Jogy 隐私政策
最后更新：2026 年 10 月 30 日
Jogy 是一款基于位置的社交应用。你可以把去过和想去的地方发到地图上，和别人一起组行程。 这份政策说明我们收集什么、为什么收集、存在哪里，以及你怎么把它们拿回去或删掉。
简短版：我们只收集让功能跑起来所必需的数据；不做广告，不做跨应用追踪， 没有接入任何广告或数据分析 SDK，崩溃诊断用的 Sentry 不关联你的账号；你可以随时在 App 内永久删除账号。
一、我们收集什么
| 类别 | 具体内容 | 为什么需要 |
|---|---|---|
| 账号信息 | 邮箱地址 | 注册、登录、找回密码。验证码通过邮件发送 |
| 个人资料 | 用户名、头像、简介、性别、生日 | 让别人知道你是谁；生日用于年龄相关的功能限制 |
| 精确位置 | 你发布内容时选择的地点坐标 | 把内容钉在地图上，并按距离推荐附近的内容 |
| 照片 | 你主动选择上传的图片 | 帖子配图、行程站点配图、聊天中发送的图片 |
| 语音 | 你主动录制的语音消息 | 在聊天中发送语音；转文字功能在你的设备上完成 |
| 你创作的内容 | 帖子正文、评论、私信、群聊消息、行程安排 | 这些就是应用本身 |
| 出行账本 | 你和同行的人记下的每笔花销：名目、金额、币种、谁付的、每人分摊多少，以及每次修改的记录 | 帮同行的人算清 AA、谁该给谁多少。只有这趟行程的成员看得到；Jogy 只记账，不经手付款 |
| 智能排行程的资料 | 你为生成行程添加的攻略链接、文字，以及截图在你的手机上识别出的文字（认不出文字的截图会以图片发送） | 生成行程草稿。只在你点「生成行程」时发送，服务器不保存 |
| 使用记录 | 浏览历史、点赞、收藏、关注关系 | 「我看过什么」页面，以及内容推荐 |
| 推送令牌 | 你允许通知后，苹果分配给这台手机的推送令牌 | 给你发新消息、行程申请和审核结果等通知。退出登录时删除；在系统设置里关掉通知即停止 |
| 使用情况 | 你用到了哪些功能、什么时候（比如打开应用、生成行程、导出长图、发布行程），生成结果的站数等数字；应用版本；一个装好应用时在手机上随机生成的设备编号 | 了解大家卡在哪一步、功能好不好用，改进应用；设备编号也用来限制没登录时免费生成行程的次数。只记功能名和数字，不记你写的内容、链接或截图；保留 180 天 |
| 崩溃诊断 | 应用崩溃、卡死或被系统关闭时的调用栈，以及设备型号、系统版本、应用版本、界面语言 | 找到并修复崩溃。不关联你的账号，不含聊天内容、位置和照片 |
我们不收集的
- 通讯录、日历、健康数据，以及银行卡、支付账号等支付信息
- 广告标识符（IDFA）—— 应用没有请求过追踪权限，也不会请求
- 后台位置 —— 位置权限是「使用期间」，你不在用 Jogy 的时候我们拿不到你的位置
二、我们怎么用这些数据
只有两个用途：让应用的功能正常运作，具体包括显示内容、匹配同行的人、 发送通知、维持登录状态、以及处理举报；以及改进应用——用上面的「使用情况」统计各个功能 用的人多不多、哪一步走不下去。统计只在我们自己的服务器上做，不用任何第三方统计工具。
我们不会把你的数据用于广告投放或个性化推销，不会出售给第三方， 也不会用于跨应用或跨网站的用户追踪。
三、谁能看到你的内容
- 帖子：图片帖发布时可以选择所有人、互关好友或仅自己可见，之后也能改；广播对所有人可见。
- 发到地图的行程：所有用户可见，包括未关注你的人。发布时可以选择不发到地图。
- 群聊和私信：只有对话中的人可见。
- 个人主页的关注列表、点赞收藏：由你在「个人隐私设置」里控制可见范围。
- 精确位置：只随你主动发布的内容公开。我们不会广播你的实时位置。
四、第三方服务
| 服务 | 用途 | 会接触到什么 |
|---|---|---|
| Mapbox | 地图渲染与地点搜索 | 你正在查看的地图范围、你输入的地点搜索词 |
| 邮件服务商（SMTP） | 发送验证码 | 你的邮箱地址 |
| 阿里云 | 服务器与数据库托管 | 作为基础设施承载上述全部数据 |
| DeepSeek（深度求索） | 智能排行程：根据你提供的资料生成行程 | 只在你同意之后、点「生成行程」时发送：你添加的链接对应笔记的文字、你输入的文字、截图识别出的文字或认不出文字的截图 |
| Apple 地图 | 为行程站点搜索、选择地点 | 站点名称和所在城市，在你的设备上通过 Apple 的服务搜索 |
