山跡
隱私權政策

最後更新：2026 年 11 月 7 日（招募網頁加入「用 Google 帳號帶入 Email」與官方 LINE）

「山跡」（以下稱「本 App」）由紫芙數位（以下稱「我們」）提供。本政策說明我們收集哪些資料、怎麼使用，以及你有哪些選擇。

先說重點

你的軌跡、行程、登頂紀錄、日誌與照片只存在你的手機，不會上傳到我們或任何伺服器。使用本 App 不需要註冊帳號。
精確位置只在你按下「開始記錄」之後使用，記錄期間通知列會一直顯示；暫停或結束行程就停止定位。本 App 不申請背景定位權限。
你按「山上天氣」或「填入當時天氣」時，或登山計畫書的「出發前一天天氣提醒」開著時（預設開、可在計畫書關掉；前一天 18:00 自動查一次），才會把一個地點送到 Open-Meteo 查天氣，整條軌跡不會送出。登山計畫書（路線、時間、隊員、留守人電話、裝備清單）只存在你的手機，分享與否由你決定；只有你用「隊伍同行」邀隊友時，才會把計畫書標題、出發與預計下山時間、隊員暱稱與有沒有報平安放到我們的伺服器，下山 7 天後自動刪除。
免費版有 Google AdMob 橫幅廣告，歐盟、英國等地區會先請你同意。購買「山跡完整版」後不會再請求或顯示廣告。
只有在你主動回報問題、選擇登入 Google 帳號，或 App 當機（可以關閉）時，才會有資料送到我們使用的 Google Firebase。
我們不會出售你的資料。

定位怎麼使用

你按下「記錄」頁的「開始記錄」後，本 App 才會用手機的精確位置（GPS）記錄軌跡。螢幕關掉也會繼續記錄，通知列會一直顯示「正在記錄」。
暫停時會關閉定位，按「結束行程」後停止。沒有在記錄時，本 App 不會取得你的位置。
本 App 不申請「背景定位（一律允許）」權限。
距離、爬升、海拔剖面與自動登頂判定都在手機上計算。位置資料不會傳給我們，也不會提供給廣告。
山上天氣：只有你自己按了、或計畫書的出發前一天天氣提醒開著（預設開、可關）才查，而且只送一個地點的座標和海拔到天氣服務 Open-Meteo（Open-Meteo 會看到你的網路位址）。在日誌按「填入當時天氣」，送的是這趟軌跡的最高點與行程日期；在百岳或預計路線按「山上天氣」，送的是山頭或路線最高點。整條軌跡、照片、日誌都不會送出，我們的伺服器也收不到；查到的預報只存在手機上。
定位由手機系統與 Google Play 服務提供；這些服務本身怎麼處理定位資料，依你手機的定位設定（例如「Google 定位精確度」）決定。

只在你手機上、不會傳出的資料

行程與軌跡：GPS 軌跡點（座標、海拔、時間）、距離與爬升統計、登頂紀錄、行程日誌（天氣、同行者、心得）、你匯入的預計路線（GPX）。
照片：在本 App 裡拍的照片，以及從相簿挑選匯入的照片。匯入時會讀取照片裡的拍攝時間與 GPS 資訊，用來把照片對到軌跡上。拍照使用手機的相機 App、選照片使用系統的相片挑選器，本 App 不申請相機或相簿權限。
地圖：下載的離線地圖、你匯入的地圖檔（MBTiles）。
設定與購買狀態：省電記錄、介面語言、是否已買完整版等設定。
早安通知：每天早上 8 點的提醒由手機自己排程，「今天有沒有打開過 App」和通知開關只記在手機上，不會傳給我們。

這些資料我們看不到。

邀請連結：朋友從你分享的連結安裝山跡時，App 會在朋友的手機上向 Google Play 讀一次「安裝來源」，只取出連結裡的邀請碼，等朋友登入後用來兌換；安裝來源的其他內容不會傳出。
備份與分享由你決定：「更多 › 備份與還原」產生的備份檔、分享圖卡與匯出的 GPX，要存在哪裡、傳給誰都由你選擇（例如雲端硬碟、通訊軟體），我們收不到。
Android 系統備份：如果你的手機開啟了 Android 內建的「備份到 Google 雲端硬碟」，系統可能會把本 App 的資料庫（行程、軌跡、登頂、日誌）與設定備份到你自己的 Google 帳號，照片與地圖不在其中。這項備份由 Google 處理，我們看不到。

