私隱政策 · Privacy Policy

又飛機 (flyg9)

繁體中文（香港）

私隱政策

生效日期：2026-10-03

我哋收集乜嘢

顯示名同預設頭像（你揀） — 用嚟喺同場朋友之間顯示你嘅身份；同場參加者會見到，頭像係 app 內置圖案，唔係你嘅相片。
裝置識別碼同本機登入憑證 — app 自動產生 UUID 作為帳號替代，另產生隨機登入憑證並只保存喺你部裝置；server 只保存憑證嘅不可逆雜湊。
可選擇提供嘅電郵地址 — 你唔使提供電郵都可以直接玩；新訂閱搞手 Pass 前須先驗證電郵。如果你喺設定或訂閱前主動加入電郵，我哋會保存經驗證嘅電郵地址，用嚟寄一次性驗證碼，等你重裝 app 或轉裝置後登入返同一個玩家帳號；我哋唔會用佢做廣告。
活動同玩法內容 — 包括你輸入嘅活動名稱、集合時間、地點、可選擇落嘅集合點座標、今場懲罰、催人內容，以及你嘅出發／到場狀態、挑戰、投票同賽果。集合點座標只會向已加入相關活動嘅參加者顯示。任何攞到該場邀請 link 嘅人，都可以喺唔使登入嘅入場頁見到活動名稱、集合時間同參加人數，但該頁唔會顯示地點文字或集合點座標；其餘內容只會向相關活動參加者顯示。
舉報同封鎖資料 — 包括你舉報嘅內容／用戶、舉報原因，同你選擇封鎖嘅用戶，用嚟處理濫用、爭議同執行封鎖。
自證相片（你主動上載） — 屬用戶生成內容，只限同場參加者睇到，用嚟做報到／挑戰嘅證據。上載前，app 會將所選圖片重新編碼成新 JPEG，移除原相嘅 EXIF、拍攝位置同其他 metadata；如果無法安全處理，就唔會上載。
活動回憶相片、相片說明同留言（你主動提交） — 活動正式封盤後，只有同場成員可以睇同加入回憶。回憶相片係你另外揀選上載嘅相片；自證相片唔會自動複製或保留喺回憶。你亦可以喺交自證時主動選擇另存一份回憶副本，封盤後先畀同場成員睇；刪除回憶副本唔會刪埋原有自證證據。上載相片只接受已移除 EXIF、拍攝位置同其他 metadata 嘅 JPEG；相片唔會附上參加者 GPS，回憶地圖只會用搞手確認嘅集合點。
粗略或精確位置（完全 opt-in） — 活動位置分享只會喺你自己選擇附上自證 GPS，或者撳「出發中」／「到咗」時揀分享位置，先會收集。新版 app 喺你揀出發分享後，會即時收集一次 snapshot，然後喺 app 位於前景時，每 3 分鐘重複收集 one-shot snapshot，包括首頁或其他 app 內頁面；舊版自動更新為每 10 分鐘，或只限該場活動畫面。鎖機或將 app 放入背景會暫停；同一次 app 使用期間返前景會即時嘗試收集新位置，再繼續三分鐘更新。報到及自證只收集當次 snapshot；如果已經開啟出發更新，報到會先停止自動更新，並嘗試取得一次新位置，唔使等三分鐘。到咗、轉返未出發、活動結算、定位權限或服務失效、切換帳號或你手動停止時會終止更新；app 被關閉後重新啟動亦唔會自動恢復。唔 share 一樣玩到晒；位置唔會自動決定投票或判決，亦唔會背景追蹤或記錄行程路線。
Firebase Cloud Messaging app／安裝識別資料及推送通知資料 — Firebase SDK 可能喺通知權限畫面之前初始化並處理 app／安裝識別資料；只有你容許通知後，我哋先會登記推送 token，並處理通知送達所需嘅事件資料。
購買及訂閱資料 — 如果 build 有配置商店 key，RevenueCat 會喺 app 啟動時建立匿名 app-user／安裝識別資料，並查詢產品 offering 同 entitlement 狀態，即使你未訂閱亦會發生。當你購買「搞手 Pass」，App Store／Google Play 同 RevenueCat 亦會提供產品、購買、續訂、取消、到期同退款狀態。我哋唔會收到你完整嘅付款卡或銀行資料。

我哋唔收集乜嘢

我哋唔會收集你嘅通訊錄、通話紀錄、瀏覽紀錄、廣告識別碼、健康資料，亦唔會直接收集完整付款卡或銀行資料。冇廣告追蹤（tracking）、冇廣告 SDK，亦唔會出售你嘅資料。

