KokoTrac Privacy Policy KokoTrac 私隱政策

Data we collect, at a glance

Every item below is listed with why we hold it, who else can see it, whether it travels over an encrypted connection, and how to remove it. Nothing is sold, and nothing is used for advertising. The full detail is in the English and Chinese sections below.

There are no analytics services, no advertising SDKs, no third-party trackers and no sale of personal data. Google is used only to sign you in; see Google user data for exactly what is accessed and why.

English

KokoTrac is a schedule and cost tracker for parents. It is made for parents and guardians, not for children, and it has no advertising profiling. This policy explains what the app stores, where it goes, how long it stays, and how to erase it.

1. What stays on your device

Children, activities, schedules and costs live in your browser's localStorage under the key kokotrac_data_v1:<account id>. That record holds the parent display name, each child's name, date of birth, avatar and colour, each activity's name, category, cost, billing frequency, location and description, the schedule, each course term together with the session check-ins and absences recorded against it, the payments you record, the app language, your invite code state and your visit streak.

Cloud backup belongs to the Pro tier. While the app is in its pre-launch period every account holds the Pro tier, so your data syncs to the cloud automatically, roughly half a minute after each change. You can also press Upload to cloud in Settings yourself at any time; both write the same single snapshot. The cloud copy is what lets you move to another device or restore your data after a reinstall.

Convex Auth also keeps a sign-in token on the device so you do not have to type your password on every launch. If you have enabled your device's own backup (for example Android backup to your Google account), the operating system may copy the app's local data; that copy is controlled by your device account and your platform's backup settings, not by KokoTrac.

2. What reaches the cloud

KokoTrac uses Convex for its database, authentication and server functions. The cloud holds:

• Account: your email address and a password hash. The password itself is never stored.
• Google sign-in: if you choose "Sign in with Google", we receive your Google account's email address and display name, and use them only to create and identify your KokoTrac account. We request no other Google permissions and read nothing else from your Google account.
• Sign-in records: session and refresh tokens needed to keep you signed in, with expiry times.
• Referral facts: your invite code (a hash of your account id), which account joined with it, and which code you joined with.
• Cloud backup: one JSON snapshot of the data listed in section 1, written automatically about half a minute after each change and replaced by the next one. You can also press Upload to cloud in Settings yourself, and download the snapshot back at any time.
• Pro record: whether the account is entitled to Pro, which store confirmed it, and when that record changed.
• Registered devices: for each device that opens the app, a device identifier, the device name it reports, and the last time it was seen. A Pro license covers three devices, and this list is what the app shows when you remove a device.
• Feedback you send us: if you use the feedback form in Settings, the text you write, its category, the app version and the app language are posted to a private issue tracker where we read your reports. The account id and the time of the submission are recorded on the server so we can rate-limit repeat submissions.

There are no analytics services, no advertising SDKs, no third-party trackers and no sale of personal data.

How we use this data. Only to operate the service: to sign you in and keep you signed in, to sync and restore your cloud snapshot, to apply referral rewards, to enforce the three-device licence limit, and to read and rate-limit the feedback you send us. Nothing is used for advertising or for building user profiles.

Google user data. Our use of Google user data complies with the Google API Services User Data Policy, including its Limited Use requirements. We do not sell Google user data, do not use it for advertising, and do not transfer it to anyone other than the infrastructure processor named in section 4. We do not use Google APIs or Google user data to develop, train or ground any machine-learning or AI model, or to generate AI content of any kind, including non-consensual intimate imagery.

3. Sponsored links

The app shows a small number of clearly labelled sponsored recommendations for online class providers (Preply, AmazingTalker, Outschool). They are ordinary links: choosing one opens the provider's own site in a browser. KokoTrac does not pass your account or your children's data to those sites, and their own privacy policies apply once you arrive. KokoTrac may earn a commission when you sign up through a link.

4. Who processes the data

Convex (convex.dev) hosts the database, the authentication service and the server functions, and processes the data in section 2 on our behalf. Feedback sent through the in-app form is written to a private issue tracker, which is where we read it; that text is not linked to your account once the account is deleted, and you can ask us to remove it as well. Local data is processed only by your own device.

