Oyanu 隐私政策
Oyanu 由 AmcoreAI 运营（以下称"我们"）。本政策说明我们收集哪些数据、用途、由谁处理、保存多久，以及你如何删除。联系邮箱：privacy@amcoreai.com。
1. 我们收集的数据
| 类别 | 具体内容 | 用途 |
|---|---|---|
| 账号 | 用户 ID；你选择的登录方式对应的邮箱、手机号或 Google 账号基本信息（姓名、邮箱）；昵称、头像；应用语言；隐私设置（谁能私信/加我） | 登录、显示你的资料、按你的语言发送通知、执行你的隐私设置 |
| 位置 | 你上报避坑情报时设备的精确位置（经纬度会随该情报公开显示）；发帖时所选城市及其坐标；"用当前定位推荐"或查看附近结伴活动时的位置（仅在设备上用于匹配城市、计算距离） | 把情报放到地图上、给帖子标注城市。只在你主动操作时获取；除下方「实时位置分享」外，不在后台获取位置 |
| 实时位置分享（SOS） | 你在 SOS 页开启分享后，手机的最新位置（经纬度与精度）约每 30 秒更新一次，以及你选中的好友、分享时长（1/4/8 小时）。分享期间应用以带常驻通知的前台服务运行，不申请后台定位权限；只保存最新位置，不保存轨迹 | 让你选中的好友在紧急情况下看到你在哪儿 |
| 结伴活动 | 你发起的活动的标题、说明、时间、城市与集合地点（含坐标）、人数上限；报名者的用户 ID 与昵称 | 提供同城结伴功能 |
| 关注的城市 | 你关注的城市（名称、国家、坐标），最多 5 个；设备据此订阅城市避坑提醒的推送主题 | 在这些城市附近出现新的高危情报时提醒你 |
| 照片 | 你拍摄或从相册选择并上传的照片（帖子、头像、私信）。上传前在设备上压缩并重新编码，照片内的拍摄位置等 EXIF 信息不会上传 | 显示你发布的内容 |
| 私信语音消息 | 你在私信中按住录制的语音（最长 60 秒，在手机上编码为 AAC/.m4a，约 32 kbps，单声道）及其时长。上传到 Firebase Cloud Storage 的 dm/{会话 ID}/{你的用户 ID}/ 路径下，消息里只保存存储路径，不生成公开下载链接；按规则只有该会话的两位成员能读取（不能列出目录）。播放过的语音会缓存在手机的应用缓存中。只在你按下录音时使用麦克风 | 在私信中发送和播放语音消息 |
| 你发布的内容 | 帖子、评论、点赞、避坑情报、私信（文字和图片）、好友请求、举报、屏蔽名单、旅行账本（仅你本人可见） | 提供社区、私信、好友、账本功能；审核举报 |
| 设备推送令牌 | Firebase Cloud Messaging 令牌与你的通知开关 | 发送私信、评论、点赞、好友通知 |
| 崩溃日志 | 应用崩溃时的堆栈、设备型号、系统版本、应用版本、随机安装 ID（Firebase Crashlytics）。不包含你的姓名、邮箱或用户 ID | 发现并修复崩溃 |
| 应用完整性 | Firebase App Check / Google Play Integrity 生成的设备与应用完整性证明 | 防止非官方客户端滥用我们的服务 |
| 你发给 AI 的文字 | AI 锦囊的目的地、AI 识单时粘贴的账单文字 | 经我们的服务器转发给 Google Gemini 生成结果；我们不保存这些文字，只记录调用次数用于限流 |
| AI 识单照片 | 你在 AI 识单中拍摄或从相册选择的小票、账单照片（先在手机上压缩为 JPEG） | 经我们的服务器转发给 Google Gemini 识别金额和项目，结果填入你的账本；照片不保存在我们的服务器或云存储中，只记录调用次数用于限流 |
| 城市搜索 | 你输入的城市关键词 | 经我们的服务器转发给 Google Places 返回城市；不保存 |
