YUTTALI 有牠 隱私權政策 / Privacy Policy

版本 / Version：2.1

生效日期 / Effective Date：2026-08-24

第一部分：繁體中文版

一、寫在前面

「YUTTALI 有牠」（以下稱「本App」）是一款給寵物飼主使用的社群App，由台灣的個人開發者 WEN GUAN BO（以下稱「我們」）開發與維運。

這份隱私權政策想做的事只有一件：讓你清楚知道，你在這個App裡留下的每一項資料，我們拿去做什麼、放在哪裡、誰看得到、會留多久。

我們盡量用白話寫，不堆法律術語。每一段都會用同樣的五個標題說明：

• 蒐集什麼
• 為什麼要蒐集
• 存在哪裡
• 誰看得到（這一項請務必看清楚）
• 保留多久

當你下載、註冊或使用本App，即表示你已閱讀並同意本政策。若你不同意其中任何一部分，請不要使用本App。

先講三件最重要的事

1. 本App是一個公開的社群平台。 你發布的貼文、照片、影片、留言、寵物檔案、走失協尋的聯絡方式、你標記的寵物友善地點，其他使用者看得到。請把「發文」想成「貼在公佈欄上」，不要放你不希望別人知道的事。

2. 實名認證要你拍證件，但那張照片永遠不會離開你的手機。 辨識在你的裝置上完成，比對完立刻丟棄；資料庫裡只留「已通過」與一段無法還原的雜湊，詳見第三節。

3. 本App不碰錢，也不追蹤你，目前也不把任何內容送給第三方 AI。 沒有 App 內購買、沒有廣告、沒有第三方登入、沒有裝置追蹤，也沒有安裝任何行為分析或廣告 SDK。原本會呼叫 Google Gemini 的 AI「毛孩內心話」功能目前已停用，詳見第四節。

二、帳號與個人檔案

2.1 註冊帳號

• 蒐集什麼：電子郵件、密碼、暱稱，以及你在註冊時勾選的「飼養寵物類型」（貓／狗等）。
• 為什麼要蒐集：建立並辨識你的帳號；寵物類型用來決定首頁動態牆與知識庫要優先顯示哪些內容。
• 存在哪裡：帳號與密碼由 Firebase Authentication 處理；暱稱與寵物類型存放在 Firestore 資料庫的 users 集合，你的 Email 與電話則存放在另一份獨立的私人文件 users/{你的使用者代碼}/private。
• 誰看得到：
• 密碼：沒有人看得到，包含我們。 Firebase Authentication 只保存經過雜湊處理的結果，本App從頭到尾不會接觸、也不會儲存你的明文密碼。
• 暱稱、頭像、自我介紹、粉絲數、寵物類型：所有已登入的使用者都看得到。
• 你的註冊 Email、電話、登入方式與帳號狀態：只有你本人。 安全規則只放行你自己的帳號，其他使用者連讀都讀不到。
• 這一項先前不是這樣，我們照實說明：本政策 2.0 版曾揭露，Email 當時和公開的個人檔案存放在同一份文件裡，而該文件允許任何已登入的使用者讀取——具備技術能力的其他使用者有可能讀到別人的註冊信箱。這項缺陷已經修正：私人欄位已搬到上述獨立文件，安全規則同步收斂，既有帳號的資料也已一併搬移完成。
• 保留多久：帳號存續期間持續保存；你刪除帳號時，users 文件、上述私人文件與 Firebase Authentication 帳號會立即刪除（其餘內容的處理方式見第九節）。

2.2 個人檔案

• 蒐集什麼：大頭貼照片、自我介紹文字、暱稱。
• 為什麼要蒐集：讓其他飼主認得你。這些都是選填的。
• 存在哪裡：大頭貼放在 Cloud Storage for Firebase 的 avatars/ 路徑，網址記錄在 users 文件。
• 誰看得到：所有已登入的使用者。另外請注意：大頭貼、貼文照片與影片、寵物頭像、交換物品照片、救援與地點照片，在 Cloud Storage 上都設定為公開讀取——任何人只要取得該檔案的網址，不需要登入本App就能開啟。 這是為了讓圖片能順利顯示，但也代表這些圖片實質上是公開的。
• 保留多久：你更換或刪除前持續保存。

補充更正：舊版政策曾寫「個人資料（選填）包含電話號碼」。這是不正確的——本App的個人檔案編輯畫面只有大頭貼、暱稱與自我介紹三個欄位，沒有任何填寫電話號碼的地方。 本App唯一會請你填電話的情境是實名認證（第三節）、走失協尋的聯絡方式（第五節）與寵物友善地點的店家電話（第六節）。

2.3 登入紀錄

• 蒐集什麼：登入、註冊、登出的動作類型、時間、成功或失敗、失敗原因，以及你的使用者代碼。
• 為什麼要蒐集：帳號安全稽核，例如協助你確認是否有異常登入。
• 存在哪裡：Firestore 的 auth_logs 集合。
• 誰看得到：只有你本人與開發者。安全規則限制每位使用者只讀得到自己的紀錄，且任何人都不能修改或刪除。
• 保留多久：目前無自動清除機制，我們會定期人工清理逾一年的紀錄。

三、實名認證（只有使用「用品交換」功能才需要）

如果你想使用「寵物用品交換」功能，本App會請你先完成實名認證。

認證分成兩個步驟：第一步確認你是誰，第二步設定東西要寄到哪裡。這兩份資料分開存放，因為它們的保護需求正好相反。

• 蒐集什麼：真實姓名、證件類型（身分證／護照／居留證）、證件號碼；以及收件人姓名、國碼與電話、收件地址、配送備註。
• 為什麼要蒐集：留存可供追溯的身分資料，讓交換雙方在發生糾紛、詐騙通報，或主管機關依法要求時，有辦法識別當事人；收件資訊則是為了讓包裹真的寄得到。我們不會把這組資料用於行銷，不會出售或出租給任何第三方。
• 存在哪裡：身分資料在 Firestore 的 verification 集合；收件資訊在 shipping 集合，兩者都是一位使用者一份文件。

3.0 證件拍攝：我們不會拿到你的證件照片

完成認證時，本App會請你當場拍攝證件。關於這張照片，請看清楚：

• 照片不會上傳。 它只存在於你手機的記憶體裡，交由 iOS 內建的 Vision 文字辨識在你的裝置上讀取。
• 照片不會存檔。 不寫入相簿、不寫入本App的檔案區、不進入 Cloud Storage，辨識完立刻釋放。
• 辨識結果不會外傳。 我們只比對「證件上的號碼」是否與你輸入的一致，比對完就丟。
• 資料庫裡實際留下的只有兩樣：一個布林值表示「已通過證件比對」，以及證件號碼經加鹽 SHA-256 運算後的雜湊值。這個雜湊無法還原成號碼，用途只有一個：偵測同一張證件被用來註冊多個帳號。
• 為什麼這樣設計：證件影本一旦外洩就是不可逆的傷害。不蒐集，就沒有保管責任，也沒有東西可以外洩。

