的。
我們保存你輸入的出生資料（日期、時間、城市）與你和解讀助手的對話，用來畫你的人類圖、產生解讀。
對話與每日解讀由 OpenAI 的模型產生。app 會在你第一次開啟時徵求你的同意，之前不會把任何內容送給 OpenAI。除非你自己在提問中輸入，送出的內容不含姓名、出生日期或出生地點。
沒有廣告、沒有廣告識別碼、沒有行為分析或追蹤 SDK，也不要求定位權限。
如果你邀請別人、或接受別人的邀請來建立雙人連結，你和那一位會看到彼此的名字與出生資料，直到任一方取消（見「雙人連結」）。
你可以隨時在 app 裡刪除帳號，資料庫裡你的帳號資料會立即刪除，沒有寬限期；仍會保留的少數紀錄列在「刪除帳號」一節。

誰在蒐集

本服務由 Coyotech 開發與營運，是下列資料的蒐集者與保有者。聯絡方式：support@coyotech.app。

我們蒐集什麼，為什麼

帳號與登入

一個隨機產生的帳號識別碼（app 的「我的 → 設定」顯示為「帳號 ID」）。它也是我們交給 RevenueCat 的購買者識別碼（見下方「購買」）。
登入憑證：短期憑證 15 分鐘失效；長期憑證 30 天沒有使用就失效。伺服器只保存長期憑證的 SHA-256 雜湊值，不保存原文。
如果你綁定 Apple、Google 或 LINE：我們保存該服務給這個 app 的帳號識別碼；如果該服務有提供，也保存那個帳號的名字與頭像的網址（以你最近一次綁定或登入時為準），用來在 app 裡顯示你登入的帳號。Apple 不提供這兩項。我們不保存你的電子郵件。綁定 Apple 時，另外保存 Apple 發給本服務的一組憑證，唯一用途是在你刪除帳號時通知 Apple 撤銷授權。
如果你在某台裝置上用一個已經綁定其他帳號的身分登入，這台裝置上匿名帳號的資料（出生資料、對話、購買與點數）會併入那個帳號，匿名帳號隨即刪除。那個帳號已經有出生資料時，保留它的，匿名帳號的出生資料連同每日解讀一起刪除；關於它的對話留在帳號下（不再連到任何出生資料），為它購買的分析會變回未使用，可以用在那個帳號的出生資料上。我們會記下「舊識別碼 → 現在的帳號」的對應，讓舊識別碼名下的購買仍算你的。

出生資料

每個帳號保存一份出生資料，就是你自己的：你取的名稱、出生日期、出生時間（可選「不知道」）、出生城市，以及由城市換算出的經緯度與時區。城市是從 app 內建的城市清單中選的，不使用你裝置的定位。這些資料是計算人類圖的唯一依據。名稱隨時可以在 app 的「我的 → 我的出生資料」修改；出生日期存下後就不能更改，出生時間與城市在沒有買過分析時可以在那裡修正。

對話

你向解讀助手提出的問題與它的回答，連同使用的 token 數與計費來源（試用、訂閱或點數），都保存在伺服器上。保存它們是為了顯示對話紀錄、讓助手能接著前幾句回答，以及計算額度。請不要在對話中輸入你不希望被保存的資訊（例如健康狀況、身分證號碼）。

每日解讀

訂閱者的每日解讀依日期與寫作時所用的裝置時區名稱保存，同一天在同一個時區重看不必重新產生。解讀裡的時間都是那個時區的當地時間，所以同一天在另一個時區（旅行中，或另一台裝置）讀，會另外產生一份。

裝置時區

app 送給伺服器的每個請求都附上裝置的時區名稱（例如 Asia/Taipei），用來決定「今天」是哪一天，以及告訴解讀助手你當地的日期與時間；推播的時間也依它計算。它會連同每日解讀（見「每日解讀」）與推播 token（見「推播通知」）一起保存。

