開口 Pipe Up 隱私權政策
本政策說明 Pipe Up（以下稱「我們」）在你使用「開口 Pipe Up」（以下稱「本服務」）時，蒐集哪些個人資料、為什麼蒐集、交給誰處理、保存多久，以及你可以怎麼行使權利。本政策同時作為《個人資料保護法》（以下稱「個資法」）第 8 條的告知。
本服務僅供年滿 18 歲的人使用。 未滿 18 歲請不要下載或使用。
一、我們是誰（個資法第 8 條第 1 項第 1 款）
- 名稱：Pipe Up（由個人開發者 Alvin Cheng 經營，護照名 Cheng Chicheng，台灣）
- 聯絡 email：{{SUPPORT_EMAIL}}
二、一句話摘要
- 你說的話（語音）會即時傳到 Google 的 Gemini API 處理，用來產生 AI 對話夥伴的回應、逐字稿和糾錯。我們的伺服器不儲存你的錄音檔。
- 我們的伺服器會保存文字：對話逐字稿（90 天後自動刪除）、糾錯紀錄、句庫、學習紀錄，以及「記憶」功能記下的事（記憶可以關閉、可以刪除）。
- 目前版本免費，沒有訂閱或 App 內購買，我們不會取得任何付款資料。
- 我們不賣你的資料，不放廣告，不做跨 App 追蹤。
- 你可以隨時在 App 內刪除帳號與所有資料。
三、我們蒐集哪些資料（第 3 款：個人資料之類別）
| 類別 | 具體內容 | 來源 |
|---|---|---|
| 帳號資料 | 帳號識別碼（由伺服器產生）、你在 App 內設定的顯示名稱與練習夥伴名稱；你以 Sign in with Apple 登入時 Apple 提供的使用者識別碼（我們不要求、也不取得你的姓名或 email） | 你提供 / Apple |
| 裝置識別 | 伺服器為這支裝置發給的存取權杖（token）、iOS 提供的裝置名稱；連線時的 IP 位址（僅用於建立連線；註冊時會把 IP 轉成無法還原的雜湊值、只在記憶體中保留 1 小時，用來偵測大量註冊等濫用，不寫入硬碟） | 自動產生 |
| 語音音訊 | 對話時麥克風收到的聲音，即時串流轉送 Google Gemini 處理。我們的伺服器不把音訊寫成檔案。 | 你提供 |
| 逐字稿 | 你和 AI 夥伴每一句話轉成的文字、每句的糾錯內容、暫停紀錄，含時間戳記與對話話題 | 由語音轉寫產生 |
| 學習紀錄 | 糾錯後的句子與說明、你原本說的句子、錯誤類型、複習排程；每次練習的句數、AI 估計的英語程度（如 B1）、你聊得最多的話題 | 由對話產生 |
| 記憶 | AI 從對話中整理出、關於你的短句，例如人物（家人、朋友、寵物）、興趣、目標、生活近況、練習偏好、學習弱點。每筆有建立日期，近況類有到期日 | 由對話產生（AI 自動整理） |
| 使用量 | 每次練習的時間與分鐘數、每日免費額度用量、AI 服務費用計量 | 自動產生 |
| 回報內容 | 你在 AI 回應上長按「回報這句」時送出的那句 AI 回應、話題與原因 | 你提供 |
| 伺服器紀錄 | 請求時間、請求方法與路徑、回應狀態與處理時間、錯誤訊息，以及經過雜湊、無法還原的帳號代碼。不含 IP 位址與查詢參數 | 自動產生 |
只存在你手機上、我們不蒐集的資料：
- App 設定（例如慢速模式、顯示中文），存在手機的 App 偏好設定中。
我們不蒐集： 精確位置、通訊錄、照片、健康資料、臉部影像或其他生物特徵、廣告識別碼（IDFA）、付款資料。
四、為什麼蒐集（第 2 款：蒐集之目的）
我們只在以下目的範圍內使用你的資料：
- 提供口說練習服務：產生 AI 對話夥伴的即時語音回應、逐字稿、每句糾錯、中文翻譯、提示、一輪結束後的小結與程度估計。
- 個人化學習：用句庫安排複習；用「記憶」讓 AI 夥伴記得你聊過的事，在之後的對話中自然接續。記憶功能可在設定中關閉；關閉後不會再記新的事（也不記錄你聊過的話題），對話也不會使用已記的內容。AI 被指示不要記下健康、金錢、宗教、政治、地址、聯絡方式、證件或帳號號碼等敏感資料，但 AI 可能判斷錯誤，你可以隨時檢視並刪除任何一筆。
- 帳號與額度管理：驗證你的身分、計算每輪與每日的免費使用時間。
