露營掌門
隱私權政策

最後更新：2026 年 11 月 7 日（招募網頁加入「用 Google 帳號帶入 Email」與官方 LINE）

「露營掌門」（以下稱「本 App」）由紫芙數位（以下稱「我們」）提供。本政策說明我們收集哪些資料、怎麼使用，以及你有哪些選擇。

先說重點

第一次打開 App 時，會自動建立一個匿名的訪客帳號（只有系統產生的識別碼，沒有姓名、信箱），用來送出營況回報、回報問題與保存營火幣。
你可以選擇用 Google 帳號登入，換手機時找回會員、營火幣、徽章與分享碼。
營況回報（訊號、水壓、小黑蚊、路況與備註）是你主動送出的，會分享給其他露友參考；別人看得到回報內容和你選用的稱號，看不到你的帳號、名稱或信箱。
定位：你允許定位後，App 會在手機上用你的位置算海拔（高度計）、找最近的營地與醫院（緊急資訊、周邊資源）、判斷你是不是在營地附近（會員的 GPS 偵測、問你要不要記進露營日誌、訊號小兵）。這些位置只在手機上計算，不會上傳；回報營況只會附上「是否在營地附近」一個是非值。只有兩個例外，而且都是你自己開啟的：①「平安錨」開著時，你最後一次打開 App 的位置會存到我們的伺服器，只有在你逾時沒回報平安時，才推播給你指定的守護人；②「私密口袋名單」裡你自己加的私藏營點座標會存到雲端，只有你和你用分享碼指定的好友看得到。查天氣時送出的是營地座標，不是你的位置。
會員的露營相簿會在你允許後讀取手機照片的拍攝地點來分營地，照片與地點都只在手機上整理，不會上傳。
本 App 有獎勵廣告（Google AdMob 提供）：只有你自己按「看廣告試用會員」才會播放。歐盟等地區會先請你同意。會員不會載入廣告。
你可以隨時在 App 內刪除帳號，雲端上屬於你的資料會一併刪除。