| 广告统计 | 广告位的展示和点击次数（按广告、按天汇总），以及用于限制重复计数的临时记录（含用户 ID，几天内自动删除） | 统计我们自己投放的广告效果。我们不使用广告 ID，也不向广告网络共享数据 |
| 省钱好物点击 | 「省钱好物」中各合作网站的点击次数（按合作方、按天汇总，不含用户 ID），以及用于限制重复计数的临时记录（含用户 ID，几天内自动删除） | 了解哪些推荐有用；推广链接的佣金结算由联盟平台完成 |
| 直播 | 你开播时摄像头与麦克风的实时音视频（经 Agora 实时传输，不录制、不保存）；直播标题、城市标签、封面图；观看时的在线状态（约每 30 秒更新）、弹幕、点赞；主播的禁言/踢出记录 | 提供直播功能。直播功能目前仅对受邀用户开放，尚未对所有用户开放。 |
| 一对一语音/视频通话 | 通话中摄像头与麦克风的实时音视频（经 Agora 实时传输，不录制、不保存）；通话信息：主叫和被叫的用户 ID、主叫昵称、所属私信会话、语音或视频、状态（接通、拒接、未接、占线、取消）以及发起、接听、结束时间；通话结束后在该私信会话中写入一条通话记录（通话类型、结果和时长）；来电通知通过 Firebase Cloud Messaging 发送到被叫的设备 | 接通通话、提醒来电和未接来电、在私信中显示通话记录；限制每小时的通话次数，防止骚扰 |
| 离线城市包 | 你下载的城市避坑情报、紧急电话和常用短语 | 只保存在你的手机里，供断网时查看；可随时删除 |
| 国籍（可选） | 你在 我 → 设置 → 国籍 中选择的国家 | 只保存在你的手机里，用于在 SOS 中显示本国外交部热线和驻当地使馆电话；不上传。可随时清除 |
| 机票低价日历 | 你输入的出发城市、到达城市和月份。由我们的服务器转给 Travelpayouts 查询票价，不附带你的账号信息；同一查询的结果在服务器缓存 6 小时。用于限制查询次数的临时计数含用户 ID，一小时后失效 | 显示每天最低的单程票价；点击日期后，在浏览器中通过推广链接打开 Aviasales |
我们不出售你的数据，不使用广告 ID，不接入第三方广告或行为分析 SDK。
2. 谁能看到
- 其他用户：你的昵称、头像、好友数、帖子、评论、避坑情报（含位置）对所有登录用户可见。私信只对会话双方可见。邮箱、手机号、推送令牌、账本、屏蔽名单和关注的城市只有你自己能读取。
- 实时位置：只有你选中的好友在分享期间能看到；分享结束后任何人都无法再读取。
- 结伴活动：活动内容、地点，以及发起人和报名者的昵称对所有登录用户可见。
- 直播：直播画面、标题、封面、城市、弹幕和在线观众昵称对进入直播间的登录用户可见。
- 通话：通话音视频和通话信息只有通话双方能看到；通话记录作为私信的一部分，只对会话双方可见。
- 审核人员：只能查看举报内容并处理被举报的帖子、评论和情报，无法读取私信。
- 数据处理方：Google LLC（Firebase 身份验证、Cloud Firestore、Cloud Storage、Cloud Functions、Cloud Messaging、Remote Config、Crashlytics、App Check、Gemini API、Places API），数据存放在 Google Cloud 新加坡区域（asia-southeast1）；直播和一对一通话的音视频由 Agora（声网）实时传输，不经我们的服务器、不录制。汇率来自欧洲央行参考汇率（frankfurter.dev），请求中不含个人数据。机票低价日历的票价和城市名来自 Travelpayouts，我们的服务器只向它发送城市和月份，不发送个人数据。
- 法律要求：仅在法律要求时依法提供。
