TimeFlow 隐私政策
更新日期：2026 年 9 月 23 日 · 生效日期：2026 年 9 月 23 日
TimeFlow（时光流）高度重视用户隐私与个人数据安全。本隐私政策依据《中华人民共和国个人信息保护法》以及 Google Play 开发者政策核心原则制定，详细说明我们在您使用 TimeFlow 时的个人信息处理实践。请在使用本应用前仔细阅读并充分理解。
一、我们处理的信息（最小必要原则）
TimeFlow 坚持「数据本地优先与最小必要」原则，仅在实现核心行程打卡功能时处理极简信息：
- 位置信息（敏感个人信息，ACCESS_FINE_LOCATION / ACCESS_COARSE_LOCATION）：仅在您主动点击「打卡」按钮时，在前台（Foreground）瞬时读取一次当前设备的经纬度坐标与大致地名，用于生成打卡行程点。TimeFlow 绝不在后台静默追踪您的实时位置，不使用后台定位权限（ACCESS_BACKGROUND_LOCATION）。若您拒绝授予位置权限，您仍可正常使用本应用进行无坐标的手动打卡。
- 时间信息：打卡操作发生的时间戳。
- 出行方式与标签：您自主选择的出行方式（步行、骑行、自驾、打车、地铁、公交、高铁、飞机、轮渡）及您填写的地点别名（如「家」「公司」）或打卡备注。
- 应用偏好与配置：您自设的应用语言、外观色彩模式、打卡偏好及 WebDAV 备份配置参数（如有）。
除上述功能必需项外，本应用不收集通讯录、短信、通话记录、设备唯一识别码（IMEI/IMSI）等任何与打卡无关的个人信息。当您主动使用小票生成功能时，相关图片和文本仅在您本机临时生成并保存。
二、第三方 SDK 及系统服务披露
为向您提供快速、稳定的定位与逆地理编码解析能力，本应用集成了以下技术支持组件：
-
高德开放平台定位 SDK
- 服务提供商：北京高德图强科技有限公司
- 使用目的：在中国大陆地区为您提供高精度定位与逆地理位置名称反查
- 收集个人信息类型：经纬度、设备信息（IP 地址、GNSS 信息、WiFi 状态/参数/列表/信号强度、基站信息、传感器信息、设备型号、操作系统、屏幕分辨率）
- 信息收集方式：SDK 在打卡时本机调用采集
- 第三方隐私政策链接：https://lbs.amap.com/pages/privacy/
-
Android 系统 / Google Play 服务定位接口（Google Play Services Location / Expo Location）
特别声明：除上述定位与逆地理必要组件外，TimeFlow 没有自建业务服务器，不会将您的个人信息上传至任何集中式数据库；本应用未集成任何第三方商业广告 SDK、未集成任何用户行为追踪/画像 SDK（如 Google Analytics、Firebase、Facebook SDK 等），绝不售卖或向第三方共享您的个人隐私。
三、信息的存储、加密与安全
- 全本地存储（Local-First）：您的所有打卡记录、时间、轨迹点与通勤数据均默认且仅存储在您手机本机的沙盒存储（SQLite 数据库）中，数据所有权 100% 归您所有。
- 加密传输：获取坐标及地名解析均通过 HTTPS 强加密传输链路进行，杜绝中间人嗅探。
- WebDAV 私有云同步与军工级加密：若您主动启用第三方 WebDAV 云同步功能，备份数据在离开手机前将基于您的私有口令进行 PBKDF2 密钥派生及 AES-256-CBC 强加密，并直接上传至您指定的个人私有云盘（如坚果云、Nextcloud）。开发者与任何第三方均无密钥，绝对无法解密或窥视备份内容。
四、信息的使用目的
收集的信息仅用于在本地向您提供核心服务：呈现今日流体时间轴、历史行程回顾、A→B 定向通勤耗时分析与图谱洞察。我们不会将您的信息用于广告推送、营销推广或自动化信用评估等任何商业化决策。
五、设备权限说明
- 前台位置权限（ACCESS_FINE_LOCATION / ACCESS_COARSE_LOCATION）：仅在主动打卡瞬时调用。您可随时在手机系统设置中撤回该授权，撤回后打卡功能依然可用，地名将默认显示为「未命名」。
- 后台位置权限（ACCESS_BACKGROUND_LOCATION）：本应用不申请、不使用任何后台静默位置追踪权限。
- 媒体与相册存储权限（READ_MEDIA_IMAGES / WRITE_EXTERNAL_STORAGE / expo-media-library）：仅在您主动点击「保存小票到本地」时调用，用于将应用生成的行程纪念小票高清图片（PNG）保存至您设备的系统相册（TimeFlow 专属相册）。TimeFlow 绝不读取、访问、扫描或上传您相册中的任何已有私人照片或视频。若您拒绝授予该权限，仅无法直接保存图片至相册，不影响任何其他核心记账打卡功能。
- 系统剪贴板（expo-clipboard）：仅在您主动点击「分享小票」时，将当前小票的格式化纯文本明细写入系统剪贴板，方便您在其他应用中粘贴发送。TimeFlow 绝不读取您的系统剪贴板历史记录。
六、您的权利与数据删除机制（Data Deletion）
依据法律法规及 Google Play 用户数据政策，您对自己的数据拥有完整的控制权：
- 单条记录删除：在首页时间轴中可就地左滑或点击删除任意误触打卡点。
- 应用内一键清空全部数据：可在「我的 → 数据管理与备份 → 清空所有打卡记录」或「洞察 → 历史 → 清空所有打卡记录」中随时一键抹除本地 SQLite 数据库中的全部历史数据，该操作不可逆。
- 设备卸载物理清除：直接在手机桌面卸载 TimeFlow 应用，操作系统将物理擦除本应用沙盒内的全部数据库文件与配置文件。