我們收集的資料

資料	何時收集	用途
帳號資料：系統產生的帳號識別碼；用 Google 登入時，另有 Google 帳號的電子郵件與顯示名稱	第一次打開 App 時自動建立訪客帳號；你按「用 Google 帳號登入」時（由 Google Firebase Authentication 保存）	辨識你的帳號、在「我的」頁顯示登入的帳號、換手機時找回你的資料
營況回報：營地、三家電信的訊號格數、小黑蚊等級、水壓是否穩定、低底盤能不能進、你寫的備註、你選用的稱號、送出時間、帳號識別碼	你在「營況情報局」按「回報營況」並送出時	整理成營地的訊號、水壓、小黑蚊平均，給所有露友參考；發放營火幣與經驗值。其他露友看得到回報內容與稱號，看不到你的帳號。請不要在備註寫出個人資料
個人紀錄：經驗值、回報次數、取得的徽章、車廂演習每一關的星數	這些數字有變動時，自動同步到雲端	換手機或重新安裝後找回你的紀錄
營火幣：餘額、兌換過的商品（會員天數、進階關卡、稱號、配色）、每天與每月的計數、每一筆增減明細	你回報營況、領取回報問題獎勵、在營火幣商店兌換時（由我們的伺服器計算與記錄）	正確發放與扣除營火幣、套用兌換的商品、避免重複發放或作弊
回報問題內容	你送出回報時：你寫的說明、當下的畫面截圖（送出前可預覽或移除）、App 版本、機型、Android 版本、所在畫面、語言、字體縮放、深色模式、是否會員、目前選的營地、帳號識別碼，以及用 Google 登入時的帳號電子郵件（讓我們知道是哪個帳號回報的；訪客帳號沒有信箱就不會附上）	重現並修正問題；把處理進度、回覆與獎勵送回你的 App
許願內容（只限年訂閱會員）	你送出許願時：許願文字、App 版本、帳號識別碼、送出時間	了解大家想要什麼功能；把評估結果通知你
分享碼與兌換紀錄	你用 Google 登入後取得分享碼，或輸入分享碼、兌換碼時：你的分享碼與被兌換的次數、兌換到的會員期限（含訂閱期間暫停保存的天數）、你兌換過哪些代碼與時間、當天嘗試兌換的次數、帳號識別碼	產生不重複的分享碼、發給你和朋友會員天數、避免同一組代碼被重複兌換或被猜代碼。朋友兌換你的分享碼時，不會看到你的信箱或名稱
訂閱、終身會員與營火幣包的購買紀錄	你購買或恢復購買時：Google Play 的購買憑證、訂閱方案與到期時間；買終身會員或營火幣包時另有商品、訂單編號（營火幣包另有發放的枚數）	確認會員資格（由我們的伺服器向 Google Play 查詢）、避免同一筆購買被不同帳號重複使用。付款由 Google Play 處理，我們看不到你的付款資料
封閉測試期間的使用紀錄（2026 年 10 月 19 日起）：Google 帳號的電子郵件與名稱、帳號識別碼、App 版本、有打開 App 的日期（台灣日期）	封閉測試期間，你用 Google 登入後，每天第一次打開 App 時自動送出一次；沒登入（訪客）不會記	確認誰參加了測試、測了幾天，好發放測試獎勵（高級會員）。不記錄你在 App 裡做了什麼
平安錨：預計到家時間、營地名稱與座標、車牌（選填）、備註（選填）、最後一次打開 App 的位置與時間	你開啟平安錨時；平安錨開著時打開 App	逾時沒按「我平安到家」時，推播給你指定的守護人。按「我平安到家」就關閉
守護關係：你和守護人的帳號識別碼、雙方的暱稱；推播權杖（裝置的通知識別碼）	守護人輸入你的守護碼時；登入後	決定誰收得到你的平安錨通知、送出推播。雙方都能隨時解除守護關係
私密口袋名單：營點名稱、座標、筆記；看得到你名單的好友暱稱	你加入營點、產生分享碼、好友輸入分享碼時	只給你和你指定的好友看；你可以隨時移除好友或停止分享
出發前天氣變化通知（會員）：口袋名單營點的出發日，以及我們每天查到的那個營點的降雨機率、最低溫、陣風	你在口袋名單設定出發日時；之後每天傍晚由我們的伺服器用營點座標查天氣	天氣比之前明顯變差時推播提醒你；出發日過後不再查詢
家庭方案：家庭擁有者與家人的帳號關係、家人的暱稱	你產生家庭碼，或用家庭碼加入家庭時	讓家人共享會員；擁有者看得到家人的暱稱，家人退出、被移除或刪除帳號時移除
團露投票：標題、候選日期、候選營地與分工（會員）、參加者的暱稱、投票與認領的分工	你發起或參加投票時	讓知道邀請碼的朋友一起選日期；發起人可以刪除整個投票
露營日誌：每一露的營地、縣市、海拔、日期、晚數，與當晚的最低溫、有沒有下雨、月亮亮度	你記一露時	徽章牆、縣市拼圖、海拔階梯
帳篷保養（會員）：帳篷名稱、防水塗層、購買年份、每次濕帳到曬乾的天數	你新增帳篷、按「濕帳收回家」與「曬乾了」時	保養紀錄與防水膠壽命估算
營況回報新增的欄位：衛浴熱水、吹風機、飲水機、營區規則、下午西曬	你回報營況時（選填）	和原本的營況回報一樣，整理後給其他露友參考，看不到你的帳號
夜衝倒數（會員）：出發地與營地座標；每天查詢的次數	你按「計算（即時路況）」時	由我們的伺服器向 Google 路線服務查含即時路況的車程。座標不保存，只記當天查了幾次（每天上限）
手機資料雲端備份（年繳與終身會員）：只存在手機上的設定與紀錄，包括離線營區包清單與你的筆記、團露分工清單、帳篷保養的家鄉縣市、各營地的海拔校正值、營位日照標記的遮蔽物方位、顯示設定（深淺色、字體、小提示）、露營美食的菜名、餐別與照片在手機上的連結（不含照片本身）、相簿「改到別的營地」的照片編號對應	你按「立即備份」，或選了「即時」「每週」自動備份時	換手機或重裝 App 後還原。照片本身、照片的拍攝地點與你的位置軌跡都不會備份；相簿只帶照片在手機上的編號。只有你自己讀得到，刪除帳號時一併刪除
幸運大獎：抽獎報名（帳號識別碼、報名日期）、第一次用 Google 登入與第一次付費的順序號碼、中獎與領取紀錄	每天第一次打開 App 時，符合資格（用 Google 登入、有連續打開）就自動報名；第一次用 Google 登入、第一次訂閱或買終身會員時給號碼	抽出每日得主、確認幸運號碼、發放營火幣或會員天數。公開看板只顯示人數與活動進度，不顯示任何人的帳號。報名名單 30 天內刪除；刪除帳號時一併刪除你的獎項與報名
網路整理的糾正：你按「已經不是這樣了」的營地、哪一句、糾正的種類、你寫的現在狀況（選填）、帳號識別碼、時間	你在營地的「網路整理」按「已經不是這樣了」並送出時	兩人以上回報時把那一句標成「可能過時」；你寫的文字只有管理員看得到，用來更新整理內容。可以隨時收回，刪除帳號時一併刪除
當機報告：當機時的程式錯誤紀錄、機型、Android 版本、App 版本、安裝識別碼	App 發生當機或嚴重錯誤時（由 Google Firebase Crashlytics 收集）	找出並修正造成當機的問題；不含你寫的內容或截圖
廣告識別碼、裝置資訊、大致位置（由網路位址判斷）、廣告互動、同意設定	你按「看廣告試用會員」時；歐盟等地區會在 App 開啟時先詢問你是否同意（Google 同意管理平台）。會員與開發者帳號不會初始化廣告	由 Google AdMob 提供與統計廣告、避免作弊。依 Google 隱私權政策處理。你可以在「我的 › 回報與隱私 › 廣告隱私權選項」修改同意，也可以在手機系統設定重設或刪除廣告識別碼

