這份政策說的是哪一版 App
揪啦(以下簡稱「本服務」)由揪啦團隊營運。本政策描述的是 2026 年 9 月改版後的揪啦 —— 用 Anthropic 產生行程、沒有「探索」社群功能、也沒有經驗值與等級的那一版。它是照那一版自己的程式碼寫出來的,不是從舊版政策改寫的。
如果你手上還是 2026 年 9 月以前的 1.0.3:那一版有「探索(Explore)」社群貼文與互動、有經驗值與等級,行程由 Google Gemini 產生 —— 這三件事在新版都不存在,本頁描述的資料流與 1.0.3 並不相同。列出它們是為了讓你分辨自己手上是哪一版;本頁其餘每一段描述的都是新版。
Jiula 用來規劃行程。為此,它保存你登入用的帳號、你建立的行程,以及你目前有沒有訂閱。就這些。
它不會使用你裝置的定位。只有在你要它做一本相簿時,它才會開啟你的照片圖庫,而且一定先由 iOS 詢問你的許可。它裡面沒有任何分析、廣告或當機回報服務,也沒有廣告識別碼。
本政策描述的是你現在正在讀它的這個版本。它是照這個 app 自己的程式碼寫出來的,不是從舊版 Jiula 改來的。
你可以用電子郵件與密碼登入,也可以用「透過 Apple 登入」或 Google 登入。
如果你用電子郵件登入,我們會保存那個地址,以及你自己取的顯示名稱。密碼本身由我們的認證服務處理,我們看不到。
如果你用 Apple 或 Google 登入,該供應商會告訴我們你是誰,並可能一併提供你在那邊帳號上的名字與電子郵件地址。Apple 允許你隱藏真實地址、改用轉寄地址;若你這麼做,我們收到的就只有那個轉寄地址。
這個 app 會讀你的顯示名稱來稱呼你,讀你的電子郵件地址來顯示你登入的是哪一個帳號。它不會讀取大頭照、電話號碼、生日、通訊錄,或供應商那邊的其他任何東西。
一個行程裡放的是你放進去的東西:標題、日期、你選的目的地、你打算怎麼移動,以及每一個站點的名稱、地點、抵達時間、預計停留多久,還有你寫在上面的備註。
行程存放在我們的伺服器上,這樣它才能在你重新安裝 app 之後還在,也才能跟著你到另一台裝置。它們掛在你的帳號下,而資料庫的設定使得一筆行程只有擁有它的那個帳號能讀取、修改或刪除。
你可以在 app 裡刪除任何一個行程。刪掉之後,存放的那一筆就沒有了。
這個 app 不會索取、讀取或儲存你裝置的位置。它裡面沒有任何定位相關的程式碼,也不要求任何定位權限,所以 iOS 永遠不會為它跳出定位詢問。
app 裡的地圖與座標,除了下面講的「附近建議」以外,講的是地點,不是你。當你搜尋一個地點,回來的是那個地點的座標;當行程顯示地圖,地圖是圍著那個行程的站點畫的。如果搜尋被限縮在某個範圍內,那個範圍是你行程所在的區域,不是你此刻站在哪裡。
唯一的例外是「附近建議」。行程進行中,你可以在某一站按下「附近建議」,問問這附近還有什麼。你按下去的那一刻,app 會向你要一次裝置定位,並把那一對座標送給 Anthropic —— 否則它無從知道「附近」是哪裡。這件事只在你按的時候發生:沒有背景追蹤,不按就不會取用你的位置,而那對座標不會被留存下來重複使用。
相簿本會把你自己的旅行照片排進行程裡,為此這個 app 會開啟你的照片圖庫。第一次使用時 iOS 會先詢問你的許可,你可以拒絕。拒絕的話,它一張都不會讀,app 的其他部分也完全照舊。
它從一張照片讀的,是你手機在拍照當下就已經存好的位置與時間。這兩樣東西會在你的裝置上,拿去跟你行程裡的站點比對。沒有任何一張照片被送到我們的伺服器,沒有任何一張照片被上傳到任何地方,也沒有任何模型看過照片。
為了把那些資訊交出來,iOS 同時會給 app 每張照片的一張小預覽圖。app 不會保留那些預覽圖、不會儲存它們,也不會把它們送到任何地方:被帶進相簿本的只有照片自己的識別碼、位置與時間。
如果你選擇只允許存取部分照片、而不是整個圖庫,iOS 就不會給這個 app 任何存取權,相簿本會直接告訴你它沒有收到任何照片。就只有這件事會發生,app 裡其他東西都不會變。
跟上面這些無關的另一件事:你在地點旁邊看到的照片,是那些地點的照片,在畫面需要時取回來給你看的。那些不是你的照片,也不是你上傳的。
訂閱透過 App Store 銷售,由 Apple 收款。這個 app 從頭到尾看不到你的信用卡、帳單地址或 Apple ID。
我們使用訂閱服務 RevenueCat,讓 app 知道你的訂閱有沒有生效。RevenueCat 會收到一個代表你帳號的識別碼,以及 Apple 給它的購買資訊,並回頭告訴我們你有沒有訂閱、買的是哪一個方案、什麼時候到期。這些就是我們保存的訂閱資料。
如果你訂閱之後想停掉,是在你的 Apple 帳號裡管理與取消,不是在這裡 —— app 會把你帶到正確的頁面。
你的帳號有一個識別碼,我們的伺服器用它來知道哪些行程、哪一筆訂閱是你的。我們給訂閱服務的也是同一個識別碼,好讓兩邊對得上同一個人。
為了執行方案的用量上限,我們的伺服器會記錄你產生行程的次數,那筆計數掛在你的帳號識別碼下。它記的是次數,不是內容。
這個 app 沒有廣告識別碼,不會要求追蹤你的許可,也不會把你跟你在其他公司的 app 或其他網站上做的事連在一起。
跟任何透過網際網路提供的服務一樣,我們的伺服器會看到請求是從哪個網路位址來的。那是用來防止服務被濫用的,不會拿來建立你的輪廓。
以下是這個 app 會傳送資料出去的每一家外部公司,以及每一家各自拿到什麼。
部分地點資訊與照片來自 Google。凡是顯示它們的地方,app 都會依 Google 的要求一併顯示 Google 的標誌。
除上述服務商外,我們不會將你的個人資料出售或出租予任何第三方。
上面這份清單講的是 app。你現在正在讀的這一個網頁本身由 Cloudflare Pages 託管,所以載入這個網頁時,Cloudflare 的伺服器會看到你的網路位址;app 本身不與 Cloudflare 通訊。
