feat(legal): update legal documents and add zh_Hant support
This commit is contained in:
qzl
@@ -6,8 +6,20 @@ Six-Line divination comes from the deep philosophical system of the *I Ching*. I
|
|||||||
|
|
||||||
MeiYao Divination is built on this idea. Its core value is to help users step outside narrow thinking, understand contradictions, opportunities, and risks from a broader trend perspective, and make calmer, more thoughtful decisions. We hope AI can become a modern bridge to this traditional wisdom.
|
MeiYao Divination is built on this idea. Its core value is to help users step outside narrow thinking, understand contradictions, opportunities, and risks from a broader trend perspective, and make calmer, more thoughtful decisions. We hope AI can become a modern bridge to this traditional wisdom.
|
||||||
|
|
||||||
## Important Notice
|
---
|
||||||
|
|
||||||
All divination interpretations are generated by AI and are for entertainment and reference only. They must not be used as the sole basis for business, medical, or other professional decisions.
|
## Company Info
|
||||||
|
|
||||||
Yue ICP 2025428416-1A
|
**Developer:** Xunmee Technology (Shenzhen) Co., Ltd.
|
||||||
|
|
||||||
|
**Contact Email:** xuyunlong@xunmee.com
|
||||||
|
|
||||||
|
**Privacy Policy:** Available at Settings → Privacy → Privacy Policy in the App
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Important Disclaimer
|
||||||
|
|
||||||
|
All divination interpretations are generated by AI and for entertainment and reference only. They are not intended to replace professional guidance in business, finance, medical, legal, or any other formal fields. We do not guarantee the accuracy or reliability of the content, and users shall take full responsibility for any decisions they make.
|
||||||
|
|
||||||
|
© 2026 MeiYao Divination. All Rights Reserved.
|
||||||
|
|||||||
@@ -1,63 +1,251 @@
|
|||||||
# Privacy Policy
|
# Privacy Policy
|
||||||
|
|
||||||
Dear user,
|
**Last Updated**: April 17, 2026
|
||||||
|
|
||||||
Welcome to MeiYao Divination. We understand that your privacy is important, and we take the protection of personal information seriously. This policy explains how we collect, use, store, and share your personal information, and how you can access and manage it.
|
**Effective Date**: April 17, 2026
|
||||||
|
|
||||||
## 1. Information We Collect
|
---
|
||||||
|
|
||||||
### Information you provide directly
|
## 1. Who We Are
|
||||||
|
|
||||||
- Account registration information, such as your phone number or verification code
|
MeiYao Divination ("we," "us," or "our") is a mobile application developed and operated by Xunmee Technology (Shenzhen) Co., Ltd. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our mobile application (the "App").
|
||||||
- Profile information you choose to fill in
|
|
||||||
- Divination-related inputs and results you create in the app
|
|
||||||
|
|
||||||
### Information collected automatically
|
**Contact Information:**
|
||||||
|
- Company: Xunmee Technology (Shenzhen) Co., Ltd.
|
||||||
|
- Email: privacy@xunmee.com
|
||||||
|
- Support Email: xuyunlong@xunmee.com
|
||||||
|
|
||||||
- Device information, such as model, system version, and device settings
|
---
|
||||||
- Log information, such as IP address, access time, page visits, and operation records
|
|
||||||
|
|
||||||
## 2. How We Use Information
|
## 2. Information We Collect
|
||||||
|
|
||||||
- To provide divination services and improve AI interpretation quality
|
### 2.1 Personal Information We Collect
|
||||||
- To manage accounts and protect account security
|
|
||||||
- To improve product quality through usage analysis
|
|
||||||
- To contact you with service notifications, support, or feedback follow-up
|
|
||||||
|
|
||||||
## 3. Storage of Information
|
We collect information that you provide directly to us and information that is collected automatically when you use our App.
|
||||||
|
|
||||||
Personal information collected in China is generally stored on servers located within China. We only keep personal information for as long as necessary to meet legal obligations and service purposes, after which it will be deleted or anonymized.
|
#### Information You Provide
|
||||||
|
|
||||||
## 4. Sharing of Information
|
- **Account Information**: When you create an account, we collect your email address and verification code.
|
||||||
|
- **Divination Content**: When you use our divination services, we collect your questions, inputs, divination results, and session history.
|
||||||
|
- **Customer Support**: If you contact us for support, we collect the information you provide in your message.
|
||||||
|
|
||||||
We do not share personal information with third parties except in limited circumstances, such as:
|
#### Information Collected Automatically
|
||||||
|
|
||||||
- when you give clear consent,
|
When you use our App, we and our third-party partners automatically collect:
|
||||||
- when we work with service providers under proper safeguards,
|
|
||||||
- when disclosure is required by law,
|
|
||||||
- or when business restructuring, merger, or acquisition requires lawful transfer.
|
|
||||||
|
|
||||||
## 5. Your Rights
|
- **Device Information**: Device model, operating system version, device settings
|
||||||
|
- **Usage Information**: Divination frequency, session duration, session history
|
||||||
|
- **Technical Information**: Access timestamps, time zone information
|
||||||
|
- **Attribution Data**: We use AppsFlyer and SKAdNetwork for attribution and marketing analytics. These services may collect device identifiers, IP addresses, and other information for advertising attribution purposes.
|
||||||
|
|
||||||
You may request access to, correction of, or deletion of your personal information, and you may also request account cancellation. Please note that account cancellation may make related data unrecoverable.
|
### 2.2 Categories of Personal Information Collected (Past 12 Months)
|
||||||
|
|
||||||
## 6. Protection of Minors
|
In the past 12 months, we have collected the following categories of personal information:
|
||||||
|
|
||||||
If you are under 14 years old, please use the service under the guidance of a parent or legal guardian and obtain their prior consent.
|
| Category | Collected | Examples |
|
||||||
|
|----------|-----------|----------|
|
||||||
|
| **A. Identifiers** | Yes | Email address |
|
||||||
|
| **B. Personal Information Categories** | No | N/A |
|
||||||
|
| **C. Protected Classification Characteristics** | No | N/A |
|
||||||
|
| **D. Commercial Information** | No | N/A |
|
||||||
|
| **E. Biometric Information** | No | N/A |
|
||||||
|
| **F. Internet or Other Electronic Network Activity Information** | Yes | Session duration, divination frequency, device information |
|
||||||
|
| **G. Geolocation Data** | No | N/A |
|
||||||
|
| **H. Sensory Data** | No | N/A |
|
||||||
|
| **I. Professional or Employment Information** | No | N/A |
|
||||||
|
| **J. Education Information** | No | N/A |
|
||||||
|
| **K. Inferences** | No | N/A |
|
||||||
|
|
||||||
## 7. Security of Personal Information
|
---
|
||||||
|
|
||||||
We use reasonable organizational and technical measures, including encryption, access control, auditing, and monitoring, to protect personal information against unauthorized access, disclosure, use, modification, damage, or loss.
|
## 3. How We Use Your Personal Information
|
||||||
|
|
||||||
## 8. Policy Updates
|
We use the personal information we collect for the following business purposes:
|
||||||
|
|
||||||
We may update this policy from time to time due to legal, business, or service changes. Material changes will be communicated in a prominent way.
|
- **To provide our services**: Process your divination queries, generate AI interpretations, store your session history, and deliver the core functionality of the App
|
||||||
|
- **To communicate with you**: Send you service-related communications, respond to your inquiries, and provide customer support
|
||||||
|
- **To improve our services**: Analyze usage patterns to enhance divination accuracy, fix bugs, and develop new features
|
||||||
|
- **To protect our services**: Detect and prevent fraud, abuse, and security issues
|
||||||
|
- **To comply with legal obligations**: Meet applicable legal, tax, and regulatory requirements
|
||||||
|
|
||||||
## 9. Contact Us
|
---
|
||||||
|
|
||||||
If you have any questions or suggestions regarding this privacy policy, please contact us at:
|
## 4. How We Share Your Personal Information
|
||||||
|
|
||||||
- xuyunlong@xunmee.com
|
### 4.1 Service Providers
|
||||||
|
|
||||||
Xunmee Technology (Shenzhen) Co., Ltd.
|
We share your personal information with third-party service providers who perform services on our behalf:
|
||||||
June 1, 2025
|
|
||||||
|
| Service Provider | Purpose | Category of Information Shared |
|
||||||
|
|------------------|---------|-------------------------------|
|
||||||
|
| **Amazon Web Services (AWS)** | Cloud hosting and infrastructure | All personal information stored in our systems |
|
||||||
|
| **AppsFlyer** | Attribution and marketing analytics | Device identifiers, IP addresses, usage information |
|
||||||
|
|
||||||
|
These service providers are contractually obligated to use your personal information only for the purposes we specify and are prohibited from selling or sharing it for their own purposes.
|
||||||
|
|
||||||
|
### 4.2 Disclosure for Business Purposes
|
||||||
|
|
||||||
|
In the past 12 months, we have disclosed the following categories of personal information for business purposes:
|
||||||
|
|
||||||
|
| Category of Personal Information | Disclosed | Recipient Categories |
|
||||||
|
|---------------------------------|-----------|---------------------|
|
||||||
|
| **A. Identifiers** | Yes | Cloud hosting providers, analytics providers |
|
||||||
|
| **F. Internet or Other Electronic Network Activity Information** | Yes | Cloud hosting providers, analytics providers |
|
||||||
|
|
||||||
|
### 4.3 Sale of Personal Information
|
||||||
|
|
||||||
|
**We do not sell personal information.** In the past 12 months, we have not sold any personal information.
|
||||||
|
|
||||||
|
### 4.4 Sharing of Personal Information for Cross-Context Behavioral Advertising
|
||||||
|
|
||||||
|
**We do not share personal information for cross-context behavioral advertising.** In the past 12 months, we have not shared any personal information for cross-context behavioral advertising.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 5. Your Privacy Rights (California Residents)
|
||||||
|
|
||||||
|
If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):
|
||||||
|
|
||||||
|
### 5.1 Right to Know
|
||||||
|
|
||||||
|
You have the right to request that we disclose what personal information we collect, use, disclose, and sell.
|
||||||
|
|
||||||
|
### 5.2 Right to Delete
|
||||||
|
|
||||||
|
You have the right to request that we delete any of your personal information that we have collected and retained, subject to certain exceptions.
|
||||||
|
|
||||||
|
### 5.3 Right to Correct
|
||||||
|
|
||||||
|
You have the right to request that we correct inaccurate personal information that we maintain about you.
|
||||||
|
|
||||||
|
### 5.4 Right to Data Portability
|
||||||
|
|
||||||
|
You have the right to request that we provide you with your personal information in a readily usable format that allows you to transmit the information to another entity without hindrance.
|
||||||
|
|
||||||
|
### 5.5 Right to Opt-Out of Sale or Sharing
|
||||||
|
|
||||||
|
**We do not sell or share personal information for cross-context behavioral advertising.** Therefore, you do not need to exercise this right with us.
|
||||||
|
|
||||||
|
### 5.6 Right to Limit Use of Sensitive Personal Information
|
||||||
|
|
||||||
|
We do not collect sensitive personal information as defined under CCPA/CPRA. Therefore, you do not need to exercise this right with us.
|
||||||
|
|
||||||
|
### 5.7 Right to Non-Discrimination
|
||||||
|
|
||||||
|
We will not discriminate against you for exercising any of your CCPA/CPRA rights.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 6. How to Exercise Your Rights
|
||||||
|
|
||||||
|
### 6.1 Submitting Requests
|
||||||
|
|
||||||
|
To exercise your rights under the CCPA/CPRA, you may:
|
||||||
|
|
||||||
|
- **Email us**: privacy@xunmee.com
|
||||||
|
- **Use in-app features**: Settings → Privacy → Data Requests
|
||||||
|
|
||||||
|
You do not need to create an account to submit a request.
|
||||||
|
|
||||||
|
### 6.2 Verifying Your Identity
|
||||||
|
|
||||||
|
To protect your privacy and security, we will take reasonable steps to verify your identity before processing your request. This may include asking you to provide information that matches what we have on file for your account.
|
||||||
|
|
||||||
|
### 6.3 Response Time
|
||||||
|
|
||||||
|
We will respond to your request within **45 days** of receipt. If we need more time (up to 90 days total), we will inform you of the reason and extension period in writing.
|
||||||
|
|
||||||
|
### 6.4 Authorized Agent
|
||||||
|
|
||||||
|
You may designate an authorized agent to submit requests on your behalf. We may require the authorized agent to provide proof of authorization and verify their identity.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 7. Data Retention
|
||||||
|
|
||||||
|
We retain your personal information for as long as necessary to fulfill the purposes for which it was collected, including:
|
||||||
|
|
||||||
|
- **Account Information**: Retained while your account is active and for 90 days after account deletion (to comply with legal obligations)
|
||||||
|
- **Divination Records**: Retained for 12 months, then deleted or anonymized
|
||||||
|
- **Technical/Usage Data**: Retained for 90 days, then anonymized
|
||||||
|
|
||||||
|
When your personal information is no longer needed, we will securely delete or anonymize it.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 8. Data Security
|
||||||
|
|
||||||
|
We implement reasonable security measures to protect your personal information from unauthorized access, use, or disclosure, including:
|
||||||
|
|
||||||
|
- Encryption of data in transit using secure HTTPS/TLS protocols
|
||||||
|
- Access controls and authentication mechanisms for user data
|
||||||
|
- Regular security reviews and monitoring
|
||||||
|
|
||||||
|
However, no security system is 100% secure, and we cannot guarantee the absolute security of your personal information.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 9. Children's Privacy
|
||||||
|
|
||||||
|
Our App is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13.