本 App 沒有使用第三方的使用行為分析工具（例如 Google Analytics）。

我們收集的資料

資料	何時收集	用途
回報問題：你寫的說明、選填的聯絡方式（登入 Google 時會先帶入你的信箱，可以修改或刪掉）、當下畫面的截圖（送出前可預覽或移除）、App 版本、手機型號、Android 版本、所在畫面、語言、字體縮放、是否已買完整版、記錄狀態（記錄中、暫停或未記錄）、送出時間、帳號識別碼，以及用 Google 登入時的帳號電子郵件（讓我們知道是哪個帳號回報的，和上面的聯絡方式分開）	你按畫面上的回報浮標，或「更多 › 回報與隱私 › 回報問題」並送出時	重現並修正問題；有留聯絡方式時回覆你。不含你的軌跡、位置紀錄或行程照片
Google 帳號：電子郵件、顯示名稱、帳號識別碼	你在「更多 › 登入 Google 帳號」或回報問題前登入時（選填，回報問題需要登入；由 Google Firebase Authentication 保存）	在「更多」顯示登入的帳號、回報問題時帶入信箱方便回覆你、計算每人每天的回報次數。登入不會上傳軌跡、照片或日誌
邀請碼與獎勵紀錄：你的邀請碼、被兌換的次數、你兌換過的邀請碼、完整版試用與免廣告的到期時間、今天與昨天領過的三餐與每日任務	你用 Google 登入後打開「邀請朋友」、兌換朋友的邀請碼、或領取三餐報到與每日任務時（Google Firebase 的雲端函式與 Firestore）	發給你和朋友邀請獎勵（朋友 7 天完整版試用、你 30 天免廣告）、三餐與任務的免廣告時間，並防止重複領取或用很多帳號刷獎勵。不含軌跡、位置、照片或日誌
幸運大獎：你打開山跡的日期（最近幾天）、你是第幾位用 Google 登入／第幾位買完整版的號碼、每日抽獎的報名紀錄、中獎與領獎紀錄、限定徽章；買了完整版的人另有購買憑證的雜湊值	你用 Google 登入後每天第一次打開山跡、剛登入、剛買完完整版，或在「更多 › 幸運大獎」領獎時（Google Firebase 的雲端函式與 Firestore）；買了完整版的人會把 Google Play 購買憑證送到雲端函式向 Google Play 確認已付款	每日抽獎、第 N 位登入與第 N 位買完整版的號碼獎、全服山友人數禮物，並防止用很多帳號刷獎（帳號要滿 3 天、最近 7 天打開 3 天）。公開看板只顯示人數，不顯示帳號。不含軌跡、位置、照片或日誌
隊伍同行：計畫書標題、出發與預計下山時間、每位隊員自己填的暱稱（預設是 Google 顯示名稱，可以改）、每人回報平安下山的時間、隊員的帳號識別碼；另有一組給留守人看的網頁代號	你在登山計畫書按「邀請隊友」開隊伍、用隊伍碼加入隊伍、或在隊伍裡按「平安下山」時（Google 登入才能用；Google Firebase 的雲端函式與 Firestore）	讓同一隊的人在自己的手機看到誰已平安下山；你分享給留守人的網頁連結只顯示標題、時間、暱稱與平安與否（沒有信箱、帳號識別碼或位置），知道連結的人都能看。不上傳軌跡、位置、照片、日誌、留守人電話或裝備清單
當機報告：當機時的程式錯誤紀錄、手機型號、Android 版本、App 版本、安裝識別碼	App 當機或發生嚴重錯誤時（Google Firebase Crashlytics，只有正式版會送）	找出並修正造成當機的問題；不含軌跡、位置、照片或日誌。可以在「更多 › 回報與隱私 › 傳送當機報告」關閉
App 完整性憑證：由 Google Play Integrity 判斷這個 App 是不是從 Google Play 安裝、沒被竄改的山跡，以及手機的基本完整性，再換成 Firebase App Check 的短期憑證	App 連線 Firebase 時（回報問題、Google 登入）自動附上（Google Play Integrity、Firebase App Check）	確認連線真的來自山跡，防止有人冒用或濫用回報服務。不含姓名、信箱、軌跡、位置或照片
廣告識別碼、裝置資訊、大致位置（由網路位址判斷）、廣告互動、同意設定	開啟 App 時初始化廣告服務；免費版在「行程」「百岳」「更多」頁底部顯示橫幅廣告時。歐盟、英國等地區會在開啟 App 時先詢問你是否同意（Google 同意管理平台）。記錄軌跡的畫面與離線地圖畫面不放廣告	由 Google AdMob 提供與統計廣告、防範詐欺，依 Google 隱私權政策處理。你可以在「更多 › 回報與隱私 › 廣告隱私設定」修改同意，也可以在手機系統設定重設或刪除廣告識別碼