只在你手機上、不會傳出的資料

裝備清單的勾選、車宿模式與營位有電的設定、最近選的營地、使用中的稱號與配色、看廣告試用的次數：只存在你的手機上，而且依帳號分開保存。
手機的加速度感測器與指南針：只在「睡墊車宿水平儀」與「抗風抗曬羅盤」裡即時換算角度與方位，不會儲存，也不會上傳。
天氣預報的暫存：存在手機上，讓你離線時也能看到上一次的預報。
營火故事接龍的錄音（你允許「麥克風」權限後才會使用）：只存在你的手機上，不會上傳；只有會員按「分享音檔」時，才由你自己選要分享給誰。
高度計的氣壓與海拔、營位日照標記的遮蔽物、離線營區包的筆記與存檔、各營地「用我測到的海拔」：只在你的手機上。
周邊資源與醫院：資料打包在 App 裡（來自 OpenStreetMap），找最近的地點是在手機上算，不會送出你的位置。
露營美食的照片、相簿做成的小動畫、整理到手機資料夾的照片：美食照片由你用系統的照片挑選器選取，所有照片都只在手機上讀取；小動畫在手機上製作，只有你按「分享」或「存到手機」時才由你自己決定給誰；整理資料夾時會先經過系統確認，照片只在手機裡搬移，不會上傳或複製。
桌面小工具：只顯示手機上已存的預報與營地，不會另外送出資料。
露營相簿（會員功能，你允許「相片」權限後才會使用）：在手機上讀取照片的拍攝時間與拍攝地點（照片內建的 GPS 資訊），比對營地後整理成相簿。照片、拍攝地點與整理結果只在你的手機上，不會上傳、不會複製，也不會傳給我們或任何第三方。你可以隨時在手機的系統設定收回相片權限。如果你手動把照片改到別的營地，App 會問你要不要把這次調整回報給我們（可以選「不用了」）；只有你按「回報」才會送出：原本判斷的營地、你改成的營地、拍攝地點（四捨五入到約 100 公尺）、張數與 App 版本，不含照片，用來修正營地座標與分類方式，刪除帳號時一併刪除。

我們不會讀取你手機的通訊錄或相機；只有在你使用「營火故事接龍」並允許時才會用麥克風錄音，錄音只存在手機上。定位只依上面的說明使用；相簿只有在你使用「露營相簿」並允許權限時在手機上讀取（見上一點），不會上傳。本 App 沒有使用第三方的使用行為分析工具；唯一自動回傳的是上面的當機報告。

截圖要特別注意：回報問題的截圖就是你當下手機上本 App 的畫面，可能包含你登入的帳號名稱。送出前請先看過預覽，不想傳的可以移除截圖。

會連線的第三方服務

Open-Meteo（天氣與海拔）：查天氣時，App 會把你選的營地座標送到 Open-Meteo 取得預報。這是營地的位置，不是你的位置，也不會附上你的帳號。
Google 地圖：「營況情報局」的地圖由 Google Maps 提供，顯示地圖時 Google 會收到地圖範圍、你的網路位址等資料，依 Google 隱私權政策處理。
Google Play 帳單：訂閱的付款與管理由 Google Play 處理。
Open-Meteo（其他查詢）：營位日照會查營地四周的高程（山稜線）、帳篷保養會查你選的家裡縣市的天氣、記一露時會查那幾晚的歷史天氣；氣候頁「環境」會查營地的空氣品質、海況與潮汐、溪水流量。送的都是營地或縣市政府的座標，不是你的位置。
Open-Meteo（地名搜尋）：用「用地名看天氣」時，App 會把你輸入的地名文字送到 Open-Meteo 找地點，不附帳號、不會存起來；你選過的地點只記在你的手機。高度計的地形估算用的是 App 內建的地形資料，不會送出你的位置。
Google 路線服務（Routes API）：會員按「夜衝倒數 › 計算（即時路況）」時，我們的伺服器把出發地與營地座標送去 Google 查車程，依 Google 隱私權政策處理。
Firebase 雲端通訊（FCM）：送平安錨的推播通知。

