照见 Offscript 隐私政策 · Privacy Policy
This is version 1.0 of the Privacy Policy, for Offscript 1.0 on iOS and the Android app (1.x). From version 3.0 on iOS and iPadOS, the current Privacy Policy applies.
谁在运营这个 App
照见 Offscript（下称「本 App」）由 Arctura Technologies Inc. 开发和运营。这是一家在加拿大安大略省注册的公司，地址：Unit 10, 1338 Wellington Street West, Ottawa, Ontario K1Y 3B7, Canada。本政策里说的「我们」，指的就是这家公司；我们是你个人信息的控制者，并已指定隐私负责人（Privacy Officer）。隐私问题、投诉与权利请求请写到 privacy@arcturatech.com；产品使用问题请写到 support@arcturatech.com。
1. 一句话
这个 App 把你写下的东西留在你自己手里。默认情况下，它不联网、不上传、不分析、不投广告。
2. 三不承诺
- 零广告：App 内没有广告，也没有任何广告 SDK。
- 永不出售情绪数据：不出售、不出租、不以营销为目的共享你的任何情绪或行为记录。
- 永不用于保险信贷画像：不用于保险、信贷、雇佣或任何评分、画像用途。
3. 你的记录存在哪里
你在 App 里创建的一切（情绪词、身体位置、三选一的结果、你写的那句话、练习记录、梦的记录与录音、关系里的那些事）只存在这台设备上。
保护它的是操作系统的文件保护（iOS 的 Data Protection；Android 上依赖设备自身的加密）。我们没有对数据库另做一层加密——这一句写在这里，是因为我们只写做得到的事。
你的录音文件同样只留在这台设备的 App 目录里。
4. 默认不联网
- 不开启云端备份（见第 5 节）时，App 不会向任何服务器发送任何东西。
- 没有遥测、没有使用分析、没有第三方崩溃上报 SDK、没有广告标识符（不使用 IDFA，也不会弹出「App 追踪透明度」授权框）。
5. 备份到云端（默认关闭 · 端到端加密 · 无账号）
我们叫它备份而不是「同步」：它做的是整份快照的备份与换机恢复，不是多端实时合并。
- 默认关闭。开启前有一张说明卡，写清楚：存什么、不存什么、谁能看、怎么关。
- 存什么：你的记录、练习、梦、你给梦里的东西写的意思（梦的标签与释义）与设置，打包成一份快照，在你的手机上加密之后再上传。
- 不存什么：录音文件、关系里的那些事、事后补的那句话——这些只留在本机。
- 谁能看：只有拿着恢复码的你。加密与解密都在你的设备上完成，密钥不离开设备；我们拿到的只是一段无法读取的密文。
- 无账号：不需要注册，不采集姓名、邮箱、电话。上传经由匿名会话完成，密文不关联你的身份，也不用于追踪。
- 恢复码：开启备份时生成一次并全屏展示，请你自己抄下来；设置里可以再看一次。换手机时输入它才能取回备份。它丢了我们无法补发——因为我们从来没有过你的密钥。
- 怎么关：设置里随手关掉即可停止上传；关的时候可以顺便删掉云端那份备份。
技术细节（供审阅）：主密钥在设备上由系统随机数生成，存放在系统钥匙串（仅本机、解锁后可读，刻意不随 iCloud 钥匙串漂移）；快照用 XChaCha20-Poly1305 加密；恢复码是主密钥的可抄写编码形式。
6. 导出与销毁
- 导出：设置里「导出我的数据」把本地数据导成一份结构化文件（含记录、练习、梦、你补的那句话、你给梦打的标签）。不含录音文件本体与关系镜面的内容。
- 销毁：设置里「销毁」抹掉这台设备上的全部记录、录音与设置，并撤掉已排的提醒；若你开过云端备份，同时删掉云端那份备份与账号。不可恢复。
7. 提醒
App 会发的本地通知（早上一句、晚上三句、周五小结这一类）全部在你的设备上排程，内容不经过任何服务器。默认每天最多两条（早上一句、晚上三句）；其余每种提醒每天至多一条。觉知铃默认关着，你自己打开之后可以定每天 1–10 声。每一项都能单独关，也可以全关。没有连续天数，没有红点，不会因为你几天没打开就来催你。
8. 订阅与购买
1.0 版本没有任何付费功能，App 内没有购买、没有订阅、不展示价格。急救与危机安全卡永远免费、一按就到。
9. 儿童
本 App 非为儿童设计，不有意收集儿童个人信息。年龄分级以 App Store 商店页面显示为准（多数地区 13+）。
10. 你的权利（GDPR / CCPA 基线）
多数权利在 App 内就能行使，不必联系我们：
- 访问 / 可携带：第 6 节的导出文件就是你的完整副本。
- 删除：第 6 节的销毁。
- 限制 / 反对处理：不开启云端备份，就没有任何数据离开设备。
- 加拿大（PIPEDA）：你有权了解我们持有的关于你的个人信息并要求更正；如有疑问可先联系我们的隐私负责人，也可向加拿大隐私专员公署（Office of the Privacy Commissioner of Canada）投诉。
- GDPR（欧盟 / 英国）：合法性基础是你的同意（云端备份）与合同履行（提供 App 核心功能，数据留在本机）。你可以随时撤回同意，也可以向监管机构投诉。
- CCPA / CPRA（加州）：我们不出售、不分享你的个人信息。你享有知情、删除、更正、限制敏感信息使用的权利，行使权利不会受到任何差别对待。