Call爆狀態

同場參加者會見到每位玩家嘅 Call爆狀態（已準備／未開／待確認），避免將 Call爆道具用喺暫時收唔到通知嘅人身上。其他玩家唔會見到你嘅通知、聲音、靜音、Focus、勿擾模式或其他裝置設定。

地圖服務

Android Google Maps SDK 亦會收集地圖 SDK 專用識別碼、裝置及 SDK 資料、IP 位址、SDK 故障堆疊及指標；使用地圖鏡頭功能時亦會收集移動、縮放等互動資料，用嚟維持及改善 Google 服務。詳見 Google Maps SDK 資料說明。

舊版 app 或其他平台嘅自證位置、集合點檢視或落點地圖，可能仍然向 OpenStreetMap Foundation（OSMF）嘅地圖服務要求你所睇附近區域嘅地圖圖塊。呢個要求會將該附近區域同你嘅 IP 位址傳送俾 OSMF，但唔會傳送你嘅顯示名、活動內容或相片。詳情見 OSMF 私隱政策；地圖資料版權及授權見 OpenStreetMap copyright。

新版 iOS 同 Android app 嘅月曆地圖、回憶、戰況、自證位置、集合點檢視同落點地圖，統一使用裝置原生地圖服務：iOS 用 Apple Maps、Android 用 Google Maps。月曆同回憶只顯示該場已確認嘅集合點（如有）；戰況顯示同場成員自願分享嘅最新位置、時間同準確度；自證位置顯示玩家主動附上嘅位置。手動落集合點只會保存你確認嘅座標，唔會自動查詢地址。打開地圖唔會自動開啟你嘅 GPS 分享。地圖供應商可能收到所瀏覽地圖區域（包括分享位置附近）、IP 位址同裝置資料，並按各自政策處理；app 唔會將回憶相片或留言作為地圖服務 request 內容。詳見 Apple Maps 私隱說明同 Google 私隱政策。

落集合點時，你亦可以主動輸入地方或地址，再撳「搵」將地圖移去附近；冇即時建議或自動完成。只有你明確提交後，Flyg9 server 先會將搜尋文字放入供應商 request，交俾已配置嘅地理編碼供應商（beta 期間可能係 OSMF Nominatim），連同目前地圖中心四捨五入至 0.1 度嘅粗略區域（如有）、server IP 同 app 聯絡資料作功能性搜尋。呢個區域用嚟優先顯示附近結果，唔一定係你身處位置；搜尋唔會額外要求 GPS 權限。唔會傳送你嘅顯示名、活動資料或裝置憑證。server 只會用搜尋文字同粗略地圖區域嘅 SHA-256 指紋做限流／cache key，短期 cache 最多三個已整理結果；唔會將原始搜尋文字放入 Flyg9 endpoint／access URL、app log 或資料庫，亦唔會保存供應商 Place ID。搜尋內容同結果唔會寫入活動；只有你最後撳「落喺呢度」確認嘅座標先會保存成該場集合點。

另外，只有你喺活動詳情主動撳「用地圖搵」之後，app 先會將搞手輸入嘅活動地點文字交俾外部地圖 app 搜尋（Android 交俾你揀嘅地圖 app；iOS 交俾 Apple Maps）。打開活動詳情本身唔會傳送呢段搜尋文字。外部地圖供應商可能會按佢嘅私隱政策收到搜尋內容、IP 位址同裝置資料；搜尋結果唔會寫返入又飛機。

服務供應商同資料傳送

我哋只會為提供 app 功能而俾服務供應商處理所需資料：Resend 只會喺你要求加入電郵或恢復帳號時，處理你提供嘅電郵地址同一次性驗證碼以送出電郵；RevenueCat 處理匿名 app-user／安裝識別、offering／entitlement 查詢同訂閱收據；Firebase SDK／Cloud Messaging 處理 app／安裝識別資料，並喺你容許通知後處理推送 token 同通知送達；OSMF 提供地圖圖塊，而已配置嘅地理編碼供應商只喺你明確提交時處理地方／地址搜尋同粗略地圖區域；雲端託管、資料庫同物件儲存供應商代我哋儲存及傳送活動資料同相片。佢哋按各自條款及私隱政策處理資料。呢啲功能性處理唔係廣告追蹤，亦唔係出售資料。

