hello@arcturatech.com

照见隐私政策 · Offscript Privacy Policy

iOS / iPadOS · Version 3.0 · 生效日期 / Effective · Arctura Technologies Inc.

中文 · English

本政策适用于 iOS / iPadOS 上的照见 3.0 及以后的版本。安卓版（1.x）仍适用 1.0 版隐私政策。

谁在运营这个 App

照见由 Arctura Technologies Inc. 开发和运营，这是一家在加拿大安大略省注册的公司，地址：Unit 10, 1338 Wellington Street West, Ottawa, Ontario K1Y 3B7, Canada。本政策里的「我们」就是这家公司；我们是你个人信息的控制者，并已指定隐私负责人（Privacy Officer）。隐私问题、投诉和权利请求请写到 privacy@arcturatech.com；使用上的问题请写到 support@arcturatech.com。

1. 先说结论

你在照见里写下的东西只存在你的手机上，照见不会把它上传到我们的服务器（手机自己的 iCloud 云备份会照常带上它，见 §3）。你可以选择用 Apple、Google 或邮箱验证码登录；登录以后，记录也一样只在你的手机上，我们只保存登录要用的身份信息。App 里没有广告，不接入任何统计或广告工具。

2. 三条承诺

  • 没有广告：App 里没有广告，也没有任何广告工具。
  • 不出售情绪数据：不出售、不出租，也不为营销目的分享你的任何情绪或行为记录。
  • 不用于画像：不用于保险、信贷、雇佣，或任何评分、画像。

3. 你的记录存在哪里

  • 你在照见里创建的内容，包括心情词、身体的感受、三种结果里选了哪一个、写下的话、练习记录、梦的文字与录音、睡前写下的事、关系里的记录、设置，都存在这台设备上 App 自己的目录里，不会上传到我们的服务器。
  • 保护它的是 iOS 的数据保护。我们没有给本机的数据库另外加一层加密。
  • 录音文件只存在这台设备上，导出文件里也只有文件名和时长。
  • 设备备份：iPhone 的 iCloud 云备份或电脑备份，会照常把照见的数据（包括录音）一起备份。这份备份由 Apple 或你的电脑按你自己的设置保存，不经过我们的服务器，我们也看不到；不想让照见进 iCloud 云备份，可以在系统的 iCloud 备份设置里把它关掉。

4. 不登录时

  • 不登录，App 就不向任何服务器发送数据。没有遥测，没有使用分析，没有第三方崩溃上报，没有广告标识符（不使用 IDFA，不会出现「App 跟踪透明度」的授权框）。
  • 只有这几种情况会联网，而且都是你自己发起的：一是你在 1.0 里申请过删除云端备份、还没删完，3.0 会接着删完；二是你用恢复码找回 1.0 时代的云备份，这时 App 会建立一个匿名的会话，只用来读取那份加密备份；三是你删除 1.0 时代的云备份（在「数据与隐私」里，或清除所有记录时一起删），这时如果还没有匿名会话，App 会临时建一个，删完备份就把这个临时的匿名账号也删掉。删除时没连上网，下次打开照见会接着删。

5. 登录（可选）

登录方式。 3.0 可以用「通过 Apple 登录」「通过 Google 登录」或「邮箱验证码」登录，不设密码。不登录也能用全部功能。

登录以后，记录仍只在你的设备上。 这个版本不同步：你的记录不会上传，也不会出现在你的其他设备上。

我们因此保存的身份信息：

  • 一个账号编号（随机生成）。
  • 用邮箱登录时：你的邮箱地址，用来发送验证码、让你登录回同一个账号；还有你当时用的 App 语言（中文或英文），验证码邮件按它来写。
  • 通过 Apple 登录时：Apple 给本 App 的用户标识，以及 Apple 随登录给出的邮箱（如果有；你选了「隐藏邮件地址」时是 Apple 的中转地址）。我们不向 Apple 请求你的名字以外的资料；Apple 给的名字只存在你的手机上，不上传。
  • 通过 Google 登录时：Google 给本 App 的账号标识。我们只向 Google 请求这一项，不请求你的邮箱、名字或头像。
  • 登录会话的记录：IP 地址、设备类型（来自网络请求的 User-Agent）和时间，由登录服务自动记下，用于保持登录和防止滥用。