|
||||||
|
|
||||||
|
If you believe we have collected personal information from a child under 13, please contact us immediately at privacy@xunmee.com. We will take steps to delete such information promptly.
|
||||||
|
|
||||||
|
Users between the ages of 13 and 17 must have parental or guardian consent to use our App.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 10. Cross-Border Data Transfers
|
||||||
|
|
||||||
|
Your personal information may be transferred to and processed in the United States. By using our App, you consent to the transfer of your personal information to the United States.
|
||||||
|
|
||||||
|
We ensure that appropriate safeguards are in place for cross-border transfers, including:
|
||||||
|
|
||||||
|
- Secure data transmission using encryption
|
||||||
|
- Contractual protections with service providers
|
||||||
|
- Compliance with applicable data protection laws
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 11. Changes to This Privacy Policy
|
||||||
|
|
||||||
|
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by:
|
||||||
|
|
||||||
|
- Posting the updated Privacy Policy in the App
|
||||||
|
- Updating the "Last Updated" date at the top of this policy
|
||||||
|
|
||||||
|
We encourage you to review this Privacy Policy periodically to stay informed about how we collect, use, and protect your personal information.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 12. Contact Us
|
||||||
|
|
||||||
|
If you have any questions about this Privacy Policy or our privacy practices, please contact us at:
|
||||||
|
|
||||||
|
**Xunmee Technology (Shenzhen) Co., Ltd.**
|
||||||
|
|
||||||
|
- **Privacy Officer**: privacy@xunmee.com
|
||||||
|
- **Support Email**: xuyunlong@xunmee.com
|
||||||
|
- **Address**: [Full Street Address], Shenzhen, Guangdong, China
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 13. Additional Rights for California Residents
|
||||||
|
|
||||||
|
### 13.1 Right to Equal Service and Price
|
||||||
|
|
||||||
|
You have the right not to receive discriminatory treatment for exercising your privacy rights under the CCPA/CPRA.
|
||||||
|
|
||||||
|
### 13.2 Financial Incentive Programs
|
||||||
|
|
||||||
|
We do not currently offer any financial incentive programs for the collection, sale, or deletion of personal information.
|
||||||
|
|
||||||
|
### 13.3 Accessibility
|
||||||
|
|
||||||
|
This Privacy Policy and our "Do Not Sell My Personal Information" link (if applicable) are accessible to users with disabilities.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
**Last Updated**: April 17, 2026
|
||||||
|
|
||||||
|
**Xunmee Technology (Shenzhen) Co., Ltd.**
|
||||||
|
|||||||
@@ -1,36 +1,97 @@
|
|||||||
# Terms of Service
|
# Terms of Service (US Compliant Version)
|
||||||
|
|
||||||
## Chapter 1 General
|
**Last Updated:** April 15, 2026
|
||||||
|
|
||||||
MeiYao Divination is developed, operated, and maintained by Xunmee Technology (Shenzhen) Co., Ltd. By downloading, installing, registering, signing in, or otherwise using the app, you confirm that you have read, understood, and accepted these terms.
|
## 1. Acceptance of Terms
|
||||||
|
|
||||||
## Chapter 2 Service Description
|
MeiYao Divination (the "App") is developed, operated, and maintained by **Xunmee Technology (Shenzhen) Co., Ltd.** ("we," "us," or "our").
|
||||||
|
|
||||||
MeiYao Divination provides AI-based divination interpretation services, including manual and automatic casting flows. Service interruption caused by maintenance, failure, force majeure, or other reasonable causes does not constitute a breach.
|
By downloading, installing, registering, accessing, or using the App, you ("you" or "user") acknowledge that you have read, understood, and **unconditionally agree** to be bound by these Terms of Service ("Terms") and our **Privacy Policy**. If you do not agree, you may not use the App.
|
||||||
|
|
||||||
## Chapter 3 User Accounts and Information Security
|
## 2. Age Requirement & COPPA Compliance
|
||||||
|
|
||||||
Users must have proper legal capacity, provide true and valid registration information, and keep account credentials secure. Necessary personal information may be collected and processed according to the privacy policy.
|
You represent and warrant that you are **at least 13 years of age** to use this App.
|
||||||
|
|
||||||
## Chapter 4 Intellectual Property
|
- This App is **not intended for use by children under 13**.
|
||||||
|
- We do not knowingly collect personal information from users under 13. If we become aware that a child under 13 has provided us with personal data, we will delete such information immediately.
|
||||||
|
|
||||||
All content of MeiYao Divination, including software, text, images, audio, video, charts, trademarks, and domains, is protected by law. Reverse engineering, decompilation, disassembly, or any attempt to obtain source code without written permission is strictly prohibited.
|
## 3. Service Description
|
||||||
|
|
||||||
## Chapter 5 User Conduct
|
The App provides **AI-assisted Six-Line divination interpretation services** (including manual and automatic hexagram casting), rooted in traditional *I Ching* philosophy.
|
||||||
|
|
||||||
Users may not publish unlawful content, infringe on the rights of others, disrupt normal service operation, exploit vulnerabilities, or conduct unauthorized commercial activity. The app may warn, restrict, suspend, or ban accounts that violate these rules and may pursue legal liability.
|
- All divination results and interpretations are **AI-generated and for entertainment and reference purposes only**.
|
||||||
|
- They are **not intended as professional advice** (financial, legal, medical, business, or otherwise).
|
||||||
|
- We do not guarantee accuracy, completeness, or reliability of any AI-generated content.
|
||||||
|
- Temporary service interruptions due to maintenance, technical failures, force majeure, or third-party issues do not constitute a breach of these Terms.
|
||||||
|
|
||||||
## Chapter 6 Liability and Disclaimer
|
## 4. User Accounts & Data Privacy
|
||||||
|
|
||||||
Users are responsible for losses caused by their own violations of these terms. AI-generated divination results are for reference only and must not be treated as the sole basis for real-world decisions. Users assume the related risks.
|
- You must provide **true, accurate, and complete registration information** and keep it updated.
|
||||||
|
- You are responsible for maintaining the confidentiality of your account credentials and for all activities under your account.
|
||||||
|
- We collect and process necessary personal information as described in our **Privacy Policy**, in compliance with applicable laws including **CCPA/CPRA (California Consumer Privacy Act)**.
|
||||||
|
- California users have the right to access, delete, and opt out of the sale of their personal data as set forth in our Privacy Policy.
|
||||||
|
|
||||||
## Chapter 7 Dispute Resolution
|
## 5. Intellectual Property
|
||||||
|
|
||||||
These terms are governed by the laws of the People's Republic of China. Disputes should first be resolved through friendly consultation. If consultation fails, either party may bring the dispute to the competent court where Xunmee Technology is registered.
|
All content within the App—including software code, text, images, audio, video, trademarks, service marks, and design—is the exclusive property of Xunmee Technology (Shenzhen) Co., Ltd. and protected under **U.S. copyright law (DMCA)**, trademark law, and international treaties.
|
||||||
|
|
||||||
## Chapter 8 Miscellaneous
|
You may not:
|
||||||
|
|
||||||
Notices may be delivered through contact information, system messages, internal messages, or announcements. If you need to contact Xunmee Technology, please email xuyunlong@xunmee.com.
|
- Copy, modify, distribute, transmit, display, or create derivative works of the App or its content.
|
||||||
|
- Reverse engineer, decompile, disassemble, or attempt to extract source code from the App.
|
||||||
|
- Remove any copyright, trademark, or proprietary notices from the App.
|
||||||
|
|
||||||
Xunmee Technology (Shenzhen) Co., Ltd.
|
## 6. Prohibited User Conduct
|
||||||
June 1, 2025
|
|
||||||
|
You agree not to:
|
||||||
|
|
||||||
|
- Use the App for **illegal, harmful, fraudulent, or infringing activities**.
|
||||||
|
- Post or transmit content that is unlawful, defamatory, obscene, threatening, or violates third-party rights.
|
||||||
|
- Interfere with or disrupt the App's servers, networks, or security measures.
|
||||||
|
- Exploit any vulnerabilities for unauthorized access or commercial use.
|
||||||
|
- Make false or misleading claims regarding the App's divination results.
|
||||||
|
|
||||||
|
We reserve the right to **warn, restrict, suspend, or terminate accounts** that violate these rules, without prior notice, and may pursue legal action where appropriate.
|
||||||
|
|
||||||
|
## 7. Disclaimer of Warranties (US Standard)
|
||||||
|
|
||||||
|
THE APP AND ALL SERVICES ARE PROVIDED **"AS IS" AND "AS AVAILABLE"**, WITHOUT WARRANTIES OF ANY KIND—EXPRESS OR IMPLIED—INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT.
|
||||||
|
|
||||||
|
WE DO NOT WARRANT THAT:
|
||||||
|
|
||||||
|
- The App will be uninterrupted, secure, error-free, or accurate.
|
||||||
|
- Results from the App will meet your expectations.
|
||||||
|
- AI-generated content is reliable or suitable for any purpose.
|
||||||
|
|
||||||
|
## 8. Limitation of Liability
|
||||||
|
|
||||||
|
TO THE FULLEST EXTENT PERMITTED BY LAW:
|
||||||
|
|
||||||
|
- IN NO EVENT SHALL XUNMEE TECHNOLOGY, ITS DIRECTORS, EMPLOYEES, OR AFFILIATES BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES ARISING FROM YOUR USE OF THE APP.
|
||||||
|
- OUR TOTAL AGGREGATE LIABILITY FOR ANY CLAIM RELATED TO THE APP SHALL NOT EXCEED THE TOTAL AMOUNT YOU PAID TO US (IF ANY) IN THE PAST 12 MONTHS.
|
||||||
|
|
||||||
|
## 9. Indemnification
|
||||||
|
|
||||||
|
You agree to **indemnify and hold harmless** Xunmee Technology from all claims, damages, losses, and expenses (including legal fees) arising from:
|
||||||
|
|
||||||
|
- Your violation of these Terms.
|
||||||
|
- Your use or misuse of the App.
|
||||||
|
- Your infringement of third-party rights.
|
||||||
|
|
||||||
|
## 10. Governing Law & Dispute Resolution
|
||||||
|
|
||||||
|
These Terms are governed by the **laws of the State of California, U.S.A.**, without regard to its conflict of laws principles.
|
||||||
|
|
||||||
|
Any dispute arising from these Terms shall first be resolved through good-faith negotiation. If unresolved, disputes shall be settled in the **state or federal courts located in Los Angeles County, California**, and you consent to the personal jurisdiction of such courts.
|
||||||
|
|
||||||
|
## 11. Modifications to Terms
|
||||||
|
|
||||||
|
We reserve the right to **update or modify these Terms at any time**. We will notify users of material changes via in-app notice, email, or prominent posting. Your continued use after the effective date constitutes acceptance of the revised Terms.
|
||||||
|
|
||||||
|
## 12. Contact Information
|
||||||
|
|
||||||
|
For questions, concerns, or notices regarding these Terms:
|
||||||
|
|
||||||
|
- **Company Name:** Xunmee Technology (Shenzhen) Co., Ltd.