3.0b 收件資訊什麼時候會給別人看

• 平常只有你自己讀得到，安全規則不放行任何其他人。
• 只有在一筆交換被接受的當下，系統會把雙方當時的收件資訊「快照」寫進那張交換單，交換對象才看得到——因為他要靠這份資料把東西寄給你。
• 快照是當下的凍結值。你之後修改地址，不會回頭改變已經成立的那一筆交換。
• 請不要把交換對象的姓名、電話、地址用在交換以外的任何用途，也不要轉發給第三人。

3.1 哪些欄位真的有加密（請看清楚，我們照實說）

這一段舊版政策寫得過於籠統，這一版據實更正：

「已加密」的具體作法：姓名與證件號碼在離開你的手機之前，會先用 ECIES 混合式加密（P-256 橢圓曲線做金鑰交換、HKDF-SHA256 導出金鑰、AES-GCM 加密內容）處理；每次加密都使用一組全新的臨時金鑰，所以同一組證件號碼加密兩次，密文也完全不同。App 內只放公鑰，解密用的私鑰由開發者離線保管，不存在於App、程式碼或任何伺服器上，App 本身沒有解密能力。

電話與地址目前是以明文存入資料庫的，我們沒有理由把這件事寫得比實際好聽。這兩個欄位的保護，目前僅依靠下述的存取控制。改為一併加密已列入待辦。

3.2 誰看得到實名認證資料

• 其他使用者：看不到。 Firestore 安全規則設定為「只有文件擁有者本人可以讀寫」，其他使用者連查詢都會被拒絕。
• 開發者：可透過 Firebase 主控台看到這份文件。其中姓名與證件號碼是密文，開發者需要另外在自己的離線電腦上用私鑰才能還原；電話與地址則是直接看得到的明文。
• Google（Firebase）：作為我們的資料處理者，會保存這份文件的內容。

3.3 關於「認證」兩個字的誠實說明

本功能名稱雖然叫「實名認證」，但在你送出資料的當下，並沒有任何人工審核或第三方查驗程序去核對這些資料的真偽——系統會直接將你的帳號標記為已認證。因此：

• 這組資料的實際作用是「事後可追溯」，不是「事前已查證」。
• 請不要因為對方帳號顯示「已認證」，就認定對方身分必然屬實。交換前仍請自行判斷。

• 保留多久：帳號存續期間持續保存。你刪除帳號時，這份實名認證文件會與帳號一併立即刪除。

舊版政策曾寫「你可以在『帳號設定』頁面自行停用實名認證」。App 內並沒有這項功能。 目前若要移除實名認證資料，唯一的方式是刪除整個帳號（會一併刪除），或透過第十一節的聯絡方式向我們申請。

四、AI「毛孩內心話」（目前已停用）

狀態說明（2026 年 8 月更新）：這項功能目前已從本App中移除，使用者無法啟用。 以下說明保留下來，是為了讓你知道它若在未來版本恢復時會如何運作；在恢復並更新本政策之前，本App不會把任何內容送給第三方 AI 服務。

這在啟用時，是本App唯一會把你的內容送到第三方 AI 服務的功能。

• 會送出什麼：你在這個功能裡選擇的那一張照片本身，加上一段由本App撰寫、要求 AI 幫寵物寫三句幽默內心話的指示文字，以及你選擇的語氣風格、輸出語言，還有（如果你有選）你的寵物名字。
• 送給誰：Google。 具體而言是透過 Firebase AI Logic 呼叫 Google 的 Gemini Developer API，使用的模型為 Google Gemini（實際模型版本可能隨 Google 汰換而異）。
• 用途：讓 AI 看圖後產生三句短句，供你製作分享字卡。僅此而已。
• 本App這一端會不會保留：不會。 這張照片只存在於你手機的記憶體中，本App不會把它上傳到我們的 Firestore 資料庫或 Cloud Storage，也不會保存 AI 產生的句子。你關掉畫面，就沒了。做好的字卡是在你的手機上算圖完成的，要不要分享、分享給誰，完全由你決定。
• Google 那一端會不會保留：這不是我們能決定或保證的事，取決於 Google 對該 API 的資料處理政策。我們無法代 Google 承諾保留期限，因此請你在使用前參閱 Google 隱私權政策 與 Google 的生成式 AI 服務條款。
• 給你的實務建議：請不要在這個功能裡選擇含有人臉、住家門牌、車牌、證件、螢幕截圖或其他敏感資訊的照片。 選一張單純的毛孩照片就好。
• 誰看得到：除了你自己與 Google 的處理流程之外，沒有其他使用者看得到，因為這些內容根本不會進入本App的資料庫。

另外，AI 產生的內容是機器生成的娛樂性文字，可能不準確、不合理，也可能與照片內容不符，請不要當成事實或任何形式的建議看待。

五、位置資訊（舊版政策此節完全錯誤，這一版重寫）

舊版政策寫著「本App不會蒐集精確地理位置（無 GPS 定位或地圖功能）」。這句話是錯的，本App確實有定位功能與地圖功能。 以下是實際情形。

5.1 「使用目前位置」按鈕

本App在三個地方提供「使用目前位置」的按鈕：發布貼文、發布走失協尋、發布浪浪救護通報。

• 蒐集什麼：只有在你主動按下那個按鈕時，本App才會向系統請求一次定位。取得座標後，立刻透過 Apple 的反向地理編碼服務換算成城市名稱（例如「台北市」），然後只把這串城市名稱文字填入欄位，座標本身即被丟棄，不會上傳、不會儲存。
• 精確度：定位精確度設定為「公里級」（kCLLocationAccuracyKilometer），本來就取不到街道等級的精確位置。
• 不會做的事：不做背景定位、不做持續追蹤、不記錄移動軌跡。你不按按鈕，本App就完全不會請求定位。
• 你可以自己改：帶入的城市名稱只是預設值，你可以自行改寫成任何文字，或整段刪掉。
• 存在哪裡／誰看得到：作為貼文或通報的一個文字欄位存放，可見範圍與該篇貼文或通報相同（見第六節）。
• 權限：使用的是「使用App期間」的定位權限，你可以隨時到 iOS「設定 → 隱私權與安全性 → 定位服務」關閉，關閉後其餘功能照常運作。

5.2 寵物友善地圖

• 本App使用 Apple MapKit 顯示地圖。地圖上會標示你目前的位置（那個藍點），但那是 iOS 在你的裝置上畫出來的，我們不會取得、不會上傳、也不會儲存這個位置。
• 當你新增一個寵物友善地點時，你輸入的是店家地址，本App會用 Apple 的地理編碼服務把那個地址換算成經緯度後存起來，好讓地點能標在地圖上。這組經緯度是那家店的位置，不是你的位置。