沒有。這個 app 裡沒有分析服務、沒有當機回報服務、沒有廣告服務,也沒有任何形式的追蹤服務。
沒有任何人會收到你打開了哪些畫面、點了什麼的紀錄。
這個 app 可以在免費試用結束前設一個提醒。那個提醒是你自己的手機排的、從你的手機發出的,我們的伺服器不會送任何東西給它。
只有在你允許通知時才會排。你不允許的話,就不會排,其他什麼都不會變。
有少量資料留在裝置本身:你有沒有看過導覽、你正在用哪一種語言、你在規劃行程時填到一半的回答,以及你的登入工作階段。
把 app 移除,這些就一起沒有了。
你可以在 app 裡刪除你的帳號。刪除之後,帳號以及掛在它下面的行程都會一併移除。
本服務適用對象為 13 歲以上使用者。我們不會明知而蒐集 13 歲以下兒童的個人資料。若發現有相關情形,將立即刪除該資料。
資料在傳輸過程中以 HTTPS 加密。行程存放在我們的資料庫中,並以資料列層級的存取控制設定成只有擁有它的帳號能讀取、修改或刪除。我們會持續套用安全性更新。然而,網路上任何資料傳輸與儲存方式皆無法保證百分之百安全。
本政策若有異動,更新後的版本就出現在這裡,以及 app 內的同一份政策上。
對本政策有任何疑問,或想知道我們持有你的哪些資料,都可以聯絡我們。
若對本政策或您的個人資料有任何疑問，歡迎來信：
support@jiula.app ／ carltseng509@gmail.com
本政策適用於揪啦 Pro 訂閱之所有方案。各方案之行程產生份數以應用程式內購買頁面所載內容為準。
為維護全體使用者的服務品質與系統穩定，本服務保留對異常使用行為進行處置之權利。
下列行為視為異常使用：
本服務將依情節輕重採取階段性處置：
情節重大或對系統有立即危害之情形，本服務得逕行暫停該帳號服務。
訂閱係透過 Apple App Store 交易，退款事宜由 Apple 依其政策處理，本服務無法直接受理退款。使用者可透過 Apple「回報問題」頁面提出申請。
本服務保留修改本政策之權利。重大變更將於生效前於應用程式內公告。
Which version of the app this policy covers
Jiula (the "Service") is operated by the Jiula team. This policy describes Jiula as rebuilt in September 2026 — the version that generates itineraries with Anthropic, has no Explore social feature, and has no XP or levels. It was written from that version's own source code rather than adapted from the earlier policy.
If you are still on 1.0.3, the version published before September 2026: that version had Explore social posts and interactions, had XP and levels, and generated itineraries with Google Gemini. None of those three exist in the new version, and the data flows described on this page are not the same as 1.0.3's. They are listed here so you can tell which version you are holding; every other paragraph on this page describes the new version.
Jiula plans trips. To do that it keeps the account you sign in with, the trips you make, and whether you have an active subscription. That is the whole list.
It does not use your device's location. It opens your photo library only when you ask it to build a scrapbook, and only after iOS has asked your permission. It contains no analytics, no advertising and no crash-reporting service, and it has no advertising identifier.
This policy describes the version of the app you are reading it in. It was written from the app's own source code rather than adapted from an earlier version of Jiula.
You can sign in with an email address and a password, or with Sign in with Apple or with Google.
