同行原生 App 隐私政策 / Tongxing Native App Privacy Policy

运营者 / Operator: Zheng Jing

生效日期 / Effective date: 2026-10-21

版本 / Version: 2026-10-21

中文

适用范围

本说明适用于同行原生 iPhone / iPad App。同行是独立个人证道听读项目，与 Mariners Church 无隶属、运营或背书关系。原生 App 不提供登录或广告。1.0.0（42）及后续版本提供默认关闭、可自愿开启的匿名语言使用统计；较早版本不上传此项统计。你主动打开的原视频、网页版、Apple 或其他外部网站有各自的隐私规则。

可选匿名语言使用统计（1.0.0（42）起）

你可在“隐私与支持”中开启或关闭统计。开启后，App 将界面语言访问、所选证道页面及正文语言、实际音轨语言、收听秒数及已播放范围上传至本项目的 Firebase 后台，用于了解各语言使用情况和改进收听体验。界面访问不要求播放；有效收听设备按当天累计至少 30 秒计算。界面语言、页面语言与音轨语言分别记录，不根据界面语言推断所听语言。

App 在设备本地生成随机标识，按洛杉矶日期每天更换；服务器仅保存按日期和平台散列后的标识，用于当天去重。统计不与账户、姓名或邮箱关联，不使用广告标识符、设备指纹、第三方分析 SDK，也不用于跨 App 跟踪。不能据此识别具体的人或跨设备去重。统计记录设置 30 天自动过期；云端删除异步完成，报表排除过期记录。托管服务常规请求日志按其自身规则处理。

关闭后立即停止新统计，并尝试撤回本次 App 运行已上传的统计记录；网络离线或请求失败时可能无法完成撤回，既往运行的匿名记录会按上述期限过期。关闭统计不影响收听。删除 App 会移除当前设备的随机标识与偏好，不能据此查找服务器上过去的匿名记录。

自愿订阅的每周通知（正式 App 1.26.21 起）

每周通知默认关闭。只有你在 App 中选择开启且允许系统通知后，App 才向项目的 Google Cloud 服务发送 Apple 推送令牌、随机安装标识、随机订阅密钥、所选通知内容语言及请求序号，用于登记、更新或撤回订阅。服务端保存密钥的散列，不保存明文密钥；不使用姓名、邮箱、广告标识符或账户。Apple 处理推送令牌与通知投递；我们发送的通知只包含已发布页面、语言和版本绑定，不包含你的播放或麦克风资料。

你可在 App 的“每周通知”中关闭，App 会尝试撤回服务端登记；断网或请求结果不明时会在再次联网后按相同请求重试。关闭系统通知权限或删除 App 不一定即时撤回服务端登记；建议先在 App 中关闭。有效登记最长 60 天，App 在你继续订阅时定期续期。登记记录、为防止重复发送而保存的投递结果设置 365 天到期；云端删除异步完成。退订时设备令牌从当前登记记录移除，但不含令牌的序号记录保留至到期，以防旧请求重新订阅。你也可通过下方私密邮箱咨询资料访问或删除。

短时麦克风

只有你点击听音对齐时，App 才请求麦克风权限并聆听 7 至 15 秒，声音清楚时会提前结束，用于在同一英文录音中查找播放位置。声音仅在设备内存中处理，不保存为录音文件、不上传、不发送至云端识别或翻译服务。取消或进入后台会停止采集。拒绝或在系统设置中撤回权限后，你仍可手动收听和定位。

内容下载与服务提供方

App 通过 HTTPS 下载证道目录、音频与参考指纹，内容由 Google Firebase Hosting 提供。Google 会处理请求 IP，用于检测滥用和分析服务使用情况；其公开说明将 IP 数据保留期描述为数月。此处不承诺本项目可以缩短或删除 Google 自身的服务日志。详情见 Firebase 隐私与数据处理说明。

本机资料与删除

音频、目录、参考指纹、语言偏好和播放历史保存在设备本机。播放历史最多 12 条；读取或更新时淘汰超过 30 天的记录，不是持续运行的定时删除服务。下载音频排除系统备份，其他资料可能依你的系统备份设置保存。删除 App 可删除当前设备的本机 App 资料；系统备份另在设备设置中管理。当前 App 不提供账户，也无账户删除流程。

系统播放展示

系统媒体控件、锁屏与实时活动可能显示证道标题、讲员、当前音轨进度和播放状态。实时活动不使用推送服务，App 不另行上传这些状态到业务服务器。你可在系统中管理麦克风和实时活动权限。

TestFlight 测试资料

使用 TestFlight 时，Apple 自动收集崩溃及使用信息并提供给开发者；你提交的文字或截图反馈也会被共享，可能包含姓名、邮箱、设备和构建资料，具体取决于邀请及反馈方式。Apple 表示保留 Beta 反馈一年，崩溃及使用数据可保留至问题解决。详情见 TestFlight 与隐私。

开发者仅将收到的测试资料用于问题排查、回复及 App 改进，不向第三方分享。开发者另行保存的可识别反馈副本在相关问题解决后 90 天内删除，仍需跟进或依法必须保留的情况除外。该期限不改变 Apple 的平台保留规则。请勿附带私人对话、凭据或无关个人资料。

联系与请求

运营者为 Zheng Jing。非敏感功能问题可通过项目 GitHub Issues报告；这是公开页面，请勿提交个人资料。私密反馈、资料访问/删除请求及内容权利问题请联系 achillesjing@gmail.com。

English

Scope

This notice covers the native Tongxing app for iPhone and iPad. Tongxing is an independent personal sermon listening project, unaffiliated with and not operated or endorsed by Mariners Church. The native app has no sign-in or advertising. Version 1.0.0 (42) and later offer optional anonymous language usage statistics, disabled by default; earlier versions do not upload these statistics. Original videos, the web app, Apple services, and other external websites you choose to open have their own privacy practices.