通过 Google 登录时，Google 那边会发生什么。 Google 的登录页在系统的登录窗口里打开，你在那一页上输入的内容照见看不到；这个窗口也不使用你在 Safari 里已经登录的 Google 账号。Google 会知道你用这个 Google 账号登录了照见，这一点适用 Google 的隐私政策，你可以在自己的 Google 账号设置里看到并移除这个关联。登录时 Google 交回的凭证里，App 只把一个一次性的身份凭证交给我们的登录服务核对，其余的立刻丢弃，不保存、不上传。我们不会把你的任何记录发给 Google。

退出登录。 本机记录保留，这台设备上的登录会话作废。

邮箱登录走到一半。 用邮箱登录时，App 会先建一个匿名账号，用来接收验证码、验证之后转成你的账号。如果你没填验证码就关掉了登录页，这个匿名账号连同你填的邮箱会被删掉；当时没连上网，下次打开照见会接着删。

6. 删除账号

在 App 里：我 › 账号 › 删除账号。删除后：

  • 账号和我们为它保存的身份信息立刻删除，无法恢复；你在 1.0 时代留在服务器上、能用这台设备找到的备份也一起删除；
  • 其他登录着同一个账号的设备随之退出登录，它们本机的记录不会被删；
  • 这台手机上的记录由你选：留下，或一起清空；
  • 通过 Apple 登录的账号，删除前 App 会请 Apple 再确认一次，我们随即撤销本 App 的「通过 Apple 登录」授权；
  • 通过 Google 登录的账号，我们这边的账号和 Google 账号标识一起删除。我们没有保存 Google 的登录凭证，不需要向 Google 撤销什么；你的 Google 账号设置里那条关联由 Google 保存，你可以在那里自己移除。

7. 导出与清除

  • 导出：「我 › 数据与隐私 › 导出我的记录」把你的记录导出成一份 JSON 文件。录音本身和关系里的记录不在文件里。
  • 清除所有记录：「我 › 数据与隐私 › 清除所有记录」删除这台手机上的全部记录、录音和设置，并取消已经排好的提醒；这台手机上如果有 1.0 时代云备份的钥匙，那份云备份也一起删除。账号保留。无法恢复。当时没连上网、云备份没删掉，App 会照实告诉你，下次打开照见时接着删。
  • 删除 1.0 的云备份：「我 › 数据与隐私 › 删除 1.0 版的云备份」（这台手机上有那份备份的钥匙时才出现，不需要登录）。删除后，用恢复码也找不回来；这台手机上的记录不受影响。

8. 语音、录音与设备上的模型

  • 麦克风：只在你按住说话、或夜里录梦时使用。可以按住说话的地方：记一下、早上一句与睡前三句、一日两句、放下念头、站到对面、静坐里记一笔刚才的感觉、安睡的睡前工单，以及梦（记下碎片、孵梦的问题、改写）。录音存在这台设备上。
  • 语音识别：把你说的话转成文字，只在设备上进行，不发送到 Apple 或我们的服务器。
  • 设备上的模型：「梦 › 三步读梦」在支持 Apple 智能的设备上使用 Apple 的设备端模型，帮你想几个问题、给出可能的读法。整个过程在设备上完成，你写的梦不会发送给我们。

9. 提醒事项与通知

  • 通知：早上一句、睡前三句、每周回顾这类提醒都在你的设备上排好，内容不经过任何服务器。一天最多两次，每一种都可以单独关掉。没有角标。你在「气头上」里点「到时提醒我」约的那一条是当场约的，不算在这两次里；它同样只在设备上排好，命中危机词后的 24 小时里不会响，清除所有记录时也会一起取消。
  • 提醒事项：只有在你打开「也加到『提醒事项』」或点「到时提醒我」时，照见才会往系统的「提醒事项」里加一条，内容是你写下的那件事或一句提醒。照见不读取、不修改你已有的提醒。加进去以后，这条提醒由「提醒事项」保存，会按你自己的 iCloud 设置同步，不经过我们的服务器。

10. 小组件、控制中心与快捷指令

小组件读的是 App 留给它的一份简短状态（只有「是哪一种提醒」和时间），里面不放你写下的任何话。控制中心、操作按钮和快捷指令只负责打开 App 的某一页。

11. 危机安全卡与联系人

  • 你写下的文字会在设备上和一份危机词表比对。命中时，App 只显示安全卡和求助热线。这个比对不联网，结果也只留在这台设备上。
  • 安全卡上的「联系我信任的人」用的是系统的联系人选择器：照见看不到你的通讯录，只拿到你选的那个号码，用来拨号，不保存。