5. How long it is kept

Device data stays until you delete the account, clear the app's site data, or uninstall the app. Cloud data stays until you delete the account. After deletion the rows described in section 2 are removed immediately; Convex may keep limited operational logs and encrypted backups for a short period under its own retention policy. Export a backup before deleting if you want to keep your children's records. Feedback you sent us stays in the issue tracker until we close the report; email us and we remove it as well.

6. Deleting your account and your data

Open Settings → Account → Delete account while signed in. After one confirmation, the app deletes the account, the sign-in records, the referral facts, the cloud backup, the Pro record, the list of registered devices and the feedback submission log, and then removes this device's copy of the children, activities, schedules and costs. The action cannot be undone. The text of a feedback report is not part of the account, so email us as well if you want that removed too.

If you can no longer sign in, email support@kokotrac.com from the address on the account and ask for deletion. We treat it as a deletion request and remove the account's cloud data within 30 days. You can also clear local data yourself by removing the site data for this app in your browser settings, or by uninstalling the app.

Deleting the account erases the device copy too. Export your data from Settings first if you want to keep it.

Your rights. You can see, export, correct and delete everything you store in KokoTrac from the app itself. On top of that, depending on where you live, you may have rights under local data protection law, such as asking us for a copy of your data, asking us to correct it, or asking us to erase it. Email support@kokotrac.com and we will respond within 30 days.

7. Children

KokoTrac is intended for adults (parents and guardians). Children do not have accounts. Information about a child is entered by the parent, is part of the cloud backup described in section 1, and is never used for advertising. Do not create an account on behalf of a child.

8. Security

Cloud traffic uses HTTPS. Passwords are hashed by Convex Auth, and sessions expire. No method of storage is perfectly secure, so keep your device and your account password protected.

9. Changes and contact

Material changes to this policy are published on this page with a new date. Questions, or a deletion request you cannot make in the app, go to support@kokotrac.com. The contact address on our store listings, hello@kokotrac.com, reaches the same inbox.

10. Google API services and Google user data

KokoTrac offers an optional "Sign in with Google" button, implemented with the OpenID Connect sign-in flow provided by Google and handled by our authentication provider. This section states, in the terms Google asks every app to use, exactly which Google user data is accessed, how it is used, with whom it is shared, how it is protected and how to delete it. We also follow the Google API Services User Data Policy and the Google Privacy Policy.

Which Google user data is accessed

The sign-in request asks Google for the standard openid, email and profile scopes only. From that response we receive exactly four items:

• Your email address, together with Google's statement that it is verified.
• Your display name, as it appears on your Google account.
• Your profile picture URL, the link to the picture on your Google account.
• Your Google account identifier, an opaque number that lets us recognise you again on the next sign-in.

That is all we read. KokoTrac does not access your Gmail, Drive, Photos, Calendar, Contacts, location, browsing history, saved searches, payments or any other Google product, and it holds no Google API key of its own. If you sign up with an email address and a password instead, no Google data is accessed at all.

How the Google user data is used

Only to operate the sign-in you asked for: to create your KokoTrac account, to recognise you when you sign in again on this or another device, to send you the six-digit verification code for a new account, and to show your own name on your own screen. It is never used for advertising, for profiling, for recommendation, for scoring, or for any automated decision about you.

With whom the Google user data is shared, transferred or disclosed

With our infrastructure provider, Convex (convex.dev), which stores the account row on our behalf and acts as our processor, and with Google itself, which runs the sign-in. We do not transfer or disclose your Google user data to third parties for purposes other than the ones described in this policy. We do not sell it, we do not rent it, and we do not share it with advertisers, analytics providers or data brokers, because we run none of those. We do not use Google user data to develop, train or ground any machine-learning or AI model, and we do not use Google APIs to generate AI content of any kind, including non-consensual intimate imagery (NCII).

How the Google user data is protected

Every request to and from Google, and every request to our own backend, runs over HTTPS with TLS encryption, so the data is encrypted in transit. Passwords are hashed by the authentication provider and the plain password is never stored. Sign-in tokens carry an expiry and are stored server-side. The account row holds nothing more than the four items listed above, and it is never exposed publicly. Access is limited to the services that need it to sign you in and to keep the app working.