5.3 所以，本App到底存不存座標？

• 關於你個人的位置：不存座標。 只會存你按按鈕後產生、而且可以自行修改的城市名稱文字。
• 關於店家的位置：會存座標。 那是你輸入的公開店家地址換算出來的。

對照隱私權資訊清單：本App的 PrivacyInfo.xcprivacy 已就上述行為宣告「粗略位置」（NSPrivacyCollectedDataTypeCoarseLocation）——與帳號連結、不用於追蹤、用途為 App 功能。不宣告「精確位置」，是因為城市名稱的解析度遠低於 Apple 對精確位置的定義（緯經度小數點後三位以上），而定位精度本來就設在公里級；寵物友善地圖上的店家座標是店家的位置而不是你的位置，因此不列在這一項。

六、你在各個功能中留下的內容，以及誰看得到

本App是社群平台，以下大部分內容都是要給別人看的。這張清單請仔細讀，特別是「誰看得到」那一欄。

6.1 社群貼文與留言

• 蒐集什麼：貼文文字、照片與影片（每則最多 10 個媒體，影片上限 60 秒並會壓縮成 720p）、你套用的濾鏡、地點文字、你標記的寵物、你的按讚、留言、追蹤與收藏。
• 為什麼：這就是社群功能本身。
• 存在哪裡：Firestore 的 posts、post_comments、post_likes、post_bookmarks、user_follows；媒體檔案在 Cloud Storage。
• 誰看得到：
• 貼文、留言、按讚、追蹤關係：所有已登入的使用者。
• 貼文的照片與影片檔案：公開讀取，任何人取得網址即可開啟，不需登入。
• 收藏（書籤）是私人的，只有你自己看得到。
• 保留多久：你自行刪除前持續保存。你可以隨時刪除自己的貼文與留言。

6.2 通知

• 蒐集什麼：誰對你按讚、留言、追蹤，以及是否已讀。
• 誰看得到：只有收件人本人。取消按讚或取消追蹤時，對應的通知會一併撤回。
• 保留多久：帳號存續期間。

6.3 私訊

• 蒐集什麼：訊息文字、參與者代碼、時間、對話摘要（最後一則訊息）。
• 存在哪裡：Firestore 的 conversations 與 messages。
• 誰看得到：只有對話的兩位當事人。 安全規則會擋掉所有非參與者的讀取。開發者可透過 Firebase 主控台存取，但我們僅在處理具體檢舉或依法配合時才會這麼做。
• 保留多久：目前沒有自動刪除機制，訊息會持續保存。App 內目前也沒有刪除單則訊息的功能。
• 請注意：私訊沒有端對端加密。傳輸過程有 TLS 加密保護，但儲存在資料庫中的內容並未額外加密。請不要用私訊傳送證件、金融帳號、密碼等敏感資訊。

6.4 寵物檔案

• 蒐集什麼：寵物名字、種類、品種、性別、生日、介紹、寵物頭像，以及你是否將牠設為「星星紀念」狀態與紀念日期。
• 誰看得到：所有已登入的使用者（其他飼主可以在你的個人頁面看到你的毛孩）。寵物頭像檔案為公開讀取。
• 保留多久：你刪除前持續保存。

6.5 健康紀錄（體重）

• 蒐集什麼：日期、體重數值、備註。
• 誰看得到：只有你自己。 這是唯一被安全規則明確保護為「僅飼主可讀寫」的寵物資料，因為我們認為健康紀錄屬於醫療性質，不該公開。
• 保留多久：你刪除前持續保存。

6.6 照護提醒

• 蒐集什麼：提醒標題、分類、寵物名稱、到期日、重複規則、備註。
• 誰看得到：只有你自己。
• 推播說明：提醒使用 iOS 本機通知排程，通知內容不會經過任何伺服器，也不會傳送給我們或第三方。本App沒有整合遠端推播服務。
• 保留多久：你刪除前持續保存。

6.7 浪浪救護通報

• 蒐集什麼：動物種類、緊急程度、狀況描述、地點文字（必填，且必須勾選「我已確認上述地點正確」才能發佈）、現場照片、你的暱稱、通報狀態。
• 為什麼：讓附近的飼主與愛心人士看得到、能前往協助。
• 誰看得到：所有已登入的使用者。這是公開通報，這正是它的目的。 照片檔案為公開讀取。
• 保留多久：你刪除前持續保存。通報人可自行更新狀態或刪除。

6.8 走失協尋

• 蒐集什麼：與浪浪救護相同的欄位，另加毛孩名字、關聯的寵物檔案、聯絡方式（選填）、謝禮說明（選填）。
• 誰看得到：所有已登入的使用者，包含你填寫的聯絡方式。
• 請務必理解：如果你在「聯絡方式」欄位填了電話號碼，那組電話會直接顯示在協尋卡片上，本App所有使用者都看得到。 這是這個功能能發揮作用的必要條件——別人要有辦法通知你。但請你在填之前想清楚：你也可以留空不填，改用本App內建的私訊功能讓別人聯絡你。
• 保留多久：找到毛孩後，請記得自行把該則通報刪除或改為已結案，你填的聯絡方式才會跟著下架。

6.9 寵物友善地圖

• 蒐集什麼：地點名稱、分類、地址、由地址換算的經緯度、店家電話（選填）、補充說明、是否為 24 小時急診、其他人給的評分。
• 誰看得到：所有已登入的使用者。
• 請注意：這個欄位是設計來填「店家」資訊的。請不要把自己家的地址或私人電話填進來——填進去就是公開的。
• 保留多久：建立者刪除前持續保存。

6.10 保姆互助

• 蒐集什麼：你要找保姆或當保姆、可照顧的寵物類型、地區、起訖日期、能否過夜、補充說明、你的暱稱與頭像。
• 誰看得到：所有已登入的使用者。
• 保留多久：你按下「已找到，關閉訊息」後即從列表下架；資料本身在你刪除前持續保存。

6.11 寵物用品交換

• 蒐集什麼：物品名稱、描述、新舊狀況（六個等級）、瑕疵說明、照片、交換請求、交換完成後的互相評價與評語。
• 誰看得到：
• 上架物品、評價：所有已登入的使用者。物品照片為公開讀取。
• 交換請求與其中的收件資訊快照：只有該筆交換的雙方當事人看得到。
• 你可以自己修改或下架：在還沒有人提出交換之前，你可以隨時修改物品內容；下架時照片會一併從儲存空間刪除。已經有人提出交換後就不能再改內容——對方是看著當時的描述決定要不要換的。
• 保留多久：你刪除前持續保存；評價一經送出即無法修改或刪除。

