隱私權政策Privacy Policy | Social Collector（社群收藏管理器）

本隱私權政策（下稱「本政策」）旨在說明「社群收藏管理器」（Social Collector，下稱「本應用程式」）如何處理使用者之資料。茲分述如次。

一、資料之蒐集

本應用程式之核心功能不需登入，亦無須提供任何個人資料。謹說明如下：

（一）使用者所新增之收藏（包含網址、標題、標籤、備註等），於預設情形下，僅儲存於使用者裝置瀏覽器之本機儲存空間（localStorage）之內。

（二）本應用程式不含任何廣告；為了解使用情形以改善服務，使用 Google Analytics 進行流量分析（詳見第四條），未啟用跨裝置或廣告個人化功能。

（三）惟下列三種情形，資料將離開使用者之裝置，詳如各該條所述：其一，擷取網頁預覽與全文時，使用者所收藏之「網址」會傳送予第三方服務（詳見第四條）；其二，使用者主動啟用「社群」或「聯繫我們」功能時，相關資料會儲存於開發者所管理之雲端資料庫（詳見第五條）；其三，使用者購買 Pro 時，訂單資料會記錄於開發者所管理之後端，並傳送予藍新金流以完成付款（詳見第四條、第六條）。

二、Google 登入與雲端備份（選用功能）

使用者得自行選擇以 Google 帳號登入，將其收藏備份至自有之 Google 雲端硬碟。相關事項，說明如下：

（一）本應用程式僅請求 drive.file 此一最小範圍之權限，其效力僅及於「由本應用程式自身所建立之備份檔案」之讀寫；對於使用者雲端硬碟內之其他任何檔案，均無從讀取。

（二）備份內容為一 JSON 檔案（檔名為 社群收藏管理器-backup.json），內含收藏、分類、最近刪除，以及成就紀錄（徽章解鎖時間與統計旗標），存放於使用者自有之雲端硬碟中，開發者無從存取。使用者於本應用程式刪除之收藏，會先暫存於「最近刪除」（同樣僅存於前述備份檔與使用者之本機裝置）三十日，期滿即永久刪除；使用者亦得隨時自行永久刪除。使用者如為 Pro 並於設定中自行開啟「圖片備份到 Google Drive」，本應用程式另會將收藏封面及圖庫圖片（經開發者後端之圖片代理自社群平台取得、必要時壓縮）以每張一個檔案之方式，存放於使用者自有雲端硬碟內名為「社群收藏管理器-圖片」之資料夾，同樣僅限本應用程式自身建立之檔案，開發者無從存取；未開啟者不會產生該資料夾。

（三）登入時所取得之使用者名稱、電子郵件位址及大頭貼，僅用於本應用程式介面之顯示，概不傳送至其他任何處所。

（四）縱不登入，使用者仍得使用本應用程式之全部核心功能。

（五）為使登入得以持久、免除每小時重新授權之煩，使用者登入後，Google 所核發之長期授權憑證（refresh token）會加密後保存於開發者所管理之後端伺服器（Cloudflare Workers 及其 D1 資料庫，詳見第六條）。該伺服器所保存者僅有：Google 帳號識別碼、電子郵件位址、加密後之憑證，及建立與使用之時間戳記（另於使用第（八）項功能時，保存連線金鑰之雜湊值）；不會讀取、亦不會保存任何收藏內容。備份檔案仍僅存於使用者自有之雲端硬碟，其內容不經過該伺服器。

（六）社群平台（如 Instagram、Facebook）之圖片連結多帶有會逾期之簽章，逾期後即無法載入，致已收藏之縮圖失效。為此，於新增收藏時，本應用程式會將該貼文之圖片網址傳送至前述開發者後端，由後端代為抓取該圖片並回傳；後端僅即時轉遞、不保存該圖片，且僅接受本應用程式來源之請求、僅代抓特定社群平台之圖片。取得之縮圖僅保存於使用者裝置本機（瀏覽器之 IndexedDB），不上傳、不同步至雲端，亦不與他人分享；使用者清除瀏覽器資料即一併刪除。

（七）使用者如選用「收藏提醒」功能，本應用程式會於使用者按下「提醒」並同意授權時，另行請求 tasks（Google Tasks）權限；未使用此功能者，不會被要求此項權限。取得後，本應用程式僅在使用者主動設定提醒時，於其 Google Tasks 預設清單中建立、修改或刪除由本應用程式自身所建立之提醒事項，所寫入之內容僅有該收藏之標題、原貼文網址、本應用程式連結及使用者所選之日期，並不讀取使用者 Google Tasks 中之其他任何事項。使用者得隨時於 Google 帳戶之「第三方存取」中撤銷此項權限。