- 客服與安全：回覆你的詢問、處理你回報的不當 AI 回應、偵測濫用、排除錯誤。
- 服務改善：以統計方式了解使用量與功能使用情形；並以去識別化方式統計常見的英文錯誤類型與回訪情形，用來改善糾錯、提示與練習內容，統計報告不含你的帳號或身分。我們不會用你的對話內容訓練任何 AI 模型。
五、資料交給誰處理（第 4 款：利用之對象）
| 對象 | 收到什麼 | 用途 |
|---|---|---|
| Google LLC（Gemini API，付費方案） | 你的語音串流；你和 AI 的對話文字；你的顯示名稱；為了讓 AI 接續對話而附上的記憶內容、正在複習的句子、近期程度估計 | 即時產生語音回應、轉寫、糾錯、翻譯、小結與記憶整理 |
| Apple Inc. | Sign in with Apple 登入驗證；刪除帳號時，我們會通知 Apple 撤銷本服務的登入授權 | 登入與帳號管理 |
| Railway Corporation（美國公司） | 我們伺服器上的全部資料（代管） | 主機與儲存 |
| 我們使用的電子郵件服務供應商 | 你寄給我們的信 | 客服 |
關於 Google：依 Gemini API 付費服務條款，Google 不會用你的提示詞與回應改善其產品，但會在有限期間內記錄提示與回應，僅用於偵測與防止違規使用；資料可能暫存或快取於任何國家。Google 如何處理資料，以 Google 的條款為準：https://ai.google.dev/gemini-api/terms 。
除上列對象，以及法律要求（例如法院或檢調機關依法調取）之外，我們不會把你的個人資料提供給其他人。我們不販售個人資料。
六、在哪裡處理：跨境傳輸（第 4 款：利用之地區）
- 我們的伺服器位於新加坡，由 Railway Corporation 代管。
- 伺服器資料每天備份一份到營運者位於台灣、僅營運者可存取的電腦，保留 30 天。
- 送往 Google Gemini API 的資料會在 Google 的設施處理，可能位於美國或其他國家。
- Apple 的處理地區依 Apple 隱私權政策。
- 第一次使用時，我們會以同意畫面取得你對「語音與對話送 Google 處理」的明確同意，並請你確認已年滿 18 歲。
七、保存多久（第 4 款：利用之期間）
| 資料 | 保存期間 |
|---|---|
| 語音音訊 | 我們的伺服器不保存；Google 端依其條款短期保存 |
| 逐字稿 | 每段對話建立後 90 天自動刪除 |
| 學習紀錄（句庫、練習紀錄） | 帳號存續期間；刪除帳號時立即刪除 |
| 記憶 | 帳號存續期間，或到你刪除為止；近況類到期後不再使用 |
| 使用量與費用計量 | 當月加前 24 個月，之後自動刪除；刪除帳號時移除帳號識別、改為匿名 |
| 回報內容 | 180 天後自動刪除；刪除帳號時移除帳號識別、改為匿名 |
| 註冊時的 IP 雜湊值 | 只在記憶體中保留 1 小時 |
| 伺服器紀錄（不含 IP） | 30 天 |
| 客服信件 | 結案後 1 年 |
刪除帳號時： 帳號、逐字稿、學習紀錄、句庫與記憶會立即從正式系統刪除；使用量與回報紀錄只保留匿名的統計數字（不再連到你）；備份中的副本會在 30 天內隨備份輪替刪除。
八、臉部辨識與生物特徵
本 App 不提供臉部辨識，也不蒐集、不使用任何生物特徵資料，包括臉部影像與臉部特徵。
九、你的權利與行使方式（第 5 款）
依個資法第 3 條，你可以對你的個人資料：
- 查詢或請求閱覽；
- 請求製給複製本；
- 請求補充或更正；
- 請求停止蒐集、處理或利用；
- 請求刪除。
怎麼做：
- App 內直接處理：
- 記憶：「設定 > 老師記得的事」可以看到全部內容、左滑刪除單筆、按「全部忘記」清空（會一併清除記憶、聊過的話題與開場紀錄），或關閉「記住我說過的事」。
- 刪除帳號：「設定 > 隱私 > 刪除帳號與所有資料」，確認後會刪除伺服器上這個帳號的逐字稿、學習紀錄、句庫與記憶，撤銷 Apple 登入授權與這支裝置的登入狀態，刪除後無法復原。