3. 保存期限
- 账号和内容保存到你删除它们或删除账号为止。
- 删除账号后立即删除；举报记录保留供审核，但不再关联你的身份；删除日志只保存一个无法还原的哈希值与时间。
- 崩溃日志最多保存 90 天；限流计数、广告和省钱好物计数的临时记录会自动过期。
- 实时位置在分享结束、你停止分享或退出登录时删除；到期未删除的由服务器在 10 分钟内清理。
- 结伴活动在开始 6 小时后归档，不再接受报名；发起人可随时取消（删除）。
- 直播结束后，直播间记录（标题、封面、城市、弹幕、点赞数）保留到主播删除账号为止；音视频不保存。
- 通话音视频不保存；通话信息保留到通话任一方删除账号为止，私信中的通话记录与该会话一起删除。AI 识单照片在识别完成后即丢弃，不保存。
- 私信语音消息保存到会话任一方删除账号为止，届时该会话的消息、照片和语音文件一起从服务器删除；手机上的缓存可通过清除应用缓存或卸载应用删除。
4. 你的选择与权利
- 删除账号：App 内「我 → 设置 → 删除账号」，或网页 ranger-520.web.app/delete-account。
- 修改：随时修改昵称、头像、隐私和通知设置；删除自己的帖子、评论和情报。
- 权限：相机、位置、通知权限都可在系统设置中关闭，关闭后相关功能不可用，其他功能照常。
- 访问或更正：发邮件至 privacy@amcoreai.com，我们会在 30 天内答复。
- 设备备份：应用数据不会进入手机云备份或换机迁移。
5. 儿童
Oyanu 面向 13 岁及以上的用户（所在地法律要求更高年龄的，以当地为准）。我们不会有意收集儿童的个人数据；如发现，请联系我们删除。
6. 安全
数据传输全程加密（HTTPS/TLS）；访问受 Firebase 安全规则限制；密钥只保存在服务器端的 Secret Manager 中，不放在 App 里。
7. 变更
政策变更会在本页更新生效日期；重大变更会在 App 内提示。
8. 网站 Cookie 与联盟脚本（Travelpayouts）
本网站的公开页面（首页、隐私政策、服务条款、加好友页）使用联盟营销平台 Travelpayouts 的 Drive 脚本：它把页面上与旅行相关的链接转换为推广链接。你通过这些链接购买时，我们可能获得佣金，不影响你的价格。删除账号页和管理后台不加载该脚本。
- Cookie 与数据：脚本从 Travelpayouts 的服务器（emrldtp.com）加载，可能设置或读取 Cookie，并记录你的 IP 地址、浏览器信息和点击的链接，用于统计点击和归因成交；这些数据由 Travelpayouts 按其隐私政策处理。
- 欧盟、欧洲经济区和英国的访客：在你点击「允许」之前不会加载该脚本（按浏览器时区判断）。
- 其他地区：默认加载，页面底部的提示可以关闭它。
- 如何退出：随时点下方「Cookie 设置」关闭或重新开启；你的选择只保存在本浏览器中。你也可以在浏览器里清除本站 Cookie 或阻止第三方 Cookie。
- Oyanu App 内不加载任何第三方网页脚本。App 若提供推广链接，只会在链接地址中带推广标识，并在页面上注明。
Google Play 和 Google Play 徽标是 Google LLC 的商标。
Oyanu Privacy Policy
Oyanu is operated by AmcoreAI ("we"). This policy explains what we collect, why, who processes it, how long we keep it and how you can delete it. Contact: privacy@amcoreai.com.
