隱私權政策
最後更新日：2026 年 6 月 28 日
重點摘要（不具法律效力，僅供快速理解）：
- 你的語音不會離開裝置——錄音在你的手機上即時轉成文字，我們從不上傳或儲存音檔。
- 你的發票載具帳號與驗證碼只存在你的裝置上，以加密方式保存，從不傳送到我們的伺服器。
- 你的記帳資料會儲存在裝置上，並加密備份到我們的伺服器（讓你換機或升級時能還原）。高級版才解鎖多裝置即時同步與完整歷史；免費版於 App 內可檢視最近 31 天。
- AI 分類時，只有「文字描述」會傳給我們的伺服器並轉送 Anthropic（Claude）處理。
- 你可以隨時在 App 內刪除帳號，我們會永久刪除你在伺服器上的所有資料。
本隱私權政策說明「念帳（Voinance）」行動應用程式與相關服務（以下合稱「本服務」）如何蒐集、使用、儲存與保護你的個人資料。本服務由 Voinance（念帳）的個人開發者（以下稱「我們」或「本服務」）獨立開發與營運。當你下載、註冊或使用本服務，即表示你已閱讀並同意本政策。
1. 我們蒐集哪些資料
1.1 你主動提供的資料
| 類別 | 內容 | 用途 |
|---|
| 帳號資料 | 透過 Apple 或 Google 登入時取得的姓名（Apple 僅首次登入提供一次）、電子郵件、個人頭像（Google）。 | 建立與識別你的帳號、跨裝置登入。 |
| 記帳資料 | 你建立的支出／收入紀錄：描述、金額、分類、備註、發票號碼、賣方統編、是否為收入、建立時間。 | 提供記帳、統計、報表等核心功能。 |
| 自訂分類 | 你新增的消費分類名稱。 | 個人化 AI 分類結果。 |
| 意見與許願 | 錯誤回報內容、許願池建議、投票。 | 改善產品；錯誤回報可選擇匿名或具名。 |
1.2 裝置端處理、不上傳的資料
| 類別 | 處理方式 |
|---|
| 語音錄音 | 麥克風錄音僅在你的裝置上由作業系統（iOS Speech / Android SpeechRecognizer）即時轉為文字。音檔不儲存、不上傳，轉錄完成即丟棄。 |
| 發票載具憑證 | 你的手機條碼（手機號碼＋驗證碼）以加密方式儲存在裝置安全區（iOS Keychain／Android EncryptedSharedPreferences），僅用於在你的裝置上登入財政部電子發票平台，從不傳送至我們的伺服器。 |
1.3 自動蒐集的技術資料
- 裝置型號、作業系統版本、App 版本、裝置識別碼（device ID）——用於登入綁定、相容性與錯誤診斷。
- 當機與診斷資料（裝置型號、作業系統與 App 版本、當機堆疊、匿名安裝識別碼）——透過 Google Firebase Crashlytics 蒐集，用於偵測並修復當機、提升穩定性。不含廣告識別碼，也不會用於跨 App 追蹤。
- 匿名使用統計（畫面瀏覽、功能事件、工作階段，以及一個僅限本 App 的匿名 app-instance ID）——透過 Google Analytics for Firebase 蒐集，用於了解功能使用情形以改善產品。我們已關閉廣告識別碼（IDFA／GAID）蒐集，這些資料不會用於廣告或跨 App 追蹤。
- 訂閱狀態（是否為高級會員、試用到期日）——由訂閱服務商 RevenueCat 提供。
2. 我們如何使用資料
- 提供、維護與改善本服務的核心功能（記帳、AI 分類、報表、載具匯入、跨裝置同步）。
- 驗證身分、管理你的帳號與訂閱狀態。
- 回應你的客服詢問與錯誤回報。
- 偵測、預防與處理詐欺、濫用及安全事件。
- 遵循法律義務。
我們不會販售你的個人資料，也不會將其用於跨站廣告追蹤。本服務不含第三方廣告。
3. 第三方服務（資料處理者）
為提供本服務，我們會在必要範圍內將部分資料交由下列受託處理者處理：
| 服務商 | 處理的資料 | 目的 |
|---|
| Anthropic（Claude API） | 記帳文字描述、發票品項名稱；必要時驗證碼圖片（OCR 備援）。不含你的姓名、Email 或帳號識別。 | AI 自動分類消費內容。 |
| Apple／Google 登入 | 登入授權與身分驗證資料。 | 第三方登入。 |
| Google Cloud（Cloud Run／Cloud SQL） | 使用者的帳號與記帳資料（加密備份）。 | 後端伺服器與資料庫託管。 |
| Google Firebase（Crashlytics／Analytics） | 當機堆疊、裝置型號、作業系統／App 版本、匿名使用事件與匿名 app-instance ID。不含姓名、Email、記帳內容或廣告識別碼。 | 當機診斷與匿名使用分析（不含廣告追蹤）。 |
| RevenueCat | 訂閱與購買交易資訊。 | 處理與驗證 App 內訂閱。 |
| 財政部電子發票整合服務平台 | 由你在裝置上以自己的載具帳號登入；我們僅協助取回你自己的發票紀錄。 | 發票載具自動匯入（高級功能）。 |
付款交易由 Apple App Store／Google Play 處理，我們不會取得你的信用卡號或完整付款資訊。
4. 資料儲存與保護
- 裝置優先 ＋ 雲端備份：記帳資料會先儲存在你的裝置本機資料庫，並加密備份至我們的伺服器，讓你換裝置或升級時能還原。多裝置即時同步與完整歷史檢視為高級版功能；免費版於 App 內可檢視最近 31 天（資料仍完整保存在伺服器上）。
- 傳輸加密：所有與伺服器的通訊皆透過 HTTPS／TLS 加密。
- 機敏資料：載具憑證存於裝置安全儲存區；登入憑證（JWT）於裝置上受作業系統層級保護，並排除於雲端備份之外。
- 存取控制：所有資料 API 皆需有效的身分權杖（JWT）方能存取。
- 外洩通報：若發生危及你個人資料的安全事件，我們將依適用法律（如台灣個人資料保護法、GDPR 之 72 小時規定）於合理期間內通知受影響的使用者及主管機關。
5. 資料保留與刪除
- 記帳資料在你刪除前持續保留。刪除單筆紀錄採「軟刪除」，並會在後續清理時永久移除。
- 你可隨時於 設定 → 帳號 → 刪除帳號 永久刪除帳號。我們會永久且不可復原地刪除你儲存在伺服器上的所有個人資料與記帳紀錄（法律要求須保留者除外）。
- 解除安裝 App 只會移除裝置上的本機資料；伺服器上的備份需透過「刪除帳號」才會一併永久清除。
- 帳號刪除後，我們僅保留一個以單向雜湊產生的帳號識別碼，用途僅為防止重複濫用免費試用；它不含任何個人資料、無法反推回你的帳號，也不用於其他目的。
6. 你的權利
你對自己的個人資料享有下列權利：查詢與閱覽、更正、刪除、複製、停止使用或限制處理。多數權利可直接在 App 內完成（編輯、刪除紀錄、刪除帳號）；其餘請來信 guagma0920@gmail.com，我們將於合理期間內回覆。