6.11b 經驗分享討論區

• 蒐集什麼：你發表的議題標題與內容、回覆內容、分類、相關寵物類型、發表時間，以及你的暱稱。
• 誰看得到：所有已登入的使用者。這是公開的討論區，請不要在這裡貼出你的地址、電話、證件或任何你不想被陌生人看到的資訊。
• 內容審核：送出前會經過關鍵字過濾；其他使用者可以檢舉。經檢舉查證屬實的廣告、洗版或違規內容會被移除，發文者可能被停權。
• 保留多久：你刪除前持續保存。你刪除議題時，底下的所有回覆會一併刪除。
• 醫療內容的提醒：討論區裡的一切都是飼主之間的經驗分享，不是獸醫診斷，也不構成任何醫療建議。毛孩身體不適請就醫。

6.12 照護知識庫

• 知識庫（毛孩照護小幫手）：內容是內建在App裡的，你的瀏覽紀錄與收藏只存在你自己的手機上（iOS UserDefaults），不會上傳到任何伺服器。
• 原本規劃的「寵物情緒音效」功能目前尚未上線（等真實音效素材備齊後才會推出），本App現階段不會蒐集任何音效評分資料。

6.13 檢舉紀錄

• 蒐集什麼：檢舉人代碼、被檢舉的對象與類型、你選擇的檢舉原因、時間。
• 誰看得到：只有開發者。 安全規則設定為「只能新增、不能讀取」，連檢舉人自己事後都讀不到，避免檢舉內容外流。

6.14 貼文觀看紀錄

• 蒐集什麼：當別人的貼文出現在你的畫面上時，會寫下一筆「你的使用者代碼＋那篇貼文＋日期」。同一個人、同一篇、同一天最多只記一筆，看自己的貼文不記。
• 為什麼：讓創作者在「寵物情報室」看得到自己貼文的觀看人次。
• 存在哪裡：Firestore 的 post_views。
• 誰看得到：只有那篇貼文的作者。 安全規則限定只有作者讀得到自己貼文的觀看紀錄，其他使用者一律讀不到。
• 保留多久：35 天，之後由 Firestore 自動清除；作者刪除貼文時，該篇的觀看紀錄也會一併刪掉。
• 不會做的事：這份資料只用來產生上面說的觀看人次，不做使用者行為分析、不做個人化廣告，本App也沒有安裝任何分析 SDK（見第八節）。

七、我們用你的資料做什麼

我們蒐集的資料，只會用在以下用途：

1. 提供、維運本App的各項功能。

2. 建立與管理你的帳號、維持登入狀態。

3. 顯示社群內容，並依你設定的寵物類型決定優先顯示的內容。

4. 處理檢舉、封鎖與違規內容，維護社群安全。

5. 在發生交換糾紛或詐騙通報時，作為身分追溯的依據。

6. 回覆你的來信、客訴與資料權利請求。

7. 遵循法令規定或配合主管機關的合法要求。

我們不會做的事：不出售你的資料、不出租你的資料、不拿你的資料做廣告投放或跨App追蹤、不把你的資料用於本政策沒有寫到的用途。

八、第三方服務（完整清單）

本App整合的外部服務只有以下這些，沒有別的：

沒有整合的東西（這一項同樣重要）：

• 沒有 Google Analytics for Firebase，也沒有任何行為分析 SDK。 舊版政策聲稱使用 Google Analytics for Firebase 蒐集匿名使用數據，這是不正確的——本App實際連結的 Firebase 元件只有 Core、Authentication、Firestore、Storage 與 AI 這五項，程式碼中沒有任何一行分析事件記錄。這一版已將該段落整個移除。
• 沒有 Crashlytics 或任何當機回報 SDK。
• 沒有廣告 SDK、沒有廣告識別碼（IDFA）、沒有 App 追蹤透明度（ATT）要求。
• 沒有第三方登入（無 Apple 登入、Google 登入或 Facebook 登入）。
• 沒有 App 內購買、訂閱或任何金流機制。本App完全不經手金錢。

資料存放地點：你的資料存放於 Google Firebase 的伺服器。Google 作為我們的資料處理者，依其自身的隱私權與安全標準運作。詳情請參閱 Google 隱私權政策 與 Firebase 隱私與安全說明。

九、刪除帳號與資料保留（據實說明目前的範圍）

你可以隨時在 App 內「設定 → 刪除帳號」永久刪除帳號。基於安全考量，若你太久沒登入，系統會要求你先重新登入再執行。

9.1 按下刪除的當下，立刻刪除的是

• 你的 Firebase Authentication 帳號（Email 與密碼憑證）
• 你的公開個人檔案文件（users）——包含暱稱、自我介紹、頭像網址、追蹤數
• 你的私人個人檔案文件（users/{你的使用者代碼}/private）——包含註冊 Email、電話、登入方式與帳號狀態
• 你的實名認證文件（verification）——包含加密的姓名與證件號碼，以及明文的電話與地址

執行後你將無法再登入。

9.2 目前不會自動一併刪除的是

我們不打算把這件事講得比實際好聽。目前的自動刪除只涵蓋上述三份文件與帳號本身，以下內容在你按下刪除後仍會留在資料庫中：

• 你發布的貼文、留言、按讚與收藏
• 你上傳的照片與影片檔案（Cloud Storage）
• 你的私訊與對話
• 你的寵物檔案、健康紀錄、照護提醒
• 你發布的浪浪救護通報、走失協尋、寵物友善地點、保姆互助訊息
• 你的交換物品、交換請求與交換評價
• 你的封鎖名單與檢舉紀錄
• 你的登入稽核紀錄

9.3 我們的承諾

• 請你在刪除帳號前，先自行刪除你在意的內容（貼文、通報、走失協尋的聯絡方式等），這是目前最快、最確實的方式，而且效果是立即的。
• 對於未能自動刪除的部分，我們會以人工方式，在收到請求或帳號刪除後的合理期間內（我們的目標是 30 日內）完成清除或去識別化。
• 你可以主動要求加速：寄信到 newemailpaul888@gmail.com，說明你的註冊 Email 或暱稱，我們會在 15 日內處理並回覆結果。
• 我們正在開發「刪除帳號時一併清除所有內容」的功能。在該功能上線前，本節就是目前的真實狀況。
• 法令要求須保存的資料，依法令規定辦理。
• 已交付給對方的私訊內容，因同時屬於對方的對話紀錄，可能無法單方面完全移除。

9.4 其他資料的保留原則

• 你自行刪除的內容：立即從App前台移除；Firebase 的備援資料會在合理期間內隨其備份週期輪替清除。
• 交換評價：為維護評價制度的公信力，一經送出即無法修改或刪除。
• 登入稽核紀錄：定期人工清理逾一年的紀錄。

