隱私權政策

中文

1我們收集什麼、怎麼收集

• 你的紀錄：留在手機上。每一次戳的時間、統計、月回顧、自訂的按鈕文字和照片，都存在你的 iPhone 上（App 和桌面小工具共用）。我們看不到，也沒有上傳。
• 匿名使用統計：App 被打開、看了哪些畫面、按下按鈕的次數，以及購買流程走到哪一步（點開付費頁、付款成功、登入完成、辦證完成；付款成功和登入完成時另外記是哪一種買法）。附帶手機型號、系統版本、App 版本和語言，以及一個 App 自己隨機產生的識別碼。不包含你的名字、Apple ID、電子郵件、帳號、證明編號、廣告識別碼，也不包含你輸入或選擇的任何內容。
• 你主動送出的回饋：你在「設定 › 回饋」寫的文字和附加的截圖（最多 4 張），連同手機型號、系統版本、App 版本和語言。只有你按下送出才會傳送。
• 全球焦慮排行（自己選擇加入）：預設不上傳。你按下「加入」後，App 會上傳「日期＋當天戳的次數」，搭配一個 App 自己隨機產生的手機識別碼（不是 Apple ID，也不是廣告識別碼；刪除 App 後重裝會換新的），用來算出全球總數、全球焦慮指數、各地區排行、各地區有多少人在戳、每人平均戳幾下，以及你的排名。人數是數這個地區有幾個手機識別碼，不需要多收任何資料。為了算出累計人數，伺服器另外只記「這個手機識別碼在這個地區戳過」，不記次數和時間。伺服器只對外公開地區的加總；一個地區不滿 50 人時，人數和平均都不顯示。伺服器會從連線判斷這次上傳來自哪個地區，這是你戳的時候所在的地方，不是你的國籍或身分。只記地區，不記城市或精確位置，不存 IP 位址，也不需要定位權限。同一個手機識別碼也用來防止少數手機灌高地區排行：每支手機每天算進地區排行的次數有上限，同一天換了地區也共用同一份上限；你在手機上看到的自己的次數不受影響。這個手機識別碼不連到你的帳號、證明或身分。不上傳每一次的時間、自訂文字或照片，也不需要帳號。對戰模式的次數不會上傳。紅按鈕小遊戲的戳數（App 1.0.10 版起）另外計一個全球數字：同樣只在你加入後才上傳，內容是「日期＋當天在紅按鈕小遊戲戳了幾下」，用同一個手機識別碼；不判地區，不算進全球總數、全球焦慮指數和地區排行，也不帶證明、買了什麼或玩的是哪一種按鈕。玩過的人不滿 50 人時，這個數字不顯示。沒加入的人玩紅按鈕小遊戲，什麼都不上傳；最佳成績只存在你的手機上。
• 一年簽（App 1.0.10 版起，自己選擇購買）：付款由 Apple 處理，App 在你的手機上直接向 Apple 確認一年簽還在不在。買一年簽不用登入，我們的伺服器不會收到、也不會存任何一年簽的資料。換手機時，按「恢復購買」就會回來。
• 專業焦慮人士證明（App 1.0.10 版起，自己選擇購買）：不買就不會收集。付款由 Apple 處理，我們拿不到你的信用卡或任何付款資料。付款後所有系列馬上能玩，不用登入，伺服器也還沒有你的資料。辦證後，伺服器會存：你填的名字（不一定要用本名）、你選的焦慮專長（可以不選）、你自己取的代號（可以不取，見下一點）、伺服器發給你的證明編號、這張證明屬於哪個帳號（只存帳號識別碼）、Apple 給這筆購買的交易識別碼（一張證明只有一個）、是正式購買還是測試購買、核發日期，以及證明目前的狀態（有效，或因退款等原因作廢）。Apple 會把退款的通知傳給我們的伺服器，裡面只有交易識別碼和日期，沒有付款資料。伺服器另外記一條只往下寫、不修改的事件紀錄：什麼時候核發、改名、改代號、補照、作廢、退款被撤回。改名和改代號只記「改過」和時間，不記名字或代號本身（新的舊的都不記）；補照不存照片；這條紀錄不記是哪支手機，也不記 IP 位址。
• 代號（App 1.0.10 版起，只有辦了證明才能取，可以不取）：你自己取的代號（例如 @tofus）存在你的證明那一筆，跟著你的帳號。它只印在你的證明上：你把證明圖分享出去，看到圖的人才看得到。App 裡別人看不到、也搜不到，沒有名單或排行。代號不跟戳的次數、地區、成績或排行連在一起，也不放進匿名使用統計。伺服器會擋掉已經有人用的、保留給官方的，以及不雅或仇恨的字詞；為了「24 小時只能改一次」，伺服器會記你上次改代號的時間。改了代號，舊的代號就釋出，別人可以取。
• 帳號（只有辦證明要登入，App 1.0.10 版起）：要拿到印著名字和編號的證明，要用 Apple 或 Google 登入，證明才會存到你的帳號；換手機或重裝 App，登入同一個帳號，名字、專長、代號和編號都會回來，證件照不會回來，要重拍。付了錢還沒登入，所有系列照樣能玩，恢復購買也不用登入，證明可以之後再回來辦。戳戳樂、全球排行、一年簽和免費的紅按鈕小遊戲都不用登入。登入由 AirBuild 代管，它會存：你用哪一家登入、Apple 或 Google 給的使用者識別碼、電子郵件（選 Apple「隱藏我的電子郵件」的話，是 Apple 的轉寄信箱）、Apple 或 Google 有提供的話還有名字，以及登入的工作階段和時間（用來讓你保持登入）。不存大頭照。我們自己的證明資料只存帳號識別碼，不另外存你的電子郵件或名字。我們會用這個電子郵件，偶爾寄活動通知給證明持有人；不想收，寫信告訴我們就不再寄。帳號只連你的證明，不連戳的次數、紅按鈕小遊戲成績、地區或排行的資料。我們不收你的住址。
• 證明上的照片：只在你的手機上。拍照需要相機權限；從相簿選時用的是系統的照片選擇器，App 只拿到你選的那一張，不需要相簿權限。照片只存在 App 裡，不存進相簿，也不上傳。
• 證明和匿名資料不相連。伺服器的證明資料裡沒有你的排行手機識別碼；App 上傳戳數時不帶證明編號。