截圖要特別注意：回報問題的截圖就是你當下本 App 的畫面，可能拍到地圖、軌跡、照片或你登入的帳號名稱。送出前請先看過預覽，不想傳的可以移除截圖。

會連線的第三方服務

內政部國土測繪中心（地圖）：有網路時顯示地圖，App 會向國土測繪中心的圖磚伺服器下載「臺灣通用電子地圖」，對方會收到你的網路位址與要顯示的地圖範圍，不會收到你的軌跡或帳號。詳見政府資料開放平臺說明。
Google AdMob：免費版的廣告，見上表。
Google Firebase：回報問題、Google 登入、當機報告與 App 完整性檢查（App Check），見上表。
Google Play Integrity：連線 Firebase 時確認 App 與手機的完整性，見上表。
Google Play 帳單：購買「山跡完整版」的付款由 Google Play 處理，我們看不到你的付款資料。App 只向 Google Play 查詢你是否已購買，結果記在你的手機上。
離線地圖下載（我們的伺服器）：完整版下載離線山區地圖時，App 會把 Google Play 的購買憑證（試用中則是你的帳號）送到我們的雲端函式（Firebase，asia-east1），向 Google Play 確認你已購買，並記錄下載次數（每 30 天上限，防止濫用）。我們只存購買憑證的雜湊值、次數與時間，不存憑證本身，也不會收到你的位置或軌跡；地圖檔從 Google Cloud Storage 下載，對方會收到你的網路位址。刪除帳號時，用帳號計的次數紀錄一併刪除。

內建的百岳、小百岳資料隨 App 安裝，查看時不會傳送你的任何資料。

資料存放在哪裡

回報問題、邀請碼與獎勵紀錄、幸運大獎、隊伍同行、Google 帳號資料存放在 Google Firebase（Authentication、Firestore、Cloud Functions，位於台灣彰化的 asia-east1 機房）；當機報告存放在 Firebase Crashlytics。傳輸過程加密。回報的文字只有你自己和開發者讀得到，截圖只有開發者看得到。

保存多久

手機上的資料：保存到你刪除行程或移除 App 為止。
回報問題：截圖在處理完成時一併刪除；說明與裝置資訊在處理完成後定期清除，送出超過 60 天的已處理回報會刪除。
隊伍同行：預計下山時間或最後一位隊員報平安（取較晚的）之後 7 天自動刪除；隊長解散隊伍時立即刪除，隊員退出或刪除帳號時移除自己的那一份。
幸運大獎：每日抽獎的報名名單保存 30 天；號碼、中獎與領獎紀錄跟著帳號，刪除帳號時一併刪除。
Google 帳號資料、邀請碼與獎勵紀錄：保存到你刪除帳號（「更多 › 刪除帳號」）或要求刪除為止；刪除帳號時一併刪除。
當機報告：依 Firebase Crashlytics 的設定保存 90 天。

我們不會做的事

不會出售你的資料。
不會把你的位置、軌跡或回報內容提供給廣告商或第三方（唯一例外是你按了查天氣時，送給 Open-Meteo 的那一個地點）。
不會把你的資料用在與本 App 無關的用途。