|
||||||
|
- **Contact Email:** xuyunlong@xunmee.com
|
||||||
|
- **Privacy Policy:** [Insert your Privacy Policy URL here]
|
||||||
|
|||||||
@@ -1,13 +1,25 @@
|
|||||||
# 关于我们
|
# 关于我们
|
||||||
|
|
||||||
你好，欢迎来到觅爻签问，这是一个借助于 AI 解读传统六爻卦象的平台，为用户了解中国传统易学文化提供一个窗口。
|
欢迎来到觅爻签问，这是一个借助于 AI 解读传统六爻占卜的平台，为用户了解中国传统易学文化提供一个窗口。
|
||||||
|
|
||||||
六爻卦象源于《周易》深邃的哲学体系，是古人探索世界运行规律的一种独特方法。古人认为宇宙万物相互关联，在你起卦时，你的心念与时空信息会凝结成卦象的方式呈现出来。得到卦象后，再结合《易经》中的爻辞和某些特定规律，如五行生克、干支冲合等，分析各要素间的发展趋势，最终推断出事物可能的走向。
|
六爻占卜源于《周易》深邃的哲学体系，是古人探索世界运行规律的一种独特方法。古人认为宇宙万物相互关联，在你起卦时，你的心念与时空信息会凝结成卦象的方式呈现出来。得到卦象后，再结合《易经》中的爻辞和某些特定规律，如五行生克、干支冲合等，分析各要素间的发展趋势，最终推断出事物可能的走向。
|
||||||
|
|
||||||
觅爻签问就是基于这样的思路而开发出来的平台，它的核心价值在于帮助你跳出局限思维，从事物全局和演变趋势的角度看清现状的矛盾、潜在机会和风险点，为你的判断和行动提供多一个维度的参考信息，让你能更理性、更周全地做决定。用 AI 解锁古老智慧，让觅爻签问成为你探索趋势、明晰方向的现代助手吧！
|
觅爻签问就是基于这样的思路而开发出来的平台，它的核心价值在于帮助你跳出局限思维，从事物全局和演变趋势的角度看清现状的矛盾、潜在机会和风险点，为你的判断和行动提供多一个维度的参考信息，让你能更理性、更周全地做决定。我们希望 AI 能成为连接这份古老智慧的现代桥梁。
|
||||||
|
|
||||||
## 特别提醒
|
---
|
||||||
|
|
||||||
卦象解读结果均由 AI 生成，仅供娱乐参考，切不可作为商业、医疗等专业领域的决策依据。理性看待卦象，自由掌握人生。
|
## 公司信息
|
||||||
|
|
||||||
粤ICP备2025428416号-1A
|
**开发者**：洵觅科技（深圳）有限公司
|
||||||
|
|
||||||
|
**联系邮箱**：xuyunlong@xunmee.com
|
||||||
|
|
||||||
|
**隐私政策**：[隐私政策链接]
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 免责声明
|
||||||
|
|
||||||
|
所有卦象解读结果均由 AI 生成，仅供娱乐和参考，不应用作商业、金融、医疗、法律或其他专业领域的决策依据。我们不对内容的准确性或可靠性做出保证，用户须对自己所做的任何决策承担全部责任。
|
||||||
|
|
||||||
|
© 2026 觅爻签问。保留所有权利。
|
||||||
|
|||||||
@@ -1,84 +1,25 @@
|
|||||||
# 隐私政策
|
# 隐私政策
|
||||||
|
|
||||||
尊敬的用户：
|
**注意：本文档正在更新中**
|
||||||
|
|
||||||
欢迎使用觅爻签问 APP（以下简称“觅爻”）！我们深知您的隐私对于您至关重要，因此我们非常重视保护您的个人信息。本隐私政策将向您详细说明我们在您使用服务时如何收集、使用、存储和共享您的个人信息，以及您如何访问和管理这些信息。请在使用我们的 APP 之前，仔细阅读并充分理解本隐私政策的全部内容。
|
英文正式稿已更新完成，简体中文版本将在英文稿确认后进行翻译。
|
||||||
|
|
||||||
## 一、我们收集哪些您的个人信息
|
请参考英文版本：
|
||||||
|
- [English Version](../en/privacy_policy.md)
|
||||||
|
|
||||||
### 1. 您主动提供的信息
|
---
|
||||||
|
|
||||||
- 账号注册信息：当您注册觅爻账号时，我们会收集您的手机号码、验证码等信息，以便为您创建账号并为您提供服务。
|
**最后更新日期**：待定
|
||||||
- 个人资料信息：您可以在个人资料页面选择填写姓名、性别、出生日期、个人签名等信息。这些信息有助于我们提供更个性化的解卦服务，但您不提供这些信息不会影响 APP 的基础功能使用。
|
|
||||||
- 解卦相关信息：在您使用解卦功能时，我们会收集您输入的问题、选择的解卦方式以及对应的解卦结果，用于提供服务和优化算法。
|
|
||||||
|
|
||||||
### 2. 我们自动收集的信息
|
**生效日期**：待定
|
||||||
|
|
||||||
- 设备信息：设备型号、操作系统版本、设备设置、唯一设备标识符等，用于性能优化、兼容性处理以及安全管理。
|
---
|
||||||
- 日志信息：包括 IP 地址、访问时间、访问页面、操作行为、网络请求信息等，用于分析用户行为和改进服务。
|
|
||||||
|
|
||||||
## 二、我们如何使用您的个人信息
|
本文档将在英文隐私政策正式稿确认后，按照以下原则进行翻译：
|
||||||
|
|
||||||
### 1. 提供和优化我们的服务
|
1. 保持与英文版本结构一致
|
||||||
|
2. 使用标准法律术语
|
||||||
|
3. 保留专业术语（如 CCPA、CPRA 等）
|
||||||
|
4. 符合中国法律文书规范
|
||||||
|
|
||||||
- 利用您提供的卦象问题、解卦方式等信息，结合 AI 解卦算法为您生成解读结果，并不断优化解卦算法，提高结果的准确性和可靠性。
|
如有疑问，请联系：xuyunlong@xunmee.com
|
||||||
|
|
||||||
### 2. 账号管理和服务运营
|
|
||||||
|
|
||||||
- 账号安全：使用注册信息进行登录验证，并结合设备信息和日志信息进行安全监测，防范账号被盗用和异常登录等风险。
|
|
||||||
- 服务改进：分析使用行为数据，了解用户需求、发现功能缺陷和性能瓶颈，以便持续优化产品体验。
|
|
||||||
|
|
||||||
### 3. 与您沟通和联系
|
|
||||||
|
|
||||||
- 服务通知：通过消息通知等方式发送服务更新、活动公告和版本变更信息。
|
|
||||||
- 用户反馈与客服支持：当您提出咨询、反馈或投诉时，我们可能使用您的联系方式与您沟通，并记录沟通内容用于服务改进。
|
|
||||||
|
|
||||||
## 三、我们如何存储您的个人信息
|
|
||||||
|
|
||||||
### 1. 存储地点
|
|
||||||
|
|
||||||
我们在中华人民共和国境内收集和产生的个人信息将原则上存储于中华人民共和国境内的服务器上。如因业务需要向境外实体提供您的个人信息，我们将依法履行相应程序并确保信息得到充分保护。
|
|
||||||
|
|
||||||
### 2. 存储期限
|
|
||||||
|
|
||||||
我们只会在符合法律要求及实现服务目的所必需的最短时间范围内存储您的个人信息。对于您主动提供且明确同意长期存储的信息（如解卦历史记录），我们会持续保存，除非您主动要求删除或法律法规另有规定。在超出存储期限后，我们会对个人信息进行删除或匿名化处理。
|
|
||||||
|
|
||||||
## 四、我们如何共享您的个人信息
|
|
||||||
|
|
||||||
我们不会与第三方共享您的个人信息，除非存在以下情况：
|
|
||||||
|
|
||||||
1. 获得您的明确同意；
|
|
||||||
2. 与服务提供商合作，且对方仅能在约定范围内处理必要信息，并承担保密与安全义务；
|
|
||||||
3. 法律法规要求，或为保护我们、用户或公众的合法权益所必需；
|
|
||||||
4. 涉及企业收购、合并、重组或破产等情形，在此情况下我们会要求新的持有人继续受本隐私政策约束。
|
|
||||||
|
|
||||||
## 五、您的权利
|
|
||||||
|
|
||||||
1. 访问和更正个人信息：您有权访问并更正您的个人信息。
|
|
||||||
2. 删除个人信息：在法律规定或服务终止等特定场景下，您可以申请删除个人信息。
|
|
||||||
3. 注销账号：您可以申请注销账号。注销是不可逆操作，相关数据和信息可能无法恢复。
|
|
||||||
|
|
||||||
## 六、未成年人保护
|
|
||||||
|
|
||||||
我们非常重视对未成年人个人信息的保护。如果您是未满 14 周岁的未成年人，请在父母或法定监护人的指导下使用服务，并确保事先获得其同意。
|
|
||||||
|
|
||||||
## 七、您的个人信息安全
|
|
||||||
|
|
||||||
我们采取合理的安全措施和技术手段，保护您的个人信息免遭未经授权的访问、公开披露、使用、修改、损坏或丢失，包括但不限于：
|
|
||||||
|
|
||||||
- 加密、匿名化处理等技术措施；
|
|
||||||
- 严格的访问控制和权限管理；
|
|
||||||
- 定期安全审计、监控和应急响应机制。
|
|
||||||
|
|
||||||
## 八、本隐私政策的更新
|
|
||||||
|
|
||||||
我们可能会根据业务发展、法律法规变化或服务调整适时更新本隐私政策。对于重大变更，我们会通过显著方式通知您。
|
|
||||||
|
|
||||||
## 九、如何联系我们
|
|
||||||
|
|
||||||
如果您对本隐私政策有任何疑问、意见或建议，或您在使用 APP 过程中遇到与个人信息相关的问题，您可以通过以下方式联系我们：
|
|
||||||
|
|
||||||
- 联系邮箱：xuyunlong@xunmee.com
|
|
||||||
|
|
||||||
洵觅科技（深圳）有限公司
|
|
||||||
2025 年 6 月 1 日
|
|
||||||
|
|||||||
@@ -1,80 +1,97 @@
|
|||||||
# 服务条款
|
# 服务条款（美国合规版本）
|
||||||
|
|
||||||
## 第一章 总则
|
**最后更新日期**：2026 年 4 月 15 日
|
||||||
|
|
||||||
### 第一条 服务条款的接受
|
## 1. 接受条款
|
||||||
|
|
||||||
1. 欢迎使用觅爻签问 APP（以下简称“觅爻”）。觅爻由洵觅科技（深圳）有限公司开发、运营和维护，旨在为用户提供实际、有趣的解卦体验。
|
觅爻签问（以下简称"本 APP"）由**洵觅科技（深圳）有限公司**（以下简称"我们"、"我们公司"或"我们的"）开发、运营和维护。
|
||||||
2. 用户在使用觅爻服务之前，请务必仔细阅读并充分理解本服务条款。一旦用户通过下载、安装、注册、登录、使用等任一方式开始使用觅爻及其相关服务，即表示用户已充分理解并完全接受本服务条款。
|
|
||||||
3. 如果用户不同意本服务条款的任何内容，或者无法准确理解条款中任何内容，请不要进行后续操作。
|
|
||||||
|
|
||||||
### 第二条 服务条款的变更和修改
|
通过下载、安装、注册、访问或使用本 APP，您（以下简称"您"或"用户"）确认您已阅读、理解并**无条件同意**受这些服务条款（以下简称"条款"）和我们的**隐私政策**约束。如果您不同意，您不得使用本 APP。
|
||||||
|
|
||||||
1. 洵觅科技有权在必要时对本服务条款进行修改和更新，且无须另行单独通知用户。修改后的服务条款一旦在觅爻上公布，即代替原来的服务条款。
|
## 2. 年龄要求与 COPPA 合规
|
||||||
2. 如用户不同意修改内容，用户有权停止使用觅爻及相关服务；若继续使用，则视为已阅读、理解并接受修改后的条款。
|
|
||||||
|
|
||||||
## 第二章 服务说明
|
您声明并保证您使用本 APP 时**年满 13 周岁**。
|
||||||
|
|
||||||
### 第一条 觅爻服务内容
|
- 本 APP**不适用于 13 岁以下儿童**。
|
||||||
|
- 我们不会故意收集 13 岁以下用户的个人信息。如果我们发现 13 岁以下儿童向我们提供了个人数据，我们将立即删除此类信息。
|
||||||
|
|
||||||
觅爻提供基于人工智能技术的解卦服务，包括但不限于手动起卦、自动起卦等功能，内容涵盖卦象含义、运势分析与建议等易学解释。
|
## 3. 服务说明
|
||||||
|
|
||||||
### 第二条 服务的中断与终止
|
本 APP 提供**AI 辅助六爻占卜解读服务**（包括手动和自动起卦流程），基于传统《易经》哲学。
|
||||||
|
|
||||||
1. 因系统维护、检修、升级等造成的合理中断或暂停，不属于洵觅科技违约。
|
- 所有占卜结果和解读均为 **AI 生成，仅供娱乐和参考目的**。
|
||||||
2. 若用户违反本服务条款，洵觅科技有权在不事先通知的情况下终止或中止向用户提供服务。
|
- 它们**不作为专业建议**（金融、法律、医疗、商业或其他）。
|
||||||
3. 如发生不可抗力或超出合理控制范围的事件，导致服务无法正常提供或终止，洵觅科技将在合理范围内尽力减少影响，但不承担间接损失责任。
|
- 我们不保证任何 AI 生成内容的准确性、完整性或可靠性。
|
||||||
|
- 由于维护、技术故障、不可抗力或第三方问题导致的临时服务中断不构成违反本条款。
|
||||||
|
|
||||||
## 第三章 用户账号与信息安全
|
## 4. 用户账户与数据隐私
|
||||||
|
|
||||||
### 第一条 账号注册与使用
|
- 您必须提供**真实、准确和完整的注册信息**并保持更新。
|
||||||
|
- 您有责任维护账户凭证的保密性，并对您账户下的所有活动负责。
|
||||||
|
- 我们按照我们的**隐私政策**收集和处理必要的个人信息，遵守适用的法律，包括**加州消费者隐私法案（CCPA/CPRA）**。
|
||||||
|
- 加州用户有权按照隐私政策的规定访问、删除和选择不出售其个人数据。
|
||||||
|
|
||||||
1. 用户应确保自己具备相应民事行为能力，或已经取得法定代理人同意。
|
## 5. 知识产权
|
||||||
2. 用户在注册过程中应提供真实、准确、完整、有效的信息，并及时更新。
|
|
||||||
3. 用户应妥善保管账号及身份验证信息，不得转让、出租、出借或与他人共享账号。
|
|
||||||
|
|
||||||
### 第二条 信息安全与隐私保护
|
本 APP 内的所有内容——包括软件代码、文本、图像、音频、视频、商标、服务标志和设计——均为洵觅科技（深圳）有限公司的专有财产，受**美国版权法（DMCA）**、商标法和国际条约保护。
|
||||||
|
|
||||||
1. 洵觅科技尊重用户隐私，并按照隐私政策收集、使用和存储用户个人信息。
|
您不得：
|
||||||
2. 洵觅科技采用合理的安全措施和技术手段保护用户信息安全，但任何网络服务都无法保证百分之百安全，用户应自行承担相应风险。
|
|
||||||
3. 未经用户明确同意或法律要求，洵觅科技不会向第三方共享或披露用户个人信息。
|
|
||||||
|
|
||||||
## 第四章 知识产权声明
|
- 复制、修改、分发、传输、展示或创建本 APP 或其内容的衍生作品。
|
||||||
|
- 对本 APP 进行反向工程、反编译、反汇编或尝试提取源代码。
|
||||||
|
- 删除本 APP 上的任何版权、商标或专有通知。
|
||||||
|
|
||||||
1. 觅爻的整体内容，包括但不限于文字、软件、声音、图片、视频、图表，以及相关商标、标识、域名等，均受法律保护。未经书面同意，用户不得复制、使用、修改、出租、出借、出售或传播上述内容。
|
## 6. 禁止的用户行为
|
||||||
2. 严禁通过反向工程、反编译、反汇编、数据截获、调试等方式尝试获取觅爻源代码或底层技术逻辑架构。对于此类行为，洵觅科技将依法追究民事、行政及刑事责任。
|
|
||||||
|
|
||||||
## 第五章 用户行为规范
|
您同意不：
|
||||||
|
|
||||||
### 第一条 禁止的用户行为
|
- 将本 APP 用于**非法、有害、欺诈或侵权活动**。
|
||||||
|
- 发布或传输非法、诽谤、淫秽、威胁或侵犯第三方权利的内容。
|
||||||
|
- 干扰或破坏本 APP 的服务器、网络或安全措施。
|
||||||
|
- 利用任何漏洞进行未经授权的访问或商业使用。
|
||||||
|
- 对本 APP 的占卜结果做出虚假或误导性声明。
|
||||||
|
|
||||||
用户不得：
|
我们保留权利**警告、限制、暂停或终止**违反这些规则的账户，无需事先通知，并可在适当情况下追究法律责任。
|
||||||