1. What we collect
| Category | Details | Why |
|---|---|---|
| Account | User ID; the e-mail, phone number or basic Google account info (name, e-mail) of the sign-in method you choose; nickname, profile photo; app language; privacy settings (who can message / add you) | Sign-in, showing your profile, notifications in your language, applying your privacy settings |
| Location | Your device's precise location when you post a safety report (its coordinates are shown publicly with the report); the city you pick for a post and its coordinates; your location when you tap "suggest from my location" or look for nearby meetups (used on the device only to match a city or measure distance) | Placing reports on the map and tagging posts with a city. Only when you act; apart from live location sharing below, never in the background |
| Live location sharing (SOS) | Once you start sharing on the SOS page: your phone's latest position (coordinates and accuracy), updated about every 30 seconds, the friends you chose and the duration (1, 4 or 8 hours). While sharing, the app runs a foreground service with a persistent notification; it does not ask for background location permission. Only the latest position is kept, never a track | Letting the friends you chose see where you are in an emergency |
| Meetups | Title, description, time, city and meeting point (with coordinates) and group size of meetups you host; user IDs and nicknames of those who join | Providing travel-buddy meetups |
| Followed cities | Up to 5 cities you follow (name, country, coordinates); your device subscribes to their alert topics | Alerting you to new danger reports near those cities |
| Photos | Photos you take or pick and upload (posts, profile photo, messages). They are compressed and re-encoded on the device first, so location and other EXIF data are not uploaded | Showing what you publish |
| Voice messages in chats | Voice clips you hold to record in a direct message (up to 60 seconds, encoded on the phone as AAC / .m4a, about 32 kbps mono) and their length. They are uploaded to Firebase Cloud Storage under dm/{chat ID}/{your user ID}/; the message stores only the storage path, never a public download link, and the rules let only the two members of that chat read them (no folder listing). Clips you play are cached in the app's cache on your phone. The microphone is used only while you hold to record | Sending and playing voice messages in direct messages |
| Your content | Posts, comments, likes, safety reports, direct messages (text and photos), friend requests, reports, your block list, travel ledger (visible to you only) | Community, messaging, friends and ledger features; reviewing reports |
| Device push token | Firebase Cloud Messaging token and your notification switches | Notifications for messages, comments, likes and friend requests |
| Crash logs | Stack trace, device model, OS and app version and a random installation ID when the app crashes (Firebase Crashlytics). No name, e-mail or user ID | Finding and fixing crashes |
| App integrity | Device and app integrity attestations from Firebase App Check / Google Play Integrity | Keeping unofficial clients from abusing our services |
| Text you send to the AI | The destination for AI tips and receipt text you paste for AI receipt scan | Forwarded by our server to Google Gemini to produce the answer; we don't store the text, only a call count for rate limiting |
| Receipt photos for AI receipt scan | The receipt or bill photo you take or pick for AI receipt scan (compressed to JPEG on your phone first) | Forwarded by our server to Google Gemini to read the amounts and items into your ledger; the photo is not stored on our servers or in cloud storage, we only keep a call count for rate limiting |
| City search | What you type in city search | Forwarded by our server to Google Places; not stored |
| Ad statistics | Impressions and clicks per ad per day, plus short-lived records (with your user ID, deleted automatically within a few days) that stop double counting | Measuring our own ad slots. We don't use the advertising ID and share nothing with ad networks |
| Smart deals clicks | How often each partner site in Smart deals is opened (per partner and day, without user IDs), and short-lived records to avoid counting repeats (with your user ID, deleted within days) | Knowing which recommendations help; commissions on affiliate links are settled by the affiliate platform |
| Live streaming | Your camera and microphone while you are live (sent in real time through Agora; not recorded or stored); live title, city tag and cover image; while watching, your presence (updated about every 30 seconds), danmaku and likes; the host's mute / remove decisions | Providing live streaming. Live streaming is currently available only to invited users and is not yet open to everyone. |
| 1:1 voice and video calls | Your camera and microphone during a call (sent in real time through Agora; not recorded or stored); call details: the caller's and callee's user IDs, the caller's nickname, the chat it belongs to, voice or video, the outcome (answered, declined, missed, busy, cancelled) and when it started, was answered and ended; after the call, a call entry in that chat (type, outcome and duration); the incoming-call notification is sent to the callee's devices through Firebase Cloud Messaging | Connecting calls, alerting you to incoming and missed calls, showing the call in your chat; an hourly limit on calls against harassment |
| Offline city packs | The scam alerts, emergency numbers and phrases you download for a city | Stored only on your phone for use without a connection; delete them any time |
| Nationality (optional) | The country you choose in Me → Settings → Nationality | Stored only on your phone, to show your country's foreign ministry line and embassy in SOS; never uploaded. Clear it any time |
| Low-fare calendar | The departure city, destination and month you type. Our server passes them to Travelpayouts to look up fares, without your account details; the answer to the same search is cached on the server for 6 hours. A short-lived counter that limits searches includes your user ID and resets after an hour | Showing the cheapest one-way fare for each day; a tapped day opens Aviasales in your browser through an affiliate link |
We don't sell your data, don't use the advertising ID and don't include third-party advertising or behavioural analytics SDKs.