How to request deletion of the Google user data

Deleting the account deletes it. Open Settings → Account → Delete account while signed in, and the account row, the sign-in tokens, the cloud backup, the device list and the referral facts are removed, so the stored email address, display name, profile picture URL and Google account identifier go with them. If you can no longer sign in, email support@kokotrac.com from the address on the account and we remove the account's data within 30 days. After deletion we keep no copy of the Google user data, apart from the short-lived operational logs and encrypted backups described in section 5.

繁體中文

KokoTrac 是供家長記錄孩子活動日程與費用的工具。本程式以家長及監護人為對象，並非供兒童使用， 也不會建立廣告用戶画像。本政策說明程式儲存哪些資料、資料傳送到哪裡、保存多久，以及如何刪除。

收集資料一覽

一、儲存在您裝置上的資料

孩子、活動、日程與費用資料儲存在瀏覽器的 localStorage，鍵值為 kokotrac_data_v1:<帳戶識別碼>。內容包括家長顯示名稱、每位孩子的姓名、 出生日期、頭像與顏色、每項活動的名稱、類別、費用、收費頻率、地點與描述、日程、程式語言、 邀請碼狀態及連續使用週數，另包括每個課期連同其出席及請假紀錄，以及您記錄的繳費。雲端備份屬 Pro 等級的功能。程式在正式推出付費方案前，每個帳戶都處於 Pro 試用狀態，因此您的資料會在每次變更後約半分鐘自動同步到雲端；您也可以隨時在設定中 按上傳到雲端，兩者寫入同一份快照。雲端副本讓您可以換裝置繼續使用，或在重新安裝後 還原資料。Convex Auth 亦會在裝置上保存登入憑證，以免每次開啟程式都要重新輸入密碼。若您啟用了裝置本身的 備份功能（例如 Android 備份至 Google 帳戶），作業系統可能會複製本程式的本機資料；該副本由您的 裝置帳戶及平台的備份設定控制，並非由 KokoTrac 控制。

二、傳送到雲端的資料

KokoTrac 使用 Convex 提供資料庫、身份驗證與伺服器函數。雲端保存：

• 帳戶資料：您的電郵地址及密碼雜湊值。密碼本身不會被儲存。
• Google 登入：若您選擇「使用 Google 登入」，我們只會接收您 Google 帳戶的電郵地址與顯示名稱，僅用於建立及識別您的 KokoTrac 帳戶。我們不會要求其他 Google 權限，亦不會讀取您 Google 帳戶的其他任何資料。
• 登入紀錄：維持登入狀態所需的 session 與 refresh token，以及其到期時間。
• 邀請紀錄：您的邀請碼（由帳戶識別碼雜湊而成）、以該邀請碼加入的帳戶，以及您加入時使用的邀請碼。
• 雲端備份：第一節所述資料的一份 JSON 快照，每次變更後約半分鐘自動寫入，下一次會覆蓋。您也可以在設定中自行按上傳到雲端，並隨時下載這份快照。
• Pro 紀錄：帳戶是否擁有 Pro 資格、由哪個商店確認，以及紀錄更新時間。
• 已註冊裝置：每部開啟程式的裝置的裝置識別碼、裝置自行報告的名稱，以及最後一次出現的時間。Pro 授權涵蓋三部裝置，這份清單就是程式在您移除裝置時顯示的內容。
• 您給我們的意見回饋：若您在設定中使用意見回饋表單，您填寫的文字、分類、程式版本與程式語言會寫入我們查看報告的私人議題追蹤器。帳戶識別碼與提交時間會記錄在伺服器上，以便我們限制重複提交的頻率。

本程式不使用分析服務、廣告 SDK 或第三方追蹤器，也不會出售個人資料。

資料用途。僅用於營運本服務：讓您登入及保持登入、同步與還原雲端快照、 計算推薦獎勵、執行三部裝置的授權上限，以及查看並限制您提交意見回饋的頻率。任何資料均不用於 廣告或建立用戶畫像。

Google 用戶資料。我們對 Google 用戶資料的使用，符合 Google API Services User Data Policy（包括其 Limited Use 規定）。我們不會出售 Google 用戶資料、不用於廣告， 亦不會轉交第四節所述基礎設施處理者以外的任何人。我們不會使用 Google API 或 Google 用戶資料 開發、訓練或為任何機器學習或 AI 模型提供基礎，或生成任何 AI 內容，包括非合意親密影像（NCII）。