國際使用者：本服務以台灣為主要營運地，但歡迎各地使用者。若你位於歐盟（GDPR）、英國、日本、韓國、美國加州（CCPA／CPRA）等地區，你另享有當地法律賦予的資料權利（例如撤回同意、反對處理、資料可攜、不受歧視等）。如欲行使，請來信聯絡，我們將依適用法律辦理。請注意，本服務的伺服器與部分受託處理者可能位於台灣以外地區，使用本服務即表示你同意必要的跨境資料傳輸，且我們將採取合理保護措施。
7. 兒童隱私
本服務並非針對 13 歲（部分地區為 16 歲）以下兒童設計，我們不會在知情下蒐集兒童的個人資料。若你認為兒童向我們提供了資料，請來信，我們將儘速刪除。
8. 政策變更
我們可能不時更新本政策。重大變更將透過 App 內通知或更新本頁「最後更新日」公告。變更後繼續使用本服務，即視為同意更新後之政策。
9. 聯絡我們
如對本政策或你的個人資料有任何疑問，請聯絡：
Voinance（念帳）開發者
Email：guagma0920@gmail.com
Privacy Policy
Last updated: June 28, 2026
Summary (for quick understanding; not legally binding):
- Your voice never leaves your device — speech is transcribed to text on your phone; we never upload or store audio.
- Your e-invoice carrier credentials stay on your device, encrypted, and are never sent to our servers.
- Your expense data is stored on your device and encrypted-backed up to our servers (so you can restore it when you switch devices or upgrade). Premium unlocks multi-device live sync and full history; the free tier shows the last 31 days in-app.
- For AI categorization, only the text description is sent to our server and forwarded to Anthropic (Claude).
- You can delete your account anytime in the app; we permanently erase all of your server-side data.
This Privacy Policy explains how the “Voinance (念帳)” mobile application and related services (collectively, the “Service”) collect, use, store, and protect your personal data. The Service is independently developed and operated by the individual developer of Voinance (“we,” “us”). By downloading, registering for, or using the Service, you acknowledge you have read and agree to this Policy.
1. Data We Collect
1.1 Data you provide
| Category | Details | Purpose |
|---|
| Account | Name (Apple provides this only once, at first sign-in), email, and profile photo (Google), obtained via Apple or Google Sign-In. | Create and identify your account; cross-device login. |
| Expense data | Records you create: description, amount, category, note, invoice number, seller tax ID, income flag, timestamp. | Provide core tracking, statistics, and reports. |
| Custom categories | Category names you add. | Personalize AI categorization. |
| Feedback | Bug reports, feature requests, and votes. | Improve the product; bug reports may be anonymous or signed-in. |
1.2 Processed on-device, never uploaded
| Category | Handling |
|---|
| Voice recordings | Microphone audio is transcribed to text in real time on your device by the OS (iOS Speech / Android SpeechRecognizer). Audio is not stored or uploaded and is discarded after transcription. |
| Carrier credentials | Your mobile barcode (phone number + verification code) is stored encrypted in the device secure store (iOS Keychain / Android EncryptedSharedPreferences) and is used only on your device to log in to Taiwan's MOF e-invoice platform. It is never sent to our servers. |
1.3 Automatically collected technical data
- Device model, OS version, app version, and device ID — for login binding, compatibility, and diagnostics.