你的選擇與權利

不想使用定位：不按「開始記錄」就不會使用定位；也可以隨時在手機設定收回定位權限（記錄軌跡會無法使用，其他功能照常）。
不想傳當機報告：「更多 › 回報與隱私 › 傳送當機報告」關閉。
不想收早安通知：「更多 › 早安通知」關閉，或在手機設定關掉本 App 的通知。
不想看到廣告：購買「山跡完整版」後不會再請求或顯示廣告。
修改廣告同意：「更多 › 回報與隱私 › 廣告隱私設定」（需要時才會出現）。
登出 Google 帳號：「更多」帳號列的「登出」。
刪除手機上的資料：在行程頁刪除行程，或移除 App。你另外存的備份檔、分享出去的圖卡與 GPX 要自己刪除。
刪除帳號：登入過 Google 帳號的，在 App 的「更多 › 刪除帳號」就能刪除，會同時刪掉該帳號與它送出的所有回報和截圖，立即生效。
刪除雲端上的其他資料：沒有登入、或無法使用 App 時，來信 zifubazaar@gmail.com。登入過的請用該帳號的信箱寫信，我們確認後會刪除該帳號與它送出的回報；沒有登入的，請告訴我們回報的日期與內容，我們會刪除那則回報。

封閉測試招募

我們在招募網頁（hikinglog-b3f57.web.app/join）收集以下資料，與 App 內的帳號資料分開存放，存放在 Google Firebase（Firestore）：你填寫的 Email、你使用的手機系統（Android／iPhone）、是否同意連續測試 14 天的條件、之後願不願意測試新產品、想不想要 iOS 版，以及登記時間。

用途只有：安排 Google Play 封閉測試（僅限 Android 使用者）、測試完成後發放獎勵，以及依你的回答，日後通知你新產品測試或 iOS 版的消息。我們不會用這些資料發送廣告，也不會出售或提供給第三方；你的 Email 會提供給 Google Play 作為測試名單，依 Google 的隱私權政策處理。

招募網頁有一顆選用的「用 Google 帳號帶入 Email」按鈕：按下後會跳出 Google 帳號選單，我們只讀取你選的那個帳號的 Email 來填進欄位，讀完後會立即刪除這次按按鈕時剛建立的暫時登入紀錄（只用來讀取 Email，不會用在 App），不保存你的 Google 名稱、頭像或其他資料；如果你本來就有山跡的帳號，這個動作不會刪除或更動它。不想用的話，也可以直接輸入 Email。

招募網頁另提供官方 LINE 連結，加入好友或用 LINE 傳送你的帳號給我們都是選擇性的；這些訊息由 LINE 依其隱私權政策處理，我們只用來確認你的登記與聯絡測試事項。

為了防止有人用程式大量登記假資料占用名額，你送出登記時，我們會暫存你的網路來源 IP 位址經單向雜湊後的值與送出時間（不保存原始 IP 位址），只用來限制同一個網路在短時間內的登記次數，隔天自動刪除。

登記之後，招募網頁上「加入測試群組」「成為測試人員」「前往 Play 商店下載」三個按鈕，你第一次按下每一個時，我們會在你的登記資料裡記下按的時間（不記錄你在 Google 群組或 Play 商店裡做了什麼），只用來統計多少人完成加入流程；為了做到這件事，你的 Email 會存在你自己的瀏覽器（localStorage）裡。這些時間和登記資料一起保存、一起刪除。

你可以隨時來信 zifubazaar@gmail.com 要求查詢或刪除你的登記。刪除招募登記只會刪除招募網頁上的資料，不會影響你的 App 帳號。

兒童

本 App 不是專為 13 歲以下兒童設計，我們不會刻意收集兒童的個人資料。

政策更新

我們可能會更新本政策，重大變更會在 App 內或上架頁面通知。

聯絡我們

紫芙數位　zifubazaar@gmail.com

HikingLogAbout the app →

HikingLog
Privacy Policy

Last updated: November 7, 2026 (sign-up page adds “Fill in my email with Google” and our official LINE). This is a translation; if it differs from the Traditional Chinese version, the Chinese version prevails.

HikingLog (“the App”) is provided by Zifu Digital (“we”). This policy explains what data we collect, how we use it, and the choices you have.

The short version

Your tracks, trips, summit records, journal and photos stay on your phone. They are never uploaded to us or any server. You don’t need an account to use the App.
Precise location is used only after you tap “Start recording”, and a notification stays visible while recording. Location stops when you pause or end the trip. The App does not request background location permission.
Only when you tap “Mountain weather” or “Fill in the weather”, or while a hiking plan’s day-before weather alert is on (on by default, can be turned off; checked once at 18:00 the day before), is a single point sent to Open-Meteo to look up the weather; your full track is never sent. Hiking plans (route, times, team, emergency contact phone, gear list) stay on your phone, and you decide whether to share them. Only when you use “Hiking team” to invite teammates are the plan’s title, start and expected return times, team nicknames and who has checked in safe stored on our server, and they are deleted automatically 7 days after the trip.
The free version shows Google AdMob banner ads. Users in the EU, the UK and similar regions are asked for consent first. After you buy the HikingLog Full Version, ads are no longer requested or shown.
Data is sent to the Google Firebase services we use only when you report a problem, choose to sign in with Google, or when the App crashes (you can turn this off).
We never sell your data.