（八）使用者如為 Pro 並選用「連線 AI 助理」功能，得於設定中產生一把連線金鑰，供使用者自己電腦上的程式（本機 MCP 伺服器）使用。開發者後端僅保存該金鑰之雜湊值（無法還原金鑰本身）、與該 Google 帳號之對應、建立時間及最後使用時間；該程式持金鑰向後端換取一顆約一小時效期之 Google Drive 存取權杖，再直接向 Google 讀取前述備份檔，收藏內容不經過開發者之伺服器。此權杖之權限範圍仍僅限 drive.file；每次換取皆會重新確認 Pro 資格，並有每日次數上限。使用者得隨時於設定中重新產生（舊金鑰立即失效）或中斷連線，解除 Google 雲端硬碟連結時亦一併作廢。未使用此功能者，不會產生任何金鑰。

（九）承上，使用者所用之 AI 助理倘「建議」整理收藏（例如搬移分類、加標籤、分類改名、封存），其建議不會直接修改使用者之收藏，而是由該本機程式寫入使用者自有雲端硬碟中、由本應用程式所建立之另一個 JSON 檔案（檔名為 社群收藏管理器-ai-proposals.json，內容為建議之動作與簡短說明，不含收藏全文）；本應用程式於使用者開啟時讀取該檔，須經使用者於設定中逐項核准後方才套用，使用者亦得略過。此功能不提供刪除收藏之動作。該檔案同屬 drive.file 範圍，開發者無從存取，其中已處理逾七日或建議逾三十日者會被自動清除；使用者亦得隨時自行於雲端硬碟刪除之。未使用「連線 AI 助理」者，不會產生此檔案。

三、Google 使用者資料之使用（有限使用聲明）

本應用程式對於經由 Google API 所取得之使用者資料，其存取、使用、儲存及分享，均遵循《Google API 服務使用者資料政策》（Google API Services User Data Policy），並符合其中之「有限使用」（Limited Use）要求。準此：

（一）前條所述之名稱、電子郵件位址及大頭貼，僅供介面顯示之用，別無他途，亦不移轉予任何第三人。

（二）drive.file 權限所及之備份檔案，僅限本應用程式自身所建立者，開發者並無存取之途徑。

（三）本應用程式不將前述資料用於任何廣告用途，亦不販售或以其他方式移轉予第三方。

（四）tasks 權限所及之提醒事項，僅限使用者主動設定、且由本應用程式自身所建立者；其內容僅用於在使用者之 Google Tasks 中顯示該提醒，開發者並無存取之途徑，亦不用於其他任何目的。

四、第三方服務

（一）Microlink（api.microlink.io）：當使用者貼上或分享網址時，本應用程式將該網址傳送至 Microlink，藉以擷取標題、縮圖等預覽資訊。此項請求係由使用者之瀏覽器逕行發出；除網址本身外，本應用程式不另附加使用者之任何個人資料。惟一如任何網路請求，Microlink 於接收之際，仍將取得使用者之 IP 位址及瀏覽器基本資訊（例如 User-Agent 字串）。Microlink 對前述資料之處理，適用其 隱私權政策。

（二）Jina AI Reader（r.jina.ai）：當使用者開啟「全文閱讀」或新增收藏時，本應用程式將該網址傳送至 Jina AI Reader，藉以擷取該頁面之完整內文，供使用者於本應用程式內閱讀。此項請求係由使用者之瀏覽器逕行發出；除網址本身外，本應用程式不另附加使用者之任何個人資料。惟一如任何網路請求，Jina AI 於接收之際，仍將取得使用者之 IP 位址及瀏覽器基本資訊。Jina AI 對前述資料之處理，適用其 相關條款與隱私權政策。為保護隱私，網址含有密鑰或私人內容者（例如帶有 token、key、簽章等參數的網址、Google 文件與雲端硬碟連結、內網位址、內嵌帳號密碼之網址），本應用程式不會將其傳送予 Microlink、Jina AI 或 YouTube，僅存為連結。使用者亦得於「設定」的「離線儲存收藏」頁開啟「不自動抓取預覽與全文」，開啟後所有網址均不會傳送予前述服務，收藏僅存連結。

（三）Google Identity Services 與 Google Drive API：僅於使用者主動使用 Google 登入功能時方予載入，並適用 Google 隱私權政策。

（四）Google Analytics：本應用程式使用 Google Analytics 分析網站與 App 之使用情形（含公開介紹頁與登入後之各功能頁面），蒐集之資料為聚合統計資訊，例如瀏覽之頁面、使用之裝置與瀏覽器種類、概略地理區域（由 IP 位址推算，Google Analytics 對此已為截短處理）及使用時間。開發者並未啟用「Google Signals」或任何跨裝置、廣告個人化功能，亦未將使用者之收藏內容、筆記或其他輸入內容傳送予 Google Analytics。使用者如欲停用，得安裝 Google 提供之 Google Analytics 停用外掛程式。Google Analytics 對前述資料之處理，適用其 隱私權政策。