- 寄信給我們： {{SUPPORT_EMAIL}}。為保護你的資料，我們會先確認你是帳號本人。我們會在個資法規定的期限內回覆；需要延長時，會告知原因。
十、不提供資料的影響（第 6 款）
- 語音與對話文字是提供口說練習所必需。你不同意送 Google 處理，就無法使用對話功能。
- 記憶功能可以關閉，關閉後仍可正常練習，只是 AI 夥伴不會記得之前聊過的事。
- 不允許麥克風權限就無法進行口說練習。
十一、未成年人
本 App 僅供 18 歲以上使用，不提供兒童模式。我們會在第一次使用時請你確認已年滿 18 歲。我們不會在知情的情況下蒐集未滿 18 歲者的個人資料；如果發現，會刪除該帳號與資料。若你認為有未滿 18 歲者在使用，請寫信到 {{SUPPORT_EMAIL}}。
十二、資料安全
我們採取以下措施保護你的資料：
- 帳號存取權杖驗證，每個帳號只能讀取自己的資料；
- App 與伺服器之間以 HTTPS / TLS 加密傳輸；
- 伺服器只有營運者能管理，主機供應商負責實體與網路安全。
沒有任何系統能保證百分之百安全。本服務不是端對端加密：我們的伺服器會以文字儲存你的逐字稿與學習紀錄，以便提供服務。若發生個資外洩，我們會依法通知你。
十三、追蹤與廣告
我們不使用第三方廣告或分析 SDK，不跨 App 或網站追蹤你，也不使用廣告識別碼。本網站也不使用 cookie 或分析工具。
十四、政策修改
我們修改本政策時，會在本頁更新日期；重大變更（例如新增資料接收對象、新的使用目的，或日後推出付費方案而需要處理交易資料）會在 App 內通知，必要時重新取得你的同意。
十五、聯絡我們
Pipe Up · Alvin Cheng
email：{{SUPPORT_EMAIL}}
Pipe Up Privacy Policy
This policy explains what personal data Pipe Up ("we", "us") collects when you use 開口 Pipe Up (the "Service"), why we collect it, who processes it, how long we keep it, and how you can exercise your rights. It also serves as the notice required by Article 8 of Taiwan's Personal Data Protection Act ("PDPA").
The Service is only for people aged 18 or older. If you are under 18, do not download or use it.
1. Who we are
- Name: Pipe Up (run by individual developer Alvin Cheng, passport name Cheng Chicheng, Taiwan)
- Contact email: {{SUPPORT_EMAIL}}
2. Summary
- What you say (your voice) is streamed in real time to Google's Gemini API, which generates the AI partner's replies, transcripts and corrections. Our server does not store your voice recordings.
- Our server stores text: conversation transcripts (deleted automatically after 90 days), corrections, your phrase bank, practice history, and the things the Memory feature remembers about you (Memory can be turned off and deleted).