| 小红书 | 读取你分享的攻略笔记的公开内容 | 你添加的小红书链接，由我们的服务器访问，不带你的账号信息 |
| Apple 推送通知服务（APNs） | 把通知送到你的手机 | 推送令牌和通知的内容（比如「知夏：周六见」） |
| Sentry（Functional Software, Inc.） | 崩溃与错误诊断 | 应用崩溃时的调用栈、设备型号、系统版本、应用版本；服务器出错时的错误信息和出错的接口路径。不含你的账号、聊天内容和位置，存放在美国 |
应用中没有集成任何广告网络、数据分析或用户行为追踪 SDK。崩溃诊断用的 Sentry 只在应用崩溃、服务器出错时上报，不关联账号，也不用于追踪。
五、数据存在哪里
数据库与上传的图片、语音文件都存放在我们租用的阿里云服务器上，服务器位于中国香港。 传输全程使用 HTTPS 加密。密码经过单向哈希后存储，我们无法还原出你的原始密码。
如果你在中国香港以外使用 Jogy，你的数据仍会被传输并存储在香港的服务器上；崩溃诊断信息由 Sentry 存放在美国。 使用本应用即表示你了解并接受这一点。
六、保留多久，怎么删除
你可以随时删除账号
路径：个人主页 → 右上角设置 → 删除账号。这是永久删除，不是停用，也不需要联系我们。
会被立即永久删除：
- 个人资料、头像、邮箱、生日
- 关注与粉丝关系
- 点赞、收藏、浏览历史
- 你发起的行程，及其成员、申请记录和账本
- 全部通知与拉黑记录
会保留但不再关联到你：
- 你发过的帖子和评论
- 你在群聊和私信中发送的消息
- 你创建的群聊
- 你在别人发起的行程账本里记的账、分摊的份额
这些内容存在于别人的对话和评论区中。直接抹去会让他人的聊天记录出现断裂， 因此内容保留，但作者字段被清空，显示为「已注销用户」，无法再关联回你的身份。
例外：其他用户针对你提交的举报记录会被保留，用于内容安全审查。 否则「删号重来」会成为规避社区规则的手段。
其他数据的保留期
只要你的账号存在，内容就一直保留。服务器运行日志保留 30 天后自动清除。使用情况记录保留 180 天后自动清除； 删除账号后，留下的使用情况记录不再关联到你的账号。
七、你的权利
- 查看与更正：个人资料可随时在应用内修改。
- 删除：见上一节，应用内一步完成。
- 控制可见性：「个人隐私设置」中可调整关注列表、点赞收藏的可见范围。
- 撤回授权：位置、相册、麦克风权限可随时在 iOS 系统设置中关闭，相关功能会停用但账号不受影响。
八、未成年人
Jogy 不面向 13 周岁以下儿童，我们不会有意收集他们的信息。 如果你是监护人并发现孩子在未经同意的情况下使用了本应用，请通过下方方式联系我们，我们会删除相关账号与数据。
九、内容安全
应用内的每一条帖子、评论、私信、行程和用户都可以被举报。 我们会在 24 小时内查看收到的举报，并对违规内容采取移除或封禁措施。 你也可以在对方主页将其拉黑，对方将无法再与你互动。
十、政策变更
政策更新时会修改本页顶部的日期。涉及数据用途的重大变更，我们会在应用内显著位置提示。
十一、联系我们
应用内：设置 → 反馈，可直接提交问题和意见。
Privacy Policy (English)
Last updated: 30 October 2026
Jogy is a location-based social app for sharing places and organising trips together. This policy explains what we collect, why, where it lives, and how you can remove it.
In short: we collect only what the features require. No advertising, no cross-app tracking, and no advertising or analytics SDK is present in the app; crash diagnostics go to Sentry and are not linked to your account. You can permanently delete your account from inside the app at any time.