語言與國家／地區

每個請求也附上 app 顯示的語言（例如 zh-Hant）。你向解讀助手提問時，該請求另附裝置所在國家／地區的代碼（例如 TW），有取得時才送：Android 取自行動網路所在的國家，沒有就用 SIM 卡的國家，再沒有就用系統語言設定中的國家；iOS 取自「地區」設定，沒有就用系統語言設定中的國家。不使用定位權限，無法得知時不送。語言用來決定伺服器回傳內容與解讀助手回答所用的語言；每日解讀依語言分開保存，推播 token 也連同註冊時的 app 語言保存，讓推播以該語言送出。國家／地區只用來挑選解讀助手在對話中提供的求助專線（有該國專線時提供專線，沒有則提供查詢專線的網站與當地的緊急電話），伺服器不保存它。

購買

我們保存你買過的分析、點數的增減紀錄、訂閱的方案與有效期間，以及商店交易編號。付款本身由 App Store 或 Google Play 處理，我們拿不到你的信用卡或付款帳戶資料。

雙人連結

你可以用邀請連結或 QR code，把你的出生資料與另一個人的連結起來，取得你們兩人的雙人分析。這是本服務唯一會把你的資料顯示給另一位使用者的情況。

對方看得到的：你出生資料中的名稱、出生日期、出生時間（或「不明」）、出生地，以及為你們兩人產生的分析。你修改這些資料時，對方也會看到變更。對方看不到你的對話，也看不到你替對方加的標註；對方看得到這組分析是否已解鎖，不論是因為你們任一方的購買或訂閱。
給誰看：只有接受你邀請的那一個人，或你接受其邀請的那一個人。你同意之前，app 只會顯示邀請人的名字，不會顯示其他資料。
用途：只用來產生你們兩人的雙人分析。
何時停止：任一方取消連結或刪除帳號時立即停止。雙方都會看不到這組與它的分析，包含任一方為這組付的解鎖。
邀請連結只含一組隨機碼，不含名字或出生資料。伺服器只保存它的 SHA-256 雜湊；72 小時後到期，使用後即刪除，未使用的在到期 7 天後刪除。連結開啟的網頁不收集任何資料，也不載入分析工具。

推播通知

只有在你允許通知之後，app 才會取得裝置的推播 token，並把它與平台（iOS／Android）、時區名稱交給我們，用來替訂閱者在當地早上 8 點多送出出生資料的今日解讀，以及在有人接受你的雙人邀請時通知你。今日解讀通知的內容是當天解讀中主要項目的標題，另附出生資料的識別碼與日期；雙人通知的內容是接受者的名字與這組的識別碼。點開通知時都能打開對的畫面。推播服務回報 token 已失效時，我們會刪除它。

分享卡片

分享卡片（把你的人類圖或今日解讀做成的圖片）在你的裝置上產生，相關內容都不會傳給我們。卡片不會出現你的出生日期、時間或地點；只有你打開「顯示我的名字」時才會出現名字。卡片只會送到你選擇的地方：Instagram 或系統分享選單收到圖片；LINE 與 Threads 收到一段文字（你的類型與內在權威）和本站連結，並適用該服務自己的條款。把卡片存進相簿時，app 只要求「加入照片」的權限（Android 10 以前為系統的儲存空間權限）；app 從不讀取你的相簿。

當機紀錄

正式版 app 當機或發生未處理的錯誤時，會透過 Firebase Crashlytics 送出當機報告，內容包含錯誤訊息、錯誤堆疊與裝置資訊（例如裝置型號、作業系統與 app 版本），以及 Crashlytics 為計算受影響人數而產生的安裝識別碼。我們不設定使用者識別碼。開發版不送出。