周邊資源與醫院的資料來自 OpenStreetMap（© OpenStreetMap 貢獻者，ODbL 授權），打包時下載放在 App 裡，使用時不連線。

營地名單來自交通部觀光署公開的「全台露營場相關資料」，下載這份資料不會傳送你的任何資料。

資料存放在哪裡

帳號、營況回報、個人紀錄、營火幣、回報問題、許願、分享碼與訂閱紀錄存放在 Google Firebase（Authentication、Firestore、Cloud Functions，位於台灣彰化的 asia-east1 機房），傳輸過程加密。營火幣、會員與訂閱紀錄只有伺服器能寫入，你的 App 只能讀取自己的；回報問題與許願只有開發者看得到；營況回報的內容所有登入的使用者都看得到（不含你的身分）。

保存多久

帳號、個人紀錄與營火幣：保存到你刪除帳號為止。
營況回報：保存到你刪除帳號為止；App 只顯示最近的回報。
回報問題：處理完成後定期清除（連同截圖），最長保存 90 天。
許願：保存到我們評估完需求為止。
訂閱紀錄：保存到訂閱結束後、或你刪除帳號為止。
分享碼與兌換到的會員期限：保存到你刪除帳號為止。你兌換過別人分享碼的紀錄（只有帳號識別碼與時間）會留在那組分享碼底下，用來避免同一個帳號重複兌換。
封閉測試期間的使用紀錄：保存到你刪除帳號為止（刪除帳號會一併刪除）。
平安錨、守護關係、推播權杖、私密口袋名單（含出發日與天氣比對紀錄）、家庭方案、露營日誌、帳篷保養紀錄：保存到你刪除或刪除帳號為止。
團露投票：保存到發起人刪除投票、或發起人刪除帳號為止；你自己的票在你刪除帳號時一併刪除。
夜衝倒數的查詢次數：只記當天，隔天重算。
手機資料雲端備份：每個帳號只留最新一份，保存到你刪除帳號為止。
當機報告：依 Firebase Crashlytics 的設定保存 90 天。

我們不會做的事

不會出售你的資料。
不會把你的回報、許願或帳號資料提供給廣告商或第三方。
不會把你的資料用在與本 App 無關的用途。

你的選擇與權利

不想分享營況：不要送出營況回報，其他功能照常使用。
不想看到廣告：不按「看廣告試用會員」就不會播放；成為會員後不會載入廣告。
修改廣告同意：「我的 › 回報與隱私 › 廣告隱私權選項」（需要時才會出現）。
刪除帳號與雲端資料：在 App 內「我的 › 帳號 › 刪除帳號」，確認後會刪除你的帳號，以及雲端上的個人紀錄、營火幣與明細、營況回報、許願、回報問題的處理通知、訂閱紀錄、你的分享碼與兌換到的會員期限、平安錨與守護關係、推播權杖、私密口袋名單與分享、出發前天氣比對紀錄、家庭方案（你是擁有者時家人的共享會員一併結束）、你發起的團露投票與你的票、露營日誌、帳篷保養紀錄，手機上屬於這個帳號的紀錄也會清除。刪除帳號不會取消 Google Play 的訂閱，請另外到 Google Play 取消。
沒辦法開啟 App 時：來信 zifubazaar@gmail.com，用你登入的 Google 帳號信箱寫信給我們，我們會在確認後刪除該帳號的所有資料。
移除本 App 會刪除手機上的資料；雲端上的資料要刪除帳號才會刪除。

封閉測試招募

我們在招募網頁（camppulse-app-tw.web.app/join）收集以下資料，與 App 內的帳號資料分開存放，存放在 Google Firebase（Firestore）：你填寫的 Email、你使用的手機系統（Android／iPhone）、是否同意連續測試 14 天的條件、之後願不願意測試新產品、想不想要 iOS 版，以及登記時間。

用途只有：安排 Google Play 封閉測試（僅限 Android 使用者）、測試完成後發放獎勵，以及依你的回答，日後通知你新產品測試或 iOS 版的消息。我們不會用這些資料發送廣告，也不會出售或提供給第三方；你的 Email 會提供給 Google Play 作為測試名單，依 Google 的隱私權政策處理。

招募網頁有一顆選用的「用 Google 帳號帶入 Email」按鈕：按下後會跳出 Google 帳號選單，我們只讀取你選的那個帳號的 Email 來填進欄位，讀完後會立即刪除這次按按鈕時剛建立的暫時登入紀錄（只用來讀取 Email，不會用在 App），不保存你的 Google 名稱、頭像或其他資料；如果你本來就有露營掌門的帳號，這個動作不會刪除或更動它。不想用的話，也可以直接輸入 Email。

