私隱政策
最後更新日期：2026年7月24日
歡迎使用「夢境紀錄」（下稱「本應用程式」、「本服務」或「我們」）。本私隱政策旨在說明我們在你使用本應用程式時，如何收集、使用、儲存、共享及保護你的個人資料。使用本應用程式即表示你同意本政策所述之內容。
一、我們收集的資料
- 帳戶資料：電郵地址、密碼（以 bcrypt 單向加密雜湊方式儲存，我們不會以明文儲存或查看你的密碼）、你選擇提供的用戶名稱（username）及姓名。如你以第三方帳戶登入，該帳戶不會設有密碼。
- 第三方登入資料（如適用）：如你選擇以 Google 或 Apple 帳戶登入或註冊，我們會從相關供應商接收：該供應商為你分配的帳戶識別碼（account ID）、你的電郵地址，以及（如供應商提供）你的姓名。我們僅以該識別碼辨識你的帳戶，並以電郵地址判斷是否與你既有的帳戶屬同一人。我們不會收到、亦不會儲存你的 Google 或 Apple 密碼。
- Apple 私人電郵轉發（如適用）：如你在「透過 Apple 登入」時選用「隱藏我的電郵」，我們收到的將會是 Apple 提供的私人轉發位址（結尾為 @privaterelay.appleid.com），而非你的真實電郵地址。Apple 會在登入時直接告知我們該電郵地址是否屬於私人轉發位址，我們並非按電郵網域判斷；我們只會將該位址用於帳戶識別及必要的服務通訊，不會嘗試、亦無法將其還原為你的真實電郵地址。
- 夢境內容：你所記錄的夢境文字內容，以及你為夢境加上的標籤（tags）。
- 語音輸入（如適用）：如你選擇以語音記錄夢境，在 iOS 應用程式中，語音會在你的裝置上直接轉換成文字（需 iOS 26 或以上），錄音毋須上載至我們或任何第三方的伺服器；在網頁版，錄音會即時傳送至 OpenAI 的 Whisper 服務作語音轉文字處理，轉錄完成後，錄音檔案不會被保留或儲存於我們的伺服器。
- AI 生成內容：你要求生成的夢境 AI 解析結果，以及每週報告內容。
- 訂閱及帳戶狀態：你目前的方案（免費版／深度版）、訂閱到期日等狀態資訊。我們不會直接接觸或儲存你的完整付款卡號——所有付款均由 Apple（經 App Store／RevenueCat）或 Stripe 直接處理。
二、我們如何使用你的資料
- 提供及維持本應用程式的核心功能，包括儲存、顯示及整理你的夢境記錄。
- 將你的夢境文字傳送至 OpenAI，以生成 AI 夢境解析及每週趨勢報告。
- 管理你的帳戶、驗證身份及維持登入狀態（session）。
- 處理及管理你的訂閱狀態（免費版／深度版）。
- 回覆你透過電郵提出的查詢、意見或支援請求。
三、第三方服務供應商
為提供服務，我們會將完成該服務所需的最少資料傳送至以下第三方處理者：
- OpenAI：用於夢境內容之 AI 解析，以及網頁版語音輸入之轉錄（Whisper）。
- Google（以 Google 帳戶登入）：如你選用此登入方式，Google 會就該次登入向我們提供你的帳戶識別碼、電郵地址，以及（如供應商提供）你的姓名，以驗證你的身份。我們不會向 Google 傳送你的夢境內容。
- Apple（透過 Apple 登入）：如你選用此登入方式，Apple 會就該次登入向我們提供你的帳戶識別碼、電郵地址（可能為「隱藏我的電郵」的私人轉發位址），以及僅在你首次授權時提供的姓名。我們不會向 Apple 傳送你的夢境內容。
- Apple（App Store）及 RevenueCat：處理 iOS 版本的訂閱及付款。
- Stripe：處理網頁版本的訂閱及付款。
- Vercel：本應用程式的網頁及後端服務主機供應商。
- Postgres 資料庫服務供應商：儲存你的帳戶及夢境資料。
這些服務供應商僅在提供相關服務所需的範圍內處理你的資料，並各自受其私隱政策約束。由於部分供應商（例如 OpenAI、Stripe、Vercel）的伺服器可能位於你所在地區以外，你的資料有可能被傳輸至其他司法管轄區進行處理及儲存。
四、資料保留
我們會保留你的帳戶及夢境資料，直至你主動刪除帳戶為止。網頁版的語音錄音檔案於轉錄完成後即時捨棄，不會被保留或儲存；iOS 應用程式的語音在你的裝置上處理，錄音不會上載至伺服器。
五、刪除帳戶
你可以隨時在應用程式內的「設定 → 刪除帳戶」中刪除你的帳戶。刪除操作為即時且不可逆轉：你的帳戶、所有夢境記錄、AI 解析結果及每週報告將會一併被永久刪除（連帶刪除），我們無法為你復原任何已刪除的資料。
如你曾以「透過 Apple 登入」建立帳戶，我們會在刪除帳戶前先嘗試向 Apple 撤銷你授予本應用程式的登入授權；即使該次撤銷未能成功（例如 Apple 服務暫時無法連接），帳戶刪除仍會照常進行，不會因而延誤或中止。我們所儲存的第三方帳戶識別碼及電郵地址將連同帳戶一併刪除，不會保留任何識別記錄。
六、資料安全
我們採取合理的技術及行政措施保護你的資料，包括以 HTTPS 加密傳輸資料，以及以 bcrypt 對密碼進行單向加密雜湊處理。然而，並無任何網路傳輸或電子儲存方式能保證百分之百安全，我們無法對資料的絕對安全作出保證。
七、兒童私隱
本應用程式並非設計給13歲以下兒童使用，我們不會在知情的情況下收集13歲以下兒童的個人資料。如你發現本應用程式在未經家長或監護人同意下收集了兒童的個人資料，請聯絡我們，我們將盡快刪除相關資料。
八、你的權利
你有權在「設定」頁面查閱及更正你的帳戶資料，並可隨時刪除你的帳戶及所有相關資料。如你對資料處理有任何疑問、要求查閱、更正或刪除個人資料，歡迎透過下方電郵聯絡我們。
九、本政策之修訂
我們可能不時更新本私隱政策，以反映產品功能或法律要求的變化。任何重大變更將透過更新本頁面頂部之「最後更新日期」作出標示，建議你定期查閱本頁面。
Privacy Policy
Last updated: July 24, 2026
Welcome to Dream Record 夢境紀錄 (the “App”, the “Service”, or “we”). This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you use the App. By using the App, you agree to the practices described in this policy.
