1. 运营者与适用范围

本政策适用于 MusePath 文艺旅人 iOS App 及官方网站。运营者为个人开发者闵晓芳（min xiaofang），隐私联系邮箱：zebai8706@gmail.com。它说明我们处理的信息、用途、接收方以及你的选择；第三方独立提供的服务另有其自身规则。

2. 旅行档案与账号

收藏、行程、点亮记录、私人故事、昵称、备注及心情保存在设备，用于展示、编辑和导出旅行档案。故事中你主动选定的地点坐标属于档案内容。Apple 登录会提供账号标识，以及你授权分享的姓名、邮箱（可为隐藏邮箱）；认证后台使用 Apple 登录凭证验证身份，并建立 Supabase 账号及 MusePath 唯一会员 ID。会员 ID 是产品内部标识，绑定到同一会员账号的登录方式可沿用该 ID；我们不会仅因两个账号姓名相同就自动合并。我们不会获取你的 Apple 账号密码。

3. 定位、照片与日历

只有在你使用附近地点、地图定位或现场点亮等功能并给予系统许可后，App 才读取位置，用于地图视野、距离计算和现场验证，不进行后台持续定位追踪。你主动保存到故事或点亮记录的地点信息可以随档案保留。你选择的照片用于旅行记录与相框，照片文件保存在本机，不纳入当前 iCloud 同步快照。使用按拍摄地点推荐时，App 在本机读取已授权照片的位置与时间进行匹配，不因此向 MusePath 服务器上传照片、照片位置或匹配结果。保存图片、写入日历时会调用对应系统权限或确认界面；拒绝相关权限仍可使用不依赖它的功能。

4. iCloud 同步

登录后，旅行档案及账号资料可免费同步至你的私人 iCloud 数据库，用于跨设备恢复与合并，照片文件除外。同步取决于 iCloud 登录、网络、容量与服务状态。

5. 可选分析、搜索与诊断

产品改进计划默认由你选择是否参加；同意后，Supabase 与 LivePulse 接收安装随机标识、时间与使用事件、受控事件参数、会员 ID（登录且取得该 ID 时）、登录方式、收藏及记录数量、App/系统版本、设备类型和语言/地区。LivePulse 通过 SensorsAnalyticsSDK 传输；接收端及网络服务可能处理请求 IP 并据此推断粗略地区。这些标识可关联使用行为，不应理解为完全匿名。我们不向 LivePulse 发送原始 Apple ID、姓名、邮箱、照片、精确定位或原始搜索词。
只有另外开启“帮助改进搜索”后，原始搜索词才可随分析事件保存到自有 Supabase，用于改善检索，不发送给 LivePulse；请勿在搜索中输入证件、联系方式等不必要的个人信息。诊断日志上报由独立开关控制，内容为错误级别、分类、受控日志、会话标识及版本/设备信息。集成并启用 Firebase Crashlytics 的版本仅在同意产品改进计划后收集崩溃与运行诊断；其数据也不保证完全匿名。关闭开关会停止相应后续收集，撤回同意不影响撤回前依法进行的处理。

6. 建议、通知与官网申请

你提交作品建议时，作品信息和备注会保存在 Supabase，并关联到经过验证的账号 UUID，以便处理建议和向本人展示审核回复。通知及已读记录用于展示消息、保存阅读状态。官网内测申请收集你填写的姓名或昵称、邮箱、设备/系统、申请理由以及页面语言和来源，用于处理 TestFlight 申请及联系你，不保证一定收到邀请。不要提交与申请无关的敏感资料。网站在浏览器本地保存语言偏好；托管和网络服务会为交付页面、防滥用及排障处理必要的 IP、请求时间等技术信息。