2資料用來做什麼

• 匿名使用統計：了解有多少人在用、哪些功能有用，用來改進 App。
• 回饋：閱讀並回應你的問題，修正問題。
• 全球排行：計算並顯示全球總數、全球焦慮指數、各地區的戳戳總數排行、各地區人數和每人平均，以及你的排名；另外算出紅按鈕小遊戲的全球戳數。
• 證明：印出你的證明和編號、換手機時恢復。事件紀錄只用來讓證明狀態正確，不分析個人。
• 帳號：讓證明跟著你換手機；偶爾寄活動通知給證明持有人。
• 客服和違規處理：開發者可以在一個只有他能登入的管理頁，查看帳號和證明資料（編號、名字、專長、狀態、代號和改名紀錄、事件紀錄），用來回覆你的來信、清除違規的代號、停用或恢復帳號，或刪除帳號。管理頁沒有證件照（照片只在你的手機上），也沒有 email，看不到任何人的戳次數、地區或分數。

我們不放廣告，不追蹤你跨 App 或網站的行為，也不出售任何資料。證明和帳號資料不拿來投放廣告或分眾，不提供給品牌或任何第三方，也不是證明你真實身分的證件。

3第三方

上面的資料存放在 AirBuild 提供的伺服器上（使用統計、回饋、排行、證明和登入伺服器），只為了替我們執行這些功能，不會拿去做別的用途。App 從 App Store 下載，Apple 依它自己的隱私權政策處理下載和當機報告等資料。兩種買法的付款都由 Apple 處理；登入時，Apple 或 Google 依它們自己的隱私權政策處理你的登入。除此之外，我們不與任何人分享資料。