（五）藍新金流（NewebPay）：使用者購買 Pro 時，付款頁面由藍新金流提供，信用卡卡號等付款資料係由使用者直接輸入於藍新金流之頁面，本應用程式與開發者不接觸、不儲存。購買時，本應用程式之後端會傳送予藍新金流者，為訂單編號、金額、品名及使用者之電子郵件位址（供藍新金流寄送交易通知）；付款完成後，藍新金流會將付款結果（含訂單編號、金額與藍新交易序號）通知開發者之後端。藍新金流對其所取得資料之處理，適用藍新金流公布之隱私權政策。僅於使用者主動按下購買鈕時方會發生；未購買者不受影響。

（六）Resend（Resend, Inc.）：本應用程式於 Pro 年訂閱到期前，會寄送到期提醒電子郵件。寄信時，開發者所管理之後端會將收件者之電子郵件位址、顯示名稱及到期日期傳送予 Resend，由其代為寄出。對象為：Pro 年訂閱且仍在有效期間、距到期七日內之會員（到期前約七日與一日各一封），以及 Pro 試用中、試用將於一日內結束之會員（結束前一封）；買斷（無到期日）及未購買者不會收到。每封信均附「不想再收到提醒」之連結，按下即停止寄送；亦得來信請求停止。Resend 對其所取得資料之處理，適用 Resend 公布之隱私權政策。

（七）YouTube（Google LLC）：當使用者收藏 YouTube 影片連結時，本應用程式之瀏覽器端會將該影片之網址傳送至 YouTube 官方之 oEmbed 服務（www.youtube.com/oembed），藉以取得影片標題、頻道名稱與縮圖；並將影片編號傳送至開發者所管理之後端（api.socialcollector.app），由後端向 YouTube 取得影片說明與字幕，供使用者於本應用程式內閱讀。除網址或影片編號外，本應用程式不另附加使用者之任何個人資料；後端不留存該等內容。YouTube 對前述資料之處理，適用 Google 隱私權政策。

（八）Google reCAPTCHA Enterprise 與 Firebase App Check：為防止自動化程式濫用開發者所管理之後端與雲端資料庫，本應用程式於需要連線至該後端或雲端資料庫時（例如登入、使用社群功能，以及擷取收藏縮圖時），會在使用者之瀏覽器載入 Firebase 軟體開發套件，並向 Google reCAPTCHA Enterprise 取得一枚驗證憑證（App Check token）。此程序於背景進行，無須使用者操作任何驗證；即使使用者尚未登入，於本應用程式擷取收藏縮圖時亦會發生。Google 於接收之際，會取得使用者之 IP 位址及瀏覽器與裝置之基本資訊，用以判斷請求是否來自真實使用者。除此之外，本應用程式不另附加使用者之收藏內容或其他個人資料。Google 對前述資料之處理，適用 Google 隱私權政策。

五、社群功能與雲端資料庫（選用功能）

本應用程式設有「社群」功能（好友分享、共同編輯、留言），及「聯繫我們」之訊息功能。使用者一旦啟用前述任一功能，相關資料即須儲存於開發者所管理之 Google Firebase／Cloud Firestore 資料庫（專案代號 social-collector-47ad0），俾能於使用者之間傳遞。茲說明如下：

（一）未使用社群功能者，不受本條影響。使用者之收藏資料，仍僅存於其裝置本機及（於選用備份時）其自有之 Google 雲端硬碟；開發者之資料庫內不會有其任何資料。

（二）啟用社群功能後，儲存於前述資料庫者，包括下列各項：

1. 會員資料：使用者之電子郵件位址、顯示名稱、方案別（Light／Pro）、方案到期日、試用狀態，以及邀請人數與邀請獎勵之領取次數。

2. 個人檔案：顯示名稱、大頭貼、帳號代號（@handle）及好友人數。其中個人頁面係屬公開，任何取得該頁面連結者均得瀏覽。

3. 分享之收藏：使用者主動設為「好友可見」或「共同編輯」之收藏，其標題、網址、預覽圖、作者、摘要、內文，以及（依使用者於該資料夾分享設定之勾選）筆記、劃線、註解與圖片註解，均會上傳；圖片檔案本身不會上傳。未經分享之收藏不會上傳。

4. 社交關係與互動：好友名單、留言（含姓名、大頭貼及留言文字）、按讚紀錄（此功能已停用，既有紀錄仍保留），分享資料夾被開啟的次數（僅為累計數字，不記錄是誰開啟），以及好友之間的「戳一下」紀錄（僅記錄送出者之顯示名稱、大頭貼及送出時間，不含任何文字內容；每位好友至多保留最近一筆），以及共編資料夾之成員名單、各成員加入之收藏與各自撰寫之筆記，和共編邀請通知（資料夾名稱、邀請者之顯示名稱與大頭貼、時間）。