十、你的權利

依據中華民國《個人資料保護法》，你對我們持有的個人資料享有下列權利：

1. 查詢或請求閱覽：了解你的資料被如何蒐集、處理與利用。

2. 請求製給複製本：取得你個人資料的副本。

3. 請求補充或更正：資料有誤時要求更正。

4. 請求停止蒐集、處理或利用。

5. 請求刪除（依法須保存者除外）。

你可以直接在App內自己做到的事：

• 編輯暱稱、自我介紹、大頭貼（設定 → 編輯個人檔案）
• 刪除自己的貼文、留言、寵物檔案、健康紀錄、照護提醒、通報、地點、交換物品
• 封鎖與解除封鎖其他使用者（設定 → 隱私 → 封鎖名單）
• 檢舉貼文或使用者
• 關閉定位權限（iOS 系統設定）
• 永久刪除帳號（設定 → 刪除帳號）

需要來信辦理的事：查詢、取得複製本、要求加速清除帳號刪除後的殘留內容、移除實名認證資料但保留帳號。

請寄信至 newemailpaul888@gmail.com，我們會在收到後 15 日內（或依法令規定期限）回覆。為保護你的資料，我們可能需要先確認你的身分。

十一、資料安全

我們採取的保護措施包括：

• 密碼交由 Firebase Authentication 以雜湊方式處理，我們不接觸明文密碼。
• 實名認證的姓名與證件號碼採 ECIES（P-256／HKDF-SHA256／AES-GCM）非對稱加密，私鑰由開發者離線保管，不存在於App或伺服器上。
• 以 Firestore 與 Cloud Storage 安全規則限制存取：私訊限對話雙方、健康紀錄限飼主、收藏與提醒限本人、實名認證限本人、檢舉紀錄禁止讀取。
• 個人檔案拆成公開與私人兩份：Email、電話、登入方式與帳號狀態存放在只有本人讀得到的獨立文件，不與全站可讀的公開檔案混在一起。Firestore 的安全規則無法逐一欄位過濾——讀取權限一旦放行就是整份文件放行——所以「誰讀得到哪些欄位」必須靠「欄位存放在哪份文件」來決定，不能靠畫面上有沒有顯示。
• 所有連線均使用 TLS 加密傳輸。
• 上傳檔案有型別與大小限制（圖片 12MB、影片 200MB），且路徑綁定上傳者身分。

我們也要誠實告訴你目前的限制：

• Cloud Storage 上的圖片與影片設定為公開讀取，取得網址者不需登入即可開啟。
• 實名認證的電話與地址目前以明文儲存。
• 私訊沒有端對端加密。

上述三項已列入改善清單。此外，任何透過網際網路傳輸或電子儲存的方式都無法保證百分之百安全，我們只能承諾持續採取合理措施。

十二、未滿 18 歲的使用者

• 未滿 13 歲不得使用本App。 本App並非為兒童設計，也未以兒童為訴求對象。
• 未滿 18 歲者，使用需要提交個人資料的功能（尤其是實名認證、走失協尋填寫聯絡方式）前，應取得法定代理人同意。
• 我們一經知悉蒐集到未滿 13 歲兒童的個人資料，將立即刪除。若你是家長或監護人，發現孩子未經你同意提供了個人資料，請立即透過 newemailpaul888@gmail.com 與我們聯繫。

十三、政策修訂

我們可能不定期修訂本政策。修訂後會更新頁首的版本與生效日期。若有重大變更（例如新增蒐集的資料類型、新增第三方服務、改變使用目的），我們會透過App內通知或其他合理方式告知你。建議你定期查閱。

你可以隨時在App內「設定 → 關於 → 隱私權政策」閱讀最新版本。

十四、聯絡我們

對本政策有疑問、想行使個人資料權利，或想檢舉違規內容，請聯絡：

• 開發者：WEN GUAN BO（台灣個人開發者）
• App：YUTTALI 有牠（Bundle ID：tw.paulwen.Mewtopia）
• 聯絡信箱：newemailpaul888@gmail.com
• 回覆時間：一般詢問 7 個工作天內；個人資料權利請求 15 日內。

Part 2: English Version

1. Introduction

"YUTTALI 有牠" (the "App") is a social app for pet owners, developed and operated by WEN GUAN BO, an independent developer based in Taiwan ("we," "us").

This Privacy Policy has one job: to tell you plainly what data you leave in this App, what we do with it, where it is stored, who can see it, and how long we keep it.

Each section below uses the same five headings: What we collect / Why / Where it is stored / Who can see it / How long we keep it.

By downloading, registering for, or using the App, you agree to this Policy. If you do not agree with any part of it, please do not use the App.

Three things to know first

1. This is a public social platform. Your posts, photos, videos, comments, pet profiles, lost-pet contact details, and the pet-friendly places you add are visible to other users. Treat posting like pinning something to a public noticeboard.

2. Verification asks you to photograph your ID, but that photo never leaves your phone. Recognition happens on your device and the image is discarded immediately; only a "passed" flag and an irreversible hash reach our database. See Section 3.

3. We do not handle money, we do not track you, and we currently send no content to any third-party AI. No in-app purchases, no ads, no third-party sign-in, no device tracking, and no analytics or advertising SDKs are installed. The AI "Pet Inner Voice" feature, which called Google Gemini, is currently disabled — see Section 4.

2. Account and Profile

2.1 Registration

• What we collect: email address, password, nickname, and the pet types (cat/dog etc.) you select at sign-up.
• Why: to create and identify your account; pet types determine which feed and knowledge-base content is prioritised for you.
• Where: credentials are handled by Firebase Authentication; nickname and pet types are stored in the users collection in Firestore, while your email and phone number are held in a separate private document at users/{your user ID}/private.
• Who can see it:
• Your password: nobody, including us. Firebase Authentication stores only a hash. The App never handles or stores your plaintext password.
• Nickname, avatar, bio, follower counts, pet types: all signed-in users.
• Your registration email, phone number, login method, and account status: only you. The security rule admits your own account and no one else — other users cannot read them at all.
• This was not always the case, and we will say so plainly: version 2.0 of this policy disclosed that the email address was then stored in the same document as the public profile, and that this document was readable by any signed-in user — a technically capable user could have read other people's registration emails. That defect has been fixed: the private fields were moved to the separate document described above, the security rules were tightened to match, and existing accounts have been migrated.
• How long: for the life of your account. Deleting your account immediately deletes the users document, the private document above, and your Firebase Authentication account (see Section 9 for everything else).

2.2 Profile

• What we collect: profile photo, bio text, nickname. All optional.
• Where: profile photos are stored in Cloud Storage for Firebase under avatars/.
• Who can see it: all signed-in users. Note also: profile photos, post photos and videos, pet avatars, exchange item photos, and rescue/place photos are all configured for public read access in Cloud Storage — anyone holding the file URL can open it without signing in to the App. This is required for images to display, but it does mean those images are effectively public.
• How long: until you replace or delete them.

Correction: a previous version of this policy listed "phone number" as optional profile data. That was inaccurate — the profile editor contains only avatar, nickname, and bio. The only places the App asks for a phone number are real-name verification (Section 3), the optional lost-pet contact field (Section 6), and the venue phone number for pet-friendly places (Section 6).

