隱私權政策Privacy Policy
生效日期：2026-11-07Effective: 2026-11-07
Little Us（以下稱「我們」）是一個只屬於兩個人的情侶 App。我們把你們的隱私放在第一位：不賣資料、不放廣告、不跨 App 追蹤你。
我們收集哪些資料
- 帳號：使用 Apple 或 Google 登入時，Apple 或 Google 提供的帳號識別碼、電子郵件（Apple 可能是隱藏信箱）與名字；用電子郵件註冊時，你的電子郵件與密碼（密碼只以雜湊形式保存）。忘記密碼時，我們會寄一組驗證碼到你的電子郵件。
- 個人資料：你填寫的暱稱、生日、交往紀念日、性別、選擇的小動物與大頭照。
- 你們的內容：訊息、照片、語音訊息、聊天室塗鴉、手寫紙條、貼圖、心情、回憶與照片的拍攝地點（用於回憶地圖）、共同清單、時光膠囊、每日一問的回答；以及你選擇開啟時的生理期資料。
- 只看一次與可重看的照片：存放在私人資料夾，連你們兩個人的 App 都不能直接下載，只能在 App 裡打開；每次打開都會產生一個很快失效的連結。看的人在看這張照片時截圖，我們會記錄截圖的時間並通知傳送的人。
- 相機與麥克風：只有在你打開 App 裡的相機或按住錄音時才會使用；照片和語音只有在你按下傳送後才會上傳。
- 通話：語音與視訊通話以點對點加密傳輸；無法直連時會經由 Cloudflare 的中繼伺服器加密轉送。我們不錄音、不錄影，也不保存通話內容，只保存通話紀錄（時間、長度與建立連線用的技術資料）。
- 心跳：只有在你按下「傳送心跳」時，App 才會從 Apple「健康」讀取當下的心率，把數字傳給另一半；這個數字會和那則心跳一起存在你們的空間裡，和其他內容一樣保存與刪除。
- 位置：在聊天中分享位置時的座標；開啟「距離」時，App 會回報大約位置，伺服器只用來算出你們之間的距離，讀數最多保留 12 小時，另一半只看得到距離（以及你選擇分享的城市）。
- 裝置與推播：推播通知和小工具所需的裝置代碼，登出或在其他裝置登出時就會失效。新帳號預設不在通知裡顯示訊息內容；你在設定裡開啟「顯示訊息預覽」後，訊息內容才會經由 Apple 或 Google 的推播服務送到你的手機。
- 購買：訂閱和購買透過 Apple 或 Google Play 處理，我們只會收到購買狀態與到期日，不會取得你的付款資訊。
- 使用紀錄：每天是否開啟過 App（只記日期），用來了解配對與留存狀況。
誰看得到
你們空間裡的內容只有你和配對的另一半看得到。這是由伺服器的資料庫權限強制執行，不只是 App 畫面上的限制。我們不會把你的資料賣給任何人，也不會用於廣告。
服務供應商
我們使用以下服務來提供 App：Supabase（資料庫、檔案儲存、登入與即時連線）、Apple（登入、推播通知與付款）、Google（登入、Android 推播通知 Firebase Cloud Messaging、Google Play 付款）、Resend（寄送驗證碼與確認信）、Cloudflare（通話中繼）、OpenStreetMap（Android 版地圖圖磚：會收到你手機的 IP 位址與顯示的地圖範圍）。這些供應商只會依我們的指示處理資料。
資料保存
- 免費方案的聊天照片保存 90 天；存進「回憶」的照片會一直保留。
- 只看一次與可重看的照片：看完後在當天的清理中永久刪除；沒有打開的，30 天後刪除。
- 解除配對後，共享空間會保留 30 天讓你們匯出，之後永久刪除。
- 刪除帳號：申請後立即在所有裝置登出、停止通知，30 天內可以再次登入取消；第 30 天永久刪除你的帳號、個人資料、大頭照、心情與生理期紀錄、照片拍攝地點、裝置代碼和購買紀錄。用 Apple 登入的帳號會向 Apple 撤銷授權。
- 你們一起的內容（聊天紀錄、回憶、照片、語音、清單）會留給另一半，可以隨時匯出，你寫的內容會顯示為「已刪除的使用者」；另一半也刪除帳號時就會全部刪除。只有你自己的空間會整個刪除。
- 資料庫備份最多保留 7 天；伺服器紀錄不含個人資料，最多保留 7 天。刪除帳號不會取消商店訂閱，請到 Apple 或 Google Play 取消。詳見刪除帳號。
兒童
Little Us 不適合 13 歲以下兒童使用，我們也不會刻意收集兒童的資料。
政策變更
如果本政策有重要變更，我們會在 App 內或本頁通知。
Little Us ("we") is a private app for couples. Your privacy comes first: we don't sell your data, show ads, or track you across other apps.