- 云端备份删除：您可随时在您绑定的 WebDAV 网盘目录中直接删除
.tfbak 备份文件，或在 App 内点击「清除 WebDAV 配置 / 清除口令」。
- 数据导出与权利请求：您可在设置中导出全部打卡明细。若有任何数据处理疑问或权利行使需求，可通过官方邮箱与开发者联系。
七、未成年人隐私保护
TimeFlow 专为职场通勤与日常生活效率记录打造，主要面向成年人群体。我们不会明知而收集未满 13 周岁（或您所在司法辖区规定的未成年人年龄）儿童的个人信息。如发现误收，我们将在核实后立即协助清除。
八、政策更新与通知
若隐私政策发生重大变更，我们将在应用内版本更新说明或设置页面中显著提示。继续使用本应用即表示您知悉并同意受更新后政策的约束。
九、联系我们
如果您对本隐私政策或个人数据安全有任何疑问、意见、建议或申诉，欢迎通过以下方式与开发者联系：
• 开发者联系邮箱：chonggao9@gmail.com
• 开源与反馈主页：https://github.com/chonggao9/timeflow
TimeFlow Privacy Policy
Last Updated: September 23, 2026 · Effective Date: September 23, 2026
TimeFlow ("we", "us", or "our") deeply respects and protects your privacy and personal data. This Privacy Policy is formulated in compliance with applicable data protection laws and Google Play Developer Policies. It describes how your personal data is processed when you use TimeFlow. Please read this policy carefully before using the app.
1. Information We Process (Data Minimization)
TimeFlow strictly adheres to the "local-first" and data minimization principles. We only process minimal data strictly necessary for milestone tracking:
- Location Data (Sensitive Personal Information, ACCESS_FINE_LOCATION / ACCESS_COARSE_LOCATION): Only when you actively tap the "Check In" button, we read your coordinates in the foreground once to log your milestone and look up the place name. TimeFlow NEVER tracks your location silently in the background, and does NOT request or use background location permission (ACCESS_BACKGROUND_LOCATION). If you deny location permission, you can still use the app with manual place names.
- Timestamp: The exact date and time of each check-in event.
- Transport Mode & Custom Labels: Your selected transport mode (Walk, Bike, Drive, Taxi, Subway, Transit, Train, Flight, Boat), place aliases (such as "Home" or "Office"), and custom notes.
- Preferences & Configuration: Language selection, theme appearance, and optional WebDAV sync settings.
We do not collect contacts, SMS, photos, phone status, hardware IDs (IMEI/IMSI), or any sensitive data unrelated to milestone tracking. When you use the trip receipt feature, the receipt image and text are rendered and stored solely on your local device.
2. Third-Party SDKs & Service Providers
To provide reliable location retrieval and reverse geocoding across regions, TimeFlow integrates the following components:
-
Amap Open Platform Location SDK
- Provider: Beijing Amap Tuqiang Technology Co., Ltd.