資料點樣儲存同保護

顯示名、預設頭像、裝置識別碼、你選擇加入嘅已驗證電郵地址、活動／玩法內容（包括搞手確認嘅集合點座標）、舉報同封鎖資料存放喺 PostgreSQL 資料庫；登入憑證只保存不可逆雜湊，電郵同驗證碼亦有 keyed hash 供安全比對。目的地搜尋 cache 只以搜尋文字同粗略地圖區域嘅 SHA-256 指紋做 key，保存最多三個已整理結果至多 24 小時；原始搜尋文字同供應商 Place ID 唔會持久保存。已移除 metadata 嘅自證同回憶 JPEG 存放喺 S3 相容嘅物件儲存。每位參加者每場只會保留最新一次自願分享嘅戰況位置（連時間、準確度同當時狀態），只供同場成員查看，新 snapshot 會覆蓋舊 snapshot。app 同公開後端之間嘅資料傳輸經 HTTPS 加密；內部資料庫同物件儲存流量走託管平台嘅私人網絡。物件儲存相片以有時效嘅 presigned URL 提供；server 每次發出新回憶相片連結前都會檢查同場成員同封鎖關係，已發出嘅連結會到期失效。

資料保留

我哋只會喺提供 app、處理爭議、防止濫用或符合法律要求所需嘅期間保留資料。電郵驗證碼 10 分鐘後失效；超過 24 小時嘅 challenge 會喺電郵服務下次處理要求時清理，恢復要求唔會將未驗證嘅電郵地址明文寫入 challenge。你可以喺設定更改已驗證電郵；刪除帳號亦會刪除該電郵。戰況位置 snapshot 會喺相關活動正式封盤（closed）時清除。你主動上載嘅回憶相片同留言會保留俾同場成員，直至你逐一刪除或者成功刪除帳號。成功刪除帳號後，我哋會刪除你嘅電郵同驗證 challenge、所有安裝登入憑證、分享嘅戰況位置、推送 token、自證相片、你上載嘅回憶相片同留言、參加紀錄、投票、催人內容、封鎖關係、現有準時分錢包／物品同物品使用關係。

已經同其他成員共享嘅活動資料同玩法結果（例如你建立嘅活動同挑戰結果）可以為維持其他成員嘅活動紀錄而保留，但你嘅顯示名、預設頭像、裝置識別、登入憑證雜湊同同意紀錄會由保留嘅隨機墓碑帳號移除。為避免重複派發準時分，已用過嘅內部冪等紀錄可以保留，但會移除帳號 owner 欄位；內部冪等 key 仍可能包含隨機墓碑 ID。舉報可以為處理濫用、爭議或法律要求而保留，但舉報人帳號連結會移除。訂閱 entitlement／每月派發紀錄可以用隨機墓碑 ID 保留，供會計、退款、防詐及 App Store、Google Play、RevenueCat 狀態對數；商店或服務供應商亦可能按佢哋嘅政策或法律要求保留交易紀錄。

刪除要求

你可以喺 app「設定」提出刪除帳號要求，或者透過支援頁聯絡我哋。App 收到要求後會即時停用該帳號；我哋會手動處理，喺 7 日內完成刪除。提交成功只代表要求已記錄，唔代表資料已刪除。你可以用留喺裝置嘅隨機收據喺 App 查處理狀態；server 只保存收據雜湊、隨機帳號 ID、申請／期限／完成時間，唔喺收據紀錄保存姓名或電郵。只有物件儲存確認自證同回憶相片已刪除後，狀態先會變成完成；儲存暫時失敗時我哋會保留物件參照並重試。舊版 App 嘅直接刪除操作仍會即時處理。商店或服務供應商依法／按其政策保留嘅訂閱交易紀錄，要由相應平台處理。