5. 「聯繫我們」之對話：使用者之顯示名稱、電子郵件位址及訊息內容。

6. 邀請碼：邀請碼本身、發送者及兌換者之識別碼；兌換者之顯示名稱會顯示給發送者，作為邀請進度之確認。

7. 分享連結之收藏：使用者於收藏上選擇「分享成連結」時，該筆收藏當下之標題、網址、預覽圖、作者、標籤、內文，及分享者之顯示名稱，會以「快照」形式上傳，並產生一組隨機網址；任何取得該網址者，無須登入即得瀏覽（唯讀），惟無法列出或搜尋他人之分享。使用者之筆記、劃線與註解不包含在內。使用者得隨時「撤回分享」，撤回後該快照即自資料庫刪除；將該筆收藏移至「最近刪除」時亦會自動撤回。此頁面設為不供搜尋引擎索引。

（三）存取權限之控制：前述資料之讀寫權限，係由 Firestore 安全規則（Security Rules）於伺服器端強制執行。好友限定之收藏及其留言，僅限擁有者與其好友讀取；會員資料僅限本人與管理員讀取。

（四）開發者之存取：開發者為維運之必要，得經由 Firebase 主控台存取上開資料庫之內容，並得讀取會員資料及「聯繫我們」之對話。除為排除故障、處理使用者所提出之請求，或依法令規定應予配合者外，開發者不會主動查閱使用者之分享內容，亦不將之用於任何廣告用途，更不販售或移轉予任何第三人。

（五）資料之所在地：前述資料存放於 Google Cloud Platform 之伺服器，並適用 Firebase 隱私權與安全性說明。

六、資料之保存與安全

（一）本應用程式之收藏資料，存放於使用者得自行掌控之處所，即其裝置之本機儲存空間，及（於選用備份時）其自有之 Google 雲端硬碟。惟使用者主動啟用社群或「聯繫我們」功能者，第五條所列之資料另存於開發者所管理之 Firestore 資料庫。

（二）Google 登入所生之短期存取權杖（access token）僅存於使用者瀏覽器之記憶體內，不寫入裝置之儲存空間。長期授權憑證（refresh token）則依第二條第（五）項，加密後保存於開發者所管理之後端（Cloudflare Workers／D1，位於 Cloudflare 之全球網路），僅用於替使用者換發短期權杖；後端須同時驗證使用者之 Firebase 登入身分與 App Check 憑證，始予換發。

（三）資料之保存期間，全由使用者自行決定；使用者得依第七條所載方式，隨時刪除之。

（四）付款訂單紀錄：使用者經由本應用程式之線上付款流程購買 Pro 時，開發者所管理之後端（Cloudflare D1）會記錄訂單編號、使用者之登入帳號識別碼（uid）與電子郵件位址、方案別、金額、訂單狀態、藍新交易序號及付款時間。此紀錄用於確認付款、自動開通 Pro、對帳與辦理退費，並供履行相關法令（例如稅務、會計）所需；保存期間以達成前述目的所必要者為限，且不含任何信用卡資料。使用者得來信請求查閱或更正，惟為履行法令義務所必須保存者，不在此限。

（五）到期提醒紀錄：開發者所管理之後端（Cloudflare D1）會記錄「某位使用者、某一到期日、某一種提醒已寄出」之事實（使用者之登入帳號識別碼、到期時間、提醒種類、寄出時間），以避免重複寄送；使用者按下「不想再收到提醒」後，亦會記錄其帳號識別碼以停止寄送。此紀錄不含信件內容，亦不另存電子郵件位址（寄信時再由會員資料讀取）。

（六）「連線 AI 助理」連線金鑰紀錄：使用者選用第二條第（八）項功能時，開發者所管理之後端（Cloudflare D1）會記錄連線金鑰之雜湊值、使用者之 Google 帳號識別碼與登入帳號識別碼（uid）、建立時間及最後使用時間；不保存金鑰本身，亦不含任何收藏內容。使用者中斷連線、重新產生金鑰或解除雲端硬碟連結時，該紀錄即被刪除或覆蓋。

七、資料之刪除

（一）裝置上之資料：於瀏覽器中清除本網站之資料，或解除安裝本應用程式即可。

（二）雲端備份與授權憑證：請至使用者之 Google 雲端硬碟刪除 社群收藏管理器-backup.json 檔案（如曾開啟圖片備份，併刪除「社群收藏管理器-圖片」資料夾）。於本應用程式內按「登出」，後端所保存之授權憑證即會被刪除，並向 Google 撤銷；亦得至 Google 帳戶之第三方存取權設定，撤銷本應用程式之授權。

（三）社群資料：於本應用程式內，得自行刪除已分享之資料夾及留言。至於會員資料、個人檔案及「聯繫我們」之對話，因涉及帳號本身，請依第十一條所載方式來信，開發者將於合理期間內自資料庫中刪除之。

