最後更新：2026-08-15
私隱政策
呢份係獨立嘅私隱政策。完整服務條款、第三方供應商同 OAuth 範圍保障，見 條款。
資料控制者
本服務由位於香港特別行政區嘅營運者（「我哋」）營運，係個人資料嘅資料控制者。適用香港《個人資料（私隱）條例》（PDPO）。
聯絡地址： Alchemys App，Hong Kong SAR
電郵： spcyapp@gmail.com
我哋收集咩
- 登入資料：Google 提供嘅用戶識別碼、電郵、名稱、頭像 URL；如你用電郵／手機驗證碼登入，我哋會儲存該聯絡資料（以遮罩形式顯示）。部分登入方式推出後先會啟用。
- 你喺各應用入面建立嘅內容（對話、檔案、樂譜、支出、分鏡等），用嚟提供服務。
- 付款紀錄（金額、時間、計劃）；唔會儲存完整卡號。付款由 Stripe 處理。
- 必要 cookies：登入識別、裝置指紋、CSRF。詳情見頁底 cookie 提示。
點用同分享
資料只用嚟提供服務同遵守法律。我哋唔賣、唔租、唔用你嘅私人內容訓練自己嘅模型。生成回覆時，提示同上傳檔案會送到你揀嘅 AI 供應商，受佢哋自己嘅條款約束（見條款 6c）。
推播通知
如果你喺我哋手機 App 開啟推播通知，提示會經 Firebase Cloud Messaging（Google） 送達。推播內容淨係帶收件箱一則通知嘅編號、佢指向嘅連結、係邊個功能、屬於邊類通知，同埋你未讀嘅數量，唔會帶通知嘅標題或者內容，亦唔會帶你做緊咩嘅內容。你部裝置嘅註冊 token 會綁喺你個帳戶下面；你登出時會刪除，Google 如果話個 App 已經卸載亦會刪除。喺某部裝置登出，該裝置就唔會再收到推播；刪除帳戶會移除所有已註冊裝置。
Cookies 同分析
登入同安全用嘅係必要 cookies。生產環境用 Cloudflare Web Analytics（唔設追蹤 cookie）去睇流量。你可以喺提示度揀「接受」或者「只開必要」。我哋冇整合 Google Analytics 或者 Meta Pixel。
保留同你嘅權利
帳戶資料保留到你刪除帳戶為止。對話附件預設 7 日後自動刪除。你可以隨時刪除內容、撤銷連接器授權，或者電郵要求刪除帳戶。查閱、更正、刪除、撤回同意：電郵 spcyapp@gmail.com，一般 30 日內回覆。
Last updated: 2026-08-15
Privacy Policy
This is the standalone privacy policy. The full terms, third-party providers and OAuth-scope safeguards are in the Terms.
Data controller
This service is operated by an operator based in the Hong Kong Special Administrative Region ("we"), which is the data controller for personal data processed through the service. Hong Kong's Personal Data (Privacy) Ordinance (PDPO) applies.
Contact address: Alchemys App, Hong Kong SAR
Email: spcyapp@gmail.com
What we collect
- Sign-in data: your Google profile (user id, email, name, avatar URL); or, when you sign in with an email / phone one-time code, the contact you verify (shown masked). Some methods go live only as they roll out.
- Content you create in the apps (chats, files, scores, expenses, storyboards) to provide the service.
- Payment records (amount, time, plan); we do not store full card numbers. Stripe processes payments.
- Essential cookies: sign-in identifier, device fingerprint, CSRF. See the cookie notice.
Use and sharing
Data is used to provide the service and comply with law. We do not sell, rent, or train our own models on your private content. To generate responses, prompts and uploads are sent to the AI provider you chose, under that provider's terms (see Terms §6c).
Push notifications
If you turn on push notifications in our mobile app, an alert is delivered through Firebase Cloud Messaging (Google). A push message contains only the ID of a notification already in your inbox, the link it points at, which app it came from, what kind of notification it is, and your unread count — never the notification's title or text, and nothing about what you were working on. Your device's registration token is held against your account, is removed when you sign out, and is removed again if Google reports the app as uninstalled. Signing out of the app on a device stops pushes to that device; deleting your account removes every registered device.
Cookies and analytics
Sign-in and security use strictly necessary cookies. On production we use Cloudflare Web Analytics (cookieless) to understand traffic. You can choose Accept or Essential only in the notice. We have not integrated Google Analytics or Meta Pixel.
Retention and your rights
Account data is kept until you delete the account. Chat attachments default to auto-deletion after 7 days. You can delete content, revoke connectors, or email to request account deletion. For access, correction, deletion or consent withdrawal, email spcyapp@gmail.com. We respond within 30 days.