系統紀錄

請求失敗時（例如伺服器內部錯誤或暫時無法連線），以及每小時排程工作（每日推播、清理逾時的提問與過期的雙人邀請）出錯時，系統紀錄可能記下你的 IP 位址、User-Agent、裝置時區、請求的路徑與帳號識別碼，以及錯誤訊息；購買通知的處理狀態也會記錄。這些紀錄用於排除故障，依伺服器的系統紀錄輪替期間保存後覆寫。系統紀錄不刻意記錄提問內容或出生資料。

我們沒有蒐集的

裝置定位（GPS、Wi-Fi 定位）。
通訊錄、相片（你要求時 app 可以把分享卡片加入相簿，但從不讀取）、簡訊、其他 app 的資料。
廣告識別碼，或任何跨 app 追蹤；本服務沒有廣告。
使用行為分析（點了哪裡、停留多久）。
信用卡或其他付款資訊。

資料會送到哪裡

OpenAI（產生解讀）

你提問時，伺服器送給 OpenAI 的是：由出生資料算出的人類圖內容（例如類型、內在權威、人生角色、已定義的閘門與通道，以及出生時間是否已知）、你當地現在的日期時間（不送時區名稱本身）、你最近的幾則對話、你的問題，以及要用來回答的語言和你所在國家或地區的求助專線名稱與電話（有該國專線時；見「語言與國家／地區」），不送國家／地區代碼本身。每日解讀只送當天選出的解讀段落、每一段在你當地時間還會持續幾天，以及要使用的語言。伺服器不送姓名、出生日期、出生時間、出生地點或帳號識別碼；但你自己在提問中輸入的任何內容（包括這些資料）會原樣送出。

我們呼叫 OpenAI 時要求不保存這次回應（store: false）。依 OpenAI API 的資料政策，API 的內容預設不會被用來訓練模型；但不論上述設定，OpenAI 預設會把內容保留在濫用監控紀錄中最長 30 天，只有在法律要求、或為保護其服務或第三方時才會保留更久。

你的同意：你第一次開啟 app 時，歡迎畫面會說明回答與每日解讀由第三方 AI 服務產生、該服務會收到哪些內容，附上服務條款與本政策的連結，並請你點「同意並開始」表示同意。在此之前，不會把你的任何內容送給 OpenAI。若要撤回同意，請停止使用提問與每日解讀，或刪除帳號（見「刪除帳號」）。

RevenueCat、App Store、Google Play（購買）

購買透過 RevenueCat 管理。RevenueCat 會收到你的帳號識別碼與商店交易紀錄（品項、時間、價格、交易編號），以及其 SDK 運作所需的裝置與 app 資訊。RevenueCat 與商店依各自的隱私權政策保存這些紀錄。

Google Firebase（推播與當機紀錄）

推播經由 Firebase Cloud Messaging（iOS 再經由 Apple 推播服務）送達，通知內容如上所述。當機報告送到 Firebase Crashlytics。app 不包含 Google Analytics SDK。

Apple、Google、LINE（登入，選用）

你選擇綁定時，登入在該服務的畫面上進行，我們只收到上面說的帳號識別碼、名字與頭像網址。

app 顯示頭像時，會直接從 Google 或 LINE 的伺服器載入，因此該服務會收到你裝置的 IP 位址與 User-Agent。

你的裝置與雲端備份（還原登入）

為了讓你重裝 app 或換手機後回到同一個帳號，app 會把帳號識別碼與一組登入憑證存在：iOS 的鑰匙圈（開啟 iCloud 鑰匙圈時會同步到你的其他 Apple 裝置）；Android 的 Google Block Store（只有在支援端對端加密時才備份到 Google 雲端，否則只存在這台裝置）。這份資料由 Apple 或 Google 保管，我們無法讀取你的雲端備份。

資料存放地點

我們的伺服器與資料庫位於 Google Cloud 的 us-central1 區域（美國愛荷華州）。OpenAI、RevenueCat 與 Firebase 也可能在美國或其他國家處理資料。使用本服務即表示你的資料會傳輸到台灣以外的地方。