无法在 App 内完成的，请联系 privacy@arcturatech.com。
11. 数据留存
本地数据保留到你自己删除或卸载 App 为止。云端备份（若你开过）保留到你请求删除、或关闭备份时选择一并删除为止。
12. 第三方
- Supabase（仅在你开启云端备份时）：只承载无法读取的密文与匿名会话，服务器位于美国。
- 除此之外，1.0 不含任何第三方数据处理方——没有分析、没有崩溃上报、没有广告、没有订阅服务商。
13. 安全
没有任何系统能保证绝对安全。设备丢失、被他人解锁或越狱/root，都可能带来风险。恢复码请像密码一样保管。
14. 变更与联系
政策更新会发布在本页并更新生效日期；重大变更会在 App 内提示一次。隐私问题请联系 privacy@arcturatech.com，或写信至 Arctura Technologies Inc., Unit 10, 1338 Wellington Street West, Ottawa, Ontario K1Y 3B7, Canada。
Who runs this app
照见 Offscript (“the app”) is developed and operated by Arctura Technologies Inc., a corporation registered in Ontario, Canada, at Unit 10, 1338 Wellington Street West, Ottawa, Ontario K1Y 3B7, Canada. “We” and “us” in this policy mean that company. We are the controller of your personal information and have designated a Privacy Officer. Privacy questions, complaints and rights requests go to privacy@arcturatech.com; product support goes to support@arcturatech.com.
1. In one line
This app keeps what you write in your own hands. By default it does not go online, upload, analyse, or advertise.
2. Three nevers
- No ads. No advertising in the app, no ad SDKs.
- We never sell emotional data. We do not sell, rent, or share any of your emotional or behavioural records for marketing.
- Never used for insurance or credit profiling. Never used for insurance, credit, employment, or any scoring or profiling purpose.
3. Where your entries live
Everything you create in the app (emotion words, body locations, which of the three you chose, the line you wrote, practice logs, dream notes and recordings, relationship notes) stays on this device.
What protects it is the operating system's file protection (Data Protection on iOS; on Android, the device's own encryption). We do not add a second layer of encryption to the database — that sentence is here because we only claim what we actually do.
Your voice recordings likewise stay in the app's own folder on this device.
4. Offline by default
- With cloud backup off (see §5), the app sends nothing to any server.
- No telemetry, no usage analytics, no third-party crash-reporting SDK, no advertising identifier (no IDFA, and no App Tracking Transparency prompt).
5. Back up to the cloud (off by default · end-to-end encrypted · no account)
We call it a backup, not “sync”: it takes a whole snapshot and restores it on a new phone. It does not merge across devices in real time.