12. 订阅与购买

3.0 没有任何付费功能：没有 App 内购买，没有订阅，App 里不出现价格。急救和危机安全卡永远免费、不需要登录。

13. 儿童

照见不是为儿童设计的，我们也不会有意收集儿童的个人信息。年龄分级以 App Store 页面为准（多数地区为 13+）。

14. 你的权利（GDPR / CCPA 基线）

很多事在 App 里就能自己做，不必联系我们：

  • 访问与携带：§7 的导出文件。
  • 删除：§6 删除账号，或 §7 清除所有记录。
  • 限制与反对处理：你的记录本来就不离开设备；不登录，我们就没有你的任何信息。
  • GDPR（欧盟 / 英国）：处理的法律依据是履行合同（提供你选择创建的账号）。你可以随时删除账号，也可以向监管机构投诉。
  • CCPA / CPRA（加州）：我们不出售、不分享你的个人信息。你有知情、删除、更正、限制使用敏感信息的权利，行使这些权利不会让你受到区别对待。

App 里做不到的，请写信到 privacy@arcturatech.com。

15. 保留多久

  • 本机数据：直到你删除，或卸载 App。
  • 账号与身份信息：直到你删除账号。
  • 登录会话的记录：随会话过期或删除账号一起删除。
  • 1.0 时代的云备份：直到你在 App 里删除它（「数据与隐私 › 删除 1.0 版的云备份」，或清除所有记录时一起删）、删除账号，或在 1.0 里删除它。
  • 邮箱登录中途关掉留下的匿名账号与你填的邮箱：关掉登录页时随即删除（没连上网时，下次打开照见删除）。为删除 1.0 云备份临时建的匿名账号：用完即删。

16. 帮我们处理数据的服务商

  • Supabase：提供登录服务的服务器和数据库，保存 §5 里列出的身份信息，以及 1.0 时代的加密备份。服务器位于美国。
  • Apple：「通过 Apple 登录」由 Apple 提供，适用 Apple 的隐私政策；删除账号时我们会请 Apple 撤销本 App 的授权。
  • Google：「通过 Google 登录」由 Google 提供，适用 Google 的隐私政策。我们只从 Google 拿到一个账号标识，不向 Google 发送你的任何记录。
  • 除此之外没有别的数据处理方：没有统计、崩溃上报、广告或订阅服务商。

17. 安卓版与 1.0

安卓版目前仍是 1.x，它的「备份到云端」（匿名、恢复码、整份快照加密备份）照旧按 1.0 版政策的说明运行；3.0 的账号与安卓版无关。iOS 从 1.0 升级到 3.0 时，你的本机数据原样保留。

18. 安全

没有任何系统能保证绝对安全。设备丢失、被别人解锁或越狱，都可能带来风险。请保管好你的设备、Apple ID、Google 账号和登录用的邮箱。

19. 变更与联系

政策有变化时，我们会更新本页和生效日期；重大变化会在 App 里提示一次。隐私问题请写信到 privacy@arcturatech.com。

This policy applies to Offscript on iOS and iPadOS, from version 3.0. The Android app (1.x) remains under the version 1.0 Privacy Policy.

Who runs this app

Offscript is developed and operated by Arctura Technologies Inc., a company registered in Ontario, Canada, at Unit 10, 1338 Wellington Street West, Ottawa, Ontario K1Y 3B7, Canada. "We" in this policy means that company. We are the controller of your personal information and have designated a Privacy Officer. Privacy questions, complaints and rights requests go to privacy@arcturatech.com. Questions about using the app go to support@arcturatech.com.

1. The short version

What you write in Offscript stays on your phone. Offscript never uploads it to our server (your phone's own iCloud Backup still includes it; see §3). You can choose to sign in with Apple, Google, or an email code; after you sign in, your records still stay on your phone, and we keep only the details needed for sign-in. There are no ads in the app, and no analytics or advertising tools.

2. Three commitments

  • No ads. There's no advertising in the app and no advertising tools.
  • We don't sell emotional data. We don't sell, rent or share any of your emotional or behavioral records for marketing.
  • No profiling. Your data is never used for insurance, credit, employment, or any kind of scoring or profiling.

3. Where your records live

  • Everything you create in Offscript, including mood words, body sensations, which of the three outcomes you chose, the lines you write, practice history, dream notes and recordings, bedtime lists, relationship notes and settings, is stored in the app's own folder on this device. None of it is uploaded to our server.
  • It's protected by iOS Data Protection. We don't add a second layer of encryption to the local database.
  • Voice recordings stay on this device, and the export file only lists their names and lengths.
  • Device backups: iCloud Backup or a computer backup of your iPhone includes Offscript's data, recordings too, as usual. That backup is kept by Apple or your computer according to your own settings. It doesn't pass through our server and we can't see it. To keep Offscript out of iCloud Backup, turn it off in your iCloud Backup settings.

