隱私權政策
1. 概要
「Alca note」（alca-note.vercel.app，原網址 ipad-handwriting-notes.vercel.app，以下稱「本服務」）是一個可安裝在 iPad 上的網頁應用程式（PWA）。我們的設計原則是盡量不經手你的資料：筆記主要存放在你自己的裝置與你自己的 Google 雲端硬碟中。本服務沒有廣告、沒有分析追蹤工具、也不販售任何資料，且沒有使用者資料庫。
2. 存在你裝置上的資料
- 筆記本、頁面、筆跡、圖片與 PDF 儲存在瀏覽器的 IndexedDB（本機）中，不會上傳到我們的伺服器（下方「共享協作」除外）。
- 少量設定（例如你在協作時顯示的名稱、雲端硬碟資料夾編號）存放在瀏覽器的 localStorage。
- 刪除筆記本、清除網站資料或移除 App，即會刪除這些本機資料。
3. Google 登入與 Google 雲端硬碟同步（選用）
若你選擇連結 Google 帳戶以同步筆記，本服務只要求以下權限（scope）：
openid、email：取得你的 Google 帳戶電子郵件，用來在 App 內顯示目前連結的是哪個帳戶。https://www.googleapis.com/auth/drive.file：只能存取本服務自己建立的檔案。本服務看不到、也無法讀取或修改你雲端硬碟中的其他任何檔案。
同步時，本服務會在你自己的 Google 雲端硬碟建立「Alca note」資料夾（2026 年 10 月 29 日前開始同步的使用者沿用原本的「手寫筆記」資料夾）（內含 library.json、各筆記本的 .ynb 檔，以及「圖片」子資料夾），並在其中讀寫。這些檔案直接由你的瀏覽器與 Google API 之間傳輸，不經過我們的伺服器保存。
權杖的處理：登入後取得的 Google refresh token 以 AES-256-GCM 加密後，存放在你瀏覽器中的 httpOnly、Secure Cookie（有效期最長一年）。我們的伺服器端（Vercel 無伺服器函式）只在需要時解密該 Cookie、向 Google 換取短效 access token 後交給你的瀏覽器，不會將權杖或你的電子郵件儲存在任何資料庫或伺服器上。在 App 中登出即會清除此 Cookie。
Google API 服務使用者資料政策：本服務對於從 Google API 取得之資訊的使用與傳輸，遵守 Google API 服務使用者資料政策，包括其中的「有限使用（Limited Use）」規定。具體而言：Google 使用者資料只用於提供你在 App 中看得到的同步功能；不會轉移給第三方（法律要求或你明確同意者除外）；不用於廣告；不由人員閱讀（除非經你同意、為了安全目的或法律要求）；也不用於訓練 AI／機器學習模型。
4. 共享協作（選用）
當你為某本筆記本建立分享連結時：
- 該筆記本的內容（Yjs 文件資料）會儲存在我們於 Cloudflare Workers／Durable Objects 上運行的中繼伺服器中，對應該分享「房間」，讓擁有連結的人可以同步。房間編號是隨機 128 位元，連結本身就是鑰匙：任何取得連結的人都能檢視與編輯。請只分享給你信任的人。
- 圖片與 PDF 等大型檔案不放在文件中，會經由中繼伺服器暫時轉送；在所有收件成員確認已儲存後即刪除，最遲於上傳後 7 天自動刪除（未完成的上傳於閒置 2 小時後刪除）。
- 在可行時，裝置之間會以 WebRTC 點對點直接連線傳輸；建立連線時會使用 Cloudflare 與 Google 的 STUN 伺服器，對方裝置與這些服務可能因此得知你的 IP 位址。
- 協作時，你設定的顯示名稱、游標／雷射筆位置會即時分享給同房間的其他人，但這些即時狀態不會寫入文件儲存。
- 也可以用 6 碼「代碼」邀請：代碼只在邀請視窗開著時有效（最多 10 分鐘、用過即失效），由你按「同意（可編輯）」或「只能看」後對方才會加入。選「只能看」時，對方拿到的是伺服器加密過的通行碼（不含房間編號），伺服器會拒絕他對筆記的任何修改。
- 若你希望刪除某個共享房間在伺服器上的資料，請來信並附上該分享連結，我們會協助刪除。
5. AI 功能（選用，Puter）
App 內的 AI 對話功能透過第三方服務 Puter（Puter.js）使用 Google Gemini。使用時你需登入你自己的 Puter 帳戶，你送出的內容（例如文字或選取的頁面圖片）會直接從你的瀏覽器傳送給 Puter 及 Google 處理，不經過我們的伺服器。此部分適用 Puter 的隱私權政策與條款。若不使用 AI 功能，不會有任何資料傳給 Puter。
AI 面板下方的「ChatGPT」「Gemini」「Claude」按鈕與「分享到 App」只會把選取的圖片複製到你的剪貼簿（Claude 按鈕另會在網址帶入一段預設或你打的問題文字），並開啟該服務；不會自動傳送任何內容。你自己在那個服務貼上、送出的內容，適用該服務（OpenAI、Google、Anthropic）的隱私權政策與條款。
意見回饋（選用）