How location is used

The App uses your phone’s precise location (GPS) to record a track only after you tap “Start recording” on the Record tab. Recording continues with the screen off, and a “recording” notification stays visible the whole time.
Location is turned off while paused and stops when you tap “End trip”. When you are not recording, the App does not get your location.
The App does not request the “background location (Allow all the time)” permission.
Distance, elevation gain, the elevation profile and automatic summit check-ins are all calculated on your phone. Location data is never sent to us and never given to advertisers.
Mountain weather: looked up only when you tap it or while a hiking plan’s day-before alert is on (on by default, can be turned off), and only one point’s coordinates and elevation are sent to the weather service Open-Meteo (which sees your IP address). “Fill in the weather” in a journal sends the highest point of that track and the trip dates; “Mountain weather” on a peak or planned route sends the peak or the route’s highest point. Your full track, photos and journal are never sent and never reach our servers; forecasts are stored only on your phone.
Location is provided by your phone’s system and Google Play services. How those services handle location depends on your phone’s location settings (for example, Google Location Accuracy).

Data that stays on your phone

Trips and tracks: GPS track points (coordinates, altitude, time), distance and elevation stats, summit records, trip journal (weather, companions, notes) and planned routes you import (GPX).
Photos: photos taken in the App and photos you pick from your gallery. When importing, the App reads each photo’s time and GPS data to place it on your track. Taking photos uses your phone’s camera app and picking photos uses the system photo picker, so the App does not request camera or gallery permissions.
Maps: downloaded offline maps and map files you import (MBTiles).
Settings and purchase status: power-saving recording, interface language, whether you own the Full Version, and other settings.
Morning greeting: the 8 AM reminder is scheduled by your phone itself. Whether you opened the App today and the on/off setting are stored only on your phone and never sent to us.

We cannot see any of this data.

Invite links: when a friend installs HikingLog from a link you shared, the App reads the Google Play “install referrer” once on your friend's phone, takes only the invite code from it, and uses it after they sign in. Nothing else from the install referrer leaves the phone.
Backups and sharing are up to you: backup files from More › Backup and restore, share cards and exported GPX files are saved or sent wherever you choose (for example cloud storage or a messaging app). We never receive them.
Android system backup: if Android’s built-in backup to Google Drive is on, the system may back up the App’s database (trips, tracks, summits, journal) and settings to your own Google account. Photos and maps are not included. That backup is handled by Google and we cannot see it.

The App uses no third-party behavior analytics (such as Google Analytics).