4. If you don't sign in

  • Without signing in, the app sends nothing to any server. No telemetry, no usage analytics, no third-party crash reporting, and no advertising identifier (no IDFA and no App Tracking Transparency prompt).
  • There are only a few exceptions, and you start each of them yourself: finishing the deletion of a cloud backup you asked to delete in version 1.0; restoring a 1.0 cloud backup with its recovery code, for which the app opens an anonymous session used only to read that encrypted backup; and deleting a 1.0 cloud backup (in Data and privacy, or together with Clear all records). If there's no anonymous session yet, the app creates a temporary one for the deletion and deletes that anonymous account as soon as the backup is gone. If you're offline at the time, the deletion continues the next time you open Offscript.

5. Signing in (optional)

How you sign in. Version 3.0 offers Sign in with Apple, Sign in with Google, and a one-time email code. There are no passwords. Every feature works without signing in.

Your records stay on your device after you sign in. This version doesn't sync: your records aren't uploaded and don't appear on your other devices.

What we keep to run your account:

  • An account number, generated at random.
  • If you sign in with email: your email address, so we can send the code and sign you back into the same account, and the app language you were using (Chinese or English), so the code email is written in that language.
  • If you use Sign in with Apple: the user identifier Apple gives this app, and the email address Apple provides with it, if any (an Apple relay address if you chose Hide My Email). Apart from your name, we don't ask Apple for anything; if Apple shares your name, it stays on your phone and is never uploaded.
  • If you use Sign in with Google: the account identifier Google gives this app. That's the only thing we ask Google for; we don't ask for your email address, name or photo.
  • Records of your sign-in sessions: IP address, device type (from the network request's user agent) and times. The sign-in service keeps these to hold your session and to prevent abuse.

What happens on Google's side. Google's sign-in page opens in the system's sign-in window. Offscript can't see what you enter there, and the window doesn't use any Google account you're signed in to in Safari. Google will know that you used your Google account to sign in to Offscript. Google's privacy policy covers that, and you can see and remove the connection in your Google Account settings. Of the credentials Google returns at sign-in, the app passes one single-use identity token to our sign-in service to check, and discards the rest without storing or uploading them. We never send any of your records to Google.

Signing out. Your records stay on this device, and this device's session ends.

If you stop partway through email sign-in. For an email sign-in, the app first creates an anonymous account that receives the code and becomes your account once the code is verified. If you close the sign-in screen without entering the code, that anonymous account and the email address you typed are deleted. If you're offline at the time, they're deleted the next time you open Offscript.

6. Deleting your account

In the app: Me › Account › Delete account. When you delete your account:

  • your account and the details we keep for it are erased right away and can't be recovered, along with any 1.0-era backup on our server that this device can identify;
  • other devices signed in to the same account are signed out, but the records on them aren't deleted;
  • you choose whether to keep the records on this phone or clear them too;
  • if you used Sign in with Apple, the app asks Apple to confirm once more, and we then revoke the app's Sign in with Apple authorization;
  • if you used Sign in with Google, your account and the Google account identifier are erased on our side. We don't keep any Google sign-in credentials, so there's nothing to revoke with Google. The connection shown in your Google Account settings is kept by Google, and you can remove it there.

7. Export and clearing

  • Export: Me › Data and privacy › Export my records saves your records as a JSON file. Voice recordings themselves and relationship notes aren't included.
  • Clear all records: Me › Data and privacy › Clear all records deletes every record, recording and setting on this phone and cancels scheduled reminders. If this phone holds the key to a cloud backup from version 1.0, that backup is deleted too. Your account stays. This can't be undone. If you're offline and the backup can't be deleted then, the app tells you so, and the deletion continues the next time you open Offscript.
  • Delete the version 1.0 cloud backup: Me › Data and privacy › Delete the version 1.0 cloud backup (shown only when this phone holds that backup's key; no sign-in needed). Once deleted, the recovery code can't bring it back. Records on this phone aren't affected.

