隐私政策
更新日期：2026-10-22 · 运营方：HeartBeat 团队
本政策说明「心跳 HeartBeat」（App 与网页版，下称"本应用"）收集哪些数据、交给谁处理、保留多久，以及你如何删除。
1. 我们收集的数据
- 账号：随机生成的设备 ID 与账号 ID；你选择登录时提供的邮箱（可选，不登录也能以游客身份使用）。
- 内容：你与角色的对话、游戏进度与设置、你上传的图片（云存档，用于换设备找回）。
- 购买：订单、会员与心动币记录。我们不接触、不保存你的银行卡等支付凭证。
- 使用：功能使用事件（如打开应用、进入某一章、发送消息），用于改进体验与排查问题。
- 推送：推送令牌，仅在你允许通知后用于给你发消息（App）。
- 网络：IP 地址，用于安全防护、防刷限流，以及判断所在国家/地区。
- 广告归因：你从广告链接进入时链接里带的点击 ID 与广告参数；安卓设备的安装来源（Install Referrer）。在 iOS 上，只有你在系统弹窗中允许"跟踪"后，我们才会把它们用于广告归因。
2. 谁会处理这些数据
仅为提供本应用的功能，按需最少提供：
- Cloudflare：服务器与数据存储。
- OpenRouter：第三方 AI 服务。你的对话与剧情上下文会发送给它（及其调用的模型提供方），用于生成角色回复与剧情。
- Brevo：发送登录验证码邮件（只涉及邮箱地址与验证码）。
- Google Firebase：发送推送通知（App）。
- Apple / Google：处理 App 内购买。
- Creem：仅处理网页版的支付。
- 投放归因系统及广告平台（如 Meta）：仅用于统计哪条广告带来了安装、注册与购买；iOS 上仅在你允许"跟踪"后。
3. 我们不出售你的个人数据
4. 保留与删除
数据保留到你删除账号为止。删除账号后，账号、存档、对话、上传的图片、推送令牌、设备记录与广告归因记录一并清除；订单与交易流水按财税法规要求去标识化后保留，不再能关联到你。
删除方式（任选其一）：
通过 App Store 或 Google Play 购买的订阅由商店管理，请在系统的订阅设置里取消；删除账号不会自动停止商店扣费。
5. 安全
数据传输全程加密（HTTPS）。
6. 内容性质
本应用为虚构的 AI 互动剧。角色与剧情均为虚构，角色回复由 AI 实时生成，不代表真实人物，也不构成任何建议。
7. 联系我们
[email protected]
8. 政策更新
重大变更会在应用内提示，并更新本页的日期。
Privacy Policy
Last updated: 2026-10-22 · Operator: the HeartBeat team
This policy explains what data HeartBeat (the app and the web version, "the app") collects, who processes it, how long we keep it, and how you can delete it.
1. What we collect
- Account: a randomly generated device ID and account ID; your email if you choose to sign in (optional — you can play as a guest).
- Content: your conversations with characters, game progress and settings, and images you upload (cloud save, so you can restore on a new device).
- Purchases: order, membership and coin records. We never see or store your card or payment credentials.
- Usage: feature-usage events (e.g. app opened, chapter entered, message sent) to improve the app and fix problems.
- Push: a push token, used only to send you messages after you allow notifications (app).
- Network: your IP address, for security, abuse and rate limiting, and determining your country or region.
- Ad attribution: the click ID and ad parameters in an ad link you arrived from, and the Android install referrer. On iOS, we use these for ad attribution only after you allow tracking in the system prompt.
2. Who processes it
Only to provide the app, and only what each service needs:
- Cloudflare: servers and data storage.
- OpenRouter: a third-party AI service. Your conversation and story context are sent to it (and the model providers it uses) to generate character replies and scenes.
- Brevo: sends sign-in code emails (your email address and the code only).
- Google Firebase: delivers push notifications (app).
- Apple / Google: process in-app purchases.
- Creem: processes payments on the web version only.
- Our ad-attribution system and ad platforms (such as Meta): only to measure which ads led to installs, sign-ups and purchases; on iOS, only after you allow tracking.
3. We do not sell your personal data
4. Retention & deletion
We keep your data until you delete your account. Deleting your account removes your account, saves, conversations, uploaded images, push token, device records and attribution records. Order and transaction records are de-identified and kept as tax and accounting law requires; they can no longer be linked to you.
You can delete your account in any of these ways:
Subscriptions bought through the App Store or Google Play are managed by the store — cancel them in your system subscription settings. Deleting your account does not stop store billing.
5. Security
All data is encrypted in transit (HTTPS).
6. Nature of the content
HeartBeat is a fictional AI interactive drama. All characters and plots are fictional; character replies are generated by AI in real time, do not represent real people, and are not advice.
7. Contact
[email protected]
8. Changes
We will notify you in the app of material changes and update the date on this page.