English version below ↓

BibleDiary 隱私權政策

更新日期：2026 年 9 月 22 日

BibleDiary 是一款心情日記 App，搭配聖經經文陪伴。這份政策說明我們如何處理你的資料。營運者：BibleDiary，聯絡信箱 contact@biblediary.app。

日記內容儲存在你的裝置上

你寫下的日記、心情、書籤與讀經計畫紀錄會加密儲存在裝置本機（AES-256-GCM），加密金鑰保存在 iOS Keychain 或 Android Keystore，不會離開裝置，也不會上傳到我們的伺服器，除非你另外啟用下方的「跨裝置同步」。

你也可以另外開啟「日記鎖」，用生物辨識或裝置密碼保護日記畫面；這是選用功能，與資料加密分開運作。

帳號與登入

BibleDiary 使用 Firebase Authentication 提供 Google 或 Apple 登入。登入後我們會取得你的帳號識別碼（User ID），以及 Google／Apple 依你的選擇提供的電子郵件地址，用來識別你的帳號、管理購買權益與同步設定。我們不會取得你的密碼。

AI 經文推薦

當你在某一篇日記按下「請 AI 推薦經文」並明確同意後，App 才會把那一篇日記的文字與你選填的心情傳送到我們自架的後端服務（Cloud Run），再轉交 Google Gemini 產生建議。這個傳送只在你每次主動同意時發生，不會自動或在背景進行。我們的伺服器不會儲存日記內容或 AI 回覆；伺服器只保留一筆用量紀錄（帳號識別碼與請求次數／時間），用來限制每日請求數以避免濫用。

跨裝置同步（選用，預設關閉）

你可以選擇開啟跨裝置同步，將日記、書籤、讀經計畫與完成紀錄備份到雲端，以便在其他裝置繼續使用。這項功能採用端對端加密：資料會先在你的裝置上用只有你持有的「復原金鑰」加密，才上傳到 Google Cloud（Firestore，資料儲存於台灣 asia-east1）。我們的伺服器只會看到加密後的內容、帳號識別碼、請求時間與資料筆數等中繼資訊，看不到日記的實際文字。復原金鑰不會被上傳，若遺失金鑰，雲端中已加密的資料將無法復原。單純登入不會自動開啟同步，需要你另外明確啟用。

匯出備份

你可以在 App 內把日記、書籤與讀經計畫匯出成 JSON 備份檔，檔案會以你自訂的密碼加密後才寫入裝置。備份檔只存在你的裝置與你自行分享的位置，我們不會收到這份檔案。

購買

BibleDiary 的付費功能由 Apple App Store 或 Google Play 完成付款，並由 RevenueCat 協助驗證與同步購買權益。BibleDiary 與 RevenueCat 會處理你的帳號識別碼、購買的商品與平台，藉此確認你的權益；我們不會收到或保存完整的信用卡號。購買前，系統商店會顯示實際價格。

匿名使用統計（預設開啟，可關閉）

為了知道哪些功能真的有人在用，App 會記錄功能被使用的次數，不含日記、經文與身分。送出的只有五件事：App 被開啟、桌布匯出成功、你點了「在手機上設定」、Plus 購買成功、AI 選經成功。其中三件會附帶一個樣式代號、語言（中文或英文）或方案代號，不會有任何自由輸入的文字。這些次數只會送到開發者自己架設的伺服器（biblediary.app），沒有經過任何第三方分析服務。每支手機在第一次開啟時會產生一組隨機編號，送到伺服器後會立刻與一組祕密鹽值和當週週次一起雜湊，只留下雜湊值的前 16 個字元；原始編號不會被儲存，雜湊值每週都會換一組，無法跨週追蹤同一支手機。它與你的 email、帳號、手機識別碼或廣告識別碼都無關。我們不會收到你的日記、經文、心情、姓名、AI 結果、檔名或錯誤訊息。你可以隨時在 App 的「隱私與語言」設定中關閉「分享匿名使用統計」，關閉後就不會再送出任何一筆。

我們不會做的事

刪除帳號與資料

你可以在 App 內「帳號」設定中永久刪除帳號，這會移除我們伺服器上與你帳號相關的雲端同步資料、登入紀錄與用量紀錄。裝置本機的日記資料可透過解除安裝 App 或在裝置設定中清除。App Store／Google Play 的購買紀錄由商店保管，刪除帳號不會影響你在商店已完成的購買。

兒童隱私

BibleDiary 不是針對兒童設計的 App，我們不會刻意收集兒童的個人資料。

政策更新

若本政策有重大變更，我們會更新本頁的「更新日期」，並視情況在 App 內另行通知。

聯絡方式

如對隱私權、資料存取或刪除有任何問題，請寄信至 contact@biblediary.app。

BibleDiary Privacy Policy

Last updated: September 22, 2026

BibleDiary is a mood journal app paired with Bible scripture companionship. This policy explains how we handle your data. Operator: BibleDiary, contact contact@biblediary.app.