（四）已移除功能之資料：本應用程式原設有「私訊」功能，業於 2026 年 9 月 6 日（v1.40.0）移除，使用者已無從發送或讀取私訊。此前既有之對話紀錄，開發者將自資料庫中刪除之。

八、兒童隱私

本應用程式係一般用途之書籤整理工具，並非以兒童為對象而設計，亦未以兒童為訴求而行銷。開發者不會在知情之情形下，蒐集未滿十三歲兒童之個人資料。倘家長或監護人發現有此情事，請依第十一條所載方式來信，開發者將儘速刪除之。

九、使用者權利

使用者之權利，依資料所在之處所而有不同，謹分述如下：

（一）未啟用社群或「聯繫我們」功能者：使用者之資料僅存於其裝置本機及（於選用備份時）其自有之 Google 雲端硬碟，開發者並未持有，就此部分並不居於資料控管者之地位。使用者對其資料本即擁有完全之掌控權，並得依第七條所載方式，隨時查閱、匯出或刪除之。

（二）已啟用社群或「聯繫我們」功能者：就第五條所列、儲存於開發者所管理之 Firestore 資料庫之資料，開發者居於資料控管者之地位。使用者就該部分資料，得請求查閱、更正、取得複本或刪除：其中已分享之資料夾與留言，得於本應用程式內自行刪除；其餘（會員資料、個人檔案及「聯繫我們」之對話）請依第十一條所載方式來信，開發者將於合理期間內處理。

（三）第三方服務所持有之資料：倘依當地法令（如歐盟《一般資料保護規則》〔GDPR〕或美國加州《消費者隱私法》〔CCPA〕）另有相關權利，就第四條所列第三方服務（Microlink、Jina AI、Google、YouTube）各自持有之資料，使用者亦得逕向各該服務主張之。

十、政策之變更

本政策倘有重大變更，將更新本頁面之內容，並一併修正頁首所載之「最後更新日期」。

十一、開發者資訊與聯絡方式

本應用程式由 哩賣亂工作室 開發及維護。使用者對本政策倘有任何疑義，敬請來函：[email protected]。

This Privacy Policy (the “Policy”) explains how Social Collector (the “Application”) handles user data. The provisions below apply.

1.Collection of Data

The Application’s core features require no sign-in and no personal data. Specifically:

(a) The collections you add (including URLs, titles, tags, and notes) are, by default, stored only within your device browser’s local storage (localStorage).

(b) The Application contains no advertising; to understand usage and improve the service, it uses Google Analytics for traffic analysis (see Section 4), with no cross-device or ad-personalization features enabled.

(c) There are, however, three circumstances in which data leaves your device, each described in the section indicated: first, when retrieving a page preview or full text, the URL you have saved is transmitted to third-party services (see Section 4); second, when you actively enable the “Community” or “Contact Us” features, the relevant data is stored in a cloud database managed by the developer (see Section 5); third, when you purchase Pro, order records are kept on a backend managed by the developer and sent to NewebPay to complete the payment (see Sections 4 and 6).

2.Google Sign-In and Cloud Backup (Optional)

You may choose to sign in with a Google account and back up your collections to your own Google Drive. The following provisions apply:

(a) The Application requests only the minimal drive.file scope, the effect of which extends solely to reading and writing files that the Application itself has created; it cannot access any other file in your Google Drive.

(b) The backup consists of a single JSON file (named 社群收藏管理器-backup.json) containing your items, categories, Recently Deleted and achievement records (badge unlock times and counters), stored in your own Google Drive, to which the developer has no access. Items you delete in the Application are first kept in “Recently Deleted” for 30 days (likewise only in that backup file and on your own device) and then permanently deleted; you may also delete them permanently at any time. If you are a Pro member and choose to turn on “Back up images to Google Drive” in Settings, the Application additionally stores item cover images and gallery images (fetched from the social platform through the developer’s image proxy and compressed where necessary) as individual files in a folder named “社群收藏管理器-圖片” in your own Google Drive, likewise limited to files the Application itself created and inaccessible to the developer; the folder is not created unless you turn the feature on.

(c) The name, email address, and profile picture obtained upon sign-in are used solely for display within the Application’s interface and are transmitted nowhere else.

(d) All core features of the Application remain available without signing in.

(e) So that you need not re-authorize every hour, the long-lived authorization credential (refresh token) issued by Google upon sign-in is stored, encrypted, on a backend server managed by the developer (Cloudflare Workers and its D1 database; see Section 6). That server holds only: your Google account identifier, your email address, the encrypted credential, and creation/usage timestamps (plus a hash of the connection key if you use the feature in Section 2(h)). It neither reads nor stores any of your collection content; the backup file continues to reside solely in your own Google Drive and does not pass through that server.