|
|
||||||
- 发布或传播违反法律法规的内容；
|
## 7. 免责声明（美国标准）
|
||||||
- 侵犯他人知识产权、名誉权、肖像权、隐私权等合法权益；
|
|
||||||
- 干扰或破坏觅爻服务正常运行；
|
|
||||||
- 利用漏洞牟利、破坏或影响他人正常使用；
|
|
||||||
- 未经书面同意进行销售、广告、推广等商业活动。
|
|
||||||
|
|
||||||
### 第二条 合规使用要求
|
本 APP 和所有服务均按**"原样"和"可用"**提供，不提供任何形式的明示或暗示保证——包括但不限于适销性、适用于特定用途或不侵权的暗示保证。
|
||||||
|
|
||||||
用户应遵守本服务条款以及觅爻内发布的其他规则和公告。对于任何违反行为，洵觅科技有权根据情节采取警告、限制功能、封禁账号等措施，并保留追究法律责任的权利。
|
我们不保证：
|
||||||
|
|
||||||
## 第六章 法律责任与免责条款
|
- 本 APP 将不间断、安全、无错误或准确。
|
||||||
|
- 本 APP 的结果将满足您的期望。
|
||||||
|
- AI 生成的内容可靠或适用于任何目的。
|
||||||
|
|
||||||
1. 若用户违反本服务条款导致洵觅科技或其关联公司遭受损失，用户应承担赔偿责任。
|
## 8. 责任限制
|
||||||
2. 对于用户因依赖解卦结果所作出的任何决策及其后果，洵觅科技不承担责任。解卦结果仅供参考，不能作为实际决策的唯一依据。
|
|
||||||
|
|
||||||
## 第七章 争议解决
|
在法律允许的最大范围内：
|
||||||
|
|
||||||
1. 本服务条款适用中华人民共和国法律。
|
- 在任何情况下，洵觅科技、其董事、员工或关联公司均不对因您使用本 APP 而产生的任何间接、偶然、特殊、后果性或惩罚性损害承担责任。
|
||||||
2. 因本服务条款引起的争议，双方应先友好协商；协商不成的，任何一方均有权向洵觅科技公司注册地有管辖权的人民法院提起诉讼。
|
- 我们对与本 APP 相关的任何索赔的总累积责任不得超过您在过去 12 个月内向我们支付的总额（如有）。
|
||||||
|
|
||||||
## 第八章 其他条款
|
## 9. 赔偿
|
||||||
|
|
||||||
1. 洵觅科技可通过联系方式、系统消息、站内信、公告等方式向用户发送通知，通知视为有效送达。
|
您同意**赔偿并使洵觅科技免受损害**所有索赔、损害、损失和费用（包括法律费用），这些索赔、损害、损失和费用源于：
|
||||||
2. 若用户需要联系洵觅科技，可通过邮箱 xuyunlong@xunmee.com 提交请求或反馈。
|
|
||||||
3. 本服务条款中的任何条款因任何原因无效或不可执行，不影响其余条款的效力。
|
|
||||||
|
|
||||||
洵觅科技（深圳）有限公司
|
- 您违反这些条款。
|
||||||
2025 年 6 月 1 日
|
- 您使用或滥用本 APP。
|
||||||
|
- 您侵犯第三方权利。
|
||||||
|
|
||||||
|
## 10. 适用法律与争议解决
|
||||||
|
|
||||||
|
这些条款受**美国加利福尼亚州法律**管辖，不考虑其法律冲突原则。
|
||||||
|
|
||||||
|
因这些条款引起的任何争议应首先通过真诚协商解决。如果未解决，争议应在位于加利福尼亚州洛杉矶县的**州或联邦法院**解决，您同意此类法院的个人管辖权。
|
||||||
|
|
||||||
|
## 11. 条款的修改
|
||||||
|
|
||||||
|
我们保留权利**随时更新或修改这些条款**。我们将通过应用内通知、电子邮件或突出发布通知用户新的重大变更。生效日期后您继续使用即构成接受修订后的条款。
|
||||||
|
|
||||||
|
## 12. 联系信息
|
||||||
|
|
||||||
|
如需有关这些条款的问题、担忧或通知：
|
||||||
|
|
||||||
|
- **公司名称**：洵觅科技（深圳）有限公司
|
||||||
|
- **联系邮箱**：xuyunlong@xunmee.com
|
||||||
|
- **隐私政策**：[在此插入您的隐私政策 URL]
|
||||||
|
|||||||
@@ -0,0 +1,25 @@
|
|||||||
|
# 關於我們
|
||||||
|
|
||||||
|
歡迎來到覓爻簽問，這是一個借助於 AI 解讀傳統六爻占卜的平台，為用戶了解中國傳統易學文化提供一個窗口。
|
||||||
|
|
||||||
|
六爻占卜源於《周易》深邃的哲學體系，是古人探索世界運行規律的一種獨特方法。古人認為宇宙萬物相互關聯，在你起卦時，你的心念與時空信息會凝結成卦象的方式呈現出來。得到卦象後，再結合《易經》中的爻辭和某些特定規律，如五行生剋、干支冲合等，分析各要素間的發展趨勢，最終推斷出事物可能的走向。
|
||||||
|
|
||||||
|
覓爻簽問就是基於這樣的思路而開發出來的平台，它的核心價值在於幫助你跳出局限思維，從事物全局和演變趨勢的角度看清現狀的矛盾、潛在機會和風險點，為你的判斷和行動提供多一個維度的參考信息，讓你能更理性、更周全地做決定。我們希望 AI 能成為連接這份古老智慧的現代橋樑。
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 公司信息
|
||||||
|
|
||||||
|
**開發者**：洵覓科技（深圳）有限公司
|
||||||
|
|
||||||
|
**聯繫郵箱**：xuyunlong@xunmee.com
|
||||||
|
|
||||||
|
**隱私政策**：[隱私政策連結]
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 免責聲明
|
||||||
|
|
||||||
|
所有卦象解讀結果均由 AI 生成，僅供娛樂和參考，不應用作商業、金融、醫療、法律或其他專業領域的決策依據。我們不對內容的準確性或可靠性做出保證，用戶須對自己所做的任何決策承擔全部責任。
|
||||||
|
|
||||||
|
© 2026 覓爻簽問。保留所有權利。
|
||||||
@@ -0,0 +1,25 @@
|
|||||||
|
# 隱私政策
|
||||||
|
|
||||||
|
**注意：本文檔正在更新中**
|
||||||
|
|
||||||
|
英文正式稿已更新完成，繁體中文版本將在英文稿確認後進行翻譯。
|
||||||
|
|
||||||
|
請參考英文版本：
|
||||||
|
- [English Version](../en/privacy_policy.md)
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
**最後更新日期**：待定
|
||||||
|
|
||||||
|
**生效日期**：待定
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
本文檔將在英文隱私政策正式稿確認後，按照以下原則進行翻譯：
|
||||||
|
|
||||||
|
1. 保持與英文版本結構一致
|
||||||
|
2. 使用標準法律術語
|
||||||
|
3. 保留專業術語（如 CCPA、CPRA 等）
|
||||||
|
4. 符合繁體中文法律文書規範
|
||||||
|
|
||||||
|
如有疑問，請聯繫：xuyunlong@xunmee.com
|
||||||
@@ -0,0 +1,97 @@
|
|||||||
|
# 服務條款（美國合規版本）
|
||||||
|
|
||||||
|
**最後更新日期**：2026 年 4 月 15 日
|
||||||
|
|
||||||
|
## 1. 接受條款
|
||||||
|
|
||||||
|
覓爻簽問（以下簡稱"本 APP"）由**洵覓科技（深圳）有限公司**（以下簡稱"我們"、"我們公司"或"我們的"）開發、運營和維護。
|
||||||
|
|
||||||
|
通過下載、安裝、註冊、訪問或使用本 APP，您（以下簡稱"您"或"用戶"）確認您已閱讀、理解並**無條件同意**受這些服務條款（以下簡稱"條款"）和我們的**隱私政策**約束。如果您不同意，您不得使用本 APP。
|
||||||
|
|
||||||
|
## 2. 年齡要求與 COPPA 合規
|
||||||
|
|
||||||
|
您聲明並保證您使用本 APP 時**年滿 13 週歲**。
|
||||||
|
|
||||||
|
- 本 APP**不適用於 13 歲以下兒童**。
|
||||||
|
- 我們不會故意收集 13 歲以下用戶的個人信息。如果我們發現 13 歲以下兒童向我們提供了個人數據，我們將立即刪除此類信息。
|
||||||
|
|
||||||
|
## 3. 服務說明
|
||||||
|
|
||||||
|
本 APP 提供**AI 輔助六爻占卜解讀服務**（包括手動和自動起卦流程），基於傳統《易經》哲學。
|
||||||
|
|
||||||
|
- 所有占卜結果和解讀均為 **AI 生成，僅供娛樂和參考目的**。
|
||||||
|
- 它們**不作為專業建議**（金融、法律、醫療、商業或其他）。
|
||||||
|
- 我們不保證任何 AI 生成內容的準確性、完整性或可靠性。
|
||||||
|
- 由於維護、技術故障、不可抗力或第三方問題導致的臨時服務中斷不構成違反本條款。
|
||||||
|
|
||||||
|
## 4. 用戶帳戶與數據隱私
|
||||||
|
|
||||||
|
- 您必須提供**真實、準確和完整的註冊信息**並保持更新。
|
||||||
|
- 您有責任維護帳戶憑證的保密性，並對您帳戶下的所有活動負責。
|
||||||
|
- 我們按照我們的**隱私政策**收集和處理必要的個人信息，遵守適用的法律，包括**加州消費者隱私法案（CCPA/CPRA）**。
|
||||||
|
- 加州用戶有權按照隱私政策的規定訪問、刪除和選擇不出售其個人數據。
|
||||||
|
|
||||||
|
## 5. 知識產權
|
||||||
|
|
||||||
|
本 APP 內的所有內容——包括軟體代碼、文本、圖像、音頻、視頻、商標、服務標誌和設計——均為洵覓科技（深圳）有限公司的專有財產，受**美國版權法（DMCA）**、商標法和國際條約保護。
|
||||||
|
|
||||||
|
您不得：
|
||||||
|
|
||||||
|
- 複製、修改、分發、傳輸、展示或創建本 APP 或其內容的衍生作品。
|
||||||
|
- 對本 APP 進行反向工程、反編譯、反彙編或嘗試提取源代碼。
|
||||||
|
- 刪除本 APP 上的任何版權、商標或專有通知。
|
||||||
|
|
||||||
|
## 6. 禁止的用戶行為
|
||||||
|
|
||||||
|
您同意不：
|
||||||
|
|
||||||
|
- 將本 APP 用於**非法、有害、欺詐或侵權活動**。
|
||||||
|
- 發布或傳輸非法、誹謗、淫穢、威脅或侵犯第三方權利的內容。
|
||||||
|
- 干擾或破壞本 APP 的伺服器、網路或安全措施。
|
||||||
|
- 利用任何漏洞進行未經授權的訪問或商業使用。
|
||||||
|
- 對本 APP 的占卜結果做出虛假或誤導性聲明。
|
||||||
|
|
||||||
|
我們保留權利**警告、限制、暫停或終止**違反這些規則的帳戶，無需事先通知，並可在適當情況下追究法律責任。
|
||||||
|
|
||||||
|
## 7. 免責聲明（美國標準）
|
||||||
|
|
||||||
|
本 APP 和所有服務均按**"原樣"和"可用"**提供，不提供任何形式的明示或暗示保證——包括但不限於適銷性、適用於特定用途或不侵權的暗示保證。
|
||||||
|
|
||||||
|
我們不保證：
|
||||||
|
|
||||||
|
- 本 APP 將不間斷、安全、無錯誤或準確。
|
||||||
|
- 本 APP 的結果將滿足您的期望。
|
||||||
|
- AI 生成內容可靠或適用於任何目的。
|
||||||
|
|
||||||
|
## 8. 責任限制
|
||||||
|
|
||||||
|
在法律允許的最大範圍內：
|
||||||
|
|
||||||
|
- 在任何情況下，洵覓科技、其董事、員工或關聯公司均不對因您使用本 APP 而產生的任何間接、偶然、特殊、後果性或懲罰性損害承擔責任。
|
||||||
|
- 我們對與本 APP 相關的任何索賠的總累積責任不得超過您在過去 12 個月內向我們支付的總額（如有）。
|
||||||
|
|
||||||
|
## 9. 賠償
|
||||||
|
|
||||||
|
您同意**賠償並使洵覓科技免受損害**所有索賠、損害、損失和費用（包括法律費用），這些索賠、損害、損失和費用源於：
|
||||||
|
|
||||||
|
- 您違反這些條款。
|
||||||
|
- 您使用或濫用本 APP。
|
||||||
|
- 您侵犯第三方權利。
|
||||||
|
|
||||||
|
## 10. 適用法律與爭議解決
|
||||||
|
|
||||||
|
這些條款受**美國加利福尼亞州法律**管轄，不考慮其法律衝突原則。
|
||||||
|
|
||||||
|
因這些條款引起的任何爭議應首先通過誠信協商解決。如果未解決，爭議應在位於加利福尼亞州洛杉磯縣的**州或聯邦法院**解決，您同意此類法院的個人管轄權。
|
||||||
|
|
||||||
|
## 11. 條款的修改
|
||||||
|
|
||||||
|
我們保留權利**隨時更新或修改這些條款**。我們將通過應用內通知、電子郵件或突出發布通知用戶新的重大變更。生效日期後您繼續使用即構成接受修訂後的條款。
|
||||||
|
|
||||||
|
## 12. 聯繫信息
|
||||||
|
|
||||||
|
如需有關這些條款的問題、擔憂或通知：
|
||||||
|
|
||||||
|
- **公司名稱**：洵覓科技（深圳）有限公司
|
||||||
|
- **聯繫郵箱**：xuyunlong@xunmee.com
|
||||||
|
- **隱私政策**：[在此插入您的隱私政策 URL]
|
||||||
@@ -12,7 +12,11 @@ IconData legalDocumentIcon(LegalDocumentType type) {
|
|||||||
}
|
}
|
||||||
|
|
||||||
String legalDocumentAssetPath(Locale locale, LegalDocumentType type) {
|
String legalDocumentAssetPath(Locale locale, LegalDocumentType type) {
|
||||||
final localeFolder = locale.languageCode == 'en' ? 'en' : 'zh';
|
final localeFolder = switch (locale.toString()) {
|
||||||
|
'en' => 'en',
|
||||||
|
'zh_Hant' => 'zh_Hant',
|
||||||
|
_ => 'zh',
|
||||||
|
};
|
||||||
final fileName = switch (type) {
|
final fileName = switch (type) {
|
||||||
LegalDocumentType.aboutUs => 'about_us.md',
|
LegalDocumentType.aboutUs => 'about_us.md',
|
||||||
LegalDocumentType.privacyPolicy => 'privacy_policy.md',
|
LegalDocumentType.privacyPolicy => 'privacy_policy.md',
|
||||||
|
|||||||
@@ -0,0 +1,512 @@
|
|||||||
|
# COPPA 儿童保护与数据安全措施实施方案
|
||||||
|
|
||||||
|
**文档状态**: 草案
|
||||||
|
**创建日期**: 2026-04-17
|
||||||
|
**关联文档**: `docs/discussions/legal-compliance-us.md` 第七点、第八点
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 一、背景与法律要求
|
||||||
|
|
||||||
|
### 1.1 COPPA（儿童在线隐私保护法）要求
|
||||||
|
|
||||||
|
针对 13 岁以下用户，COPPA 要求：
|
||||||
|
|
||||||
|
1. **年龄验证**：必须采取合理措施验证用户年龄
|
||||||
|
2. **禁止收集**：不得收集 13 岁以下儿童个人信息