- The current version is free. There are no subscriptions or in-app purchases, and we never receive payment details.
- We do not sell your data, show ads, or track you across apps.
- You can delete your account and all its data in the app at any time.
3. What we collect
| Category | Details | Source |
|---|---|---|
| Account data | An account identifier generated by our server, the display name and partner name you set in the app; the user identifier Apple provides when you sign in with Apple (we do not request or receive your name or email) | You / Apple |
| Device identifiers | An access token our server issues to your device and the device name iOS provides; your IP address when connecting (used only to establish the connection; at sign-up it is turned into a non-reversible hash kept in memory for 1 hour to detect abuse such as mass sign-ups, never written to disk) | Generated automatically |
| Voice audio | Sound picked up by the microphone during a conversation, streamed in real time to Google Gemini. Our server does not write audio to files. | You |
| Transcripts | The text of every line you and the AI partner say, the correction for each line, pause events, with timestamps and the conversation topic | Generated from speech |
| Learning records | Corrected sentences and explanations, the sentence you originally said, error type, review schedule; for each session: number of lines, an AI-estimated English level (e.g. B1), the topics you talked about most | Generated from conversations |
| Memory | Short statements about you that the AI extracts from conversations, such as people (family, friends, pets), interests, goals, life events, practice preferences and learning weaknesses. Each item has a date; time-bound items have an expiry date | Generated by the AI from conversations |
| Usage | Time and minutes per session, daily free-time usage, AI cost metering | Generated automatically |
| Reports | The AI reply, topic and reason you send when you long-press a reply and choose "Report" | You |
| Server logs | Request time, request method and path, response status and processing time, error messages, and a hashed, non-reversible account code. No IP addresses or query parameters | Generated automatically |
Kept only on your phone (we do not collect it): app settings such as slow mode and showing Chinese.
We do not collect: precise location, contacts, photos, health data, face images or other biometric data, the advertising identifier (IDFA), or payment details.
4. Why we collect it
- To provide speaking practice: real-time voice replies from the AI partner, transcripts, per-line corrections, Chinese translations, hints, the end-of-round summary and level estimates.
- Personalised learning: scheduling phrase reviews; using Memory so the AI partner remembers what you talked about and can follow up naturally. You can turn Memory off in Settings; when off, nothing new is remembered (including the topics you talked about) and existing items are not used in conversations. The AI is instructed not to remember sensitive details such as health conditions, money amounts, religion, politics, addresses, contact details, or ID or account numbers, but it may get this wrong, so you can review and delete any item at any time.
- Account and quota management: verifying your account and counting free talk time per round and per day.
- Support and safety: answering your requests, handling inappropriate AI replies you report, detecting abuse, fixing errors.
- Improving the Service: understanding usage and feature use in aggregate, and counting common English mistake types and return visits in de-identified form to improve corrections, hints and practice content; these statistics do not include your account or identity. We do not use your conversations to train any AI model.
5. Who processes your data
| Recipient | What they receive | Purpose |
|---|---|---|
| Google LLC (Gemini API, paid tier) | Your voice stream; the text of your conversation with the AI; your display name; Memory items, phrases under review and recent level estimates attached so the AI can continue naturally | Real-time voice replies, transcription, corrections, translation, summaries and Memory updates |
| Apple Inc. | Sign in with Apple verification; when you delete your account we ask Apple to revoke the Service's sign-in authorisation | Sign-in and account management |
| Railway Corporation (US company) | All data on our server (hosting) | Hosting and storage |
| Our email service provider | Emails you send us | Support |
About Google: under the Gemini API terms for Paid Services, Google does not use your prompts or responses to improve its products, but logs prompts and responses for a limited period of time solely for detecting and preventing violations, and this data may be stored transiently or cached in any country. Google's handling is governed by its terms: https://ai.google.dev/gemini-api/terms
Apart from the recipients above and where required by law (e.g. a lawful court or prosecutor's order), we do not disclose your personal data to anyone. We do not sell personal data.