(f) Image links from social platforms (such as Instagram and Facebook) often carry expiring signatures; once expired they can no longer load, causing saved thumbnails to break. To address this, when you add an item the Application transmits the post’s image URL to the aforementioned developer backend, which fetches the image on your behalf and returns it. The backend merely relays the image in real time and does not store it; it accepts requests only from the Application’s own origin and only proxies images from specific social platforms. The retrieved thumbnail is stored solely on your own device (your browser’s IndexedDB); it is not uploaded, synced to the cloud, or shared with anyone, and is deleted when you clear your browser data.

(g) If you choose to use the “item reminder” feature, the Application will request the tasks (Google Tasks) scope only when you tap “Remind” and agree to authorize it; users who do not use this feature are never asked for it. Once granted, the Application, only when you set a reminder, creates, modifies, or deletes the reminder items that it itself created in your default Google Tasks list. The content written consists solely of the item’s title, the original post URL, a link to the Application, and the date you chose; the Application does not read any other item in your Google Tasks. You may revoke this permission at any time under “Third-party access” in your Google Account.

(h) If you are a Pro user and choose to use “Connect AI assistants”, you may generate a connection key in Settings for a program running on your own computer (a local MCP server). The developer’s backend stores only a hash of that key (the key itself cannot be recovered), the Google account it belongs to, and its creation and last-used times. That program presents the key to the backend to obtain a Google Drive access token valid for about one hour, and then reads the backup file directly from Google; your collection content does not pass through the developer’s servers. The token’s scope remains limited to drive.file; Pro eligibility is re-checked on every exchange and a daily limit applies. You may regenerate the key (the old one stops working immediately) or disconnect at any time, and unlinking Google Drive also revokes it. If you do not use this feature, no key is ever created.

(i) Further to (h), if the AI assistant you use “suggests” organizing your collection (for example moving items between categories, adding tags, renaming a category, or archiving), the suggestion does not modify your collection directly. Instead, that local program writes it to a separate JSON file, created by the Application, in your own Google Drive (named 社群收藏管理器-ai-proposals.json; it contains the proposed actions and a short description, not the full text of your items). The Application reads that file when you open it, and applies a suggestion only after you approve it item by item in Settings; you may also skip it. This feature offers no action that deletes items. The file is likewise within the drive.file scope and is inaccessible to the developer; handled suggestions older than seven days and any suggestions older than thirty days are removed automatically, and you may delete the file from your Drive at any time. If you do not use “Connect AI assistants”, this file is never created.

3.Use of Google User Data (Limited Use)

The Application’s access to, and use, storage, and sharing of, any user data obtained through Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Accordingly:

(a) The name, email address, and profile picture described above are used solely for interface display, for no other purpose, and are transferred to no third party.

(b) The backup file accessible under the drive.file scope is limited to files the Application itself has created, and the developer has no means of access.

(c) The Application uses none of the foregoing data for any advertising purpose, and neither sells nor otherwise transfers it to any third party.

(d) Reminder items accessible under the tasks scope are limited to those that you chose to set and that the Application itself created; their content is used solely to display that reminder in your Google Tasks, the developer has no means of access, and they are not used for any other purpose.

4.Third-Party Services

(a) Microlink (api.microlink.io): When you paste or share a URL, the Application transmits that URL to Microlink in order to retrieve preview information such as the title and thumbnail. This request is issued directly by your browser; apart from the URL itself, the Application appends none of your personal data. However, as with any network request, Microlink will upon receipt necessarily obtain your IP address and basic browser information (such as the User-Agent string). Microlink’s handling of such data is governed by its Privacy Policy.

(b) Jina AI Reader (r.jina.ai): When you open the “full-text reading” feature or add an item, the Application transmits that URL to Jina AI Reader to retrieve the full text of the page for in-app reading. This request is issued directly by your browser; apart from the URL itself, the Application appends none of your personal data. However, as with any network request, Jina AI will upon receipt necessarily obtain your IP address and basic browser information. Jina AI’s handling of such data is governed by its terms and privacy policy. To protect your privacy, URLs that contain secrets or private content (for example URLs carrying token, key or signature parameters, Google Docs and Drive links, internal-network addresses, or URLs with embedded credentials) are not sent to Microlink, Jina AI or YouTube; they are saved as plain links only. You may also turn on “Do not auto-fetch previews and full text” under Settings, on the “Offline storage” page; when on, no URL is sent to the services above and items are saved as links only.

(c) Google Identity Services and the Google Drive API: These are loaded only when you actively use the Google Sign-In feature and are governed by the Google Privacy Policy.

(d) Google Analytics: The Application uses Google Analytics to analyze how the website and App are used (including both the public marketing pages and the signed-in feature pages), collecting aggregate statistics such as pages viewed, device and browser type, approximate geographic region (derived from a truncated IP address), and usage timing. The developer has not enabled Google Signals or any cross-device or ad-personalization features, and does not transmit your collection content, notes, or other input to Google Analytics. You may opt out by installing Google's Google Analytics Opt-out Browser Add-on. Google Analytics's handling of this data is governed by the Google Privacy Policy.