招募網頁另提供官方 LINE 連結，加入好友或用 LINE 傳送你的帳號給我們都是選擇性的；這些訊息由 LINE 依其隱私權政策處理，我們只用來確認你的登記與聯絡測試事項。

為了防止有人用程式大量登記假資料占用名額，你送出登記時，我們會暫存你的網路來源 IP 位址經單向雜湊後的值與送出時間（不保存原始 IP 位址），只用來限制同一個網路在短時間內的登記次數，隔天自動刪除。

登記之後，招募網頁上「加入測試群組」「成為測試人員」「前往 Play 商店下載」三個按鈕，你第一次按下每一個時，我們會在你的登記資料裡記下按的時間（不記錄你在 Google 群組或 Play 商店裡做了什麼），只用來統計多少人完成加入流程；為了做到這件事，你的 Email 會存在你自己的瀏覽器（localStorage）裡。這些時間和登記資料一起保存、一起刪除。

你可以隨時來信 zifubazaar@gmail.com 要求查詢或刪除你的登記。刪除招募登記只會刪除招募網頁上的資料，不會影響你的 App 帳號。

兒童

本 App 不是專為 13 歲以下兒童設計，我們不會刻意收集兒童的個人資料。

政策更新

我們可能會更新本政策，重大變更會在 App 內或上架頁面通知。

聯絡我們

紫芙數位　zifubazaar@gmail.com

CampPulseAbout the app →

CampPulse
Privacy Policy

Last updated: November 7, 2026 (sign-up page adds “Fill in my email with Google” and our official LINE). This is a translation; if it differs from the Traditional Chinese version, the Chinese version prevails.

CampPulse (“the App”) is provided by Zifu Digital (“we”). This policy explains what data we collect, how we use it, and the choices you have.

The short version

The first time you open the App, it creates an anonymous guest account (just a system-generated ID, no name or email). It is used to send campsite reports and bug reports and to keep your campfire coins.
You can choose to sign in with Google to keep your membership, coins, badges and share code when you change phones.
Campsite reports (signal, water pressure, biting midges, road and notes) are sent only when you choose, and are shared with other campers. Others see the report and any title you use, never your account, name or email.
Location: once you allow location access, the App uses your location on your phone to work out your altitude (altimeter), find the nearest campsites and hospitals (Emergency, Nearby) and tell whether you’re at a campsite (Premium GPS detection, the camp log prompt, Signal soldier). This location is calculated on your phone and never uploaded; a report only carries a yes/no for “near the campsite”. There are two exceptions, both turned on by you: (1) while a Safety anchor is on, the location from the last time you opened the App is stored on our server and sent to the guardians you chose only if you’re overdue; (2) the coordinates of private spots you add to your Private pocket list are stored in the cloud and visible only to you and friends you share a code with. Weather lookups send campsite coordinates, not yours.
The Premium Camping album, once you allow it, reads where your photos were taken to sort them by campsite. Photos and their locations are processed on your phone only and never uploaded.
The App has rewarded ads from Google AdMob that play only when you tap “Watch an ad for Premium”. Users in the EU and similar regions are asked for consent first. Members never load ads.
You can delete your account in the App at any time, and your data in the cloud is deleted with it.

