1.我們蒐集的資料

帳號資料

• 登入方式：可用 Apple、Google 或 Email 登入。透過 Apple／Google 登入時，我們取得的僅是你授權提供的 Email（Apple「隱藏我的電子郵件」轉發位址亦可正常使用）。
• 個人檔案：顯示名稱、使用者名稱、自我介紹、所在地（自由填寫文字，非 GPS）、個人連結、自訂 3D 像素角色（角色外觀由色塊組成，並非真人照片）。

活動與票務資料

• 你建立、報名或轉刊分享的活動；報名／審核狀態；票卷（含序號與 QR Code）、入場核銷紀錄。
• 若你將票卷加入 Apple Wallet，票卷內容會生成一份已簽章的 .pkpass 檔案。

位置資訊（選填）

只有在你主動使用「我的附近」依距離排序活動時，App 才會取用你當下的裝置位置（僅「使用期間」，不會背景定位）。你可以隨時在 iOS「設定」關閉此授權，不影響其餘功能。

相機與照片

相機僅用於主辦方掃描報名者的票卷 QR Code 核銷入場；相簿僅用於選擇活動封面圖片，或在你主動選擇「分享到 Instagram 限動」時，把產生的分享圖片存到相簿（這是開啟 Instagram 限動編輯器的唯一方式）。我們不會存取你相簿中的其他照片。

使用者內容

主辦方填寫的活動標題／介紹／自訂標籤；你在已報名活動的 3D 島嶼上放置的建造紀錄（會標註為你的帳號，該場活動的其他參與者可見）；個人島嶼佈置。

推播通知

登入後若你同意推播權限，我們會儲存裝置的推播權杖（device token），用於發送報名結果、票卷與活動提醒通知。

使用數據與分析

我們使用 Google Analytics（GA4）與自有的第一方流量分析工具，蒐集聚合性的使用行為資料（例如瀏覽了哪些頁面、點擊了哪些功能），協助我們了解產品使用狀況、改善服務。這些工具不會用於跨平台廣告追蹤。

裝置與紀錄資訊

如同絕大多數網路服務，我們的雲端與主機服務商（Supabase、Vercel）會依標準做法記錄 IP 位址、瀏覽器／裝置資訊等連線紀錄，主要用於安全防護與異常排除。

2.我們如何使用資料

• 提供、維運與改善本服務的核心功能（探索活動、報名、票卷核銷、活動島共建）。
• 寄送交易型通知：登入連結、報名結果、票卷、活動提醒。主辦方觸發的「電子報」由伺服器端逐一寄送給已報名用戶——主辦方永遠不會看到任何報名者的 Email 地址，只負責撰寫內容並觸發寄送。
• 維護社群安全：處理使用者的檢舉、依服務條款移除違規內容或停權帳號。
• 分析聚合使用趨勢，優化功能與效能。
• 遵循法律義務、回應主管機關或司法要求。

3.資料如何共享——第三方服務

我們不會出售你的個人資料，也不會把你的資料分享給第三方作為他們自己的行銷用途。為了提供服務，我們會將必要的資料交給下列協力廠商處理：

在法律要求、保護本服務或使用者權益與安全所必要的情況下，我們也可能依法揭露資料予主管機關。

4.資料保留

只要你的帳號存在，我們會持續保留上述資料以維持服務運作。你可以隨時在 App 內刪除帳號——刪除後，你的個人檔案、自訂角色、追蹤關係、收藏與推播權杖會立即從系統中移除；你發起主辦的活動（連同該活動的報名與票卷紀錄）也會一併移除。

5.你的權利與選擇

• 查看／更新：登入後於「編輯檔案」隨時更新個人資料。
• 刪除帳號：於「個人頁 → 刪除帳號」自助刪除，此動作無法復原。
• 管理裝置權限：可在 iOS「設定 → 活動島嶼」隨時開關定位、相機、相簿、通知等權限。
• 索取或刪除資料：可寄信至下方聯絡信箱提出請求，我們會在合理時間內回覆處理。