Data we collect

Data	When	Purpose
Problem reports: your description, optional contact details (filled in with your email if you signed in with Google; you can change or delete it), a screenshot of the current screen (you can preview or remove it before sending), app version, phone model, Android version, current screen, language, font scale, whether you own the Full Version, recording state (recording, paused or not recording), the time sent, your account ID and, if you signed in with Google, your account email (so we know which account sent it; separate from the contact details above)	When you tap the floating report button, or More › Reports and privacy › Report a problem, and send it	To reproduce and fix problems, and to reply if you left contact details. Reports never include your tracks, location history or trip photos
Google account: email, display name and account ID	When you sign in under More › Sign in with Google or before sending a problem report (optional, but required to report a problem; stored by Google Firebase Authentication)	To show which account you are using on the More tab and fill in your email on problem reports so we can reply, and to count reports per person per day. Signing in never uploads tracks, photos or journal entries
Invite codes and rewards: your invite code, how many times it was used, the code you redeemed, when your Full version trial and ad-free time end, and which meals and daily missions you claimed today and yesterday	When you open Invite friends, redeem a friend's code, or claim a meal check-in or daily mission after signing in with Google (Google Firebase Cloud Functions and Firestore)	To give you and your friend the invite rewards (a 7-day Full version trial for them, 30 ad-free days for you) and ad-free time for meals and missions, and to stop rewards being claimed twice or farmed with many accounts. No tracks, locations, photos or journals
Lucky prizes: the days you opened HikingLog (recent days), your number as the Nth person to sign in with Google or buy the Full version, daily draw entries, prizes won and claimed, and limited badges; for Full version buyers, a hash of the purchase token	The first time you open HikingLog each day while signed in with Google, right after signing in or buying the Full version, or when you claim a prize in More › Lucky prizes (Google Firebase Cloud Functions and Firestore); Full version buyers send their Google Play purchase token to our cloud function so Google Play can confirm the payment	For the daily draw, Nth sign-in and Nth purchase prizes, and gifts for all hikers, and to stop prizes being farmed with many accounts (an account must be 3 days old and opened on 3 of the last 7 days). The public board shows only counts, never accounts. No tracks, locations, photos or journals
Hiking team: the plan’s title, start and expected return times, each teammate’s own nickname (your Google display name by default, can be changed), when each person checked in safe, and teammates’ account IDs; plus a code for the emergency contact’s web page	When you tap “Invite your team” on a hiking plan, join a team with a code, or tap “I’m back safe” in a team (needs Google sign-in; Google Firebase Cloud Functions and Firestore)	So everyone on the team can see on their own phone who is back safe. The web link you share with your emergency contact shows only the title, times, nicknames and who is safe (no email, account ID or location), and anyone with the link can view it. No tracks, location, photos, journals, contact phone numbers or gear lists are uploaded
Crash reports: the error log at the time of a crash, phone model, Android version, app version and an installation ID	When the App crashes or hits a serious error (Google Firebase Crashlytics, release versions only)	To find and fix the cause of crashes. They contain no tracks, location, photos or journal entries. You can turn them off in More › Reports and privacy › Send crash reports
App integrity token: Google Play Integrity checks whether this is the genuine HikingLog installed from Google Play and not modified, plus the basic integrity of your phone, and this is exchanged for a short-lived Firebase App Check token	Attached automatically when the App connects to Firebase (problem reports, Google sign-in) (Google Play Integrity, Firebase App Check)	To confirm the connection really comes from HikingLog and stop others from impersonating or abusing the report service. It contains no name, email, tracks, location or photos
Advertising ID, device information, approximate location (from IP address), ad interactions and consent choices	The ad service is initialized when the App opens; banner ads appear at the bottom of the Trips, Baiyue and More tabs in the free version. In the EU, the UK and similar regions you are asked for consent when the App opens (Google consent management). The recording screen and offline map screens never show ads	Used by Google AdMob to serve and measure ads and prevent fraud, under the Google Privacy Policy. You can change your consent in More › Reports and privacy › Ad privacy settings, and reset or delete your advertising ID in your phone’s settings

About screenshots: a problem-report screenshot shows the App’s screen at that moment and may include a map, your track, photos or the name of the account you signed in with. Check the preview before sending, and remove it if you don’t want to send it.

Third-party services the App connects to

National Land Surveying and Mapping Center (maps): to show maps while you are online, the App downloads the Taiwan e-Map tiles from the Center’s tile server (Ministry of the Interior, Taiwan). They receive your IP address and the map area being shown, never your track or account. See the dataset page.
Google AdMob: ads in the free version, see the table above.
Google Firebase: problem reports, Google sign-in, crash reports and app integrity checks (App Check), see the table above.
Google Play Integrity: checks the integrity of the App and your phone when it connects to Firebase, see the table above.
Google Play Billing: payment for the HikingLog Full Version is handled by Google Play and we never see your payment details. The App only asks Google Play whether you have bought it and keeps the result on your phone.
Offline map downloads (our server): when a Full Version user downloads an offline mountain area, the App sends the Google Play purchase token (or, during a trial, your account) to our cloud function (Firebase, asia-east1) to confirm the purchase with Google Play and count downloads (limited per 30 days to prevent abuse). We keep only a hash of the token, the count and the time, never the token itself, your location or your tracks; the map file is downloaded from Google Cloud Storage, which receives your IP address. Account-based counts are deleted when you delete your account.

The built-in Baiyue and Little Baiyue peak data comes with the App, and viewing it sends none of your data.

Where data is stored

Problem reports, invite codes and reward records, lucky prizes, hiking teams, and Google account data are stored in Google Firebase (Authentication, Firestore and Cloud Functions, in the asia-east1 region in Changhua, Taiwan). Crash reports are stored in Firebase Crashlytics. Data is encrypted in transit. The text of a report can be read only by you and the developer, and screenshots only by the developer.

