Spendie 隐私政策
生效日期：2026 年 10 月 5 日
简单说：你的账本、收据图片只给你自己看。为了识别收据，图片会发送给 Google Gemini（付费 API）读取文字，不会被用来训练模型。我们不卖你的资料，也不用你的收据或记账数据投放广告。你可以随时导出或删除全部数据。
1. 谁在运营 Spendie
Spendie（App 与网站 spendie-blue.vercel.app）由个人开发者运营。联系方式：chloeceyi.888@hotmail.com。
2. 我们收集哪些资料、为什么
| 资料 | 用途 |
|---|---|
| 邮箱地址、密码（以加密哈希保存，我们看不到明文）、昵称 | 建立和登录账号 |
| 头像选择（女孩 / 男孩 / 兔兔）；你上传的头像照片只保存在你的设备上，不会上传 | 显示头像 |
| 收据图片 | 识别收据内容、作为记录的附件；保存在只有你能访问的私人存储空间 |
| 记账资料：交易、分类、预算、订阅、存钱目标、备注、识别结果和你的修改 | 提供记账、统计、日记等功能 |
| 语言、币种、时区、主题等设置 | 按你的偏好显示 |
| AI 扫描次数和用量（模型、token 数、费用估算、耗时、成功或失败），不含收据内容 | 计算每月免费次数与会员合理使用、控制成本、排查问题 |
| 错误记录（错误代码，不含收据内容、卡号或密码） | 修复问题 |
| 会员订阅状态（Apple 提供的商品、交易编号、购买与到期日期、续订、退款状态） | 开通和管理会员。付款由 Apple 处理，我们看不到你的银行卡或付款资料 |
| 邮箱的加盐哈希值（不是邮箱本身）及每月免费扫描次数 | 防止删除账号后用同一邮箱重复领取当月免费次数；删除账号后仍保留 |
我们不收集你的位置、通讯录、健康资料，也不连接你的银行账户。
3. 收据识别（第三方 AI）
你选择拍收据或上传收据识别时，图片会经由我们的服务器发送给 Google Gemini API（付费服务）读取商家、日期、金额、税费和商品等文字。第一次识别前，App 会请你同意。按 Google 付费服务条款，这些内容不会用于改进 Google 的产品或训练模型，但 Google 可能按其政策在一段时间内保留请求数据用于滥用监测。识别结果只作为建议，由你核对后才保存。你也可以完全不使用识别，只手动记账。
4. 广告（只限 iPhone App 的免费用户）
免费用户在 iPhone App「发现」页的功能列表下方会看到一处 Google AdMob 广告，并标有「广告」。会员不会看到、也不会加载任何广告。网站上没有广告。
- 广告不使用你的收据、记账或任何财务资料。
- 我们不请求 App 跟踪授权（不使用广告标识符 IDFA），只请求非个性化广告。
- Google 会按其政策处理设备信息和广告互动等资料，用于投放广告、统计和防止欺诈。在法律要求的地区（例如欧洲），App 会先显示 Google 的同意窗口，你可以在 App 的「隐私与安全 → 广告隐私选项」随时修改。
5. 我们和谁共享资料
我们不出售你的个人资料。只在提供服务所必需的范围内，使用以下服务商：
- Supabase：数据库、登录、私人文件存储和服务器功能，资料储存在新加坡（ap-southeast-1）。
- Google：Gemini API（收据识别）、AdMob（免费用户的广告）。
- Apple：App 内购买与订阅。
- Vercel：网站托管。
法律要求时，我们可能需要依法提供资料。
6. 保存多久、怎么删除
- 你的账号和账本资料会一直保存，直到你删除。你可以随时删除单笔记录或单张收据。
- 在 App「我的 → 隐私与安全 → 删除账号与全部数据」可以永久删除账号、所有记录、收据图片和设置。
- 删除后仍会保留的：上述邮箱哈希值；不含个人身份的 AI 用量统计（已与账号断开）；服务商备份（如有）会在其备份周期内自然过期；Apple 依其政策保留的购买记录。
- 删除账号不会自动取消 Apple 订阅。请在 iPhone「设置 → Apple ID → 订阅」或 App 的「管理订阅」取消。
7. 你的权利
你可以随时在 App 中查看、修改、导出（CSV / JSON）或删除你的资料，也可以撤回识别同意（不再使用收据识别）。如需协助或对资料处理有疑问，请发邮件给我们。我们依照马来西亚《2010 年个人资料保护法》（PDPA）处理个人资料。
8. 安全
传输全程加密（HTTPS）。每位用户的资料以数据库权限规则相互隔离，收据图片存放在私人存储空间，只能通过短时间有效的签名链接查看。API 密钥只保存在服务器端。
9. 儿童
Spendie 不是为 13 岁以下儿童设计的，我们不会有意收集儿童的个人资料。
10. 政策更新
如有重要变更，我们会更新本页的生效日期，并在 App 内提示。
Spendie Privacy Policy (English)
Effective 5 October 2026
In short: your ledger and receipt images are private to you. To read a receipt, the image is sent to Google Gemini (paid API), which does not use it to train models. We never sell your data and never use your receipts or financial data for ads. You can export or delete everything at any time.
Who runs Spendie
Spendie (the app and spendie-blue.vercel.app) is run by an individual developer. Contact: chloeceyi.888@hotmail.com.
What we collect and why
- Email, password (stored as a secure hash) and nickname — to run your account.
- Avatar choice; an uploaded avatar photo stays on your device only.
- Receipt images — for recognition and as attachments, kept in private storage only you can access.
- Your records, categories, budgets, subscriptions, goals, notes, recognition results and your corrections — to provide the app.