7. 处理依据与第三方服务

8. 保存、存储与安全

本地记录保存至你删除、清除设备数据或卸载 App；系统备份可能按你的设备设置另行保留副本。iCloud 数据与本机分开存储，卸载或退出登录不会自动删除云快照。账号档案在账号存续及完成必要服务期间保存；建议、通知和内测申请按处理事项和后续联系所需期间保存，目的不再需要时应删除或去标识化。分析与诊断按排障和产品改进所需的最短必要期间保存；不因关闭收集开关而自动删除此前已收到的数据，你可以联系申请删除。
保存期判断因素包括记录用途、未完成请求、账号状态以及依法必要的安全或争议处理；不同类别的数据不适用统一的保存天数。删除后，依法必须保留的记录及服务商备份可能按适用规则和备份周期有限保留，不用于继续提供已终止的分析。
Apple、Supabase、Google、Vercel 及分析服务可能在你所在地区以外处理信息；本政策不承诺所有数据仅存储于中国境内。涉及受适用法律限制的跨境处理时，应落实所需保障及告知、同意等要求。可通过隐私邮箱询问与你的数据有关的存储、接收方和保留情况。我们使用加密传输、系统权限、访问控制及服务端身份验证，仍无法保证绝对安全；发生事件时会依适用规则处理及通知。

9. 你的选择、权利与注销

你可以在 iOS 设置中管理定位、照片和日历许可，在 App 的“账号与隐私”中关闭产品改进计划、搜索改进及诊断上报，并导出旅行档案。仅删除本地记录不等于注销账号，退出登录和卸载 App 也不会自动删除后台账号或云数据。
“删除账号与全部数据”流程需要联网并重新完成 Apple 身份确认；成功后会撤销相关 Apple 授权，删除后台账号、关联建议/通知和以会员 ID 关联的自有分析事件，并清理本机档案及 iCloud 快照。请先导出需要的内容；应以 App 的完成或失败提示确认结果。网络或云端失败可能使操作未完成，不能将按钮点击视为所有系统已删除。
LivePulse、Crashlytics 中已传输的数据、未关联账号的安装分析，以及另行提交的官网申请，不应假定被该按钮自动清除。如需访问、更正、复制、删除、限制处理或撤回同意，请联系 zebai8706@gmail.com，说明涉及的 App 会员或申请邮箱及请求范围；不要发送 Apple 密码或私钥。我们会按必要程度核验身份、协调服务商，并在适用法律规定期限内答复；不能处理时说明原因和可用救济。已不可逆匿名化的信息可能无法重新识别。你依法享有向主管机关投诉的权利。

10. 未成年人及政策更新

本服务不专门面向儿童。未成年人应在监护人指导和适用法律要求的同意下使用；如不满 14 周岁，请监护人先与我们联系，勿自行提交账号或内测申请资料。发现未经所需授权处理儿童信息时，我们会核实并依法删除或采取其他保护措施。重要数据用途、接收方或权利安排变化时，我们会更新本页并作适当提示，需要重新取得同意时会在新处理前征求。更新不追溯授权此前未经许可的用途。

1. Operator and scope

This policy covers the MusePath iOS app and official website. The operator is individual developer min xiaofang (闵晓芳). Privacy contact: zebai8706@gmail.com. It explains our processing, recipients and your choices; independently provided third-party services also have their own rules.

2. Travel records and accounts

Favorites, trips, check-ins, personal stories, display names, notes and moods are stored on your device for display, editing and export. Coordinates you choose for a story form part of that record. Sign in with Apple supplies an account identifier and any name or email you authorize, including a relay email. Our authentication backend verifies Apple credentials and creates a Supabase account and unique MusePath member ID. Sign-in methods linked to the same member account can share that ID; matching display names alone do not cause automatic account merging. We do not receive your Apple account password.

3. Location, photos and calendar

With system permission, location is read for nearby places, map positioning and on-site check-ins, including distance calculations and verification. We do not continuously track location in the background. Place information you choose to save can remain in your records. Selected photos are used in records and frames, remain on the device and are excluded from the current iCloud snapshot. Photo suggestions compare authorized capture locations and times on-device without uploading photos, photo locations or matches to MusePath servers for that purpose. Saving images or adding trips to Calendar uses the relevant permission or system confirmation. Declining a permission leaves unrelated features available.

4. iCloud sync

After sign-in, travel records and account details can sync to your private iCloud database for free for cross-device restoration and merging. Photo files are excluded. Sync depends on iCloud sign-in, connectivity, storage and service availability.