- Purpose: High-precision location and reverse geocoding primarily in mainland China.
- Data Collected: Coordinates, device information (IP address, GNSS info, Wi-Fi parameters/list/signal, base station info, sensor data, device model, OS, screen resolution).
- Method: Collected locally on-device upon check-in.
- Privacy Policy: https://lbs.amap.com/pages/privacy/
-
Android System & Google Play Services Location (Google Play Services / Expo Location)
Important Disclosure: Other than the technical location components listed above, TimeFlow operates with NO centralized backend servers and stores no user data on remote databases. Furthermore, TimeFlow contains ZERO advertising SDKs, and ZERO behavioral analytics or tracking SDKs (such as Google Analytics, Firebase, Facebook SDK, etc.). We never sell, rent, or trade your personal data.
3. Data Storage, Encryption & Security
- 100% Local-First Storage: All your check-in logs, timestamps, routes, and statistics are stored exclusively in your device's local application sandbox (SQLite database). You own 100% of your data.
- Encryption in Transit: Location coordinate lookups and geocoding queries are transmitted over encrypted HTTPS channels.
- WebDAV Private Cloud Sync & AES-256 Encryption: If you choose to enable WebDAV cloud backup, backup packages are strongly encrypted locally with AES-256-CBC (derived via PBKDF2 from your private passphrase) before being sent directly to your self-hosted or chosen WebDAV cloud server (e.g. Nextcloud). Neither the developer nor any third party possesses the decryption key.
4. Purpose of Data Use
Data processed by TimeFlow is used solely on your local device to generate your daily fluid timeline, trip duration insights, and commuting patterns. We do not use your data for advertising, profiling, or automated credit assessment.
5. Device Permissions
- Foreground Location Permission (ACCESS_FINE_LOCATION / ACCESS_COARSE_LOCATION): Requested only at the moment of check-in. You can revoke this permission at any time in system settings without breaking core manual logging functionality.
- Background Location (ACCESS_BACKGROUND_LOCATION): TimeFlow neither declares nor uses background location tracking.
- Photos & Media Storage Permissions (READ_MEDIA_IMAGES / WRITE_EXTERNAL_STORAGE / expo-media-library): Requested strictly when you actively tap the "Save Locally" button on a trip receipt, solely to save the generated trip receipt image (PNG) into your device's photo gallery under a dedicated "TimeFlow" album. TimeFlow NEVER reads, scans, accesses, or uploads any of your existing personal photos or videos. Denying this permission only prevents direct image export to your gallery and will not affect any core tracking or logging features.
- System Clipboard (expo-clipboard): Used solely when you actively tap the "Share Receipt" button to write formatted receipt summary text to your system clipboard for easy pasting into your communication apps. TimeFlow NEVER reads, inspects, or transmits your clipboard history.
6. Your Rights & Data Deletion Policy
In full compliance with Google Play User Data Policies and global privacy regulations, you have comprehensive control over your data:
- Granular In-App Deletion: Swipe or tap to delete any single milestone or trip directly from the timeline.
- Complete In-App Data Wipe: Navigate to "Profile → Data & Cloud Backup → Clear All Check-In Records" or "Insights → History → Clear All Check-In Records" to permanently erase your local SQLite database with one tap. This action is irreversible.
- App Uninstallation: Uninstalling TimeFlow from your device permanently purges all local sandbox database files, cache, and configurations via the operating system.
- Cloud Backup Deletion: You can delete `.tfbak` files directly on your WebDAV cloud server, or tap "Clear WebDAV Config" within the app.
- Developer Contact for Data Inquiries: Although we hold no server copies of your data, you can email us at
chonggao9@gmail.com for any data deletion assistance or privacy inquiries.
7. Children's Privacy
TimeFlow is intended for general audiences and adult commuters/professionals. We do not knowingly collect personal information from children under 13 (or under 16 in the EEA). If you believe a child has provided data, please contact us to have it purged.
8. Changes to this Policy
If we update this Privacy Policy, the revised version will be published here with an updated effective date. Material changes will be highlighted within the app.
9. Contact Us
If you have any questions, feedback, or requests regarding this Privacy Policy, please reach out to us:
• Developer Email: chonggao9@gmail.com
• GitHub Repository: https://github.com/chonggao9/timeflow