Data we collect

Data	When	Purpose
Account data: a system-generated account ID; if you sign in with Google, also your Google account email and display name	A guest account is created automatically the first time you open the App; Google details when you tap “Sign in with Google” (stored by Google Firebase Authentication)	To identify your account, show which account you are using on the My account page, and restore your data on a new phone
Campsite reports: the campsite, signal bars for three carriers, midge level, whether water pressure is steady, whether low cars can get in, your note, the title you use, the time and your account ID	When you tap “Report conditions” on the Campsite Intel tab and send it	To average signal, water and midge conditions for every camper, and to award coins and XP. Other campers see the report and your title, never your account. Please don’t put personal information in notes
Personal records: XP, number of reports, badges earned and stars for each trunk drill level	Synced to the cloud automatically when these numbers change	To restore your records on a new phone or after reinstalling
Campfire coins: balance, items you bought (Premium days, bonus levels, titles, color themes), daily and monthly counts, and a log of every change	When you report a campsite, claim a bug-report reward, or buy something in the coin shop (calculated and recorded by our server)	To award and deduct coins correctly, apply what you bought, and prevent double rewards or cheating
Bug reports	When you send a report: your description, a screenshot of the current screen (you can preview or remove it before sending), app version, device model, Android version, current screen, language, font scale, dark mode, whether you are a member, the campsite you picked, your account ID and, if you signed in with Google, your account email (so we know which account sent it; guest accounts have no email, so none is attached)	To reproduce and fix problems, and to send progress, replies and rewards back to your App
Wishes (yearly members only)	When you send a wish: the wish text, app version, account ID and time sent	To learn which features people want and tell you the outcome
Share codes and redemptions	When you get your share code after signing in with Google, or enter a share code or gift code: your share code and how many times it has been redeemed, the membership time you received (including days paused while you subscribe), which codes you redeemed and when, how many redeem attempts you made that day, and your account ID	To create unique share codes, give membership days to you and your friends, and stop codes being redeemed twice or guessed. Friends who redeem your code never see your email or name
Subscription, Lifetime and coin pack purchase records	When you buy or restore a purchase: the Google Play purchase token, subscription plan and expiry; for Lifetime and coin packs, also the product and order number (and, for coin packs, the coins granted)	To confirm membership (our server checks with Google Play) and stop the same purchase being used by different accounts. Payment is handled by Google Play and we never see your payment details
Usage record during the closed test (from October 19, 2026): your Google account email and name, account ID, app version and the dates you opened the App (Taiwan time)	During the closed test, sent automatically the first time you open the App each day after signing in with Google; nothing is recorded for guests	To confirm who took part in the test and for how many days, so we can give out the test reward (Premium). We do not record what you do in the App
Safety anchor: your expected return time, campsite name and coordinates, plate number (optional), notes (optional), and the location and time you last opened the App	When you turn on a Safety anchor, and when you open the App while it is on	If you haven’t tapped “I’m home safe” in time, a notification is sent to the guardians you chose. Tapping “I’m home safe” turns it off
Guardian links: your and your guardians’ account IDs and nicknames; a push token (your device’s notification ID)	When a guardian enters your guardian code; after you sign in	To decide who receives your Safety anchor alerts and to deliver notifications. Either side can remove the link at any time
Private pocket list: spot names, coordinates and notes; nicknames of friends who can view your list	When you add spots, create a share code, or a friend enters it	Visible only to you and the friends you choose; you can remove friends or stop sharing at any time
Pre-trip forecast alerts (Premium): the departure date of a pocket-list spot, and the rain chance, low temperature and gusts we look up for that spot each day	When you set a departure date in your pocket list; after that our server checks the weather for the spot’s coordinates each evening	To notify you if the forecast gets clearly worse; checks stop after the departure date
Family plan: the link between the plan owner and family members, and members’ nicknames	When you create a family code or join a family with one	To share Premium with family; the owner can see members’ nicknames, which are removed when a member leaves, is removed, or deletes their account
Group trip polls: title, candidate dates, candidate campsites and tasks (Premium), participants’ nicknames, votes and claimed tasks	When you start or join a poll	To let friends with the invite code pick a date together; the organiser can delete the poll
Camp log: each trip’s campsite, county, altitude, dates and nights, plus that night’s low, rain and moon brightness	When you log a trip	Badges, the county map and the altitude ladder
Tent care (Premium): tent name, coating, year bought and how many days each wet pack took to dry	When you add a tent or tap “wet tent” and “it’s dry now”	Care records and an estimate of how long the waterproof coating will last
New campsite report fields: shower hot water, hair dryers, drinking water, campsite rules, afternoon sun	When you report conditions (optional)	Shared with other campers like the rest of the report, without your account
Night-drive countdown (Premium): departure and campsite coordinates; how many lookups you made today	When you tap “Calculate (live traffic)”	Our server asks Google’s routing service for the drive time with live traffic. Coordinates aren’t stored; only today’s lookup count is kept (there’s a daily limit)
Phone data cloud backup (yearly and lifetime members): settings and records that otherwise live only on your phone, including your offline pack list and notes, group-trip task lists, your tent-care home county, altitude corrections per campsite, obstacles marked for pitch sunlight, display settings (theme, text size, tips), camp meal names, meal times and links to the photos on your phone (not the photos themselves), and the photo IDs of album photos you moved to another campsite	When you tap “Back up now”, or choose “Instant” or “Weekly” automatic backup	To restore after changing phones or reinstalling. Photos themselves, where they were taken and your location history are never backed up; the album only carries each photo’s ID on your phone. Only you can read it, and it is deleted when you delete your account
Lucky draw: draw entries (account ID and date), your number in the order of first Google sign-ins and first purchases, and prize and claim records	Each day the first time you open the App, you are entered automatically if eligible (signed in with Google and opening the App regularly); a number is given the first time you sign in with Google, subscribe, or buy Lifetime	To pick daily winners, confirm lucky numbers, and give out coins or Premium days. The public board shows only head counts and progress, never anyone’s account. Entry lists are deleted within 30 days; your prizes and entries are deleted when you delete your account
Corrections to web notes: the campsite and sentence you flag as “no longer true”, the kind of correction, what it is like now (optional), your account ID and the time	When you tap “No longer true” on a campsite’s web notes and send it	When two or more people flag a sentence it is marked “may be outdated”; what you wrote is visible only to admins and is used to update the notes. You can withdraw it at any time, and it is deleted when you delete your account
Crash reports: the error log at the time of a crash, device model, Android version, app version and an installation ID	When the App crashes or hits a serious error (collected by Google Firebase Crashlytics)	To find and fix the cause of crashes. They contain nothing you wrote and no screenshots
Advertising ID, device information, approximate location (from IP address), ad interactions and consent choices	When you tap “Watch an ad for Premium”. In the EU and similar regions you are asked for consent when the App opens (Google consent management). Ads are never initialized for members or developer accounts	Used by Google AdMob to serve and measure ads and prevent fraud, under the Google Privacy Policy. You can change your consent in My account › Support & privacy › Ad privacy options, and reset or delete your advertising ID in your phone’s settings