4保存與刪除

• 手機上的紀錄：刪除 App 就會一起刪除，我們這邊沒有副本。
• 一年簽：我們沒有存，所以沒有要刪的；購買紀錄在 Apple。
• 全球排行：每支手機每天的次數，伺服器只保留 7 天；地區和全球的總數會一直累計。在設定裡退出後，就不再上傳，伺服器上這支手機的資料（包括「在這個地區戳過」那一筆）也會整筆刪除，地區人數也跟著扣掉。紅按鈕小遊戲的逐日次數一樣只保留 7 天，退出時一起刪除，還留著的那幾天也從它的全球數字扣掉。
• 證明和帳號：證明沒有到期日，會一直保存到你自己刪除。因退款作廢的證明，代號會在作廢時馬上清掉、釋出給別人取，留下的紀錄裡沒有代號；其餘從作廢那天起保存 2 年，期滿伺服器會自動刪除，連同它的事件紀錄；編號空著，不會發給別人。你也可以隨時自己刪：在 App「我的」分頁按「刪除帳號」，伺服器上的證明（包括你的代號）、事件紀錄、你的帳號和登入資料，以及這支手機上的證件照，會全部立刻刪掉（管理操作紀錄例外，見下一條）；你的代號會釋出，別人之後可以取。刪掉之後，你的編號就不會再回來，之後再辦會拿到新的編號。刪除資料不會取消一年簽：要停止扣款，請到 iPhone 的「設定」裡取消訂閱（刪除畫面也有直接前往的按鈕）。
• 管理操作紀錄：在管理頁清除代號、停用、恢復或刪除帳號時，會記下誰做的、什麼時候、對哪個編號、做了什麼，保存 2 年後自動刪除。你刪除帳號時這些紀錄不會刪，但只留下編號、動作和時間，帳號和代號都會拿掉。被清掉的代號加進封鎖詞時，只存那個字，不連到帳號或編號。在管理頁刪除帳號時，證明資料立刻刪掉，你的登入資料會在一天內另外刪除；在那之前只留一筆待刪的帳號代碼，刪完就清掉。
• 回饋：保存到問題處理完為止。想刪除你送出的回饋，寫信給我們。
• 匿名使用統計：因為無法對應到你本人，我們沒辦法挑出屬於你的那幾筆；它只用來看整體的使用趨勢。

5撤回同意

全球排行可以隨時在 App 的設定裡退出，退出即撤回同意。帳號資料只在你登入之後才建立；只有辦證明要登入，其他功能（包括一年簽）都不用登入。回饋只在你按下送出時傳送，不送就不會收集。

6聯絡我們

對隱私有任何問題，寫信給 Tofus Wang：terry.f.wang@gmail.com。政策有變動時，我們會更新這一頁和上方的生效日期。

English · 焦慮戳戳樂 (Panic Tracker)

