隐私政策
轻递是一款为当前配对的两个人提供投递、健康状态摘要与自愿位置共享的 iPhone 和 Apple Watch App。我们不出售个人数据，也不使用个人数据投放广告或跨 App 跟踪。
简体中文
我们处理哪些数据
- 账户与设备：通过“使用 Apple 登录”取得的稳定用户标识、App 安装标识、设备类型、通知令牌及推送环境。
- 个人资料与配对：昵称、头像、配对邀请码、当前配对关系及共享设置。
- 投递内容：投递卡、定时投递、发送与回应记录。提醒自己的本地提醒主要保存在设备上。
- 健康摘要：经你授权后，App 在设备上读取 HealthKit 中的心率、血氧、呼吸频率、手腕温度、HRV、睡眠和活动数据，并上传你选择共享类别的派生摘要。HealthKit 的逐条原始样本不会上传。
- 位置：只有你主动开启最近位置共享后，才保存最近一次合格坐标、精度和采集时间；只有再次单独开启轨迹共享后，才保存经过抽稀的近期轨迹点。
- 购买：为确认 Apple 免费试用、自动续订状态及有效期而处理的 App Store 交易标识与订阅状态。我们不会获得你的银行卡或完整付款资料。
- 运行与诊断：请求时间、结果、隐私安全的错误类别及必要的服务日志，用于可靠性、安全与故障排查。
为什么处理这些数据
用于登录、配对、投递与通知、同步 iPhone 和 Apple Watch、向当前配对的人展示你明确同意共享的状态或位置、执行定时任务、验证购买，以及防止滥用和修复故障。
共享范围
你选择共享的健康摘要、最近位置、轨迹、资料和投递会向当前配对的人展示。我们也会使用完成服务所必需的基础设施和处理方，例如 Apple 的登录、HealthKit、App Store 与推送服务，以及托管、数据库和网络服务商。我们不会向数据经纪商出售数据，也不会用于广告画像。
保存与删除
- 共享健康摘要和轨迹仅保留最近 14 天；关闭相应共享后，对方不再看到该类别，关闭轨迹共享会删除轨迹记录。
- 关闭最近位置共享会撤回最近位置并同时停止轨迹共享。
- 账户、资料、配对、投递和购买权益记录会在提供服务所需期间保存，或直到你在 App 内删除账户；法律要求另行保存的记录除外。
- 你可在“我们 → 删除轻递账号”永久删除轻递 app user 及关联的服务端数据。该操作无法撤销，但不会删除同一 Wristlab 账号在其他 App 中的数据、membership 或权益。
你的选择
健康、通知和位置权限由 Apple 的系统授权控制。你可以随时在“我们”中关闭某类共享，并可在 iPhone“设置”或“健康”App 中撤回系统权限。撤回权限不会影响撤回前已经合法完成的处理。
安全与健康说明
我们使用 HTTPS 传输和访问控制保护数据，但任何系统都无法保证绝对安全。轻递展示的压力、睡眠、活动和身体变化只用于生活方式参考，不提供医学诊断、治疗或紧急预警。
儿童与政策更新
轻递并非面向儿童设计。我们可能随产品或法律变化更新本政策；重大变化会通过 App 或本页面说明，并更新生效日期。
English
Data we process
- Account and device: the stable user identifier supplied by Sign in with Apple, an app installation identifier, device type, notification token, and push environment.
- Profile and pairing: display name, avatar, pairing invite, current pairing, and sharing choices.
- Deliveries: delivery cards, scheduled deliveries, sending history, and reactions. Personal reminders are primarily stored on the device.
- Health summaries: with permission, the app reads heart rate, blood oxygen, respiratory rate, wrist temperature, HRV, sleep, and activity from HealthKit. Processing happens on device and only derived summaries for the categories you choose are uploaded. Individual raw HealthKit samples are not uploaded.
- Location: only after you enable latest-location sharing do we store the latest qualifying coordinate, accuracy, and capture time. Reduced route points are stored only after you separately enable route sharing.
- Purchases: App Store transaction identifiers, introductory free-trial status, subscription status, and expiration needed to provide auto-renewing VIP. We do not receive card or full payment details.
- Operations and diagnostics: request timing, outcomes, privacy-safe error classes, and necessary service logs for reliability, security, and troubleshooting.
How we use data
We use it to sign you in, pair two people, deliver notifications, synchronize iPhone and Apple Watch, show the current pair only the status or location you chose to share, run scheduled actions, verify purchases, prevent abuse, and fix failures.