Data that stays on your phone

Checklist ticks, car-camping and pitch-power settings, your last campsite, the title and theme in use, and how many ad trials you used: stored only on your phone, kept separately for each account.
The accelerometer and compass: used only live inside the Sleeping & car-camping level and the Wind & sun compass to work out angles and directions. Nothing is saved or uploaded.
Cached weather forecasts: kept on your phone so you can see the last forecast offline.
Campfire story recordings (only after you allow Microphone access): stored only on your phone and never uploaded. Premium members can choose to share a recording themselves.
Altimeter pressure and altitude, obstacles you mark for pitch sunlight, offline pack notes and saved data, and “use my altitude” per campsite: stay on your phone.
Nearby supplies and hospitals: the data is bundled in the App (from OpenStreetMap), and the nearest places are worked out on your phone without sending your location.
Camp meal photos, album slideshows and photos sorted into phone folders: meal photos are chosen with the system photo picker, and all photos are read only on your phone; slideshows are made on your phone and only go where you choose when you tap Share or Save; sorting into folders asks the system for your confirmation first and moves photos within your phone, never uploading or copying them.
Home-screen widget: shows only the forecast and campsite already saved on your phone and sends nothing extra.
Camping album (Premium, only after you allow Photos access): the App reads when and where your photos were taken (the GPS data stored in each photo) on your phone, matches them to campsites and sorts them into albums. Your photos, their locations and the albums stay on your phone; they are never uploaded, copied, or sent to us or anyone else. You can revoke Photos access at any time in your phone settings. If you move photos to a different campsite yourself, the App asks whether to report that fix to us (you can say No thanks). Only if you tap Report do we receive the campsite we guessed, the one you chose, where the photos were taken (rounded to about 100 m), how many photos and the App version, never the photos themselves. We use this to correct campsite locations and sorting, and it is deleted when you delete your account.

We do not read your contacts or camera. The microphone is used only when you record in Campfire story chain and allow it, and recordings stay on your phone. Location is used only as described above. Your gallery is read on the phone only when you use the Camping album and allow access (see above), and nothing from it is uploaded. The App uses no third-party behavior analytics; the only automatic upload is the crash report above.

About screenshots: a bug-report screenshot shows the App’s screen at that moment and may include the name of the account you signed in with. Check the preview before sending, and remove it if you don’t want to send it.

Third-party services the App connects to

Open-Meteo (weather and elevation): to get a forecast, the App sends the coordinates of the campsite you picked to Open-Meteo. That is the campsite’s location, not yours, and no account information is attached.
Google Maps: the map on the Campsite Intel tab is provided by Google Maps. When it shows a map, Google receives the map area and your IP address, under the Google Privacy Policy.
Google Play Billing: subscription payments and management are handled by Google Play.
Open-Meteo (other lookups): pitch sunlight looks up elevation around the campsite (the ridgeline), tent care looks up the weather for the home city you picked, logging a trip looks up past weather for those nights, and the Conditions tab looks up air quality, sea state, tides and river flow for the campsite. Only campsite or city-hall coordinates are sent, never yours.
Open-Meteo (place search): when you use “Weather for any place”, the App sends the place name you type to Open-Meteo to find it, with no account information, and it is not stored; places you pick are saved only on your phone. The altimeter’s terrain estimate uses terrain data built into the App and never sends your location.
Google routing (Routes API): when a Premium member taps Night-drive countdown › Calculate (live traffic), our server sends the departure and campsite coordinates to Google for the drive time, under the Google Privacy Policy.
Firebase Cloud Messaging (FCM): delivers Safety anchor notifications.

Nearby supplies and hospitals come from OpenStreetMap (© OpenStreetMap contributors, ODbL), downloaded when the App is built and bundled inside it; no connection is made when you use them.

The campsite list comes from the Taiwan Tourism Administration’s open data on campgrounds. Downloading it sends none of your data.