1What we collect and how

• Your records stay on your phone. Every tap time, your statistics, monthly recaps, and your custom button text and photo are stored on your iPhone, shared between the app and its widget. We cannot see them and they are never uploaded.
• Anonymous usage statistics: app opens, screens viewed, panic button taps, and how far the purchase flow got (purchase screen opened, payment completed, sign-in completed, certificate issued; for a completed payment or sign-in, which of the two ways to buy it was). They come with your device model, OS version, app version and language, and a random identifier the app creates. They never include your name, Apple ID, email, account, certificate number, advertising identifier, or anything you type or pick.
• Feedback you choose to send: the message and up to four screenshots you write in Settings › Feedback, with your device model, OS version, app version and language. Sent only when you tap Send.
• Global Panic (opt-in): off by default. Only after you tap Join Global Panic does the app upload the date and that day's tap count, with a random device ID the app creates (not your Apple ID or advertising identifier; reinstalling the app creates a new one), to compute the global total, the global anxiety index, the Region Ranking, how many people tap in each region, the average taps per person, and your ranking. The number of people is a count of device IDs in a region, so nothing extra is collected. To keep the all-time count, the server also records only that a device ID has tapped in a region, with no counts or times. The server publishes only regional totals, and a region with fewer than 50 people shows no head count or average. The server works out which region an upload comes from, based on the connection. That is where you are when you tap, not your nationality or identity. Only the region is kept: no city or precise location, no stored IP address, and no location permission. The same device ID also keeps a few phones from inflating the Region Ranking: each phone's taps count toward the Region Ranking only up to a daily limit, and that limit is shared across regions on the same day. Your own count on your phone is not affected. The device ID is not linked to your account, your certificate or your identity. Individual tap times, custom text and photos are never uploaded, and no account is needed. Battle mode taps are never uploaded. Red Button Challenge taps (from app version 1.0.10) are counted as a separate global number: they are uploaded only after you join, as the date and that day's Red Button Challenge tap count, with the same device ID. No region is worked out, these taps never count toward the global total, the global anxiety index or the Region Ranking, and nothing about your certificate, your purchases or which red button you played is sent. The number stays hidden until at least 50 people have played. If you have not joined, playing uploads nothing, and your best score stays on your phone.
• Yearly Pass (from app version 1.0.10, opt-in purchase): Apple handles payment, and the app checks with Apple on your phone whether your pass is active. The pass needs no sign-in, and our server receives and stores no Yearly Pass data. On a new phone, it comes back with Restore Purchases.
• Pro Worrier Certificate (from app version 1.0.10, opt-in purchase): nothing is collected unless you buy it. Apple handles payment; we never receive your card or any payment details. Right after paying, every series is playable with no sign-in, and the server holds nothing about you yet. Once your certificate is issued, the server stores the name you enter (it does not have to be your real name), the anxiety specialty you pick (optional), the username you choose (optional, see the next item), the certificate number the server gives you, which account the certificate belongs to (the account ID only), Apple's transaction ID for the purchase (one per certificate), whether it is a real or test purchase, the date it was issued, and its status (active, or revoked, for example after a refund). Apple sends our server refund notices containing only the transaction ID and dates, never payment details. The server also keeps an append-only event log: when the certificate was issued, renamed, had its username changed, had its photo retaken, was revoked, or had a refund reversed. A rename or username change records only that it changed and when, never the name or username itself (old or new); a retaken photo stores no photo; the log records no device and no IP address.
• Username (from app version 1.0.10, only with a certificate, optional): the username you choose (for example @tofus) is stored with your certificate and tied to your account. It is printed only on your certificate: people see it only if you share an image of your certificate. No one else can see or search for it in the app, and there are no lists or rankings of usernames. Your username is never linked to your tap counts, region, scores or ranking, and is never included in anonymous usage statistics. The server blocks usernames that are taken, reserved for official use, or offensive or hateful; to allow one change every 24 hours, it records when you last changed it. When you change your username, the old one is released and anyone can take it.
• Account (only for the certificate, from app version 1.0.10): to get the certificate with your name and number, you sign in with Apple or Google so it is saved to your account. On a new phone or after reinstalling, sign in to the same account and your name, specialty, username and number come back; the certificate photo does not, and needs retaking. If you have paid but not signed in yet, every series still works, Restore Purchases needs no sign-in, and you can come back for your certificate later. Tapping, Global Panic, the Yearly Pass and the free button games need no sign-in. Sign-in is run by AirBuild, which stores which service you used, the user ID Apple or Google gives, your email (with Apple's Hide My Email, a relay address from Apple), your name if Apple or Google provides it, and your sign-in sessions and times (to keep you signed in). No profile picture is stored. Our own certificate data keeps only the account ID, not your email or name. We may use that email to occasionally send certificate holders event news; email us and we will stop. Your account is linked only to your certificate, never to your tap counts, button game scores, region or ranking data. We do not collect your postal address.
• Your certificate photo stays on your phone. Taking one needs camera access. Choosing one uses the system photo picker, so the app receives only the photo you pick and needs no photo library access. The photo is kept only inside the app, never saved to your library or uploaded.
• Your certificate is kept apart from anonymous data. The server's certificate data has no ranking device ID; the app never sends your certificate number with tap counts.