2.3 Authentication Logs

• What we collect: login/registration/logout action, timestamp, success or failure, failure reason, and your user ID.
• Why: account security auditing.
• Where: the auth_logs collection in Firestore.
• Who can see it: only you and the developer. Security rules restrict each user to reading their own records, and no one may modify or delete them.
• How long: there is currently no automatic purge; we manually clear records older than one year on a periodic basis.

3. Real-Name Verification (only required for the Item Exchange feature)

Verification has two steps: first we confirm who you are, then you set where parcels should be sent. These two sets of data are stored separately, because their protection requirements are opposite.

• What we collect: legal name, ID type (national ID / passport / residence permit), ID number; plus recipient name, country code and phone number, delivery address, and an optional delivery note.
• Why: to retain traceable identity information so that parties can be identified in the event of an exchange dispute, a fraud report, or a lawful request from a competent authority; delivery details exist so parcels actually arrive. We do not use this data for marketing and do not sell or rent it to any third party.
• Where: identity data in the verification collection; delivery details in the shipping collection. One document per user in each.

3.0 ID photography: we never receive your document image

When you verify, the App asks you to photograph your document on the spot. About that photo:

• It is never uploaded. It exists only in your phone's memory and is read by Apple's built-in Vision text recognition on your device.
• It is never saved. Not to your photo library, not to the App's storage, not to Cloud Storage. It is released as soon as recognition finishes.
• The recognition output never leaves your phone. We only check whether the number on the document matches what you typed, then discard it.
• Only two things reach our database: a boolean recording that the document check passed, and a salted SHA-256 hash of the document number. That hash cannot be reversed into the number; its only purpose is detecting the same document being used to register multiple accounts.
• Why it is built this way: a leaked ID image is irreversible harm. If we never collect it, we have nothing to safeguard and nothing to leak.

3.0b When your delivery details become visible to someone else

• Normally only you can read them; security rules grant no one else access.
• Only at the moment an exchange is accepted does the system write a snapshot of both parties' delivery details into that exchange record, so your counterparty can post the item to you.
• The snapshot is frozen at that moment. Changing your address later does not alter an exchange that has already been agreed.
• Please do not use your counterparty's name, phone number, or address for anything other than that exchange, and do not pass them to anyone else.

3.1 Which fields are actually encrypted (stated honestly)

What "encrypted" means here: name and ID number are encrypted on your device before transmission using ECIES hybrid encryption (P-256 ECDH key agreement, HKDF-SHA256 key derivation, AES-GCM encryption). A fresh ephemeral key pair is generated for every encryption, so encrypting the same ID number twice produces entirely different ciphertext. The App contains only the public key; the private key required for decryption is held offline by the developer and exists nowhere in the App, the source code, or on any server. The App itself has no decryption capability.

The phone number and address are currently stored as plaintext. We see no reason to describe this more favourably than it is. Those two fields are protected only by the access controls described below. Encrypting them as well is on our to-do list.

3.2 Who can see verification data

• Other users: nobody. The security rule permits read and write access only to the document owner; queries from anyone else are rejected.
• The developer: can view the document via the Firebase console. Name and ID number appear as ciphertext and require the offline private key to recover; phone number and address are directly readable.
• Google (Firebase): as our data processor, stores the document contents.

3.3 An honest note about the word "verification"

Although this feature is called "real-name verification," no human review or third-party check is performed against the data at the time you submit it — your account is marked verified immediately. Therefore:

• The data functions as an after-the-fact traceability record, not as prior verification.
• Do not assume another user's identity is genuine simply because their account shows as verified. Exercise your own judgement before exchanging.

• How long: for the life of your account. Deleting your account immediately deletes this verification document as well.

A previous version of this policy stated you could "disable Cat Exchange verification in Account Settings." No such feature exists in the App. Currently the only ways to remove verification data are to delete your entire account (which removes it) or to request removal via Section 11.

4. AI "Pet Inner Voice" (currently disabled)

Status (updated August 2026): this feature has been removed from the App and cannot be enabled by users. The description below is retained so you know how it would work if a future version restores it. Until it is restored and this policy is updated, the App sends no content to any third-party AI service.

When enabled, this was the only feature that sent your content to a third-party AI service.

• What is sent: the specific photo you select in this feature, together with a text instruction written by the App asking the AI to produce three humorous inner-monologue lines, plus your chosen tone, output language, and (if you select one) your pet's name.
• Sent to whom: Google. Specifically, Google's Gemini Developer API via Firebase AI Logic, using Google Gemini (the exact model version may change as Google retires models).
• Purpose: to generate three short lines for you to make a shareable caption card. Nothing else.
• Does our side retain it: No. The photo exists only in your device's memory. The App does not upload it to our Firestore database or Cloud Storage, and does not save the generated lines. Close the screen and it is gone. The caption card is rendered on your device; whether and with whom you share it is entirely your choice.
• Does Google retain it: that is not ours to decide or guarantee; it depends on Google's data handling policy for that API. We cannot make retention commitments on Google's behalf, so please review the Google Privacy Policy and Google's generative AI terms before using this feature.
• Practical advice: do not select photos containing human faces, house numbers, licence plates, identity documents, screenshots, or other sensitive information. Pick a plain photo of your pet.
• Who can see it: other than you and Google's processing pipeline, no one — this content never enters the App's database.

AI-generated content is machine-produced entertainment text. It may be inaccurate, nonsensical, or unrelated to the photo. Do not treat it as fact or as advice of any kind.

5. Location Data (this section was entirely wrong in the previous version and has been rewritten)

The previous policy stated the App "does not collect precise geolocation (no GPS or map functionality)." That was false — the App does have location and map functionality. Here is how it actually works.

5.1 The "Use current location" button

The App offers a "use current location" button in three places: composing a post, filing a lost-pet report, and filing a stray-animal rescue report.

• What we collect: only when you actively tap that button does the App request a single location fix. The coordinates are immediately reverse-geocoded via Apple's service into a city name (e.g. "Taipei City"), and only that city name text is placed in the field. The coordinates themselves are discarded — never uploaded, never stored.
• Accuracy: location accuracy is set to kilometre level (kCLLocationAccuracyKilometer), so street-level precision is not obtained in the first place.
• What we do not do: no background location, no continuous tracking, no movement history. If you never tap the button, the App never requests location at all.
• You can edit it: the inserted city name is only a default. You may rewrite it as any text, or delete it entirely.
• Where / who can see it: stored as a text field on the post or report; visibility matches that post or report (see Section 6).
• Permission: the App uses "While Using the App" location permission. You may revoke it at any time in iOS Settings → Privacy & Security → Location Services; all other features continue to work.