What we collect
- Account: when you sign in with Apple or Google, the account identifier, email (with Apple, possibly its private relay address) and name they share; when you sign up with email, your email and password (stored only as a hash). If you forget your password, we email you a code.
- Profile: the nickname, birthday, anniversary, gender, animal and profile photo you enter.
- Your content: messages, photos, voice messages, doodles on the chat, handwritten notes, stickers, moods, memories and where photos were taken (for the memory map), shared lists, time capsules, daily question answers, and cycle data if you turn it on.
- View-once and replayable photos: kept in a private folder that neither of your apps can download directly; they open only inside the app, each time through a link that expires quickly. If the person viewing one takes a screenshot while it's open, we record when and tell the sender.
- Camera and microphone: used only while you have the in-app camera open or hold to record; photos and voice messages are uploaded only when you tap send.
- Calls: voice and video calls are encrypted and peer to peer; when a direct connection isn't possible they are relayed, still encrypted, through Cloudflare. We never record or store calls, only a call log (time, length and the technical data used to set up the connection).
- Heartbeat: only when you tap "send your heartbeat" does the app read your current heart rate from Apple Health and send the number to your partner; the number is saved with that heartbeat in your shared space and kept and deleted like your other content.
- Location: the coordinates when you share a location in chat; with Distance turned on, the app reports an approximate location that the server uses only to work out how far apart you are, keeping readings for at most 12 hours. Your partner sees only the distance (and the city, if you choose to share it).
- Device and notifications: the device tokens needed for push notifications and widgets; they stop working when you sign out, here or on another device. New accounts don't show message text in notifications; only after you turn on "Show message previews" does message text travel through Apple's or Google's push service to your phone.
- Purchases: subscriptions and purchases are handled by Apple or Google Play; we only receive their status and expiry, never your payment details.
- Usage: whether you opened the app on a given day (the date only), to understand pairing and retention.
Who can see it
What's in your space is visible only to you and your partner. The server's database permissions enforce this, not just the app. We never sell your data or use it for advertising.
Service providers
We use Supabase (database, file storage, sign-in and realtime), Apple (sign-in, notifications and payments), Google (sign-in, Android notifications through Firebase Cloud Messaging, Google Play payments), Resend (sending code and confirmation emails), Cloudflare (call relay) and OpenStreetMap (map tiles in the Android app, which receives your phone's IP address and the map area shown). They process data only on our instructions.
Retention
- On the free plan, chat photos are kept for 90 days; photos saved to Memories are kept.
- View-once and replayable photos are deleted for good in the daily cleanup after they've been viewed; unopened ones after 30 days.
- After you disconnect, the shared space is kept for 30 days so you can export it, then deleted for good.
- Deleting your account: you're signed out everywhere and notifications stop at once, and you can sign in within 30 days to cancel; on day 30 your account, profile, photo, mood and cycle records, where your photos were taken, device tokens and purchase records are deleted for good. For Sign in with Apple we revoke our access with Apple.
- What you made together (the chat, memories, photos, voice messages, lists) stays with your partner, who can export it any time, shown as from "Deleted user"; it's deleted when your partner deletes their account too. A space of your own is deleted entirely.
- Database backups are kept for up to 7 days; server logs hold no personal data and are kept for up to 7 days. Deleting your account doesn't cancel a store subscription: cancel it with Apple or Google Play. See Delete account.
Your choices
You can export chats and memories in the app, edit your profile, or delete your account in Settings → Delete account (or ask us on the web). For anything else, email tw466376@gmail.com.
Children
Little Us isn't meant for children under 13, and we don't knowingly collect their data.
Changes
If this policy changes in an important way, we'll let you know in the app or on this page.