Optional anonymous language statistics (from 1.0.0 (42))

You can enable or disable statistics in Privacy and Support. When enabled, the app sends interface-language visits, the selected sermon page and text language, actual audio language, listening seconds, and played ranges to this project's Firebase backend to understand language usage and improve listening. Interface visits do not require playback. Qualified listening devices accumulate at least 30 seconds that day. Interface, page, and audio language are recorded separately.

The app generates a random local identifier that changes each Los Angeles calendar day. The server stores only a date-and-platform-specific hash for daily deduplication. Statistics are not linked to an account, name, or email. We use no advertising identifier, device fingerprint, third-party analytics SDK, or cross-app tracking. Counts cannot identify people or deduplicate across devices. Records have a 30-day expiry; cloud deletion is asynchronous and reports exclude expired records. Hosting providers handle ordinary request logs under their own policies.

Disabling statistics stops new collection and attempts to retract records uploaded during the current app run. Offline or failed requests may prevent retraction; anonymous records from earlier runs expire under the retention policy above. Listening remains available. Deleting the app removes its local identifier and preferences but cannot locate past anonymous server records.

Optional weekly notifications (formal app 1.26.21 and later)

Weekly notifications are off by default. Only after you opt in within the app and allow system notifications does the app send an Apple push token, random installation ID, random subscription secret, chosen notification language, and request sequence to this project's Google Cloud service to register, renew, or withdraw the subscription. The server stores a hash of the secret, not its plaintext. No name, email, advertising identifier, or account is used. Apple handles the push token and delivery. Our notification contains only a published page, language, and release binding; it contains no playback or microphone data.

You can turn notifications off in the app, which attempts to withdraw the server registration. If offline or the request outcome is uncertain, the app retries the same request when connected. Revoking system permission or deleting the app may not immediately withdraw the server registration, so turn it off in the app first. An active registration lasts up to 60 days and renews periodically while you remain subscribed. Registration records and delivery outcomes retained to prevent duplicate sends are set to expire after 365 days; cloud deletion is asynchronous. On withdrawal the device token is removed from the current registration, while a token-free sequence record remains until expiry to prevent an old request from re-enabling it. Contact the private email below for access or deletion requests.

Microphone

Only when you start sound alignment does the app request microphone permission. It listens for 7 to 15 seconds, ending early when the sound is clear, to locate a position in the same original English recording. Audio stays in device memory; it is not saved as a recording, uploaded, or sent to cloud transcription or translation services. Cancelling or backgrounding stops capture. You can listen and seek manually if permission is denied or revoked in Settings.

Content delivery

The app downloads catalogs, audio, and reference fingerprints over HTTPS through Google Firebase Hosting. Google processes request IP addresses to detect abuse and analyze service usage, and states that Hosting retains IP data for a few months. This notice does not promise that the project can shorten or delete Google's own service logs. See Firebase privacy and data processing.

Local storage and deletion

Audio, catalogs, reference fingerprints, language preferences, and listening history are stored locally. Up to 12 history entries are retained; entries older than 30 days are discarded when history is read or updated, rather than by a continuously running deletion timer. Downloaded audio is excluded from system backups; other local data may be backed up according to your settings. Deleting the app removes its local data on that device. Manage system backups separately in Settings. The app has no accounts or account deletion workflow.

System playback display

System media controls, the Lock Screen, and Live Activities may show the sermon title, speaker, the current audio track’s progress, and playback state. Live Activities do not use push notifications, and the app does not separately upload these states to a business server. Microphone and Live Activity permissions can be managed in system settings.

TestFlight

Apple automatically collects crash and usage information when you use TestFlight and shares it with the developer. Feedback you submit, including text and screenshots, is also shared and may include your name, email, device, and build details depending on the invitation and feedback method. Apple states that beta feedback is retained for one year and that crash and usage data may be retained until bugs are resolved. See TestFlight & Privacy.

The developer uses test data only for troubleshooting, responses, and app improvement and does not share it with third parties. Identifiable feedback copies separately retained by the developer will be deleted within 90 days after the related issue is resolved, except when continued follow-up or a legal obligation requires retention. This does not change Apple's retention rules. Do not submit private conversations, credentials, or unrelated personal information.

Contact

The operator is Zheng Jing. Use project GitHub Issues for non-sensitive feature reports. Issues are public; do not include personal information. For private feedback, access/deletion requests, or content rights inquiries, contact achillesjing@gmail.com.