Who receives data
Your chosen health summaries, latest location, route, profile, and deliveries are visible to the person currently paired with you. We also rely on providers necessary to operate the service, including Apple services for authentication, HealthKit, App Store purchases, and notifications, plus hosting, database, and network providers. We do not sell data to brokers or use it for advertising profiles.
Retention and deletion
- Shared health summaries and route points are limited to the most recent 14 days. Disabling a category hides it from your pair; disabling route sharing deletes route history.
- Disabling latest-location sharing withdraws the latest location and also stops route sharing.
- Account, profile, pairing, delivery, and entitlement records remain while needed to provide the service or until in-app account deletion, except where law requires limited retention.
- Use “Us → Delete Wrist Signal Account” to permanently remove the Wrist Signal app user and associated service data. This cannot be undone, but it does not delete data, memberships, or entitlements in other Wristlab apps under the same account.
Your choices
Apple system permissions control access to Health, notifications, and location. You may disable each sharing category in the app and revoke system access in iPhone Settings or the Health app at any time.
Security and health notice
We use HTTPS in transit and access controls, but no system can guarantee absolute security. Stress, sleep, activity, and body-change results are lifestyle references only—not medical diagnosis, treatment, or emergency alerts.
Children and changes
Wrist Signal is not designed for children. We may update this policy as the product or law changes. Material changes will be described in the app or on this page with a revised effective date.
联系 / Contact
开发者 / Developer: Lin Qun
Email: linqun0123@gmail.com · 微信 / WeChat: MomentChaserf
数据存储地区 / Data storage region
正式版登录时，App 根据当前 App Store 商店区域使用中国大陆或新加坡的服务。TestFlight 测试版允许在登录前手动选择服务区域。账号与云端数据保存在所选服务区域；已登录会话不会随旅行或商店变化自动迁移。两个区域的数据独立，退出后切换商店区域再登录可能进入另一套账号。删除账号只处理当前登录区域内本 App 的账号与数据，另一地区的账号需在该地区登录后另行管理。
At sign-in, the App Store version uses services in mainland China or Singapore according to the current App Store storefront. The TestFlight version also lets testers choose a service region before signing in. Your account and cloud data remain in the selected service region; travel or storefront changes do not move an active session. The regions store data independently. Signing out, changing storefront and signing in again may open a separate account. Account deletion applies to this app in the signed-in region; an account in the other region must be managed by signing in there.
为更新订阅状态，Apple 签名的购买通知会在两个服务区域分别验证处理；只有持有对应账号的区域会更新权益。
Apple-signed purchase notifications are verified and processed in both service regions to update subscriptions; only the region holding the matching account updates its entitlements.
界面语言
登录后，iPhone 会随账号请求上报此 App 实际使用的界面语言。服务端按此 App 与账号保存语言代码及最后一次语言变化的时间，用于本地化支持和问题排查。它不包含记录内容，不用于广告或跨 App 跟踪，也不能确认你的国籍。删除此 App 的账号时会一并删除；退出登录停止上报，但保留已有值。
Interface language
After sign-in, your iPhone reports this App's active interface language with account requests. Our service stores the language code and the time of its last change for this App and account to support localization and troubleshooting. It contains no record content and is not used for advertising, cross-app tracking, or determining nationality. Deleting this App's account removes it. Signing out stops reporting while retaining the existing value.
首次使用体验统计 / First-use analytics
为了解首次使用在哪一步中断，我们记录此 App 专属的随机安装标识、引导步骤及尝试结果、前台耗时、版本、实际界面语言、安装来源与 App Store 国家／地区。登录后可关联本 App 的账号，购买只记录已验证的成功及同步结果，不采集表单、任务、照片、健康、位置或原始交易内容。正式、TestFlight 和调试数据分开保存；行为记录保留 90 天，删除本 App 账号时删除关联流程。数据仅用于改进体验，不用于广告或跨 App 跟踪。
To understand where first use stops, we record an app-specific random installation identifier, onboarding steps and attempt outcomes, foreground duration, app version, active interface language and installation source. After sign-in, observations may be linked to your account in this app. Purchase observations contain verified success and synchronization outcomes, never form, task, photo, health, location or raw transaction content. Production, TestFlight and debug data are separated. Behavior records are retained for 90 days; deleting this app account removes linked flows. These data improve the experience and are not used for advertising or cross-app tracking.
为区分首次下载、更新与重装，我们临时处理 Apple 已验证的 App 下载交易，只保存此 App 专属的匿名下载标识、原始下载时间、来源及有限错误类别，并用于关联引导与购买转化。原始签名与 Apple 标识不保存或写入日志，不用于广告或跨 App 跟踪。关联账号删除时清理对应记录，匿名行为与来源摘要保留 90 天。