8. Voice, recordings and the on-device model

  • Microphone: used only while you hold to talk, or record a dream at night. Hold to talk is available in Note, the morning line and the evening lines, Two Lines a Day, Let Thoughts Go, Their Side, noting how you feel in Quiet Sitting, the bedtime list in Sleep, and Dreams (dream fragments, incubation questions and rewrites). Recordings stay on this device.
  • Speech recognition: turns what you say into text on the device only. Nothing is sent to Apple or to our server.
  • On-device model: Dreams › Read a dream uses Apple's on-device model, on devices that support Apple Intelligence, to suggest a few questions and possible readings. It all happens on the device, and your dream isn't sent to us.

9. Reminders and notifications

  • Notifications: the morning line, the evening lines, the weekly review and similar reminders are scheduled on your device, and their content never passes through a server. At most two a day, and each kind can be turned off. No badges. A reminder you set yourself with "Remind me then" in In the Heat of It doesn't count toward the two a day. It's also scheduled only on your device, stays silent for 24 hours after crisis words are detected, and is cancelled when you clear all records.
  • Reminders app: only when you turn on "Also add to Reminders" or tap "Remind me then" does Offscript add an item to Apple's Reminders app, containing the task you wrote or a short reminder line. Offscript never reads or changes your existing reminders. Once added, the item is kept by Reminders and syncs according to your own iCloud settings, not through our server.

10. Widgets, Control Center and Shortcuts

Widgets read a short status the app leaves for them (only which kind of reminder it is, and the time). None of your own words go into it. Control Center, the Action button and Shortcuts only open a page in the app.

11. The crisis safety card and contacts

  • The text you write is compared with a list of crisis words on your device. If there's a match, the app shows only a safety card and crisis lines. The check doesn't go online, and the result stays on this device.
  • "Contact someone I trust" on the safety card uses the system contact picker. Offscript can't see your contacts; it only receives the number you pick, uses it to place the call, and doesn't store it.

12. Subscriptions and purchases

Version 3.0 has no paid features: no in-app purchases, no subscriptions, and no prices in the app. Rescue and the crisis safety card are always free and never require signing in.

13. Children

Offscript isn't designed for children, and we don't knowingly collect children's personal information. The age rating on the App Store page applies (13+ in most regions).

14. Your rights (GDPR / CCPA baseline)

You can do much of this yourself in the app, without contacting us:

  • Access and portability: the export file in §7.
  • Deletion: delete your account (§6) or clear all records (§7).
  • Restriction and objection: your records never leave your device, and if you don't sign in, we hold nothing about you.
  • GDPR (EU / UK): the legal basis is performance of a contract (providing the account you choose to create). You can delete your account at any time and complain to a supervisory authority.
  • CCPA / CPRA (California): we don't sell or share your personal information. You have the right to know, delete, correct, and limit the use of sensitive information, and you won't be treated differently for using these rights.

For anything you can't do in the app, write to privacy@arcturatech.com.

15. How long we keep data

  • Data on your device: until you delete it or uninstall the app.
  • Your account and its details: until you delete your account.
  • Sign-in session records: deleted when the session expires or when you delete your account.
  • Cloud backups from version 1.0: until you delete the backup in the app (Data and privacy › Delete the version 1.0 cloud backup, or together with Clear all records), delete your account, or delete the backup in version 1.0.
  • The anonymous account and email address left by an email sign-in you didn't finish: deleted when you close the sign-in screen (or the next time you open Offscript, if you were offline). A temporary anonymous account created to delete a 1.0 cloud backup: deleted right after use.

16. Service providers

  • Supabase runs the sign-in servers and database. It holds the account details listed in §5 and the encrypted backups from version 1.0. Its servers are located in the United States.
  • Apple provides Sign in with Apple, under Apple's own privacy policy. When you delete your account, we ask Apple to revoke this app's authorization.
  • Google provides Sign in with Google, under Google's own privacy policy. We receive only an account identifier from Google and send Google none of your records.
  • There are no other data processors: no analytics, crash reporting, advertising or subscription vendors.

17. Android and version 1.0

The Android app is still version 1.x. Its cloud backup (anonymous, recovery code, one encrypted snapshot) works as described in the 1.0 policy. A 3.0 account isn't used by the Android app. When you update from 1.0 to 3.0 on iOS, your local data is kept as it was.

18. Security

No system can promise perfect security. A lost device, a device someone else can unlock, or a jailbroken device all carry risk. Keep your device, your Apple ID, your Google account and the email you sign in with safe.

19. Changes and contact

When this policy changes, we'll update this page and the effective date, and we'll mention major changes once in the app. For privacy questions, write to privacy@arcturatech.com.