How long we keep it

Data on your phone: until you delete the trip or uninstall the App.
Problem reports: screenshots are deleted when the report is resolved. Descriptions and device details are cleared regularly after resolution, and resolved reports older than 60 days are deleted.
Hiking teams: deleted automatically 7 days after the expected return time or the last teammate’s check-in, whichever is later; deleted at once when the leader disbands the team, and your part is removed when you leave or delete your account.
Lucky prizes: daily draw entry lists are kept for 30 days; numbers, prizes won and claim records stay with your account and are deleted when you delete your account.
Google account data, invite codes and reward records: until you delete your account (More › Delete account) or ask us to delete them; deleting your account removes them too.
Crash reports: kept for 90 days under Firebase Crashlytics settings.

What we never do

We never sell your data.
We never share your location, tracks or reports with advertisers or other third parties (the only exception is the single point sent to Open-Meteo when you look up the weather).
We never use your data for purposes unrelated to the App.

Your choices and rights

Don’t want to use location: the App uses location only after you tap “Start recording”. You can also revoke location permission in your phone’s settings at any time (track recording will stop working; everything else still works).
Don’t want to send crash reports: turn off More › Reports and privacy › Send crash reports.
Don’t want the morning greeting: turn off More › Morning greeting, or turn off the App’s notifications in your phone’s settings.
Don’t want ads: after you buy the HikingLog Full Version, ads are no longer requested or shown.
Change your ad consent: More › Reports and privacy › Ad privacy settings (shown when it applies).
Sign out of Google: tap “Sign out” on the account row of the More tab.
Delete data on your phone: delete trips on the trip page, or uninstall the App. Backup files you saved and share cards or GPX files you sent must be deleted by you.
Delete your account: if you signed in with Google, go to More › Delete account in the app. It deletes the account and every report and screenshot it sent, right away.
Delete other data in the cloud: if you never signed in or can’t use the app, email zifubazaar@gmail.com. If you signed in with Google, write from that account’s email and we will delete the account and the reports it sent after confirming it. If you never signed in, tell us the date and content of your report and we will delete it.

Closed-test sign-up

On the sign-up page (hikinglog-b3f57.web.app/join) we collect the following, stored separately from in-app account data in Google Firebase (Firestore): the email you enter, your phone system (Android / iPhone), whether you agree to the 14-day continuous testing condition, whether you'd like to test future products, whether you want an iOS version, and the time you signed up.

We use it only to arrange the Google Play closed test (Android users only), give out rewards when the test is completed, and, depending on your answers, tell you about future new-product tests or an iOS version. We do not use this data for advertising and we never sell it or share it with third parties; your email is given to Google Play as part of the tester list and handled under Google's privacy policy.

The sign-up page has an optional “Fill in my email with Google” button. When you tap it, a Google account chooser appears and we read only the email of the account you pick, to fill in the field. Right after reading it, we delete the temporary sign-in record created by that tap (it is used only to read your email, never for the app), and we do not keep your Google name, profile picture or any other data. If you already have a HikingLog account, this never deletes or changes it. If you prefer, you can simply type your email instead.

The sign-up page also offers a link to our official LINE account. Adding us as a friend or sending us your account through LINE is entirely optional; those messages are handled by LINE under its own privacy policy, and we use them only to confirm your sign-up and to contact you about the test.

To stop automated fake sign-ups from using up the spots, when you submit we temporarily store a one-way hash of your network IP address and the time of submission (we never store the IP address itself). It is used only to limit how many sign-ups can come from the same network in a short time, and it is deleted automatically the next day.

After you register, the first time you tap each of the three buttons on the sign-up page (“Join the test group”, “Become a tester” and “Download on Google Play”), we record the time in your sign-up record (we do not record anything you do in Google Groups or on Google Play). It is used only to count how many people completed the joining steps; to do this, your email is kept in your own browser (localStorage). These times are kept and deleted together with your sign-up.

You can email zifubazaar@gmail.com at any time to see or delete your sign-up. Deleting your sign-up only removes the sign-up page data and does not affect your app account.

Children

The App is not designed for children under 13, and we do not knowingly collect personal data from children.

Changes to this policy

We may update this policy. Significant changes will be announced in the App or on the store listing.

Contact

Zifu Digital · zifubazaar@gmail.com

山跡隱私權政策