你主動送出的意見回饋，會連同你填的內容、選填的 Email、裝置型號與系統版本（瀏覽器 User-Agent、螢幕尺寸）、匿名裝置代碼與大略國家，存放在 Cloudflare，最多保留 180 天，只用來改進本服務與回覆你。不包含你的筆記內容。
6. 主機服務與技術紀錄
本服務的網頁與登入函式由 Vercel 託管，協作中繼伺服器由 Cloudflare 託管。與一般網站相同，這些平台可能會為了營運與安全，短期記錄 IP 位址、請求時間等標準連線紀錄。我們不會使用這些紀錄來追蹤或分析使用者。
7. 我們不做的事
- 不放廣告、不使用 Google Analytics 或其他分析／追蹤工具。
- 不販售、出租或交換任何使用者資料。
- 不在伺服器端保存你的筆記（共享房間除外，見第 4 節）。
8. 如何刪除你的資料
- 本機資料：在 App 中刪除筆記本，或在 Safari 設定中清除本網站資料／移除主畫面 App。
- 撤銷 Google 存取權：前往 myaccount.google.com/permissions，移除「Alca note」（或舊名「手寫筆記」）的存取權；之後本服務即無法再存取你的雲端硬碟。
- 雲端硬碟中的檔案：在 Google 雲端硬碟中刪除「Alca note」（或舊的「手寫筆記」）資料夾即可（撤銷權限並不會自動刪除這些檔案，它們屬於你）。
- 共享房間：來信 ianhsieh981031@gmail.com 並附上分享連結。
9. 兒童
本服務並非專為 13 歲以下兒童設計，也不會蓄意蒐集兒童的個人資料。
10. 政策變更
本政策若有修改，會更新此頁面與上方的生效日期；重大變更會在 App 中提示。
11. 聯絡我們
營運者：謝宗恩（臺灣）
電子郵件：ianhsieh981031@gmail.com
Privacy Policy
In case of any difference between the Chinese and English versions, both are intended to say the same thing; please contact us if anything is unclear.
1. Overview
Alca note (alca-note.vercel.app, formerly ipad-handwriting-notes.vercel.app; the "Service") is a Progressive Web App for handwritten notes on iPad. It is designed to handle as little of your data as possible: your notes live on your own device and, if you choose, in your own Google Drive. The Service has no ads, no analytics or tracking, does not sell data, and has no user database.
2. Data stored on your device
- Notebooks, pages, ink strokes, images and PDFs are stored locally in your browser's IndexedDB and are not uploaded to our servers (except for shared notebooks, see Section 4).
- A few settings (such as your collaboration display name and the Drive folder id) are kept in localStorage.
- Deleting a notebook, clearing site data, or removing the app deletes this local data.
3. Google Sign-In and Google Drive sync (optional)
If you connect a Google account to sync your notes, the Service requests only these scopes:
openid,email— to read your Google account email address so the app can show which account is connected.https://www.googleapis.com/auth/drive.file— access only to files the Service itself creates. The Service cannot see, read or modify any other file in your Drive.