Your journal stays on your device

Your journal entries, moods, bookmarks and reading-plan records are encrypted and stored locally on your device (AES-256-GCM); the encryption key is kept in iOS Keychain or Android Keystore, never leaves your device, and is never uploaded to our servers unless you turn on cross-device sync below.

You can also optionally enable a Journal Lock, protected by biometrics or your device passcode. This is a separate, opt-in feature.

Account and sign-in

BibleDiary uses Firebase Authentication for Google or Apple sign-in. After you sign in, we receive your account identifier (User ID) and the email address Google/Apple chooses to share, used to identify your account and manage purchase entitlements and sync settings. We never receive your password.

AI scripture recommendation

Only when you tap "Get AI scripture recommendation" on a specific entry and explicitly consent does the app send that entry's text and your optional mood to our own backend service (Cloud Run), which forwards it to Google Gemini to generate a suggestion. This only happens when you actively consent each time; it never runs automatically or in the background. Our server does not store journal text or the AI reply; it keeps only a usage record (account ID and request count/time) to enforce daily rate limits and prevent abuse.

Cross-device sync (optional, off by default)

You may choose to enable cross-device sync to back up entries, bookmarks, reading plans and completion records to the cloud so you can continue on another device. This feature is end-to-end encrypted: data is encrypted on your device with a recovery key that only you hold, before being uploaded to Google Cloud (Firestore, stored in Taiwan, asia-east1). Our servers only see the encrypted content plus metadata such as account ID, request time and record counts — never the plaintext of your journal. The recovery key itself is never uploaded; if you lose it, encrypted cloud data cannot be recovered. Signing in alone never turns sync on; you must enable it explicitly.

Exported backups

You can export your entries, bookmarks and reading plans as a JSON backup file inside the app; the file is encrypted with a password you choose before it is written to your device. Backup files stay on your device and wherever you choose to share them; we never receive a copy.

Purchases

Paid features in BibleDiary are billed through the Apple App Store or Google Play, and RevenueCat helps verify and sync your purchase entitlement. BibleDiary and RevenueCat process your account identifier, purchased product and platform to confirm your entitlement; we never receive or store your full card number. The store shows the actual price before purchase.

Anonymous usage counts (on by default, can be turned off)

So we can tell which features people actually use, the app counts how often features are used. Never your entries, verses, or identity. Only five things are sent: the app was opened, a wallpaper was exported, you tapped "Set up on my phone", a Plus purchase completed, and an AI scripture match succeeded. Three of them carry one extra value — a wallpaper style code, a language (Chinese or English), or a plan code. No free-typed text is ever included. These counts go only to the developer's own server at biblediary.app; no third-party analytics service is involved. Each phone generates a random number the first time it opens. The server hashes it together with a secret salt and the current week, keeps the first 16 characters of that hash, and never stores the original number; the hash changes every week, so one phone cannot be followed from one week to the next. It is unrelated to your email, your account, your device identifier or any advertising identifier. We never receive your entries, verses, moods, name, AI results, file names or error messages. You can turn "Share anonymous usage counts" off at any time in the app's Privacy and language settings, and nothing further is sent.

What we don't do

Deleting your account and data

You can permanently delete your account in the app's Account settings, which removes your cloud sync data, sign-in records and usage records from our servers. Local journal data can be removed by uninstalling the app or clearing app data on your device. Purchase records are held by the App Store and Google Play; deleting your account does not affect a purchase you already made there.

Children's privacy

BibleDiary is not directed at children, and we do not knowingly collect personal data from children.

Changes to this policy

If we make material changes to this policy, we will update the date above and, where appropriate, notify you in the app.

Contact

For any privacy, access or deletion questions, contact contact@biblediary.app.