- Settings (language, currency, time zone, theme).
- AI-scan usage (model, tokens, estimated cost, duration, success/failure; no receipt content) — for the monthly free scans and member fair use, cost control and troubleshooting.
- Error codes (no receipt content, card numbers or passwords).
- Subscription status from Apple (product, transaction ids, dates, renewal and refund status). Payments are handled by Apple; we never see your card details.
- A salted hash of your email (not the email itself) with the number of free scans used each month, so deleting and re-registering does not reset them; kept after account deletion.
Receipt recognition
When you choose to scan a receipt, the image is sent through our server to the Google Gemini API (paid service). You are asked for consent before the first scan. Under Google's paid-service terms the content is not used to improve Google's products or train models; Google may keep request data for a limited time for abuse monitoring. Results are suggestions you confirm before anything is saved. Manual entry works without recognition.
Ads (iPhone app, free users only)
Free users see one labelled Google AdMob ad below the tools on Discover. Members never load ads; the website has none. Ads never use your receipts or financial data. We do not request App Tracking Transparency (no IDFA) and request non-personalised ads. Google processes device and ad-interaction data under its policies; where required by law you are asked for consent first and can change it in Privacy & security → Ad privacy choices.
Sharing
We do not sell personal data. Service providers: Supabase (database, sign-in, private storage, server functions; data stored in Singapore), Google (Gemini API, AdMob), Apple (in-app purchases), Vercel (website hosting). We may disclose data where required by law.
Retention and deletion
Data is kept until you delete it. Me → Privacy & security → Delete account permanently deletes your account, records, receipt images and settings. Kept afterwards: the email hash above, anonymised AI-usage statistics, provider backups (if any) until they expire, and Apple's own purchase records. Deleting your account does not cancel an Apple subscription — cancel it in Settings → Apple ID → Subscriptions or Manage subscription in the app.
Your rights
You can view, correct, export (CSV / JSON) or delete your data in the app at any time and withdraw consent for recognition. Contact us for help. We handle personal data under Malaysia's Personal Data Protection Act 2010.
Security, children, changes
All traffic is encrypted (HTTPS); each user's data is isolated by database access rules; receipt images are viewable only through short-lived signed links; API keys stay on the server. Spendie is not directed at children under 13. We will update the effective date and notify you in the app of significant changes.