(e) NewebPay (藍新金流; Neweb Technologies Co., Ltd.): When you purchase Pro, the payment page is provided by NewebPay, and your card number and other payment details are entered directly on NewebPay’s page; the Application and the developer neither receive nor store them. At purchase, the Application’s backend sends NewebPay the order number, amount, item description and your email address (so that NewebPay can send transaction notices); once payment completes, NewebPay notifies the developer’s backend of the result (including the order number, amount and NewebPay transaction number). NewebPay’s handling of the data it receives is governed by the privacy policy NewebPay publishes. This occurs only when you actively press a purchase button; users who do not purchase are unaffected.

(f) Resend (Resend, Inc.): Before a Pro annual plan expires, the Application sends an expiry-reminder email. To send it, the backend managed by the developer transmits the recipient’s email address, display name and expiry date to Resend, which delivers the message on our behalf. It is sent to Pro annual-plan members whose plan is still active and expires within seven days (about seven days and one day before expiry), and to Pro trial users whose trial ends within one day (one email before it ends); lifetime purchasers (no expiry date) and non-purchasers do not receive it. Every email carries a “stop these reminders” link that takes effect immediately; you may also email us to stop them. Resend’s handling of the data it receives is governed by the privacy policy Resend publishes.

(g) YouTube (Google LLC): When you save a YouTube video link, the Application's browser-side code transmits the video URL to YouTube's official oEmbed service (www.youtube.com/oembed) to obtain the video title, channel name and thumbnail; it also transmits the video ID to the backend managed by the developer (api.socialcollector.app), which retrieves the video description and captions from YouTube for in-app reading. Apart from the URL or video ID, the Application attaches no personal data of yours; the backend does not retain that content. YouTube's handling of such data is governed by the Google Privacy Policy.

(h) Google reCAPTCHA Enterprise and Firebase App Check: To prevent automated abuse of the backend and cloud database managed by the developer, when the Application needs to connect to them (for example for sign-in, social features, and when fetching thumbnails for saved items), it loads the Firebase SDK in your browser and obtains a verification credential (an App Check token) from Google reCAPTCHA Enterprise. This happens in the background and requires no action from you; it also happens when fetching thumbnails even if you have not signed in. On receipt, Google obtains your IP address and basic browser and device information to judge whether the request comes from a real user. The Application attaches no saved content or other personal data. Google's handling of that data is governed by the Google Privacy Policy.

5.Community Features and Cloud Database (Optional)

The Application provides “Community” features (sharing with friends, co-editing, and comments) and a “Contact Us” messaging feature. Once you enable any of these, the relevant data must be stored in a Google Firebase / Cloud Firestore database managed by the developer (project social-collector-47ad0) in order to be delivered between users. The following provisions apply:

(a) If you do not use the Community features, this Section does not affect you. Your collections remain solely on your device and, where backup is used, in your own Google Drive; the developer’s database will hold no data of yours.

(b) Once the Community features are enabled, the database stores the following:

1. Membership data: your email address, display name, plan (Light / Pro), plan expiry, trial status, and your invitation count and reward-claim count.

2. Profile: display name, avatar, account handle (@handle), and friend count. Your profile page is public and may be viewed by anyone holding its link.

3. Shared collections: for collections you have actively set to “visible to friends” or “co-edited”, the title, URL, preview image, author, summary and body text, plus (depending on the options you tick for that folder) notes, highlights, comments and image comments, are uploaded; image files themselves are not uploaded. Collections you have not shared are not uploaded.

4. Social graph and interactions: your friend list, comments (including name, avatar, and comment text), likes (this feature is retired; existing records are kept), a running count of how many times a shared folder has been opened (a number only; we do not record who opened it), and “poke” records between friends (only the sender’s display name, avatar and the time sent, with no text content; at most the latest one per friend is kept), as well as the member list of co-edited folders, the collections each member adds and the notes each member writes, and co-edit invitation notices (folder name, the inviter’s display name and avatar, and time).

5. “Contact Us” conversations: your display name, email address, and message content.

6. Invitation codes: the code itself and the identifiers of the issuer and the redeemer; the redeemer’s display name is shown to the issuer to confirm invitation progress.

7. Shared-link collections: when you choose “Share as link” on a collection, a snapshot of its title, URL, preview image, author, tags and body text at that moment, plus your display name, is uploaded and given a random URL. Anyone holding that URL can view it (read-only) without signing in, but nobody can list or search other people’s shares. Your notes, highlights and comments are not included. You may “Revoke sharing” at any time, which deletes the snapshot from the database; moving the collection to “Recently deleted” also revokes it automatically. These pages are marked not to be indexed by search engines.

(c) Access control: read and write permissions for the foregoing are enforced server-side by Firestore Security Rules. Friends-only collections and their comments are readable only by the owner and their friends; membership data only by the member and the administrator.