兒童

本 app 並非為 13 歲以下兒童而設，我哋亦唔會刻意收集兒童嘅個人資料。

政策更新

本政策日後可能更新。有重大改動時，我哋會更新本頁頂部嘅生效日期。

English

Privacy Policy

Effective date: 2026-10-03

What we collect

Display name and preset avatar (you choose them) — used to show your identity inside your friend events. Event participants can see both; the avatar is an artwork built into the app, not your photo.
Device identifier and local sign-in credential — the app generates a UUID as an account substitute and a random sign-in credential retained only on your device; the server stores only an irreversible digest of that credential.
Optional email address — you can play without providing an email; a new 搞手 Pass subscription requires email verification first. If you add an email in Settings or before subscribing, we store the verified address and use it to send one-time codes so you can return to the same player account after reinstalling or changing devices. We do not use it for advertising.
Event and gameplay content — includes event names, gathering times, locations, an optional destination coordinate selected by the host, forfeits, and nudge text you enter, plus your travel/arrival status, challenges, votes, and results. Destination coordinates are shown only to participants who joined the relevant event. The event name, gathering time, and participant count appear on a no-sign-in join page available to anyone holding that event's invite link, but that page does not show the location text or destination coordinates; other content is shown only to participants in the relevant event.
Report and block data — includes the content or users you report, your report reason, and users you choose to block, used to address abuse and disputes and to enforce blocks.
Proof photos (you upload them) — user-generated content, visible only inside the relevant friend event, used as check-in / challenge evidence. Before upload, the app re-encodes the selected image as a new JPEG and removes the original photo's EXIF, capture location, and other metadata. If safe processing fails, the image is not uploaded.
Event memory photos, captions, and comments (you submit them) — after an event closes, only its members can view and add memories. Memory photos are separately chosen uploads; proof photos are never copied or retained there automatically. You may explicitly choose a separate memory copy when submitting a proof; it becomes visible only after the event closes. Deleting that copy does not delete the challenge evidence. Uploads accept only JPEGs without EXIF, capture location, or other source metadata. Participant GPS is not attached to photos; the memory map uses only the host-confirmed destination pin, if any.
Coarse or precise location (strictly opt-in) — in-event location is collected when you choose to attach proof GPS or share location on an “en route” / “arrived” action. In the current app, choosing to share when heading out collects one snapshot immediately, then a new one-shot snapshot every 3 minutes while the app is in the foreground, including Home and other app pages; older versions update every 10 minutes or only on that event screen. Locking or backgrounding the app pauses updates. Returning to the foreground during the same app session immediately attempts a fresh capture and resumes the three-minute schedule. Arrival and proof sharing collect a single snapshot. If departure updates are already enabled, arrival first stops them and attempts one fresh capture without waiting three minutes. Updates end when you arrive, return to not departed, enter settlement, lose location permission or service, switch accounts, or stop them yourself, and do not resume after the app is terminated and relaunched. The app works fully without location; location never decides a vote or verdict automatically, and there is no background tracking or route history.
Firebase Cloud Messaging app/installation identifiers and push notification data — the Firebase SDK may initialize and process app/installation identifiers before the notification-permission prompt. We register a push token and process event data for notification delivery only after you allow notifications.
Purchase and subscription data — in builds configured with a store key, RevenueCat creates an anonymous app-user/installation identifier and checks product offerings and entitlement status at app launch, even before you subscribe. If you buy 搞手 Pass, the App Store / Google Play and RevenueCat also provide purchase, renewal, cancellation, expiry, and refund status. We do not receive your full payment-card or bank details.

What we do NOT collect

We do not collect your contacts, call logs, browsing history, advertising identifiers, health data, or full payment-card or bank details. There is no advertising tracking, no advertising SDK, and we do not sell your data.

Call Blast status

Participants in the same event can see each player’s Call Blast status (ready, off, or unknown) so the app does not spend an item on someone who is not currently ready to receive it. We do not show other players your OS notification, sound-channel, Silent, Focus, Do Not Disturb, or device-setting details.

Map service

The Android Google Maps SDK also collects an SDK-specific pseudonymous identifier, device and SDK metadata, IP address, and SDK crash traces and metrics. Map camera functions collect interaction data such as panning and zooming to maintain and improve Google services. See Google Maps SDK data disclosure.

Older app versions or other platforms may still request map tiles for proof-location, destination-view or destination-picker maps from the OpenStreetMap Foundation (OSMF) map service. That request sends the nearby map area and your IP address to OSMF, but does not send your display name, friend-event content, or photos. See the OSMF Privacy Policy and OpenStreetMap copyright and licence information.

Current iOS and Android apps use native map services for calendar, memory, battle, proof-location, destination-view and destination-picker maps: Apple Maps on iOS and Google Maps on Android. Calendar and memory maps display the event's confirmed destination pin, if available; battle maps display members' latest voluntarily shared positions, capture times and accuracy; proof-location maps display the location the player chose to attach. Manually placing a destination saves only the coordinates you confirm and does not automatically look up an address. Opening a map does not enable your location sharing. The provider may receive the visible map area (including the area around shared positions), IP address, and device data under its policy. The app does not include memory photos or comments in map-service requests. See Apple Maps & Privacy and Google Privacy Policy.