|
||||||
|
3. **隐私政策披露**：隐私政策必须明确说明不面向 13 岁以下用户
|
||||||
|
|
||||||
|
### 1.2 CCPA/CPRA 数据安全要求
|
||||||
|
|
||||||
|
针对数据安全措施，隐私政策声明的安全措施必须真实实施：
|
||||||
|
|
||||||
|
1. **加密措施**：AES-256 数据加密、TLS 1.3 传输加密
|
||||||
|
2. **访问控制**：基于角色的访问控制（RBAC）
|
||||||
|
3. **监控审计**：审计日志
|
||||||
|
4. **泄露响应**：72 小时内通知机制
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 二、当前系统现状分析
|
||||||
|
|
||||||
|
### 2.1 用户认证流程
|
||||||
|
|
||||||
|
**现有实现**：
|
||||||
|
- 认证方式：邮箱 + OTP（验证码）登录
|
||||||
|
- 认证提供方：Supabase Auth
|
||||||
|
- 用户表：`auth.users`（Supabase 内置）
|
||||||
|
- 扩展表：`public.profiles`
|
||||||
|
|
||||||
|
**缺失项**：
|
||||||
|
- ❌ 无年龄验证机制
|
||||||
|
|
||||||
|
### 2.2 数据安全现状
|
||||||
|
|
||||||
|
**已有措施**：
|
||||||
|
- ✅ Supabase Auth 内置 JWT 认证（HS256 签名）
|
||||||
|
- ✅ 数据库 RLS（Row Level Security）策略 - `anon`/`authenticated` 角色被禁止访问业务表
|
||||||
|
- ✅ 日志敏感字段过滤（`core/config/settings.py` 的 `log_sensitive_fields`）
|
||||||
|
- ✅ 软删除机制（`SoftDeleteMixin`）
|
||||||
|
- ✅ 环境变量管理敏感配置
|
||||||
|
- ✅ Supabase 托管服务默认启用 HTTPS + 数据库加密
|
||||||
|
|
||||||
|
**Supabase 安全特性**：
|
||||||
|
- 传输加密：所有 API 请求强制 HTTPS
|
||||||
|
- 静态数据加密：PostgreSQL 透明数据加密（TDE）
|
||||||
|
- 密码哈希：bcrypt 自动处理
|
||||||
|
- JWT 签名：HS256 算法
|
||||||
|
- RLS 策略：细粒度行级访问控制
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 三、第七点：COPPA 儿童保护实施方案
|
||||||
|
|
||||||
|
### 3.1 年龄验证机制
|
||||||
|
|
||||||
|
**重要澄清：Apple 没有直接的年龄验证 API**
|
||||||
|
|
||||||
|
Apple 不提供可以获取用户具体年龄的 API。Apple 的年龄保护机制是通过以下方式实现的：
|
||||||
|
|
||||||
|
#### 方案一：App Store 年龄分级（推荐 - 主要防护）
|
||||||
|
|
||||||
|
**原理**：在 App Store Connect 中设置年龄分级，App Store 会自动阻止不符合年龄要求的用户下载。
|
||||||
|
|
||||||
|
**实施步骤**：
|
||||||
|
|
||||||
|
1. **登录 App Store Connect**
|
||||||
|
2. **选择应用 → "App 信息" → "年龄分级"**
|
||||||
|
3. **填写年龄分级问卷**
|
||||||
|
4. **设置年龄分级为 12+（或更高）**
|
||||||
|
|
||||||
|
**年龄分级说明**：
|
||||||
|
- **4+**：无 objectionable 内容
|
||||||
|
- **9+**：可能包含轻微的卡通暴力/幻想暴力
|
||||||
|
- **12+**：可能包含轻微的现实暴力/偶尔粗俗幽默/轻微模拟赌博
|
||||||
|
- **17+**：可能包含频繁/强烈的现实暴力/成人内容
|
||||||
|
|
||||||
|
**设置 12+ 的效果**：
|
||||||
|
- App Store 会阻止 12 岁以下用户下载应用
|
||||||
|
- 家长控制功能会根据年龄分级限制儿童访问
|
||||||
|
|
||||||
|
**优点**：
|
||||||
|
- ✅ 零成本，无需开发
|
||||||
|
- ✅ Apple 系统级保护
|
||||||
|
- ✅ 自动生效
|
||||||
|
|
||||||
|
**缺点**：
|
||||||
|
- ⚠️ 仅防止下载，不能防止借用他人设备/账号
|
||||||
|
- ⚠️ 用户可能谎报年龄注册 Apple ID
|
||||||
|
|
||||||
|
#### 方案二：应用内年龄声明（推荐 - 辅助防护）
|
||||||
|
|
||||||
|
**原理**：在注册流程中添加年龄确认 checkbox 或弹窗。
|
||||||
|
|
||||||
|
**实施步骤**：
|
||||||
|
|
||||||
|
1. **前端修改**：
|
||||||
|
|
||||||
|
```dart
|
||||||
|
// apps/lib/features/auth/presentation/screens/login_screen.dart
|
||||||
|
|
||||||
|
// 在登录界面添加年龄确认 checkbox
|
||||||
|
Row(
|
||||||
|
children: [
|
||||||
|
Checkbox(
|
||||||
|
value: _ageConfirmed,
|
||||||
|
onChanged: (value) {
|
||||||
|
setState(() {
|
||||||
|
_ageConfirmed = value ?? false;
|
||||||
|
});
|
||||||
|
},
|
||||||
|
),
|
||||||
|
Expanded(
|
||||||
|
child: Text(
|
||||||
|
l10n.ageConfirmationText, // "我已年满 13 岁"
|
||||||
|
style: Theme.of(context).textTheme.bodySmall,
|
||||||
|
),
|
||||||
|
),
|
||||||
|
],
|
||||||
|
),
|
||||||
|
```
|
||||||
|
|
||||||
|
2. **后端验证**：
|
||||||
|
|
||||||
|
```python
|
||||||
|
# backend/src/v1/auth/schemas.py
|
||||||
|
|
||||||
|
class EmailSessionCreateRequest(BaseModel):
|
||||||
|
model_config = ConfigDict(extra="forbid")
|
||||||
|
|
||||||
|
email: str = Field(pattern=SUPABASE_EMAIL_PATTERN)
|
||||||
|
token: str = Field(min_length=6, max_length=6)
|
||||||
|
age_confirmed: bool = Field(
|
||||||
|
default=False,
|
||||||
|
description="用户确认年满 13 岁"
|
||||||
|
)
|
||||||
|
```
|
||||||
|
|
||||||
|
```python
|
||||||
|
# backend/src/v1/auth/service.py
|
||||||
|
|
||||||
|
async def create_email_session(
|
||||||
|
self, request: EmailSessionCreateRequest
|
||||||
|
) -> SessionResponse:
|
||||||
|
if not request.age_confirmed:
|
||||||
|
raise AgeConfirmationRequiredError(
|
||||||
|
detail="User must confirm age 13 or older to register"
|
||||||
|
)
|
||||||
|
|
||||||
|
return await self._gateway.create_email_session(request)
|
||||||
|
```
|
||||||
|
|
||||||
|
3. **数据库记录**：
|
||||||
|
|
||||||
|
```sql
|
||||||
|
-- 在 profiles 表添加年龄确认字段
|
||||||
|
ALTER TABLE profiles
|
||||||
|
ADD COLUMN age_confirmed_at timestamptz,
|
||||||
|
ADD COLUMN age_confirmation_method varchar(20) DEFAULT 'self_declaration';
|
||||||
|
```
|
||||||
|
|
||||||
|
4. **本地化文本**：
|
||||||
|
|
||||||
|
```json
|
||||||
|
// apps/lib/l10n/app_zh.arb
|
||||||
|
{
|
||||||
|
"ageConfirmationText": "我确认已年满 13 岁，或已获得家长/监护人同意使用本应用",
|
||||||
|
"@ageConfirmationText": {
|
||||||
|
"description": "年龄确认声明文本"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
```json
|
||||||
|
// apps/lib/l10n/app_en.arb
|
||||||
|
{
|
||||||
|
"ageConfirmationText": "I confirm that I am 13 years of age or older, or have parental/guardian consent to use this app"
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
**优点**：
|
||||||
|
- ✅ 实现简单
|
||||||
|
- ✅ 满足 COPPA 最低合规要求
|
||||||
|
- ✅ 记录用户确认时间和方式
|
||||||
|
|
||||||
|
**缺点**：
|
||||||
|
- ⚠️ 依赖用户自我声明
|
||||||
|
- ⚠️ 用户可能撒谎
|
||||||
|
|
||||||
|
#### 推荐方案：App Store 年龄分级 + 应用内年龄声明
|
||||||
|
|
||||||
|
**组合使用**：
|
||||||
|
1. **App Store 年龄分级设置为 12+**（主要防护）
|
||||||
|
2. **应用内注册时要求年龄确认**（辅助防护 + 合规记录）
|
||||||
|
|
||||||
|
**理由**：
|
||||||
|
- App Store 分级阻止儿童下载（系统级保护）
|
||||||
|
- 应用内确认作为法律合规证据（用户明确声明）
|
||||||
|
- 双重保护，满足 COPPA 要求
|
||||||
|
|
||||||
|
### 3.2 隐私政策更新
|
||||||
|
|
||||||
|
**需要添加的内容**：
|
||||||
|
|
||||||
|
```markdown
|
||||||
|
## 儿童隐私保护
|
||||||
|
|
||||||
|
本应用不面向 13 岁以下儿童。
|
||||||
|
|
||||||
|
**年龄限制**：
|
||||||
|
- 您必须年满 13 岁才能使用本应用
|
||||||
|
- 本应用在 App Store 的年龄分级为 12+，系统会阻止 12 岁以下用户下载
|
||||||
|
- 注册时，您需要确认年满 13 岁
|
||||||
|
|
||||||
|
**数据收集**：
|
||||||
|
- 我们不会故意收集 13 岁以下儿童的个人信息
|
||||||
|
- 如果我们发现在未经许可的情况下收集了儿童的个人信息，我们将采取措施删除相关信息
|
||||||
|
|
||||||
|
**联系我们**：
|
||||||
|
如果您认为我们可能收集了儿童的个人信息，请联系 privacy@xunmee.com。
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 四、第八点：数据安全措施实施方案
|
||||||
|
|
||||||
|
### 4.1 加密措施
|
||||||
|
|
||||||
|
#### 4.1.1 传输加密（TLS）
|
||||||
|
|
||||||
|
**当前状态**：✅ 已满足
|
||||||
|
|
||||||
|
- Supabase 托管服务默认强制 HTTPS
|
||||||
|
- 所有 API 请求使用 TLS 1.2/1.3 加密
|
||||||
|
- 无需额外配置
|
||||||
|
|
||||||
|
**验证方式**：
|
||||||
|
- 使用 SSL Labs 测试：https://www.ssllabs.com/ssltest/
|
||||||
|
- 目标评级：A 或 A+
|
||||||
|
|
||||||
|
#### 4.1.2 静态数据加密（AES-256）
|
||||||
|
|
||||||
|
**当前状态**：✅ 已满足
|
||||||
|
|
||||||
|
- Supabase PostgreSQL 默认启用透明数据加密（TDE）
|
||||||
|
- Supabase Storage 默认启用服务端加密
|
||||||
|
- 无需额外配置
|
||||||
|
|
||||||
|
**用户输入是否需要加密字段存储？**
|
||||||
|
|
||||||
|
**回答：不需要**
|
||||||
|
|
||||||
|
理由：
|
||||||
|
1. **当前数据类型不敏感**：
|
||||||
|
- 用户输入主要是占卜问题、起卦数据
|
||||||
|
- 不涉及身份证、信用卡、医疗健康等高敏感信息
|
||||||
|
- 数据库已有 RLS 保护，只有 `service_role` 可访问
|
||||||
|
|
||||||
|
2. **加密成本**：
|
||||||
|
- 应用层加密会增加查询复杂度（无法索引、无法搜索）
|
||||||
|
- 增加开发和维护成本
|
||||||
|
- 性能开销
|
||||||
|
|
||||||
|
3. **已有保护措施**：
|
||||||
|
- 数据库 TDE（透明数据加密）
|
||||||
|
- RLS 策略
|
||||||
|
- JWT 认证
|
||||||
|
- 传输加密
|
||||||
|
|
||||||
|
### 4.2 访问控制
|
||||||
|
|
||||||
|
#### 4.2.1 基于角色的访问控制（RBAC）
|
||||||
|
|
||||||
|
**当前实现**：✅ 已满足
|
||||||
|
|
||||||
|
- 数据库 RLS 策略：`anon`/`authenticated` 角色被禁止访问业务表
|
||||||
|
- 后端 Service 层强制校验 `owner_id`
|
||||||
|
- 只有 `service_role` 可以访问业务数据
|
||||||
|
|
||||||
|
**RLS 策略示例**（来自 `20260411_0001_initial_llm_schema.py`）：
|
||||||
|
```sql
|
||||||
|
-- 所有业务表启用 RLS
|
||||||
|
ALTER TABLE table_name ENABLE ROW LEVEL SECURITY;
|
||||||
|
|
||||||
|
-- 禁止 anon 和 authenticated 角色访问
|
||||||
|