What we collect
| Category | Details | Why |
|---|---|---|
| Account | Email address | Sign-up, sign-in, password recovery via emailed codes |
| Profile | Username, avatar, bio, gender, birthday | Identity within the app; age-related limits |
| Precise location | Coordinates you choose when posting | Pinning content to the map, nearby recommendations |
| Photos | Images you choose to upload | Posts, trip stops, chat |
| Audio | Voice messages you record | Sending voice in chat; speech-to-text runs on your device |
| Your content | Posts, comments, messages, itineraries | This is the app itself |
| Trip ledger | Expenses you and your travel companions record: what it was, amount, currency, who paid, each person's share, and the history of every edit | Working out who owes whom on a shared trip. Visible only to that trip's members; Jogy only keeps the record and never handles payments |
| AI planner input | Guide links and text you add, and text recognised from your screenshots on your device (screenshots it cannot read are sent as images) | Generating an itinerary draft; sent only when you tap Generate, not kept on our servers |
| Activity | Browsing history, likes, favourites, follows | Your history screen and content ranking |
| Push token | The token Apple assigns to your phone once you allow notifications | Notifying you of new messages, trip requests and their outcome; deleted when you sign out |
| Usage | Which features you use and when (opening the app, generating an itinerary, exporting a poster, publishing a trip), counts such as how many stops were planned, the app version, and a random device number created on your phone when the app is installed | Seeing where people get stuck and improving the app; the device number also limits free itinerary generations before sign-in. Feature names and numbers only, never your text, links or screenshots; kept for 180 days |
| Crash diagnostics | Stack traces from crashes, freezes and system terminations, with the device model, OS version, app version and interface language | Finding and fixing crashes. Not linked to your account; no messages, locations or photos |
We do not collect contacts, calendars, health data, or payment details such as bank cards or payment accounts, and we never request the advertising identifier or App Tracking Transparency permission. Location access is "while using the app" only.
How we use it
For app functionality, and to improve the app using the usage records above, analysed on our own servers without any third-party analytics tool. We do not use your data for advertising or personalised marketing, do not sell it, and do not track you across other apps or websites.
Third parties
Mapbox renders the map and handles place search, and therefore sees the map area you are viewing and the search terms you type. An SMTP provider delivers verification codes and sees your email address. Alibaba Cloud hosts the servers and database. DeepSeek generates itineraries in the AI planner: only after you agree, and only when you tap Generate, we send it the text of the guide links you add, the text you type, and the text recognised from your screenshots (screenshots it cannot read are sent as images); our servers do not keep this material. Apple Maps searches places for itinerary stops from your device. Notifications are delivered through Apple Push Notification service, which receives your push token and the notification text. When you add a Xiaohongshu link, our server fetches that public note without any of your account details. Photo posts can be shown to everyone, mutual followers only, or only you. Sentry (Functional Software, Inc.) receives crash and error diagnostics: the stack trace, device model, OS and app version when the app crashes, and the error and the API path when our server fails. It never receives your account, messages or location, and stores this data in the United States. No advertising or analytics SDK is included; Sentry reports only crashes and errors and is not used for tracking.
Where data is stored
On servers we rent from Alibaba Cloud, located in Hong Kong. All transport is over HTTPS. Passwords are stored as one-way hashes and cannot be recovered by us. If you use Jogy from outside Hong Kong, your data is still transferred to and stored on those servers. Crash diagnostics are stored by Sentry in the United States.
Deletion
Go to Profile → Settings → Delete Account. This is a permanent deletion, not a
deactivation, and does not require contacting us.
Permanently removed: profile, avatar, email, birthday, follows and followers, likes, favourites, browsing history, trips you created along with their members, requests and ledgers, all notifications and block records.
Retained but no longer attributed to you: posts, comments, messages you sent, groups you created, and the expenses and shares you recorded in ledgers of trips other people created. These live inside other people's conversations and comment threads; removing them outright would leave gaps in other users' records, so the content stays while the author field is cleared and displays as a deleted user.
Reports that other users filed about you are retained for content-safety review, so that deleting an account cannot be used to escape community rules.
Usage records are deleted automatically after 180 days; once you delete your account, any that remain are no longer linked to it.
Your rights
You can view and correct your profile in the app, delete your account in one step, adjust the visibility of your follow lists and likes in Privacy Settings, and revoke location, photo or microphone permissions at any time in iOS Settings.
Children
Jogy is not directed to children under 13 and we do not knowingly collect their information. Guardians who believe a child has used the app without consent can contact us and we will delete the account and its data.
Content safety
Every post, comment, message, itinerary and user can be reported from within the app. We review reports within 24 hours and remove violating content or suspend accounts. You can also block another user from their profile.
Contact
In-app: Settings → Feedback. By email: privacy@jogy.cc