While placing a destination pin, you can also enter a place or address and explicitly tap Search to move the map nearby; there are no live suggestions or autocomplete. Only after that explicit submit does the Flyg9 server put the submitted text in a provider request to the configured geocoder (which may be OSMF Nominatim during beta), together with the current map center rounded to 0.1 degrees, when available, and the server IP and app contact details. That coarse area boosts nearby matches; it need not be your actual location, and searching does not request GPS permission. It does not send your display name, event data, or device credential. The server uses only a SHA-256 fingerprint of the search text and coarse map area as a rate-limit/cache key and briefly caches at most three sanitized results; it does not put the raw query in a Flyg9 endpoint/access URL, persist it, write it to app logs, or retain a provider Place ID. Neither the query nor results are stored in the event. Only coordinates you separately confirm with “落喺呢度” are saved as that event's destination.

Separately, the app passes the event-location text entered by the host to an external map app only after you tap “用地圖搵” in the event details (to a map app you choose on Android, or to Apple Maps on iOS). Merely opening the event details does not send that search text. The external map provider may receive the search query, IP address, and device data under its privacy policy; search results are not written back to 又飛機.

Service providers and data transfers

We let service providers process only the data needed to operate the app: Resend processes the email address and one-time code only when you request email linking or account recovery, to deliver that email; RevenueCat processes anonymous app-user/installation identifiers, offering/entitlement checks, and subscription receipts; Firebase SDK / Cloud Messaging processes app/installation identifiers and, after notification permission, push tokens and delivery; OSMF provides map tiles, while the configured geocoder processes place/address text and the coarse map area only after explicit search submit; and cloud hosting, database, and object-storage providers store and transmit event data and photos on our behalf. They process data under their own terms and privacy policies. This functional processing is not advertising tracking or a sale of data.

How data is stored and protected

Display names, preset avatars, device identifiers, an optional verified email address, event/gameplay content (including a host-confirmed destination coordinate), reports, and blocks are stored in a PostgreSQL database. Sign-in credentials are stored only as irreversible digests, and keyed hashes are used to compare email addresses and one-time codes securely. The destination-search cache is keyed only by a SHA-256 fingerprint of the query and coarse map area and retains at most three sanitized results for up to 24 hours; the raw query and provider Place ID are not persisted. Proof and memory JPEGs with metadata removed are stored in S3-compatible object storage. For each participant and event, we keep only the latest voluntarily shared battle-map location (with its time, accuracy, and captured status), visible only to that event's members; a new snapshot overwrites the old one. Data between the app and the public backend is encrypted over HTTPS; internal database and object-storage traffic uses the hosting platform's private network. Object-storage photos use time-limited presigned URLs. The server checks membership and blocks before issuing a new memory-photo URL; already issued URLs work until they expire.

Retention

We keep data only as long as needed to operate the app, resolve disputes, prevent abuse, or meet legal obligations. Email codes expire after 10 minutes; challenge records older than 24 hours are purged when the email service next processes a request, and recovery requests do not write an unverified email address in plaintext to a challenge. You can change your verified email in Settings; deleting your account also deletes that email. Battle-map location snapshots are cleared when a friend event is closed. Memory photos and comments that you voluntarily submit remain available to event members until you delete each item or successfully delete your account. Successful account deletion removes your email and verification challenges, every installation credential, in-event locations, push tokens, proof photos, your uploaded memory photos and comments, participation records, votes, nudge content, block relationships, current points wallet/inventory, and item-use relationships.

Event facts and gameplay outcomes already shared with other members (such as events you created and challenge outcomes) may remain so their event records still work, but your display name, preset avatar, device identifier, sign-in credential digest, and consent record are removed from the retained random tombstone account. Used points-idempotency records may remain to prevent duplicate awards, but their account-owner field is removed; an internal idempotency key may still contain the random tombstone ID. Reports may be retained to handle abuse, disputes, or legal obligations, but the reporter-account link is removed. Subscription entitlement/monthly-grant records may remain under the random tombstone ID for accounting, refunds, fraud prevention, and reconciliation with App Store, Google Play, and RevenueCat status; stores and service providers may also retain transaction records under their policies or legal obligations.

Deletion requests

You can request account deletion in Settings, or contact us through the support page. The app disables account access as soon as it records the request; we manually complete deletion within seven days. Acceptance confirms the request was recorded, not that deletion is complete. A random receipt kept on your device lets you check completion in the app. The server retains only the receipt digest, random player ID, and request, deadline, and completion times for this status check; no name or email is stored in the receipt record. Completion is reported only after object storage confirms deletion of proof and memory photos. If storage fails temporarily, object references remain for a retry. Older app versions still perform immediate direct deletion. Store or service-provider transaction records retained under law or policy are handled by those platforms.

Children

This app is not directed at children under 13, and we do not knowingly collect personal data from them.

Changes to this policy

We may update this policy over time. When we make material changes, we will update the effective date at the top of this page.