(d) Developer access: as necessary for operation and maintenance, the developer may access the contents of the database through the Firebase console, and may read membership data and “Contact Us” conversations. Save where required to diagnose faults, to act upon a request made by a user, or to comply with applicable law, the developer does not review users’ shared content, uses none of it for any advertising purpose, and neither sells nor transfers it to any third party.

(e) Location of data: the foregoing data is stored on Google Cloud Platform servers and is subject to Firebase’s privacy and security documentation.

6.Data Retention and Security

(a) Your collection data resides in locations within your control, namely your device’s local storage and, where backup is used, your own Google Drive. Where you have actively enabled the Community or “Contact Us” features, however, the data listed in Section 5 is additionally stored in a Firestore database managed by the developer.

(b) The short-lived access token arising from Google Sign-In is held solely in your browser’s memory and is not written to device storage. The long-lived credential (refresh token) is, as described in Section 2(e), stored encrypted on a backend managed by the developer (Cloudflare Workers / D1, hosted on Cloudflare’s global network) and used solely to issue short-lived tokens to you; the backend verifies both your Firebase sign-in identity and an App Check attestation before doing so.

(c) The retention period is determined entirely by you; you may delete the data at any time by the means set out in Section 7.

(d) Payment order records: when you purchase Pro through the Application’s online payment flow, the backend managed by the developer (Cloudflare D1) records the order number, your sign-in account identifier (uid) and email address, the plan, the amount, the order status, the NewebPay transaction number and the payment time. These records are used to confirm payment, activate Pro automatically, reconcile accounts and process refunds, and to meet applicable legal obligations (for example tax and accounting); they are retained only as long as necessary for those purposes and contain no credit-card data. You may email us to request access or correction, except where retention is required to comply with law.

(e) Expiry-reminder records: the backend managed by the developer (Cloudflare D1) records the fact that a given reminder for a given expiry date was sent to a given user (account identifier, expiry time, reminder type, send time) so that it is not sent twice; if you choose “stop these reminders”, your account identifier is also recorded so that none are sent. These records contain no message content and no separately stored email address (the address is read from your membership data at send time).

(f) “Connect AI assistants” key records: if you use the feature in Section 2(h), the backend managed by the developer (Cloudflare D1) records a hash of the connection key, your Google account identifier and sign-in account identifier (uid), and its creation and last-used times; it does not store the key itself and contains no collection content. The record is deleted or overwritten when you disconnect, regenerate the key, or unlink Google Drive.

7.Deletion of Data

(a) Data on your device: clear this site’s data in your browser, or uninstall the Application.

(b) Cloud backup and authorization credential: delete the 社群收藏管理器-backup.json file from your Google Drive (and, if you turned on image backup, the “社群收藏管理器-圖片” folder). Signing out within the Application causes the backend to delete the stored credential and revoke it with Google; you may also revoke the Application’s authorization via your Google account’s third-party access settings.

(c) Community data: within the Application you may delete your shared folders and comments yourself. As for membership data, your profile, and “Contact Us” conversations (which pertain to the account itself), please write to the developer by the means set out in Section 11, and they will be deleted from the database within a reasonable period.

(d) Data from removed features: the Application formerly provided a “direct messages” feature, which was removed on 6 September 2026 (v1.40.0); messages can no longer be sent or read. Any conversation records created before then will be deleted from the database by the developer.

8.Children’s Privacy

The Application is a general-purpose bookmark-organizing tool. It is neither designed for nor marketed to children. The developer does not knowingly collect personal data from children under 13. Should a parent or guardian become aware that this has occurred, please write to the developer by the means set out in Section 11 and the data will be deleted promptly.

9.Your Rights

Your rights differ according to where the data resides:

(a) If you do not use the Community or “Contact Us” features: your data resides solely in your device’s local storage and, where you opt into backup, in your own Google Drive. The developer holds none of it and does not act as a data controller in respect of it. You retain full control and may access, export, or delete it at any time by the means set out in Section 7.

(b) If you do use those features: in respect of the data listed in Section 5 and stored in the Firestore database managed by the developer, the developer does act as a data controller. You may request access to, correction of, a copy of, or the deletion of that data. Shared folders and comments can be deleted by you within the Application; for the remainder (membership data, your profile, and “Contact Us” conversations), please write to the developer by the means set out in Section 11, and your request will be dealt with within a reasonable period.

(c) Data held by third-party services: to the extent applicable law (such as the EU General Data Protection Regulation (GDPR) or the California Consumer Privacy Act (CCPA)) confers further rights, you may also assert those rights directly with the third-party services listed in Section 4 (Microlink, Jina AI, Google and YouTube) in respect of the data each of them holds.

10.Changes to this Policy

Should this Policy undergo material change, the content of this page will be updated and the “Last updated” date at the top revised accordingly.

11.Developer Information and Contact

The Application is developed and maintained by 哩賣亂工作室. If you have any questions regarding this Policy, please write to: [email protected].