- Crash and diagnostic data (device model, OS and app version, crash stack traces, an anonymous installation identifier) — collected via Google Firebase Crashlytics to detect and fix crashes and improve stability. Contains no advertising identifier and is not used for cross-app tracking.
- Anonymous usage statistics (screen views, feature events, sessions, and an app-scoped anonymous app-instance ID) — collected via Google Analytics for Firebase to understand feature usage and improve the product. We disable advertising-identifier (IDFA / GAID) collection; this data is not used for advertising or cross-app tracking.
- Subscription status (premium / trial end date), provided by our subscriptions processor RevenueCat.
2. How We Use Data
- Provide, maintain, and improve core features (tracking, AI categorization, reports, carrier import, cross-device sync).
- Authenticate you and manage your account and subscription.
- Respond to your support inquiries and bug reports.
- Detect, prevent, and address fraud, abuse, and security incidents.
- Comply with legal obligations.
We do not sell your personal data and do not use it for cross-site advertising. The Service contains no third-party ads.
3. Third-Party Services (Processors)
| Provider | Data processed | Purpose |
|---|
| Anthropic (Claude API) | Expense text descriptions and invoice item names; when needed, a CAPTCHA image (OCR fallback). No name, email, or account identifier. | AI categorization of spending. |
| Apple / Google Sign-In | Login authorization and identity data. | Third-party authentication. |
| Google Cloud (Cloud Run / Cloud SQL) | Users' account and expense data (encrypted backup). | Backend server and database hosting. |
| Google Firebase (Crashlytics / Analytics) | Crash stack traces, device model, OS/app version, anonymous usage events, and an anonymous app-instance ID. No name, email, expense content, or advertising identifier. | Crash diagnostics and anonymous usage analytics (no ad tracking). |
| RevenueCat | Subscription and purchase transaction data. | Process and verify in-app subscriptions. |
| MOF e-invoice platform (Taiwan) | You log in on-device with your own carrier account; we only help retrieve your own invoice records. | E-invoice carrier auto-import (premium). |
Payments are processed by the Apple App Store / Google Play. We do not receive your card number or full payment details.
4. Storage & Security
- Device-first + cloud backup: expense data is stored in your device's local database and encrypted-backed up to our servers so you can restore it when switching devices or upgrading. Multi-device live sync and full-history viewing are Premium features; the free tier shows the last 31 days in-app (the data remains fully retained on the server).
- Encryption in transit: all communication with our servers uses HTTPS/TLS.
- Sensitive data: carrier credentials live in the device secure store; the login token (JWT) is protected at the OS level on-device and excluded from cloud backups.
- Access control: all data APIs require a valid identity token (JWT).
- Breach notification: if a security incident affects your personal data, we will notify affected users and the relevant authorities within a reasonable time as required by applicable law (e.g., Taiwan's PDPA, the GDPR's 72-hour rule).
5. Data Retention & Deletion
- Expense data is retained until you delete it. Deleting a record is a “soft delete,” later purged permanently.
- You may permanently delete your account anytime via Settings → Account → Delete Account. We will permanently and irreversibly erase all of your personal and expense data stored on our servers (except where retention is legally required).
- Uninstalling the app only removes local data on the device; the server backup is permanently erased only by deleting your account.
- After account deletion, we retain only a one-way hashed account identifier, solely to prevent repeated abuse of the free trial. It contains no personal data, cannot be reversed to your account, and is not used for any other purpose.
6. Your Rights
You have the right to access, correct, delete, export, and restrict processing of your personal data. Most rights can be exercised directly in the app (edit, delete records, delete account); for others, email guagma0920@gmail.com and we will respond within a reasonable time.
International users: the Service is primarily operated from Taiwan but welcomes users worldwide. If you are in the EU (GDPR), UK, Japan, Korea, or California (CCPA/CPRA), you also have the data rights granted by your local law (e.g., withdraw consent, object to processing, data portability, non-discrimination). To exercise them, email us and we will act per applicable law. Note that our servers and certain processors may be located outside Taiwan; by using the Service you consent to the necessary cross-border data transfers, for which we apply reasonable safeguards.
7. Children's Privacy
The Service is not directed to children under 13 (or 16 in some regions), and we do not knowingly collect their personal data. If you believe a child provided us data, please email us and we will delete it promptly.
8. Changes to This Policy
We may update this Policy from time to time. Material changes will be announced via in-app notice or by updating the “Last updated” date above. Continued use after changes constitutes acceptance of the updated Policy.
9. Contact Us
For any questions about this Policy or your personal data, contact:
Voinance (念帳) — Individual Developer
Email: guagma0920@gmail.com