CREATE POLICY anon_select_table_name ON table_name
|
||||||
|
FOR SELECT TO anon USING (false);
|
||||||
|
|
||||||
|
CREATE POLICY authenticated_select_table_name ON table_name
|
||||||
|
FOR SELECT TO authenticated USING (false);
|
||||||
|
|
||||||
|
-- 只有 service_role 可以访问（后端使用 service_role key）
|
||||||
|
```
|
||||||
|
|
||||||
|
#### 4.2.2 Supabase 是否拒绝匿名用户登录？
|
||||||
|
|
||||||
|
**回答：是的**
|
||||||
|
|
||||||
|
- Supabase Auth 默认要求认证
|
||||||
|
- 未登录用户只有 `anon` 角色
|
||||||
|
- RLS 策略禁止 `anon` 角色访问业务表
|
||||||
|
- 后端 API 依赖 JWT 验证用户身份
|
||||||
|
|
||||||
|
**验证流程**：
|
||||||
|
```python
|
||||||
|
# backend/src/v1/auth/dependencies.py
|
||||||
|
|
||||||
|
async def get_current_user(
|
||||||
|
authorization: str | None = Header(default=None)
|
||||||
|
) -> AuthUser:
|
||||||
|
if not authorization:
|
||||||
|
raise UnauthenticatedError() # 拒绝匿名访问
|
||||||
|
|
||||||
|
# 验证 JWT
|
||||||
|
user = await verify_jwt(authorization)
|
||||||
|
return user
|
||||||
|
```
|
||||||
|
|
||||||
|
### 4.3 审计日志
|
||||||
|
|
||||||
|
#### 4.3.1 当前 points_audit_ledger 是否满足要求？
|
||||||
|
|
||||||
|
**回答：部分满足**
|
||||||
|
|
||||||
|
**points_audit_ledger 现状**：
|
||||||
|
- ✅ 记录积分变更审计
|
||||||
|
- ✅ 包含 `user_id_snapshot`、`user_email_snapshot`
|
||||||
|
- ✅ 包含 `event_id`、`change_type`、`amount`
|
||||||
|
- ✅ 包含时间戳 `created_at`
|
||||||
|
- ❌ 只记录积分相关操作，不记录其他操作
|
||||||
|
|
||||||
|
**不满足的审计需求**：
|
||||||
|
- ❌ 用户登录/登出
|
||||||
|
- ❌ 账户删除
|
||||||
|
- ❌ 个人信息修改
|
||||||
|
- ❌ 数据导出请求
|
||||||
|
|
||||||
|
**建议：扩展审计日志系统**
|
||||||
|
|
||||||
|
```sql
|
||||||
|
-- 创建通用审计日志表
|
||||||
|
CREATE TABLE audit_logs (
|
||||||
|
id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
|
||||||
|
user_id uuid REFERENCES auth.users(id) ON DELETE SET NULL,
|
||||||
|
action varchar(50) NOT NULL,
|
||||||
|
resource_type varchar(50) NOT NULL,
|
||||||
|
resource_id uuid,
|
||||||
|
old_values jsonb,
|
||||||
|
new_values jsonb,
|
||||||
|
ip_address inet,
|
||||||
|
user_agent text,
|
||||||
|
created_at timestamptz NOT NULL DEFAULT now()
|
||||||
|
);
|
||||||
|
|
||||||
|
CREATE INDEX ix_audit_logs_user_id ON audit_logs(user_id);
|
||||||
|
CREATE INDEX ix_audit_logs_action ON audit_logs(action);
|
||||||
|
CREATE INDEX ix_audit_logs_created_at ON audit_logs(created_at);
|
||||||
|
|
||||||
|
COMMENT ON TABLE audit_logs IS '通用审计日志：记录用户关键操作';
|
||||||
|
```
|
||||||
|
|
||||||
|
**审计事件类型**：
|
||||||
|
```python
|
||||||
|
# backend/src/core/audit/events.py
|
||||||
|
|
||||||
|
class AuditAction(str, Enum):
|
||||||
|
# 认证相关
|
||||||
|
USER_LOGIN = "user.login"
|
||||||
|
USER_LOGOUT = "user.logout"
|
||||||
|
USER_DELETE = "user.delete"
|
||||||
|
|
||||||
|
# 数据操作
|
||||||
|
PROFILE_UPDATE = "profile.update"
|
||||||
|
DATA_EXPORT = "data.export"
|
||||||
|
|
||||||
|
# 积分相关（已有 points_audit_ledger）
|
||||||
|
POINTS_CHANGE = "points.change"
|
||||||
|
```
|
||||||
|
|
||||||
|
**实施优先级**：
|
||||||
|
- P1：创建 `audit_logs` 表
|
||||||
|
- P2：记录用户登录/登出
|
||||||
|
- P3：记录账户删除
|
||||||
|
- P4：记录个人信息修改
|
||||||
|
|
||||||
|
### 4.4 数据泄露响应
|
||||||
|
|
||||||
|
#### 4.4.1 响应流程文档
|
||||||
|
|
||||||
|
**文档位置**：`docs/security/incident-response.md`
|
||||||
|
|
||||||
|
**响应时间线**：
|
||||||
|
|
||||||
|
| 阶段 | 时间 | 行动 |
|
||||||
|
|------|------|------|
|
||||||
|
| 发现 | T+0 | 确认泄露范围和影响 |
|
||||||
|
| 评估 | T+1h | 确定严重等级（低/中/高/严重）|
|
||||||
|
| 控制 | T+4h | 阻止泄露继续，保留证据 |
|
||||||
|
| 通知 | T+72h | 通知受影响用户（法律要求）|
|
||||||
|
| 修复 | T+7d | 修复漏洞，加强防护 |
|
||||||
|
| 复盘 | T+14d | 总结经验，更新流程 |
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 五、实施优先级与时间线
|
||||||
|
|
||||||
|
### 5.1 优先级矩阵
|
||||||
|
|
||||||
|
| 优先级 | 项目 | 预计工时 | 合规必要性 | 状态 |
|
||||||
|
|--------|------|----------|------------|------|
|
||||||
|
| P0 | App Store 年龄分级设置 | 0.5 天 | 必须 | 待实施 |
|
||||||
|
| P0 | 隐私政策更新 | 0.5 天 | 必须 | 待实施 |
|
||||||
|
| P1 | 应用内年龄确认 | 1-2 天 | 必须 | 待实施 |
|
||||||
|
| P2 | 通用审计日志表 | 2 天 | 推荐 | 待实施 |
|
||||||
|
| P3 | 泄露响应流程文档 | 1 天 | 推荐 | 待实施 |
|
||||||
|
|
||||||
|
### 5.2 MVP 上线前必须完成
|
||||||
|
|
||||||
|
1. ✅ App Store 年龄分级设置为 12+
|
||||||
|
2. ✅ 隐私政策更新（添加儿童隐私章节）
|
||||||
|
3. ✅ 应用内年龄确认（checkbox + 后端记录）
|
||||||
|
|
||||||
|
### 5.3 上线后 3 个月内完成
|
||||||
|
|
||||||
|
1. 通用审计日志系统
|
||||||
|
2. 泄露响应流程文档
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 六、验收标准
|
||||||
|
|
||||||
|
### 6.1 COPPA 合规
|
||||||
|
|
||||||
|
- [ ] App Store 年龄分级设置为 12+（或更高）
|
||||||
|
- [ ] 应用内注册时要求年龄确认
|
||||||
|
- [ ] 后端记录年龄确认时间和方式
|
||||||
|
- [ ] 隐私政策明确说明不面向 13 岁以下用户
|
||||||
|
|
||||||
|
### 6.2 数据安全
|
||||||
|
|
||||||
|
- [ ] 所有 API 强制 HTTPS（Supabase 默认）
|
||||||
|
- [ ] SSL Labs 评级 A 或以上
|
||||||
|
- [ ] 数据库 RLS 策略正确配置
|
||||||
|
- [ ] 审计日志记录关键操作
|
||||||
|
- [ ] 有书面泄露响应流程
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 七、关键决策记录
|
||||||
|
|
||||||
|
### 7.1 年龄验证方案
|
||||||
|
|
||||||
|
**决策**：App Store 年龄分级 + 应用内年龄声明
|
||||||
|
|
||||||
|
**理由**：
|
||||||
|
1. Apple 没有直接的年龄验证 API
|
||||||
|
2. App Store 年龄分级（12+）可阻止儿童下载（系统级保护）
|
||||||
|
3. 应用内年龄确认作为法律合规证据
|
||||||
|
4. 零额外成本
|
||||||
|
|
||||||
|
**实施方式**：
|
||||||
|
- **主要防护**：App Store Connect 设置年龄分级为 12+
|
||||||
|
- **辅助防护**：注册时 checkbox 确认年满 13 岁 + 后端记录
|
||||||
|
|
||||||
|
### 7.2 数据加密
|
||||||
|
|
||||||
|
**决策**：依赖 Supabase 默认加密，不额外应用层加密
|
||||||
|
|
||||||
|
**理由**：
|
||||||
|
1. 当前数据类型不敏感（占卜问题、起卦数据）
|
||||||
|
2. Supabase 已提供 TDE + HTTPS
|
||||||
|
3. 应用层加密成本高、收益低
|
||||||
|
|
||||||
|
### 7.3 审计日志
|
||||||
|
|
||||||
|
**决策**：扩展通用审计日志表
|
||||||
|
|
||||||
|
**理由**：
|
||||||
|
1. `points_audit_ledger` 只记录积分变更
|
||||||
|
2. 需要记录用户登录、删除等操作
|
||||||
|
3. 满足 CCPA/CPRA 审计要求
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 八、参考资源
|
||||||
|
|
||||||
|
### 8.1 法律法规
|
||||||
|
|
||||||
|
- [COPPA 官方指南](https://www.ftc.gov/business-guidance/privacy-security/childrens-privacy)
|
||||||
|
- [CCPA 官方文本](https://oag.ca.gov/privacy/ccpa)
|
||||||
|
|
||||||
|
### 8.2 技术参考
|
||||||
|
|
||||||
|
- [App Store 年龄分级](https://developer.apple.com/help/app-store-connect/reference/age-ratings/)
|
||||||
|
- [Supabase Auth 文档](https://supabase.com/docs/guides/auth)
|
||||||
|
- [Supabase RLS 文档](https://supabase.com/docs/guides/auth/row-level-security)
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
**下一步行动**：
|
||||||
|
1. 在 App Store Connect 设置年龄分级为 12+
|
||||||
|
2. 更新隐私政策文档
|
||||||
|
3. 实现应用内年龄确认（前端 checkbox + 后端记录）
|
||||||
@@ -0,0 +1,500 @@
|
|||||||
|
# 美国合规法律文档讨论记录
|
||||||
|
|
||||||
|
**文档来源**: 飞书文档 [About us、Privacy Policy、Terms of Service](https://uidqlzahr8w.feishu.cn/wiki/As6AwJRImilu4Lk0lNtcrbmXnOc)
|
||||||
|
|
||||||
|
**更新日期**: 2026-04-17
|
||||||
|
|
||||||
|
**状态**: 待确认
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 一、数据收集相关
|
||||||
|
|
||||||
|
### 1.1 "globally" 措辞问题
|
||||||
|
|
||||||
|
**评论位置**: Privacy Policy - Introduction
|
||||||
|
|
||||||
|
**问题描述**: 文档中使用了 "globally" 措辞，可能涉及欧盟 GDPR 合规问题
|
||||||
|
|
||||||
|
**待确认**:
|
||||||
|
- [ ] 是否需要同时支持 GDPR 合规？
|
||||||
|
- [ ] 如果只针对美国市场，是否应该移除 "globally" 措辞？
|
||||||
|
- [ ] 是否需要为欧盟用户单独准备一份 GDPR 合规的隐私政策？
|
||||||
|
|
||||||
|
**决策**:
|
||||||
|
✅ 确认只针对美国市场，已移除 "globally" 措辞。欧盟暂不支持，后续如需支持将单独准备 GDPR 合规的隐私政策。
|
||||||
|
|
||||||
|
**负责人**:
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
### 1.2 占卜数据作为敏感信息
|
||||||
|
|
||||||
|
**评论位置**: Privacy Policy - Information We Collect - 1.1
|
||||||
|
|
||||||
|
**问题描述**: 占卜输入输出被标记为 CCPA/CPRA 下的敏感个人信息（Sensitive Personal Information, SPI）
|
||||||
|
|
||||||
|
**待确认**:
|
||||||
|
- [ ] 占卜数据归类为 SPI 是否正确？
|
||||||
|
- [ ] 归类为 SPI 有什么风险和合规要求？
|
||||||
|
- [ ] 是否需要在用户使用前明确告知并获取同意？
|
||||||
|
- [ ] SPI 数据的处理、存储、删除是否有特殊要求？