6.兒童隱私

本服務並非針對兒童設計，我們不會在知情的情況下蒐集 13 歲以下兒童的個人資料。若你發現本服務意外蒐集了兒童資料，請與我們聯絡，我們會盡快處理刪除。

7.資料安全

我們透過資料庫列級安全性原則（Row Level Security）、加密傳輸（HTTPS/TLS）與最小權限的伺服器端金鑰管理來保護你的資料。但沒有任何網路服務能保證絕對安全，我們會持續檢視與改善保護措施。

8.政策修訂

我們可能不時更新本政策。重大變更時，我們會在此頁面更新「最後更新」日期，並視情況以站內公告或 Email 通知。建議你定期查看本頁面。

1.Data We Collect

Account data

• Sign-in: You can sign in with Apple, Google, or email. When you sign in with Apple/Google, we only receive the email address you authorize (Apple's "Hide My Email" relay addresses work fine too).
• Profile: display name, username, bio, location (free-text field, not GPS), personal link, and a customizable 3D voxel character (built from colored blocks — not a photo of you).

Event & ticketing data

• Events you create, register for, or repost; registration/approval status; tickets (serial number and QR code) and check-in records.
• If you add a ticket to Apple Wallet, its contents are used to generate a signed .pkpass file.

Location (optional)

We only read your device's current location when you actively use "Near me" distance sorting — "while using the app" only, never in the background. You can revoke this anytime in iOS Settings without affecting other features.

Camera & Photos

Camera access is used only by organizers to scan attendees' ticket QR codes at check-in. Photo library access is used only to pick an event cover image, or — when you choose to "Share to Instagram Story" — to save the generated share image to your library, which is the only way to open Instagram's story composer. We never access any other photos in your library.

User content

Event titles/descriptions/tags written by organizers; the block-placement/building records you add to an event's 3D island (attributed to your account and visible to other participants of that event); and your personal island layout.

Push notifications

If you grant push permission after signing in, we store your device's push token to send registration results, ticket, and event reminder notifications.

Usage & analytics

We use Google Analytics (GA4) and our own first-party traffic-analytics script to collect aggregated usage data (e.g., which pages or features were used) to understand and improve the product. These tools are not used for cross-app/cross-site ad tracking.

Device & log data

Like most internet services, our infrastructure providers (Supabase, Vercel) log standard connection information such as IP address and browser/device info, primarily for security and troubleshooting.

2.How We Use Data

• To provide, operate, and improve the Service's core features (discovering events, registering, ticket check-in, collaborative island building).
• To send transactional notifications: login links, registration results, tickets, and event reminders. Organizer-triggered "newsletters" are sent server-side to each registrant individually — organizers can never see any registrant's email address; they only write the content and trigger the send.
• To keep the community safe: handling user reports, removing content, or suspending accounts that violate our Terms of Service.
• To analyze aggregated usage trends and improve performance.
• To comply with legal obligations and respond to lawful requests from authorities.

3.How We Share Data — Third Parties

We do not sell your personal data, and we do not share it with third parties for their own marketing purposes. To operate the Service, we share the minimum necessary data with these processors:

We may also disclose data where required by law, or where necessary to protect the Service, our users, or the public.

4.Data Retention

We retain the data above for as long as your account exists. You can delete your account at any time in the app — this immediately removes your profile, custom character, follows, favorites, and push token, and also removes any events you organized along with their registrations and tickets.

5.Your Rights & Choices

• Access/update: Update your profile anytime via "Edit Profile" after signing in.
• Delete your account: Self-serve from Profile → Delete Account. This cannot be undone.
• Manage device permissions: Toggle Location, Camera, Photos, and Notifications anytime under iOS Settings → 活動島嶼.
• Request access or deletion: Email the address below and we'll respond within a reasonable time.

6.Children's Privacy

The Service is not directed at children, and we do not knowingly collect personal data from children under 13. If you believe we've inadvertently collected a child's data, please contact us and we'll delete it promptly.

7.Data Security

We protect your data with database Row Level Security, encrypted transport (HTTPS/TLS), and least-privilege server-side key management. No internet service can guarantee absolute security, and we continuously review and improve our safeguards.

8.Changes to This Policy

We may update this policy from time to time. When we make material changes, we'll update the "Last updated" date on this page and, where appropriate, notify you in-app or by email. Please check back periodically.