5. Optional analytics, search and diagnostics

You choose whether to join product analytics. After consent, Supabase and LivePulse receive a random installation identifier, timestamps, usage events, controlled parameters, a member ID when available after sign-in, sign-in method, record/favorite counts, app/OS versions, device type and locale. LivePulse receives data via SensorsAnalyticsSDK. Receiving and network services may process request IP addresses and infer a coarse region. These identifiers can link behavior and are not necessarily anonymous. We do not send raw Apple IDs, names, emails, photos, precise location or raw search terms to LivePulse.
Only if you separately enable “Help improve search” can raw search terms be stored with analytics in our Supabase database for search improvement; they are not sent to LivePulse. Avoid entering unnecessary identification or contact details. A separate diagnostic-upload setting controls error severity, category, controlled log text, session identifiers and device/version details. Builds that integrate and enable Firebase Crashlytics collect crash/runtime diagnostics only after product-analytics consent; these reports are not guaranteed anonymous. Turning a setting off stops the corresponding future collection without invalidating lawful processing before withdrawal.

6. Suggestions, messages and website applications

Work suggestions and notes are stored in Supabase under your verified account UUID to handle requests and show replies to you. Notifications and read records support message delivery and reading status. Beta applications collect the name/nickname, email, device/OS and reason you enter, plus language and source, to handle TestFlight applications and contact you. An application does not guarantee an invitation. Do not provide unrelated sensitive details. The website saves a language preference in browser storage. Hosting/network services process necessary IP addresses, request times and technical information for page delivery, abuse prevention and troubleshooting.

7. Purposes and service providers

8. Retention, storage and security

Local records remain until deletion, device erasure or uninstallation; system backups may separately retain copies according to your settings. iCloud is separate: signing out or uninstalling does not automatically remove its snapshot. Account profiles remain while the account and necessary services require them. Suggestions, messages and beta applications are kept for handling and necessary follow-up, then should be deleted or de-identified when no longer needed. Analytics and diagnostics are retained for the shortest period necessary for troubleshooting and improvement. Disabling collection does not automatically erase previously received data; you may request deletion.
Retention depends on purpose, outstanding requests, account status and legally necessary security/dispute handling. Different categories of information do not share one uniform retention period. Legally required records and provider backups may remain for limited periods under applicable rules and backup cycles, without continuing discontinued analytics uses.
Apple, Supabase, Google, Vercel and analytics services may process data outside your region. We do not promise China-only storage. Restricted international processing requires the safeguards, notices and consents applicable to it. Contact us about storage, recipients and retention relevant to your data. We use encrypted transport, system permissions, access controls and server-side identity verification, but cannot guarantee absolute security. Incidents will be handled and notified as applicable rules require.

9. Choices, rights and account deletion

Manage location, Photos and Calendar permissions in iOS Settings and optional analytics, search improvement and diagnostics in Account & Privacy. You can export travel records. Local deletion is separate from account deletion; signing out or uninstalling does not automatically delete the backend account or cloud data.
“Delete account and all data” requires connectivity and fresh Apple identity confirmation. Successful completion revokes the associated Apple authorization, deletes the backend account, linked suggestions/messages and member-linked first-party analytics events, and clears local records and the iCloud snapshot. Export what you need first, and check the completion or failure message. Network/cloud failure may leave the operation incomplete; a button tap is not proof of deletion across all systems.
Do not assume the button automatically erases previously transmitted LivePulse or Crashlytics data, unlinked installation analytics or separately submitted website applications. For access, correction, copying, deletion, restrictions or withdrawal of consent, contact zebai8706@gmail.com, identifying the relevant member account or application email and scope. Do not send Apple passwords or private keys. We verify identity only as necessary, coordinate with providers and respond within applicable legal deadlines, explaining any refusal and available remedies. Irreversibly anonymized information may no longer be identifiable. You retain applicable rights to complain to a supervisory authority.

10. Minors and changes

The service is not specifically directed to children. Minors should use it with guardian guidance and any legally required consent. If under 14, ask a guardian to contact us before submitting account or application information. If children’s information was processed without required authorization, we will investigate and delete it or take other legally appropriate protective steps. Material changes to purposes, recipients or rights will be reflected here with appropriate notice. Where new consent is required, it will be sought before new processing. Updates do not retroactively authorize previously unpermitted uses.