If you sign in with an email address, we hold that address and the display name you choose. The password itself is handled by our authentication provider and is never visible to us.
If you sign in with Apple or Google, that provider tells us who you are and may pass along the name and email address held on your account there. Apple lets you hide your real address and pass on a relay address instead; if you do, the relay address is all we ever receive.
The app reads your display name to greet you and your email address to show you which account you are signed in to. It does not read a profile picture, a phone number, a birthday, a contact list or anything else from your provider.
A trip holds what you put in it: its title, its dates, the destinations you chose, how you plan to get around, and for each stop its name, its place, its arrival time, how long you plan to stay and any note you write on it.
Trips are stored on our servers so that they survive reinstalling the app and follow you to another device. They are stored against your account and the database is configured so that a trip can only ever be read, changed or deleted by the account that owns it.
You can delete any trip from inside the app. Deleting it removes the stored trip.
The app does not ask for, read or store your device's location. It contains no location code and requests no location permission, so iOS will never show you a location prompt for it.
Maps and coordinates in the app are about places, not about you — with one exception, described below. When you search for a place, the search is answered with that place's coordinates; when a trip shows a map, it is drawn around the stops in that trip. If a search is narrowed to an area, the area is the region your trip is about, not where you happen to be standing.
The one exception is nearby suggestions. While a trip is running you can tap a stop and ask what else is nearby. At the moment you tap, the app asks your device for your position once and sends that pair of coordinates to Anthropic — otherwise it has no way to know where "nearby" is. This happens only when you tap: there is no background tracking, your position is not read unless you ask, and those coordinates are not retained for reuse.
The scrapbook lays your own travel photos onto a trip, and to do that the app opens your photo library. iOS asks your permission the first time, and you can refuse. If you refuse, nothing is read, and every other part of the app carries on exactly as before.