1. Information We Collect
- Account information: your email address, password (stored as a one-way bcrypt hash — we never store or view your password in plain text), and the optional username and name you choose to provide. If you sign in with a third-party account, that account has no password.
- Third-party sign-in data (if applicable): if you choose to sign in or register with a Google or Apple account, we receive from that provider: the account identifier it assigns you, your email address, and (if the provider supplies it) your name. We use the identifier only to recognize your account, and the email address only to determine whether it matches an existing account of yours. We never receive or store your Google or Apple password.
- Apple private relay (if applicable):if you choose “Hide My Email” when signing in with Apple, we receive the private relay address Apple issues (ending in @privaterelay.appleid.com) instead of your real email address. Apple tells us at sign-in whether the address is a private relay address — we do not infer this from the email domain. We use that address only for account identification and necessary service communication — we never attempt to, and cannot, resolve it back to your real address.
- Dream content: the text of the dreams you record, and any tags you attach to them.
- Voice input (optional):if you choose to record a dream by voice, in the iOS app your speech is transcribed directly on your device (requires iOS 26 or later) and the recording never leaves your device. On the web, the recording is sent to OpenAI's Whisper service in real time for speech-to-text transcription; once transcription is complete, the audio file is discarded and is not retained on our servers.
- AI-generated content: the AI dream analysis results and weekly reports you request.
- Subscription and account status: your current plan (Free or Deep Plan) and subscription expiry information. We never handle or store your full payment card details — all payments are processed directly by Apple (via the App Store / RevenueCat) or Stripe.
2. How We Use Your Information
- To provide and maintain the App's core functionality, including storing, displaying, and organizing your dream entries.
- To send your dream text to OpenAI to generate AI dream analyses and weekly trend reports.
- To manage your account, verify your identity, and maintain your login session.
- To process and manage your subscription status (Free / Deep Plan).
- To respond to inquiries, feedback, or support requests you send us by email.
3. Third-Party Service Providers
To operate the Service, we share the minimum data necessary with the following third-party processors:
- OpenAI: AI analysis of dream content, and transcription of voice input on the web (Whisper).
- Google (Sign in with Google): if you use this sign-in method, Google provides us your account identifier, email address, and (if the provider supplies it) your name for that sign-in to verify your identity. We never send your dream content to Google.
- Apple (Sign in with Apple):if you use this sign-in method, Apple provides us your account identifier, email address (which may be a “Hide My Email” private relay address), and your name — the name only on your first authorization. We never send your dream content to Apple.
- Apple (App Store) and RevenueCat: processing of iOS subscriptions and payments.
- Stripe: processing of web subscriptions and payments.
- Vercel: web and backend hosting provider for the App.
- Our Postgres database host: storage of your account and dream data.
These providers process your data only to the extent necessary to deliver their respective services, and are each bound by their own privacy policies. Because some providers (e.g. OpenAI, Stripe, Vercel) operate servers outside your region, your data may be transferred to and processed in other jurisdictions.
4. Data Retention
We retain your account and dream data until you delete your account. Web voice recordings are discarded immediately after transcription and are not retained; in the iOS app, voice is processed on your device and recordings are never uploaded to our servers.
5. Account Deletion
You can delete your account at any time from within the App under Settings → Delete Account. Deletion is immediate and irreversible: your account, all dream entries, AI analysis results, and weekly reports are permanently deleted (cascade deleted) together, and we cannot recover any deleted data on your behalf.
If you created your account with Sign in with Apple, before deleting your account we first attempt to revoke with Apple the sign-in authorization you granted this app. Even if that revocation attempt is unsuccessful (for example, Apple's service is temporarily unreachable), account deletion proceeds as normal without delay. The third-party account identifier and email address we stored are deleted together with your account, and no identifying record is retained.
6. Data Security
We take reasonable technical and administrative measures to protect your data, including encrypting data in transit via HTTPS and one-way hashing passwords with bcrypt. However, no method of transmission over the internet or electronic storage is 100% secure, and we cannot guarantee absolute security.
7. Children's Privacy
The App is not designed for use by children under the age of 13, and we do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data without parental or guardian consent, please contact us and we will delete the relevant data promptly.
8. Your Rights
You may view and update your account information from the Settings page, and you may delete your account and all associated data at any time. If you have questions or requests regarding access, correction, or deletion of your personal data, please contact us using the email address below.
9. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in the product or legal requirements. Material changes will be indicated by updating the “Last updated” date at the top of this page. We encourage you to review this page periodically.