|
||||||
|
|
||||||
|
**决策**:
|
||||||
|
✅ 占卜数据理论上符合 CCPA/CPRA 中"哲学信念或思想活动"的 SPI 定义，但从合规和实用角度，**不建议将其标记为 SPI**。
|
||||||
|
- 占卜属于娱乐性质，不涉及健康、金融等专业领域
|
||||||
|
- 标记为 SPI 会增加用户限制使用 SPI 数据的权利请求，增加合规负担
|
||||||
|
- 行业主流做法（如 ChatGPT、Character AI）不将此类内容标记为 SPI
|
||||||
|
|
||||||
|
**已更新**: 从所有语言版本的隐私政策中移除对占卜数据作为 SPI 的标记。
|
||||||
|
|
||||||
|
**负责人**:
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
### 1.3 数据收集范围完整性
|
||||||
|
|
||||||
|
**评论位置**: Privacy Policy - Information We Collect
|
||||||
|
|
||||||
|
**问题描述**: 需要确认文档中列出的数据收集范围是否完整
|
||||||
|
|
||||||
|
**待确认**:
|
||||||
|
- [ ] 账户信息：邮箱、验证码 - 是否完整？
|
||||||
|
- [ ] 设备标识符：IDFA、AAID、UDID、MAC 地址 - 是否都有收集？
|
||||||
|
- [ ] 技术数据：IP、时间戳、崩溃日志 - 是否完整？
|
||||||
|
- [ ] 使用数据：功能访问、占卜频率、会话时长 - 是否有收集？
|
||||||
|
- [ ] 是否还有其他收集的数据未列出？
|
||||||
|
|
||||||
|
**决策**:
|
||||||
|
✅ 根据代码分析和规划，已更新数据收集范围：
|
||||||
|
|
||||||
|
**目前已收集**：
|
||||||
|
- 账户信息：邮箱、验证码、refresh_token
|
||||||
|
- 占卜数据：问题、起卦数据（YaoType 数组）、device_timezone
|
||||||
|
- 设备信息：设备型号、OS 版本
|
||||||
|
- 技术数据：访问时间戳、会话历史
|
||||||
|
- **使用数据**：占卜频率、会话时长（后端采集）
|
||||||
|
|
||||||
|
**未来将接入（已保留在文档中）**：
|
||||||
|
- ✅ AppsFlyer（归因和营销分析）
|
||||||
|
- ✅ SKAdNetwork（苹果归因）
|
||||||
|
|
||||||
|
**未收集且暂无计划（已从文档移除）**：
|
||||||
|
- ❌ 设备标识符：IDFA、AAID、UDID、MAC 地址（会通过 AppsFlyer 间接收集）
|
||||||
|
- ❌ 技术数据：IP 地址、崩溃日志
|
||||||
|
- ❌ Analytics：Firebase Analytics、Google Analytics
|
||||||
|
- ❌ 崩溃报告：Crashlytics
|
||||||
|
- ❌ 推送通知：FCM、APNs（目前不使用推送）
|
||||||
|
|
||||||
|
**已更新**: 保留未来会接入的 SDK 和功能，移除目前没有且暂无计划的服务。
|
||||||
|
|
||||||
|
**负责人**: 志良
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 二、数据存储与跨境传输
|
||||||
|
|
||||||
|
### 2.1 云服务商与服务器位置
|
||||||
|
|
||||||
|
**评论位置**: Privacy Policy - Data Storage, Retention & Cross-Border Transfers - 3.1
|
||||||
|
|
||||||
|
**问题描述**: 需要确认实际使用的云服务商和服务器位置
|
||||||
|
|
||||||
|
**待确认**:
|
||||||
|
- [ ] 实际使用什么云服务商？（AWS / 阿里云 / 其他）
|
||||||
|
- [ ] 服务器是否在美国？
|
||||||
|
- [ ] 是否有数据传输到中国？
|
||||||
|
- [ ] 管理员从中国访问美国服务器上的数据，是否算跨境传输？
|
||||||
|
- [ ] 如果使用阿里云，在美国应用商店是否会被歧视？
|
||||||
|
|
||||||
|
**决策**:
|
||||||
|
|
||||||
|
**负责人**: 志良
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
### 2.2 跨境传输安全
|
||||||
|
|
||||||
|
**评论位置**: Privacy Policy - Data Storage, Retention & Cross-Border Transfers
|
||||||
|
|
||||||
|
**问题描述**: 如何解决跨境传输安全问题
|
||||||
|
|
||||||
|
**待确认**:
|
||||||
|
- [ ] 是否存在跨境传输场景？
|
||||||
|
- [ ] 如果存在，使用什么加密协议？（文档声称 AES-256 + TLS 1.3）
|
||||||
|
- [ ] 是否符合美国数据保护法律要求？
|
||||||
|
- [ ] 是否需要在美国隐私政策中披露跨境传输？
|
||||||
|
|
||||||
|
**决策**:
|
||||||
|
|
||||||
|
**负责人**:
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 三、数据保留策略
|
||||||
|
|
||||||
|
### 3.1 账户删除后 90 天留存
|
||||||
|
|
||||||
|
**评论位置**: Privacy Policy - Data Storage, Retention & Cross-Border Transfers - 3.2
|
||||||
|
|
||||||
|
**问题描述**: 账户删除后数据保留 90 天是否合规
|
||||||
|
|
||||||
|
**待确认**:
|
||||||
|
- [ ] CCPA/CPRA 对删除后留存时间的要求是什么？
|
||||||
|
- [ ] 90 天留存是否符合法律要求？
|
||||||
|
- [ ] 留存 90 天的目的是什么？（法律义务？安全审计？）
|
||||||
|
- [ ] 是否应该改为立即删除或更短时间？
|
||||||
|
|
||||||
|
**决策**:
|
||||||
|
|
||||||
|
**负责人**:
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
### 3.2 占卜记录 12 个月留存
|
||||||
|
|
||||||
|
**评论位置**: Privacy Policy - Data Storage, Retention & Cross-Border Transfers - 3.2
|
||||||
|
|
||||||
|
**问题描述**: 占卜记录保留 12 个月，然后删除或匿名化
|
||||||
|
|
||||||
|
**待确认**:
|
||||||
|
- [ ] 12 个月留存期的法律依据是什么？
|
||||||
|
- [ ] 如何实现匿名化？具体方案？
|
||||||
|
- [ ] 用户主动删除数据时，是否立即删除还是仍保留 12 个月？
|
||||||
|
- [ ] 匿名化后的数据用途是什么？
|
||||||
|
|
||||||
|
**决策**:
|
||||||
|
|
||||||
|
**负责人**:
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 四、第三方服务商
|
||||||
|
|
||||||
|
### 4.1 分析工具清单
|
||||||
|
|
||||||
|
**评论位置**: Privacy Policy - Sharing & Disclosure of Information - 4.2
|
||||||
|
|
||||||
|
**问题描述**: 需要补充实际使用的分析工具
|
||||||
|
|
||||||
|
**待确认**:
|
||||||
|
- [ ] 当前使用了哪些分析工具？
|
||||||
|
- [ ] AppsFlyer（已添加到文档）
|
||||||
|
- [ ] SKAdNetwork（已添加到文档）
|
||||||
|
- [ ] Firebase Analytics
|
||||||
|
- [ ] Google Analytics
|
||||||
|
- [ ] 其他：______
|
||||||
|
- [ ] 这些工具是否都在隐私政策中列出？
|
||||||
|
- [ ] 每个工具收集什么数据？
|
||||||
|
- [ ] 是否需要用户同意？
|
||||||
|
|
||||||
|
**决策**:
|
||||||
|
✅ 已在文档中添加未来将接入的 AppsFlyer 和 SKAdNetwork。
|
||||||
|
|
||||||
|
**待确认**：
|
||||||
|
- AppsFlyer 和 SKAdNetwork 的具体数据收集范围
|
||||||
|
- 用户是否需要通过 App Store/Google Play 同意
|
||||||
|
- 是否需要在文档中更详细描述这两个 SDK 收集的数据
|
||||||
|
|
||||||
|
**负责人**: 志良
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
### 4.2 推送服务与数据类型
|
||||||
|
|
||||||
|
**评论位置**: Privacy Policy - Sharing & Disclosure of Information - 4.2
|
||||||
|
|
||||||
|
**问题描述**: 需要确认推送服务的类型和数据
|
||||||
|
|
||||||
|
**待确认**:
|
||||||
|
- [ ] 使用什么推送服务？
|
||||||
|
- [ ] Firebase Cloud Messaging (FCM)
|
||||||
|
- [ ] Apple Push Notification Service (APNs)
|
||||||
|
- [ ] 其他：______
|
||||||
|
- [ ] 推送哪些类型的通知？
|
||||||
|
- [ ] 占卜结果提醒
|
||||||
|
- [ ] 系统通知
|
||||||
|
- [ ] 营销通知
|
||||||
|
- [ ] 其他：______
|
||||||
|
- [ ] 推送数据是否包含个人信息？
|
||||||
|
|
||||||
|
**决策**:
|
||||||
|
|
||||||
|
**负责人**: 志良
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 五、用户权利实现
|
||||||
|
|
||||||
|
### 5.1 数据删除功能
|
||||||
|
|
||||||
|
**评论位置**: Privacy Policy - Your U.S. Privacy Rights
|
||||||
|
|
||||||
|
**问题描述**: 是否已实现数据删除功能
|
||||||
|
|
||||||
|
**待确认**:
|
||||||
|
- [ ] App 内是否有账户删除/数据删除按钮？
|
||||||
|
- [ ] 删除流程是什么？
|
||||||
|
- [ ] 立即删除
|
||||||
|
- [ ] 冷却期后删除
|
||||||
|
- [ ] 标记删除但保留数据
|
||||||
|
- [ ] 删除后数据是直接清空还是标记删除？
|
||||||
|
- [ ] 删除后哪些数据会保留？（交易记录、日志等）
|
||||||
|
- [ ] 是否符合 CCPA 45 天内删除的要求？
|
||||||
|
|
||||||
|
**决策**:
|
||||||
|
|
||||||
|
**负责人**: 志良
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
### 5.2 "Do Not Sell My Personal Information" 实现
|
||||||
|
|
||||||
|
**评论位置**: Privacy Policy - Your U.S. Privacy Rights
|
||||||
|
|
||||||
|
**问题描述**: 是否需要在隐私政策页实现 "Do Not Sell" 按钮
|
||||||
|
|
||||||
|
**待确认**:
|
||||||
|
- [ ] 是否需要在隐私政策页添加 "Do Not Sell My Personal Information" 按钮？
|
||||||
|
- [ ] 按钮形式：
|
||||||
|
- [ ] 勾选框（默认勾选/不勾选？）
|
||||||
|
- [ ] 开关按钮
|
||||||
|
- [ ] 是否需要在设置-隐私中也添加此选项？
|
||||||
|
- [ ] 用户选择后如何处理？
|
||||||
|
- [ ] 既然文档声明 "WE DO NOT SELL"，是否还需要此按钮？
|
||||||
|
|
||||||
|
**决策**:
|
||||||
|
|
||||||
|
**负责人**:
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
### 5.3 App 内数据请求路径
|
||||||
|
|
||||||
|
**评论位置**: Privacy Policy - Your U.S. Privacy Rights - How to Exercise Your Rights
|
||||||
|
|
||||||
|
**问题描述**: 确认是否有 Settings → Privacy → Data Requests 路径
|
||||||
|
|
||||||
|
**待确认**:
|
||||||
|
- [ ] 当前 App 是否有此路径？
|
||||||
|
- [ ] 如果没有，是否需要实现？
|
||||||
|
- [ ] Data Requests 页面应包含哪些功能？
|
||||||
|
- [ ] 数据访问请求
|
||||||
|
- [ ] 数据删除请求
|
||||||
|
- [ ] 数据导出请求
|
||||||
|
- [ ] Do Not Sell 设置
|
||||||
|
|
||||||
|
**决策**:
|
||||||
|
|
||||||
|
**负责人**:
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 六、联系方式
|
||||||
|
|
||||||
|
### 6.1 隐私专用邮箱
|
||||||
|
|
||||||
|
**评论位置**: Privacy Policy - Your U.S. Privacy Rights - How to Exercise Your Rights
|
||||||
|
|
||||||
|
**问题描述**: 需要创建觅爻专用的隐私邮箱
|
||||||
|
|
||||||
|
**待确认**:
|
||||||
|
- [ ] 是否需要创建 privacy@xunmee.com 或类似邮箱？
|
||||||
|
- [ ] 邮箱命名方案：
|
||||||
|
- [ ] privacy@xunmee.com
|
||||||
|
- [ ] privacy@meiyao.com
|
||||||
|
- [ ] 其他：______
|
||||||
|
- [ ] 谁负责处理隐私相关邮件？
|
||||||
|
|
||||||
|
**决策**:
|
||||||
|
|
||||||
|
**负责人**:
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
### 6.2 物理地址
|
||||||
|
|
||||||
|
**评论位置**: Privacy Policy - Your U.S. Privacy Rights - How to Exercise Your Rights
|
||||||
|
|
||||||
|
**问题描述**: 是否必须提供物理地址
|
||||||
|
|
||||||
|
**待确认**:
|
||||||
|
- [ ] CCPA 是否要求提供物理地址？
|
||||||
|
- [ ] 如果必须，使用什么地址？
|