What the app reads from a photo is the location and the time your phone already saved with it when you took it. Those two things are compared to the stops in your trip, on your device. No photo is sent to our servers, no photo is uploaded anywhere, and no model is ever shown a picture.
To hand over that information, iOS also gives the app a small preview image of each photo. The app does not keep those previews, does not store them and does not send them anywhere: only the photo's own identifier, location and time are carried into the scrapbook.
If you allow access to selected photos only, rather than to your whole library, iOS does not give this app access at all, and the scrapbook will tell you it received no photos. That is the only thing that happens; nothing else in the app changes.
Separately from any of this, the photographs you see beside places are pictures of those places, fetched for you when a screen needs them. They are not yours and they are not uploaded by you.
Subscriptions are sold through the App Store. Apple takes the payment. The app never sees your card, your billing address or your Apple ID.
We use RevenueCat, a subscription service, to tell the app whether your subscription is active. RevenueCat receives an identifier for your account and the purchase information Apple gives it, and tells us in return whether you are subscribed, which product you bought and when it expires. That is what we store about your subscription.
If you subscribe and later want to stop, you manage and cancel the subscription in your Apple account, not here — the app links you to the right page.
Your account has an identifier that our servers use to know which trips and which subscription are yours. The same identifier is what we give the subscription service, so that the two agree about who you are.
To enforce the usage limits on your plan, our servers keep a count of how many itineraries you have generated, held against your account identifier. It records how many, not what was in them.
The app has no advertising identifier, does not ask for permission to track you, and does not link you to anything you do in other companies' apps or on other websites.
As with any service reached over the internet, our servers see the network address a request arrives from. It is used to keep the service from being abused, and is not used to build a profile of you.
These are every outside company the app sends anything to, and exactly what each one gets.
Some place information and photographs come from Google. Where the app shows them, it shows Google's mark alongside, as Google requires.
Apart from the services above, we do not sell or rent your personal data to any third party.
That list is about the app. This web page itself is hosted on Cloudflare Pages, so loading this page lets Cloudflare's servers see your network address. The app itself does not talk to Cloudflare.
There is none. The app contains no analytics service, no crash-reporting service, no advertising service and no tracking service of any kind.
Nobody is sent a record of which screens you opened or what you tapped.
The app can set a reminder before a free trial ends. That reminder is scheduled by your own phone, from your phone, and nothing is sent to it from our servers.
It is only scheduled if you allow notifications. If you do not, nothing is scheduled and nothing else changes.
A small amount is kept on the device itself: whether you have been through the introduction, which language you are reading in, the answers you are part-way through giving while you plan a trip, and your signed-in session.
Removing the app removes all of it.
You can delete your account from inside the app. Deleting it removes the account and the trips stored against it.
The Service is intended for users aged 13 and above. We do not knowingly collect personal data from children under 13. If we become aware of such collection, we will delete it promptly.
Data is encrypted in transit with HTTPS. Trips are stored in our database with row-level access control configured so that only the account that owns a trip can read, change or delete it. We apply security updates as they are released. However, no method of transmission or storage over the internet can be guaranteed completely secure.
If this policy changes, the updated version appears here, and in the same policy inside the app.
To ask about anything in this policy, or to ask what we hold about you, contact us.
For questions about this policy or your data, contact:
support@jiula.app / carltseng509@gmail.com
This policy applies to all Jiula Pro subscription plans. The number of itinerary generations included in each plan is as stated on the in-app purchase page.
To maintain service quality and system stability for all users, we reserve the right to take action against abnormal usage.
The following constitute abnormal usage:
We will act in proportion to the severity of the conduct:
Where conduct is severe or poses an immediate risk to the system, we may suspend the account without prior notice.
Subscriptions are purchased through the Apple App Store. Refunds are handled by Apple under its own policies; we cannot process refunds directly. You may submit a request through Apple's "Report a Problem" page.
We reserve the right to modify this policy. Material changes will be announced in-app before taking effect.