5.2 Pet-Friendly Map

• The App uses Apple MapKit. The map shows your current position (the blue dot), but that is drawn by iOS on your device — we do not obtain, upload, or store that position.
• When you add a pet-friendly place, you enter a venue address, which the App geocodes via Apple's service into latitude and longitude so the place can be pinned on the map. Those coordinates are the venue's location, not yours.

5.3 So does the App store coordinates?

• For your personal location: no coordinates are stored. Only an editable city name that you produced by tapping the button.
• For venues: yes, coordinates are stored. Derived from the public venue address you entered.

Cross-reference with the privacy manifest: the App's PrivacyInfo.xcprivacy declares Coarse Location (NSPrivacyCollectedDataTypeCoarseLocation) for the behaviour described above — linked to your account, not used for tracking, collected for app functionality. Precise Location is not declared, because a city name is far below Apple's precise-location threshold (a latitude and longitude with three or more decimal places) and the accuracy setting is kilometre level to begin with. The venue coordinates on the pet-friendly map are the venue's location, not yours, and so are not covered by this data type.

6. What you post in each feature, and who can see it

This is a social platform; most of the content below is meant to be seen by others. Please read the "who can see it" line carefully.

6.1 Posts and comments

• What we collect: post text, photos and videos (up to 10 media per post; videos capped at 60 seconds and compressed to 720p), the filter you applied, location text, tagged pets, plus your likes, comments, follows, and bookmarks.
• Where: the posts, post_comments, post_likes, post_bookmarks, and user_follows collections; media files in Cloud Storage.
• Who can see it:
• Posts, comments, likes, follow relationships: all signed-in users.
• Post photo and video files: publicly readable — anyone with the URL can open them without signing in.
• Bookmarks are private and visible only to you.
• How long: until you delete them. You may delete your own posts and comments at any time.

6.2 Notifications

• What we collect: who liked, commented on, or followed you, and read status.
• Who can see it: only the recipient. Unliking or unfollowing withdraws the corresponding notification.
• How long: for the life of your account.

6.3 Direct messages

• What we collect: message text, participant IDs, timestamps, and a conversation summary (last message).
• Where: the conversations and messages collections.
• Who can see it: only the two participants. Security rules block reads by anyone else. The developer can access them via the Firebase console, but we do so only when handling a specific report or complying with a lawful request.
• How long: there is currently no automatic deletion, and the App does not yet offer deletion of individual messages.
• Please note: direct messages are not end-to-end encrypted. Transmission is protected by TLS, but the stored content is not separately encrypted. Do not send identity documents, financial account numbers, or passwords via direct message.

6.4 Pet profiles

• What we collect: pet name, species, breed, sex, birthday, bio, pet avatar, and whether you have marked the pet as a memorial along with the memorial date.
• Who can see it: all signed-in users — other owners can see your pets on your profile page. Pet avatar files are publicly readable.
• How long: until you delete them.

6.5 Health records (weight)

• What we collect: date, weight, notes.
• Who can see it: only you. This is the one category of pet data explicitly protected by a rule restricting read and write access to the owner, because we consider health records medical in nature and not for public view.
• How long: until you delete them.

6.6 Care reminders

• What we collect: reminder title, category, pet name, due date, repeat rule, notes.
• Who can see it: only you.
• Notifications: reminders are scheduled as iOS local notifications. The notification content never passes through any server and is not sent to us or any third party. The App does not integrate remote push notifications.
• How long: until you delete them.

6.7 Stray-animal rescue reports

• What we collect: animal type, urgency, description, location text (required; you must also tick "I confirm the location above is correct" before publishing), on-scene photos, your nickname, report status.
• Who can see it: all signed-in users. This is a public report — that is its entire purpose. Photo files are publicly readable.
• How long: until you delete it. The reporter can update the status or delete the report.

6.8 Lost-pet reports

• What we collect: the same fields as rescue reports, plus pet name, linked pet profile, contact details (optional), and reward note (optional).
• Who can see it: all signed-in users, including any contact details you enter.
• Please understand: if you enter a phone number in the contact field, that number is displayed on the lost-pet card and every user of the App can see it. This is what makes the feature work — people need a way to reach you. But decide deliberately: you may leave it blank and rely on the App's built-in direct messaging instead.
• How long: once your pet is found, please delete the report or mark it closed so that the contact details you entered come down with it.

6.9 Pet-friendly map

• What we collect: place name, category, address, coordinates derived from the address, venue phone number (optional), notes, 24-hour emergency flag, and ratings from other users.
• Who can see it: all signed-in users.
• Please note: these fields are designed for venue information. Do not enter your home address or personal phone number — anything entered here is public.
• How long: until the creator deletes it.

6.10 Pet-sitter mutual aid

• What we collect: whether you are seeking or offering care, pet types, area, start and end dates, overnight availability, notes, your nickname and avatar.
• Who can see it: all signed-in users.
• How long: tapping "Found someone — close this post" removes it from the list; the underlying record persists until deleted.

6.11 Item exchange

• What we collect: item name, description, condition (six levels), flaw details, photos, exchange requests, and post-exchange ratings and comments.
• Who can see it:
• Listings and ratings: all signed-in users. Item photos are publicly readable.
• Exchange requests, including the delivery-detail snapshots inside them: only the two parties to that exchange.
• You can edit or remove your own listings: until someone offers an exchange, you can change the details at any time; removing a listing also deletes its photos from storage. Once an offer exists the details are locked, because the other person decided based on what was written at the time.
• How long: until you delete them. Ratings cannot be edited or deleted once submitted.

6.11b Shared Experience forum

• What we collect: the topic titles and bodies you post, your replies, the category, the related pet type, timestamps, and your display name.
• Who can see it: every signed-in user. This is a public forum — do not post your address, phone number, identity documents, or anything else you would not want strangers to read.
• Moderation: submissions pass through a keyword filter, and other users can report content. Advertising, flooding, or violations confirmed after a report are removed, and the poster may be suspended.
• How long: until you delete it. Deleting a topic also deletes every reply beneath it.
• A note on medical content: everything in the forum is owners sharing experience. It is not veterinary diagnosis and does not constitute medical advice. If your pet is unwell, see a vet.

6.12 Care knowledge base

• Knowledge base: content is bundled inside the App. Your browsing history and bookmarks are stored only on your own device (iOS UserDefaults) and are never uploaded.
• The originally planned "Pet Emotion Sounds" feature is not yet live (it awaits real audio assets before launch), so the App currently collects no sound-rating data.

6.13 Reports of violations

• What we collect: reporter ID, reported target and type, the reason you selected, timestamp.
• Who can see it: only the developer. The security rule permits creation but no reads at all — not even by the reporter — to prevent report contents from leaking.