保存期間與刪除

伺服器上的資料沒有自動刪除期限，會一直保存到你刪除它，或刪除整個帳號。

出生資料

出生資料隨帳號一起刪除，不單獨刪除。買過分析之後，出生資料就不能在 app 內修改，因為分析是為那組出生資料購買的；需要修正請來信 support@coyotech.app。

刪除帳號

在 app 的「我的 → 設定 → 刪除帳號」。刪除立即生效，沒有寬限期，也無法復原：

如果綁定過 Apple，我們會先請 Apple 撤銷授權；Apple 無法完成時，整個刪除不會進行，你可以稍後再試。
接著一次刪除：帳號、綁定的身分（含其名字與頭像網址）、登入憑證、出生資料、對話、每日解讀、你所有的雙人與未使用的邀請、購買與點數紀錄、訂閱狀態、推播 token，以及併入這個帳號的舊識別碼對應。
app 會清除這台裝置上的登入憑證，以及屬於這個帳號的還原資料。
你所在的每一組雙人，對方那邊也會一起消失，包含對方付費的那組：對方會失去它的分析與解鎖。

刪除帳號不會取消你在 App Store 或 Google Play 的訂閱，請到商店的訂閱管理取消。

刪除帳號後仍會保留的：

RevenueCat 與商店依其政策保存的交易紀錄。
我們伺服器上收到的每一則 RevenueCat 購買通知的完整原文，包括帳號識別碼、品項、交易編號、價格與幣別、國家或商店地區、商店別。它們沒有刪除期限，用來防止同一筆交易被重複使用、處理退款與續訂。因為刪除帳號不會取消商店的訂閱，訂閱仍有效期間，續訂等通知會在帳號刪除後繼續送來並被保存。
Firebase Crashlytics 依其保存期限保留的當機報告（我們不設定使用者識別碼）。
系統紀錄（可能含 IP 位址與帳號識別碼，見「系統紀錄」），依系統紀錄輪替期間保存後覆寫。
帶有資料庫結構變更的部署前所做的資料庫備份。這些備份目前沒有固定的刪除時程，因此可能仍含有之後才刪除的帳號的資料；它們只用於更新失敗時還原資料庫，不作其他用途。

沒有 app 時的刪除方式見刪除帳號。

長期未使用

匿名帳號 30 天沒有開啟 app，登入憑證會失效，之後在任何裝置上都無法再進入那個帳號；但它的資料不會自動刪除。如果你打算停用，請在那之前先在 app 裡刪除帳號。

安全

app 與伺服器之間一律使用 HTTPS。
伺服器只保存登入憑證的雜湊值。
伺服器的金鑰存在 Google Secret Manager；資料庫只接受本機連線。

你的權利

依《個人資料保護法》第 3 條，你可以就你的個人資料請求查詢、閱覽、製給複製本、補充或更正、停止蒐集處理利用，以及刪除。更正：出生資料中的名稱隨時可在 app 內修改；出生日期存下後無法更改，出生時間與城市在沒有買過分析時可在 app 內修正，其他情況請來信。刪除：可在 app 內自行完成。其他請求請來信 support@coyotech.app，並附上 app「我的 → 設定」中的帳號 ID，我們會依該帳號處理。

兒童

本服務不是為未滿 13 歲的人設計的，我們也不刻意蒐集他們的資料。家長發現孩子使用本服務，可來信要求刪除。

關於對話內容

本服務的解讀僅供娛樂與自我探索，不是醫療、心理、法律或財務建議。對話中提到自我傷害或緊急狀況時，解讀助手會提供求助專線與緊急電話；系統不會因為對話內容自動通報任何人或機構。app 內「需要幫助？」的專線清單隨時可用，不需要網路。

這個網頁

這是靜態網頁：沒有 cookie、沒有分析、沒有載入任何第三方資源。

政策變更

修改時會更新上方的生效日。若變更後開始保存新種類的資料，app 會在收集該資料的地方、收集之前告知你。