2. Who can see it
- Other users: your nickname, photo, friend count, posts, comments and safety reports (with their location) are visible to signed-in users. Messages are visible to the two people in the chat only. Your e-mail, phone number, push tokens, ledger, block list and followed cities are readable by you only.
- Live location: only the friends you chose, and only while sharing lasts; nobody can read it afterwards.
- Meetups: the meetup, its place and the nicknames of the host and those who join are visible to signed-in users.
- Live streams: the video, title, cover, city, danmaku and viewers' nicknames are visible to signed-in users in the room.
- Calls: call audio, video and call details are visible to the two people on the call only; the call entry is part of the chat and visible to its two people only.
- Moderators: see reports and can remove reported posts, comments and safety reports; they cannot read direct messages.
- Processors: Google LLC (Firebase Authentication, Cloud Firestore, Cloud Storage, Cloud Functions, Cloud Messaging, Remote Config, Crashlytics, App Check, Gemini API, Places API), stored in Google Cloud's Singapore region (asia-southeast1). Audio and video of live streams and 1:1 calls are carried in real time by Agora, without passing through our servers and without being recorded. Exchange rates come from the European Central Bank via frankfurter.dev, without personal data. Fares and city names in the low-fare calendar come from Travelpayouts; our server sends it only the cities and the month, no personal data.
- Legal requests: only when the law requires it.
3. How long we keep it
- Your account and content stay until you delete them or your account.
- Deleting your account removes it immediately; reports you filed stay for moderation without your identity; the deletion log keeps only a one-way hash and the time.
- Crash logs are kept for up to 90 days; rate-limit, ad and Smart deals counting records expire automatically.
- Your live location is deleted when sharing ends, when you stop it or when you sign out; anything left after it expires is removed by the server within 10 minutes.
- Meetups are archived 6 hours after they start (no more joins); the host can cancel (delete) them at any time.
- After a live ends, its record (title, cover, city, danmaku, like count) stays until the host deletes their account; audio and video are not stored.
- Call audio and video are not stored; call details stay until either person on the call deletes their account, and the call entry in a chat is deleted with that chat. Receipt photos are discarded once they are read and never stored.
- Voice messages stay until either member of the chat deletes their account, when that chat's messages, photos and voice files are all deleted from our servers; the copy cached on your phone goes when you clear the app's cache or uninstall it.
4. Your choices and rights
- Delete your account: in the app, Me → Settings → Delete account, or on the web at ranger-520.web.app/delete-account.
- Change: edit your nickname, photo, privacy and notification settings; delete your own posts, comments and reports at any time.
- Permissions: camera, location and notifications can be turned off in system settings; only the related features stop working.
- Access or correction: e-mail privacy@amcoreai.com; we reply within 30 days.
- Device backup: app data is excluded from cloud backup and phone-to-phone transfer.
5. Children
Oyanu is for people aged 13 and over (or older where local law requires). We don't knowingly collect children's data; contact us and we will delete it.
6. Security
All traffic is encrypted (HTTPS/TLS); access is enforced by Firebase security rules; API keys live only in Secret Manager on the server, never in the app.
7. Changes
Changes are published here with a new effective date; important changes are announced in the app.
8. Website cookies and the affiliate script (Travelpayouts)
The public pages of this website (home, privacy policy, terms, add-friend page) use the Drive script of the affiliate marketing platform Travelpayouts. It turns travel-related links on the page into affiliate links: if you buy through them we may earn a commission, at no extra cost to you. The account deletion page and the admin console don't load it.
- Cookies and data: the script is loaded from Travelpayouts' servers (emrldtp.com) and may set or read cookies and record your IP address, browser details and the links you click, to count clicks and attribute purchases. Travelpayouts processes this data under its own privacy policy.
- Visitors in the EU, EEA and UK: the script is not loaded until you choose "Allow" (based on your browser's time zone).
- Everywhere else: it loads by default, and the notice at the bottom of the page can turn it off.
- How to opt out: use "Cookie settings" below at any time to turn it off or back on; your choice is stored only in this browser. You can also clear this site's cookies or block third-party cookies in your browser.
- The Oyanu app loads no third-party web scripts. Any affiliate links in the app only carry an affiliate id in the link address and are labelled as such.
Google Play and the Google Play logo are trademarks of Google LLC.