2How we use it

• Usage statistics: to see how many people use the app and which features help, so we can improve it.
• Feedback: to read and answer your message and fix problems.
• Global Panic: to calculate and show the global total, the index, total taps per region, people and average taps per person in each region, and your ranking; and to count Red Button Challenge taps worldwide.
• Certificate: to show your certificate and number and restore it on a new phone. The event log is used only to keep the certificate status correct, never to analyse individuals.
• Account: to let your certificate follow you to a new phone, and to occasionally send certificate holders event news.
• Support and moderation: the developer can view account and certificate data (number, name, specialty, status, username and its change history, event log) on an admin page only he can sign in to, to answer your emails, clear usernames that break the rules, disable or restore accounts, or delete accounts. The admin page has no certificate photos (they stay on your phone) and no email addresses, and shows no one's tap counts, region or scores.

We show no ads, do not track you across other apps or websites, and never sell data. Certificate and account data are never used for ad targeting or segmentation, never given to brands or any third party, and is not proof of your real identity.

3Third parties

The data above is stored on servers provided by AirBuild (usage statistics, feedback, ranking, certificate and sign-in servers), which process them only to run these features for us. The app is distributed through the App Store; Apple handles download and crash data under its own privacy policy. Apple processes payments for both ways to buy; when you sign in, Apple or Google handles your sign-in under its own privacy policy. We share data with no one else.

4Retention and deletion

• Records on your phone: deleting the app removes them; we hold no copy.
• Yearly Pass: we store nothing, so there is nothing to delete; the purchase record is with Apple.
• Global Panic: the server keeps each device's daily counts for 7 days; regional and global totals keep adding up. Leave it in Settings and uploads stop; all of this device's data, including the record that it tapped in a region, is deleted from the server, and it no longer counts toward its region's head count. Button game daily counts are also kept for only 7 days and are deleted when you leave, and the days still kept are taken off its global number.
• Certificate and account: a certificate has no end date and is kept until you delete it. When a certificate is revoked after a refund, its username is cleared at once and released for anyone to take, so the kept record has no username; the rest is kept for 2 years from the day it was revoked, then deleted automatically by the server together with its event log; its number stays unused, never given to anyone else. You can delete it yourself at any time: tap Delete Account on the Me tab in the app, and the certificate (including your username), its event log, your account and sign-in data on the server, and the certificate photo on this iPhone are all deleted at once (except the admin action log, see the next item); your username is released and anyone can take it later. Once deleted, your number never comes back, and getting a certificate again gives you a new one. Deleting data does not cancel your Yearly Pass: to stop being charged, cancel the subscription in your iPhone's Settings (the delete screen has a button that takes you there).
• Admin action log: when the admin page is used to clear a username or to disable, restore or delete an account, it records who did it, when, on which number, and what was done. This log is kept for 2 years, then deleted automatically. If you delete your account, these entries stay but keep only the number, the action and the time; your account and username are removed. When a cleared username is added to the blocked words, only the word itself is stored, with no link to any account or number. When an account is deleted from the admin page, its certificate data is deleted at once and its sign-in data is deleted separately within one day; until then only a pending-deletion account ID is kept, and it is cleared once that is done.
• Feedback: kept until your issue is handled. Email us to have your feedback deleted.
• Usage statistics: because they cannot be tied to you, we cannot single out your records; they are used only to see overall trends.

5Withdrawing consent

Leave Global Panic in the app's Settings at any time to withdraw consent. Account data exists only after you sign in; only the certificate requires sign-in; nothing else needs it, including the Yearly Pass. Feedback is only sent when you tap Send.

6Contact

Privacy questions go to Tofus Wang at terry.f.wang@gmail.com. If this policy changes, we will update this page and its effective date.

Effective October 26, 2026