- Off by default. Before you turn it on, a card spells out what is stored, what isn't, who can read it, and how to turn it off.
- What is stored: your entries, practices, dreams, the tags and meanings you wrote for things in your dreams, and your settings, packed into one snapshot and encrypted on your phone before anything is uploaded.
- What is not stored: voice recordings, relationship notes, and lines you added afterwards. Those stay on this device.
- Who can read it: only you, with your recovery code. Encryption and decryption happen on your device and the key never leaves it. What we hold is ciphertext we cannot read.
- No account: no sign-up, no name, email, or phone number. Uploads run over an anonymous session; the ciphertext is not linked to your identity and is not used for tracking.
- Recovery code: generated once when you turn backup on and shown full-screen for you to write down; you can view it again in settings. Enter it on a new phone to get your backup back. If you lose it we cannot reissue it — we never had your key.
- Turning it off: switch it off in settings and uploads stop. You can delete the cloud copy at the same time.
Technical detail, for reviewers: the master key is generated on-device from the system random source and held in the system keychain (this device only, readable only while the device is unlocked, deliberately not synced to iCloud Keychain); snapshots are encrypted with XChaCha20-Poly1305; the recovery code is a writable encoding of that master key.
6. Export and destroy
- Export: “Export my data” in settings writes your local data to a structured file (entries, practices, dreams, the lines you added afterwards, the tags you put on dreams). It does not include the recording files themselves or your relationship notes.
- Destroy: “Destroy” in settings wipes every entry, recording and setting on this device and cancels any scheduled reminders. If you ever turned on cloud backup, it deletes the cloud copy and the anonymous account too. This cannot be undone.
7. Reminders
Every notification the app sends (the morning line, the three evening lines, the Friday summary, and so on) is scheduled on your device; the content never passes through a server. By default at most two a day (the morning line and the evening lines); every other kind is at most one a day. The awareness bell is off until you turn it on, and you choose how many chimes a day (1–10). Each one can be switched off on its own, or all of them at once. No streaks, no badges, and nothing that nags you for having been away.
8. Subscriptions and purchases
Version 1.0 has no paid features: no in-app purchase, no subscription, no prices shown anywhere. Rescue breathing and the crisis safety card are always free and one tap away.
9. Children
The app is not designed for children and does not knowingly collect children's personal information. The age rating shown on the App Store product page applies (13+ in most regions).
10. Your rights (GDPR / CCPA baseline)
Most of these you can exercise in the app, without contacting us:
- Access / portability: the export file in §6 is your complete copy.
- Deletion: “Destroy” in §6.
- Restriction / objection: leave cloud backup off and nothing leaves the device.
- Canada (PIPEDA): you may ask what personal information we hold about you and request corrections. Contact our Privacy Officer first; you may also complain to the Office of the Privacy Commissioner of Canada.
- GDPR (EU / UK): the legal bases are your consent (cloud backup) and performance of a contract (providing the app's core functionality, kept on-device). You may withdraw consent at any time and lodge a complaint with a supervisory authority.
- CCPA / CPRA (California): we do not sell or share your personal information. You have the rights to know, delete, correct, and limit the use of sensitive information, and you will not be treated differently for exercising them.
For anything you cannot do in the app, contact privacy@arcturatech.com.
11. Retention
Local data is kept until you delete it or uninstall the app. A cloud backup (if you ever turned it on) is kept until you ask us to delete it, or until you delete it while switching backup off.
12. Third parties
- Supabase (only when you turn cloud backup on): carries nothing but unreadable ciphertext over an anonymous session; servers are located in the United States.
- Beyond that, 1.0 has no third-party data processors — no analytics, no crash reporting, no advertising, no subscription vendor.
13. Security
No system can guarantee absolute security. A lost device, one someone else can unlock, or a jailbroken/rooted device all carry risk. Keep your recovery code the way you would keep a password.
14. Changes and contact
Updates are posted on this page with a revised effective date; material changes are surfaced once in the app. For privacy questions: privacy@arcturatech.com, or by mail to Arctura Technologies Inc., Unit 10, 1338 Wellington Street West, Ottawa, Ontario K1Y 3B7, Canada.