Where data is stored

Accounts, campsite reports, personal records, campfire coins, bug reports, wishes, share codes and subscription records are stored in Google Firebase (Authentication, Firestore and Cloud Functions, in the asia-east1 region in Changhua, Taiwan) and encrypted in transit. Coins, membership and subscription records can only be written by our server, and your App can only read your own. Bug reports and wishes can only be seen by the developer. Campsite report contents can be seen by every signed-in user (without your identity).

How long we keep it

Account, personal records and campfire coins: until you delete your account.
Campsite reports: until you delete your account; the App only shows recent reports.
Bug reports: cleared regularly after they are resolved (screenshots included), kept for no more than 90 days.
Wishes: kept until we have reviewed the request.
Subscription records: until the subscription ends or you delete your account.
Share codes and membership time from codes: until you delete your account. The record that you redeemed someone else’s share code (only your account ID and the time) stays with that code so the same account cannot redeem it twice.
Closed-test usage record: kept until you delete your account (deleting your account deletes it).
Safety anchor, guardian links, push token, private pocket list (including departure dates and forecast checks), family plan, camp log and tent care records: until you delete them or your account.
Group trip polls: until the organiser deletes the poll or their account; your own vote is deleted when you delete your account.
Night-drive lookup count: today only, reset the next day.
Phone data cloud backup: only the latest copy per account, kept until you delete your account.
Crash reports: kept for 90 days under Firebase Crashlytics settings.

What we never do

We never sell your data.
We never share your reports, wishes or account data with advertisers or other third parties.
We never use your data for purposes unrelated to the App.

Your choices and rights

Don’t want to share campsite conditions: don’t send campsite reports. Everything else still works.
Don’t want ads: ads play only if you tap “Watch an ad for Premium”; members never load ads.
Change your ad consent: My account › Support & privacy › Ad privacy options (shown when it applies).
Delete your account and cloud data: in the App, go to My account › Account › Delete account. After you confirm, your account is deleted together with your personal records, campfire coins and their log, campsite reports, wishes, bug-report notifications, subscription records, your share code and membership time from codes, Safety anchor and guardian links, push token, private pocket list and sharing, pre-trip forecast checks, family plan (if you own it, members’ shared Premium ends too), polls you started and your votes, camp log and tent care records, and that account’s records on your phone are cleared. Deleting your account does not cancel a Google Play subscription; cancel it separately in Google Play.
If you can’t open the App: email zifubazaar@gmail.com from the Google account you signed in with, and we will delete all data for that account after confirming it.
Uninstalling the App deletes the data on your phone; cloud data is only deleted when you delete your account.

Closed-test sign-up

On the sign-up page (camppulse-app-tw.web.app/join) we collect the following, stored separately from in-app account data in Google Firebase (Firestore): the email you enter, your phone system (Android / iPhone), whether you agree to the 14-day continuous testing condition, whether you'd like to test future products, whether you want an iOS version, and the time you signed up.

We use it only to arrange the Google Play closed test (Android users only), give out rewards when the test is completed, and, depending on your answers, tell you about future new-product tests or an iOS version. We do not use this data for advertising and we never sell it or share it with third parties; your email is given to Google Play as part of the tester list and handled under Google's privacy policy.

The sign-up page has an optional “Fill in my email with Google” button. When you tap it, a Google account chooser appears and we read only the email of the account you pick, to fill in the field. Right after reading it, we delete the temporary sign-in record created by that tap (it is used only to read your email, never for the app), and we do not keep your Google name, profile picture or any other data. If you already have a CampPulse account, this never deletes or changes it. If you prefer, you can simply type your email instead.

The sign-up page also offers a link to our official LINE account. Adding us as a friend or sending us your account through LINE is entirely optional; those messages are handled by LINE under its own privacy policy, and we use them only to confirm your sign-up and to contact you about the test.

To stop automated fake sign-ups from using up the spots, when you submit we temporarily store a one-way hash of your network IP address and the time of submission (we never store the IP address itself). It is used only to limit how many sign-ups can come from the same network in a short time, and it is deleted automatically the next day.

After you register, the first time you tap each of the three buttons on the sign-up page (“Join the test group”, “Become a tester” and “Download on Google Play”), we record the time in your sign-up record (we do not record anything you do in Google Groups or on Google Play). It is used only to count how many people completed the joining steps; to do this, your email is kept in your own browser (localStorage). These times are kept and deleted together with your sign-up.

You can email zifubazaar@gmail.com at any time to see or delete your sign-up. Deleting your sign-up only removes the sign-up page data and does not affect your app account.

Children

The App is not designed for children under 13, and we do not knowingly collect personal data from children.

Changes to this policy

We may update this policy. Significant changes will be announced in the App or on the store listing.

Contact

Zifu Digital · zifubazaar@gmail.com

露營掌門隱私權政策