6. Where your data is processed (international transfers)
- Our server is located in Singapore, hosted by Railway Corporation.
- Server data is backed up daily to a computer in Taiwan that only the operator can access, and backups are kept for 30 days.
- Data sent to the Gemini API is processed in Google's facilities, which may be in the United States or other countries.
- Apple processes data as described in Apple's privacy policy.
- On first use, a consent screen asks for your explicit agreement to sending your voice and conversation to Google, and asks you to confirm you are 18 or older.
7. How long we keep it
| Data | Retention |
|---|---|
| Voice audio | Not stored on our server; Google keeps it briefly under its terms |
| Transcripts | Deleted automatically 90 days after each conversation |
| Learning records (phrase bank, practice history) | While your account exists; deleted immediately with your account |
| Memory | While your account exists or until you delete it; time-bound items stop being used after their expiry date |
| Usage and cost metering | The current month plus the previous 24 months, then deleted automatically; de-identified when you delete your account |
| Reports | Deleted automatically after 180 days; de-identified when you delete your account |
| Sign-up IP hash | Kept in memory for 1 hour |
| Server logs (no IP address) | 30 days |
| Support emails | 1 year after the case is closed |
When you delete your account: your account, transcripts, learning records, phrase bank and Memory are deleted from production systems immediately; usage and report records keep only anonymous figures that no longer link to you; copies in backups are deleted as backups rotate within 30 days.
8. Face recognition and biometric data
The app does not offer face recognition and does not collect or use any biometric data, including face images or face features.
9. Your rights
Under Article 3 of the PDPA you may, regarding your personal data: (1) inquire or request to review it; (2) request a copy; (3) request supplements or corrections; (4) request that we stop collecting, processing or using it; (5) request deletion.
How:
- In the app:
- Memory: "Settings > 老師記得的事 (What your partner remembers)" shows everything; swipe to delete one item, tap "全部忘記 (Forget everything)" to clear it (this also clears the topics you talked about and the conversation-opener history), or turn off "記住我說過的事 (Remember what I say)".
- Delete account: "Settings > 隱私 (Privacy) > 刪除帳號與所有資料 (Delete account and all data)". After you confirm, this deletes this account's transcripts, learning records, phrase bank and Memory from our server, revokes the Apple sign-in authorisation and signs this device out. It cannot be undone.
- By email: {{SUPPORT_EMAIL}}. We will verify that you own the account and reply within the time limits set by the PDPA; if we need more time we will tell you why.
10. If you choose not to provide data
- Your voice and conversation text are necessary for speaking practice. If you do not agree to Google processing them, you cannot use the conversation features.
- Memory can be turned off; you can still practise, but the AI partner will not remember earlier conversations.
- Without microphone permission you cannot do speaking practice.
11. People under 18
The app is only for people aged 18 or older and has no children's mode. We ask you to confirm this on first use. We do not knowingly collect personal data from anyone under 18; if we learn we have, we delete the account and its data. If you believe someone under 18 is using the Service, email {{SUPPORT_EMAIL}}.
12. Security
We protect your data with: access-token authentication so each account can only read its own data; HTTPS/TLS encryption between the app and our server; server administration limited to the operator, with the hosting provider responsible for physical and network security.
No system is 100% secure. The Service is not end-to-end encrypted: our server stores your transcripts and learning records as text in order to provide the Service. If a personal data breach occurs, we will notify you as required by law.
13. Tracking and advertising
We use no third-party advertising or analytics SDKs, do not track you across apps or websites, and do not use the advertising identifier. This website uses no cookies or analytics either.
14. Changes
When we change this policy we update the date on this page; for material changes (for example a new recipient, a new purpose, or handling transaction data if paid plans are introduced later) we notify you in the app and ask for consent again where required.
15. Contact
Pipe Up · Alvin Cheng
Email: {{SUPPORT_EMAIL}}