||||||
|
- [ ] 公司注册地址
|
||||||
|
- [ ] 办公地址
|
||||||
|
- [ ] 其他：______
|
||||||
|
- [ ] 地址信息：______
|
||||||
|
|
||||||
|
**决策**:
|
||||||
|
|
||||||
|
**负责人**:
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
### 6.3 联系邮箱确认
|
||||||
|
|
||||||
|
**评论位置**: Privacy Policy - Contact Us & Complaints
|
||||||
|
|
||||||
|
**问题描述**: 确认并更新联系邮箱
|
||||||
|
|
||||||
|
**待确认**:
|
||||||
|
- [ ] Privacy Officer Email: privacy@xunmee.com - 是否正确？
|
||||||
|
- [ ] Support Email: xuyunlong@xunmee.com - 是否正确？
|
||||||
|
- [ ] 是否需要更新？
|
||||||
|
|
||||||
|
**决策**:
|
||||||
|
|
||||||
|
**负责人**:
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 七、儿童保护（COPPA）
|
||||||
|
|
||||||
|
### 7.1 年龄验证机制
|
||||||
|
|
||||||
|
**评论位置**: Privacy Policy - Children's Privacy (COPPA Compliance)
|
||||||
|
|
||||||
|
**问题描述**: 如何验证用户年龄，防止 13 岁以下儿童使用
|
||||||
|
|
||||||
|
**待确认**:
|
||||||
|
- [ ] 是否需要年龄验证机制？
|
||||||
|
- [ ] 验证方案：
|
||||||
|
- [ ] 注册时声明年龄
|
||||||
|
- [ ] App Store/Google Play 年龄 API
|
||||||
|
- [ ] 其他：______
|
||||||
|
- [ ] 参考其他 App 的做法：
|
||||||
|
- [ ] TikTok、YouTube 等如何处理？
|
||||||
|
- [ ] 如果发现 13 岁以下用户，如何处理？
|
||||||
|
|
||||||
|
**决策**:
|
||||||
|
|
||||||
|
**负责人**:
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 八、数据安全措施
|
||||||
|
|
||||||
|
### 8.1 安全措施确认
|
||||||
|
|
||||||
|
**评论位置**: Privacy Policy - Data Security
|
||||||
|
|
||||||
|
**问题描述**: 确认文档中声明的安全措施是否真实实施
|
||||||
|
|
||||||
|
**待确认**:
|
||||||
|
- [ ] 加密措施：
|
||||||
|
- [ ] AES-256 数据加密
|
||||||
|
- [ ] TLS 1.3 传输加密
|
||||||
|
- [ ] 访问控制：
|
||||||
|
- [ ] 基于角色的访问控制
|
||||||
|
- [ ] 多因素认证（MFA）
|
||||||
|
- [ ] 监控审计：
|
||||||
|
- [ ] 24/7 安全监控
|
||||||
|
- [ ] 定期渗透测试
|
||||||
|
- [ ] 审计日志
|
||||||
|
- [ ] 泄露响应：
|
||||||
|
- [ ] 72 小时内通知机制
|
||||||
|
- [ ] 响应流程
|
||||||
|
|
||||||
|
**决策**:
|
||||||
|
|
||||||
|
**负责人**: 志良
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 九、其他待确认事项
|
||||||
|
|
||||||
|
### 9.1 App Store 合规要求
|
||||||
|
|
||||||
|
**评论位置**: Privacy Policy - Next Steps for U.S. App Store Compliance
|
||||||
|
|
||||||
|
**待确认**:
|
||||||
|
- [ ] 隐私政策链接已添加到 App Store Connect？
|
||||||
|
- [ ] 隐私政策链接已添加到 Google Play Console？
|
||||||
|
- [ ] App 内隐私政策链接是否可用？
|
||||||
|
- [ ] "Do Not Sell My Personal Information" 链接是否已实现？
|
||||||
|
- [ ] App Store Privacy Details 是否已填写？
|
||||||
|
- [ ] Google Play Data Safety Form 是否已填写？
|
||||||
|
- [ ] iOS ATT (App Tracking Transparency) 权限提示是否已实现？
|
||||||
|
- [ ] App 内账户删除功能是否已实现？（Apple 要求）
|
||||||
|
|
||||||
|
**决策**:
|
||||||
|
|
||||||
|
**负责人**:
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 讨论记录
|
||||||
|
|
||||||
|
### 会议/讨论 1
|
||||||
|
|
||||||
|
**日期**:
|
||||||
|
|
||||||
|
**参与人**:
|
||||||
|
|
||||||
|
**讨论内容**:
|
||||||
|
|
||||||
|
**决策结论**:
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
### 会议/讨论 2
|
||||||
|
|
||||||
|
**日期**:
|
||||||
|
|
||||||
|
**参与人**:
|
||||||
|
|
||||||
|
**讨论内容**:
|
||||||
|
|
||||||
|
**决策结论**:
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 更新记录
|
||||||
|
|
||||||
|
### 2026-04-17: 英文隐私政策按CCPA/CPRA标准重写
|
||||||
|
|
||||||
|
**更新内容**：
|
||||||
|
|
||||||
|
1. **按照CCPA/CPRA标准规范重新编写英文隐私政策**
|
||||||
|
|
||||||
|
标准格式包括：
|
||||||
|
- Who We Are - 公司信息和联系方式
|
||||||
|
- Information We Collect - 详细列出收集的信息类别
|
||||||
|
- Categories of Personal Information - 按照CCPA要求的表格格式列出A-K类别
|
||||||
|
- How We Use Your Personal Information - 使用目的
|
||||||
|
- How We Share Your Personal Information - 共享情况，包括服务提供商表格
|
||||||
|
- Your Privacy Rights (California Residents) - 加州居民权利
|
||||||
|
- How to Exercise Your Rights - 如何行使权利
|
||||||
|
- Data Retention - 数据保留政策
|
||||||
|
- Data Security - 安全措施
|
||||||
|
- Children's Privacy - 儿童隐私保护（COPPA）
|
||||||
|
- Cross-Border Data Transfers - 跨境传输
|
||||||
|
- Changes to This Privacy Policy - 政策变更
|
||||||
|
- Contact Us - 联系方式
|
||||||
|
- Additional Rights for California Residents - 加州居民额外权利
|
||||||
|
|
||||||
|
2. **关键更新**：
|
||||||
|
- ✅ 移除占卜数据作为 SPI 的标记
|
||||||
|
- ✅ 添加 AppsFlyer 和 SKAdNetwork 归因工具
|
||||||
|
- ✅ 添加会话时长和占卜频率收集说明
|
||||||
|
- ✅ 明确声明不销售个人数据
|
||||||
|
- ✅ 按CCPA要求提供数据类别表格（A-K）
|
||||||
|
- ✅ 提供行使权利的具体方式（邮箱 + 应用内）
|
||||||
|
|
||||||
|
3. **简体中文和繁体中文**：
|
||||||
|
- 已清空并标记等待英文正式稿确认后翻译
|
||||||
|
- 将保持与英文版本结构一致
|
||||||
|
|
||||||
|
4. **About Us 更新**：
|
||||||
|
- 更新隐私政策链接说明
|
||||||
|
|
||||||
|
**待确认**：
|
||||||
|
- [ ] 隐私邮箱 privacy@xunmee.com 是否已创建
|
||||||
|
- [ ] 公司完整地址是否需要提供
|
||||||
|
- [ ] App 内是否有 Settings → Privacy → Data Requests 路径
|
||||||
|
- [ ] 是否需要实现 "Do Not Sell My Personal Information" 页面（虽然我们不销售数据）
|
||||||
|
- [ ] AppsFlyer 和 SKAdNetwork 具体数据收集范围需要确认
|
||||||
|
- [ ] 确认数据保留政策是否合理（账户90天，占卜记录12个月）
|
||||||
|
|
||||||
|
---
|
||||||
@@ -1,8 +1,8 @@
|
|||||||
name: supabase
|
name: eryao-supabase
|
||||||
|
|
||||||
services:
|
services:
|
||||||
db:
|
db:
|
||||||
container_name: supabase-db
|
container_name: eryao-supabase-db
|
||||||
image: supabase/postgres:15.8.1.085
|
image: supabase/postgres:15.8.1.085
|
||||||
restart: unless-stopped
|
restart: unless-stopped
|
||||||
volumes:
|
volumes:
|
||||||
@@ -33,7 +33,7 @@ services:
|
|||||||
- 127.0.0.1:${ERYAO_DATABASE__PORT:-5432}:5432
|
- 127.0.0.1:${ERYAO_DATABASE__PORT:-5432}:5432
|
||||||
|
|
||||||
auth:
|
auth:
|
||||||
container_name: supabase-auth
|
container_name: eryao-supabase-auth
|
||||||
image: supabase/gotrue:v2.186.0
|
image: supabase/gotrue:v2.186.0
|
||||||
restart: unless-stopped
|
restart: unless-stopped
|
||||||
depends_on:
|
depends_on:
|
||||||
@@ -73,7 +73,7 @@ services:
|
|||||||
GOTRUE_MAILER_URLPATHS_EMAIL_CHANGE: /auth/v1/verify
|
GOTRUE_MAILER_URLPATHS_EMAIL_CHANGE: /auth/v1/verify
|
||||||
|
|
||||||
rest:
|
rest:
|
||||||
container_name: supabase-rest
|
container_name: eryao-supabase-rest
|
||||||
image: postgrest/postgrest:v14.8
|
image: postgrest/postgrest:v14.8
|
||||||
restart: unless-stopped
|
restart: unless-stopped
|
||||||
depends_on:
|
depends_on:
|
||||||
@@ -91,7 +91,7 @@ services:
|
|||||||
PGRST_APP_SETTINGS_JWT_EXP: 3600
|
PGRST_APP_SETTINGS_JWT_EXP: 3600
|
||||||
|
|
||||||
storage:
|
storage:
|
||||||
container_name: supabase-storage
|
container_name: eryao-supabase-storage
|
||||||
image: supabase/storage-api:v1.48.26
|
image: supabase/storage-api:v1.48.26
|
||||||
restart: unless-stopped
|
restart: unless-stopped
|
||||||
depends_on:
|
depends_on:
|
||||||
@@ -124,7 +124,7 @@ services:
|
|||||||
- storage-data:/var/lib/storage
|
- storage-data:/var/lib/storage
|
||||||
|
|
||||||
meta:
|
meta:
|
||||||
container_name: supabase-meta
|
container_name: eryao-supabase-meta
|
||||||
image: supabase/postgres-meta:v0.96.3
|
image: supabase/postgres-meta:v0.96.3
|
||||||
restart: unless-stopped
|
restart: unless-stopped
|
||||||
depends_on:
|
depends_on:
|
||||||
@@ -145,7 +145,7 @@ services:
|
|||||||
retries: 1
|
retries: 1
|
||||||
|
|
||||||
studio:
|
studio:
|
||||||
container_name: supabase-studio
|
container_name: eryao-supabase-studio
|
||||||
image: supabase/studio:2026.04.08-sha-205cbe7
|
image: supabase/studio:2026.04.08-sha-205cbe7
|
||||||
restart: unless-stopped
|
restart: unless-stopped
|
||||||
depends_on:
|
depends_on:
|
||||||
@@ -180,7 +180,7 @@ services:
|
|||||||
- studio-functions:/var/lib/functions
|
- studio-functions:/var/lib/functions
|
||||||
|
|
||||||
kong:
|
kong:
|
||||||
container_name: supabase-kong
|
container_name: eryao-supabase-kong
|
||||||
image: kong/kong:3.9.1
|
image: kong/kong:3.9.1
|
||||||
restart: unless-stopped
|
restart: unless-stopped
|
||||||
depends_on:
|
depends_on:
|
||||||
|
|||||||
Reference in New Issue
Block a user