When syncing, the Service creates a folder named 「Alca note」 in your own Google Drive (users who started syncing before October 29, 2026 keep their existing 「手寫筆記」 folder) (containing library.json, one .ynb file per notebook, and an image subfolder) and reads and writes only there. These files travel directly between your browser and Google's APIs; they are not stored on our servers.
Token handling: the Google refresh token obtained at sign-in is encrypted with AES-256-GCM and stored in an httpOnly, Secure cookie in your browser (lifetime up to one year). Our serverless functions on Vercel decrypt that cookie only to exchange it with Google for a short-lived access token, which is returned to your browser. Neither the token nor your email address is stored in any database or on any server. Signing out in the app clears the cookie.
Google API Services User Data Policy: Alca note's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, Google user data is used only to provide the user-facing Drive sync feature; it is not transferred to third parties except as required by law or with your explicit consent; it is not used for advertising; it is not read by humans except with your consent, for security purposes, or as required by law; and it is not used to train AI or machine-learning models.
4. Collaboration via share link (optional)
- When you create a share link for a notebook, that notebook's content (its Yjs document data) is stored for that shared "room" on our relay server running on Cloudflare Workers / Durable Objects, so people with the link can sync. Room ids are random 128-bit values and the link is the key: anyone who has the link can view and edit the notebook. Share it only with people you trust.
- Images and PDFs are kept out of the document and pass through the relay temporarily; each is deleted once all recipients acknowledge they have saved it, and at the latest 7 days after upload (unfinished uploads are dropped after 2 hours idle).
- When possible, devices connect directly peer-to-peer via WebRTC. Connection setup uses STUN servers operated by Cloudflare and Google, so peers and those services may see your IP address.
- Your display name and cursor / laser-pointer position are shared live with others in the room; this presence data is not saved into the document.
- You can also invite with a 6-character code: it is valid only while your invite dialog is open (at most 10 minutes, single use), and the other person joins only after you choose 「同意（可編輯）」 (can edit) or 「只能看」 (view only). A view-only member receives a server-encrypted pass (not the room id), and the relay rejects any change from them.
- To have a shared room's data deleted from the relay, email us with the share link.
5. AI features (optional, Puter)
The in-app AI chat uses Google Gemini through the third-party service Puter (Puter.js). You sign in to your own Puter account, and what you submit (e.g. text or a selected page image) is sent directly from your browser to Puter and Google — not through our servers. Puter's privacy policy and terms apply to that processing. If you do not use the AI features, nothing is sent to Puter.
The “ChatGPT”, “Gemini” and “Claude” buttons and “Share to app” below the AI panel only copy the selected image to your clipboard (the Claude button also puts a default or typed question in the link) and open that service; nothing is sent automatically. Whatever you paste and send there is governed by that service's (OpenAI, Google, Anthropic) privacy policy and terms.
Feedback (optional)
Feedback you choose to send is stored on Cloudflare together with what you wrote, an optional email, your device model and OS version (browser user agent, screen size), an anonymous device id and approximate country, for up to 180 days, and is used only to improve the Service and reply to you. It never includes your notes.
6. Hosting and technical logs
The web app and sign-in functions are hosted on Vercel; the collaboration relay is hosted on Cloudflare. Like any website, these platforms may briefly keep standard request logs (such as IP address and time) for operation and security. We do not use them to track or profile users.
7. What we don't do
- No advertising, no Google Analytics or other analytics/tracking tools.
- No selling, renting or trading of user data.
- No server-side storage of your notes (except shared rooms, Section 4).
8. How to delete your data
- Local data: delete notebooks in the app, or clear this site's data in Safari settings / remove the Home Screen app.
- Revoke Google access: go to myaccount.google.com/permissions and remove access for Alca note (or its former name 「手寫筆記」).
- Files in Drive: delete the 「Alca note」 (or older 「手寫筆記」) folder in Google Drive (revoking access does not delete these files — they are yours).
- Shared rooms: email ianhsieh981031@gmail.com with the share link.
9. Children
The Service is not directed to children under 13 and does not knowingly collect their personal information.
10. Changes
We will update this page and the effective date if this policy changes, and highlight material changes in the app.
11. Contact
Operator: 謝宗恩 (Tsung-En Hsieh), Taiwan
Email: ianhsieh981031@gmail.com