6.14 Post view records

• What we collect: when someone else's post appears on your screen, one record of "your user ID + that post + the date" is written. At most one record per person, per post, per day; viewing your own posts is not recorded.
• Why: so that creators can see the view counts for their own posts in the creator dashboard.
• Where: Firestore post_views.
• Who can see it: only the author of that post. The security rule restricts reads to the author of the post; no other user can read these records.
• How long: 35 days, after which Firestore deletes them automatically. When an author deletes a post, that post's view records are deleted along with it.
• What we do not do: this data is used only to produce the view counts described above — no behavioural analytics, no personalised advertising, and no analytics SDK is installed (see Section 8).

7. How we use your data

1. To provide and operate the App's features.

2. To create and manage your account and keep you signed in.

3. To display social content and prioritise it according to your selected pet types.

4. To handle reports, blocks, and violating content, and keep the community safe.

5. To support identity traceability in exchange disputes or fraud reports.

6. To respond to your enquiries, complaints, and data rights requests.

7. To comply with legal obligations and lawful requests from competent authorities.

What we do not do: we do not sell or rent your data, do not use it for ad targeting or cross-app tracking, and do not use it for any purpose not described in this Policy.

8. Third-party services (complete list)

What is not integrated (equally important):

• No Google Analytics for Firebase and no behavioural analytics SDK of any kind. The previous policy claimed the App used Google Analytics for Firebase to collect anonymised usage data. That was inaccurate — the only Firebase components actually linked are Core, Authentication, Firestore, Storage, and AI, and there is not a single analytics event call in the codebase. That section has been removed entirely.
• No Crashlytics or crash-reporting SDK.
• No advertising SDK, no IDFA, no App Tracking Transparency prompt.
• No third-party sign-in (no Sign in with Apple, Google, or Facebook).
• No in-app purchases, subscriptions, or payment processing of any kind. The App does not handle money.

Where data is stored: on Google Firebase servers. Google acts as our data processor under its own privacy and security standards. See the Google Privacy Policy and Firebase Privacy and Security.

9. Account deletion and data retention (an honest account of current scope)

You may permanently delete your account at any time via Settings → Delete Account. For security, if you have not signed in recently the system will ask you to sign in again first.

9.1 Deleted immediately

• Your Firebase Authentication account (email and password credentials)
• Your public profile document (users) — nickname, bio, avatar URL, follow counts
• Your private profile document (users/{your user ID}/private) — registration email, phone number, login method, and account status
• Your real-name verification document (verification) — the encrypted name and ID number, and the plaintext phone number and address

You will no longer be able to sign in.

9.2 Not yet deleted automatically

We will not describe this more favourably than it is. Automatic deletion currently covers only the three documents above plus the account itself. The following remains in the database after you delete your account:

• Your posts, comments, likes, and bookmarks
• Your uploaded photos and videos (Cloud Storage)
• Your direct messages and conversations
• Your pet profiles, health records, and care reminders
• Your rescue reports, lost-pet reports, pet-friendly places, and sitter posts
• Your exchange listings, requests, and ratings
• Your block list and the reports you have filed
• Your authentication audit logs

9.3 Our commitments

• Before deleting your account, please delete the content you care about yourself (posts, reports, lost-pet contact details). This is currently the fastest and most reliable route, and takes effect immediately.
• For content not covered by automatic deletion, we will manually complete erasure or de-identification within a reasonable period following the request or account deletion — our target is 30 days.
• You can ask us to expedite this: email newemailpaul888@gmail.com with your registration email or nickname, and we will action it and reply within 15 days.
• We are building a feature to erase all associated content at the time of account deletion. Until it ships, this section describes the actual situation.
• Data we are legally required to retain will be retained as required by law.
• Direct messages already delivered also form part of the other participant's conversation history and may not be fully removable unilaterally.

9.4 Other retention rules

• Content you delete yourself: removed from the App immediately; Firebase backup copies age out with their normal backup rotation.
• Exchange ratings: cannot be edited or deleted once submitted, to preserve the integrity of the rating system.
• Authentication logs: manually cleared periodically for records older than one year.

10. Your rights

Under Taiwan's Personal Data Protection Act, you have the right to: (1) enquire about and access your data; (2) obtain a copy; (3) request correction or supplementation; (4) request that we cease collection, processing, or use; and (5) request deletion (except where retention is legally required).

What you can do yourself in the App: edit your nickname, bio, and avatar; delete your own posts, comments, pet profiles, health records, care reminders, reports, places, and exchange listings; block and unblock users (Settings → Privacy → Block List); report posts or users; revoke location permission in iOS Settings; permanently delete your account.

What requires contacting us: data access requests, obtaining a copy, expediting erasure of residual content after account deletion, or removing verification data while keeping your account.

Email newemailpaul888@gmail.com. We will respond within 15 days of receipt, or within the period required by law. To protect your data, we may need to verify your identity first.

11. Data security

Measures in place:

• Passwords are hashed by Firebase Authentication; we never handle plaintext passwords.
• Verification name and ID number use ECIES asymmetric encryption (P-256 / HKDF-SHA256 / AES-GCM), with the private key held offline by the developer and absent from the App and all servers.
• Firestore and Cloud Storage security rules restrict access: direct messages to participants, health records to the pet's owner, bookmarks and reminders to the user, verification data to the user, and violation reports to no reader at all.
• The profile is split into a public and a private document: email, phone number, login method, and account status live in a document only you can read, separate from the publicly readable profile. Firestore security rules cannot filter individual fields — granting read access grants the whole document — so which fields others can see must be decided by which document a field lives in, not by whether the UI displays it.
• All connections use TLS.
• Uploads are constrained by content type and size (images 12MB, videos 200MB), with paths bound to the uploader's identity.

Current limitations, stated honestly:

• Images and videos in Cloud Storage are publicly readable; anyone with the URL can open them without signing in.
• Verification phone numbers and addresses are stored as plaintext.
• Direct messages are not end-to-end encrypted.

All of the above are on our remediation list. Beyond that, no method of internet transmission or electronic storage is 100% secure; we can only commit to continuing reasonable measures.

12. Users under 18

• Children under 13 may not use the App. It is not designed for or directed at children.
• Users under 18 should obtain the consent of a parent or legal guardian before using features that involve submitting personal data, particularly real-name verification and entering contact details on lost-pet reports.
• If we become aware that we have collected personal data from a child under 13, we will delete it promptly. Parents and guardians who believe their child has provided personal data without consent should contact us at newemailpaul888@gmail.com immediately.

13. Changes to this Policy

We may revise this Policy from time to time; the version and effective date at the top will be updated. For material changes — new data types, new third-party services, or changed purposes — we will notify you via in-app notice or other reasonable means. The current version is always available in the App under Settings → About → Privacy Policy.

14. Contact us

• Developer: WEN GUAN BO (Independent Developer, Taiwan)
• App: YUTTALI 有牠 (Bundle ID: tw.paulwen.Mewtopia)
• Contact email: newemailpaul888@gmail.com
• Response times: general enquiries within 7 business days; data rights requests within 15 days.