三、贊助連結

程式會顯示少量清楚標示為贊助的網上課程平台推薦（Preply、AmazingTalker、Outschool）。 這些是一般連結，按下後會在瀏覽器開啟該平台的網站。KokoTrac 不會把您的帳戶或孩子的資料傳給 這些網站，抵達後適用該平台自己的私隱政策。若您透過連結註冊，KokoTrac 可能獲得佣金。

四、資料處理者

Convex（convex.dev）代我們託管資料庫、身份驗證服務與伺服器函數，並處理第二節所述的資料。 透過程式內意見回饋表單送出的內容會寫入我們查看報告的私人議題追蹤器；帳戶刪除後，該文字不再 與您的帳戶關聯，您亦可要求我們一併移除。本機資料只由您的裝置處理。

五、保存期限

裝置上的資料會一直保存，直到您刪除帳戶、清除本程式的網站資料或解除安裝程式。雲端資料會一直 保存，直到您刪除帳戶。刪除後，第二節所述的紀錄會即時移除；Convex 可能依其自身的保存政策， 短暫保留有限的營運日誌與加密備份。如欲保留孩子的紀錄，請在刪除前先匯出備份。您送出的意見回饋會留在議題追蹤器直到我們處理完畢；如需移除，請電郵通知我們。

六、刪除帳戶與資料

登入後開啟設定 → 帳戶 → 刪除帳戶。確認一次後，程式會刪除帳戶、登入紀錄、邀請紀錄、 雲端備份、Pro 紀錄、已註冊裝置清單與意見回饋提交紀錄，然後移除本裝置上的孩子、活動、日程與費用副本。 此操作無法復原。意見回饋的文字並不屬於帳戶資料，如需一併移除請同時電郵通知我們。

若您已無法登入，請以帳戶所用的電郵地址寄信至 support@kokotrac.com 要求刪除。我們會把它視為刪除要求，並在 30 天內移除該帳戶的雲端資料。您也可以在瀏覽器設定中 清除本程式的網站資料，或解除安裝程式，以自行清除本機資料。

刪除帳戶亦會清除裝置上的副本。如欲保留資料，請先在設定中匯出備份。

您的權利。您可以直接在程式內查看、匯出、更正及刪除您儲存的一切資料。此外， 視乎您所在地區，您可能依當地資料保護法享有其他權利，例如要求我們提供資料副本、要求更正或 要求刪除。請電郵 support@kokotrac.com， 我們會在 30 天內回覆。

七、兒童

KokoTrac 供成人（家長及監護人）使用，兒童不設帳戶。孩子的資料由家長輸入，屬於第一節所述雲端備份的 一部分，且不會用於廣告。請勿以孩子的名義建立帳戶。

八、安全

雲端傳輸使用 HTTPS。密碼由 Convex Auth 雜湊保存，登入 session 會到期。任何儲存方式都無法 保證絕對安全，請為裝置及帳戶設定密碼保護。

九、政策更新與聯絡

本政策的重大變更會在本頁公布並更新日期。如有疑問，或無法在程式內提出刪除要求，請電郵 support@kokotrac.com。我們在應用商店上架資料上填寫的 聯絡地址 hello@kokotrac.com 收到同一個信箱。

十、Google API 服務與 Google 用戶資料

KokoTrac 提供選用的「使用 Google 登入」按鈕，採用 Google 的 OpenID Connect 登入流程，並由我們的 身份驗證供應商處理。本節以 Google 要求每個應用程式採用的說明方式，交代程式存取哪些 Google 用戶 資料、如何使用該等資料、與誰共用、如何保護，以及如何刪除。我們亦遵守 Google API Services User Data Policy 及 Google 私隱政策。

存取的 Google 用戶資料

登入要求只會向 Google 索取標準的 openid、email 及 profile 權限。我們從該回應中只會收到四項資料：

• 您的電郵地址，連同 Google 對該地址已驗證的說明。
• 您的顯示名稱，即 Google 帳戶上顯示的名稱。
• 您的個人相片網址，即指向 Google 帳戶相片的連結。
• 您的 Google 帳戶識別碼，一個不透明的數字，讓我們在下次登入時認出您。

我們只會讀取以上資料。KokoTrac 不會存取您的 Gmail、雲端硬碟、相片、日曆、聯絡人、位置、瀏覽紀錄、 已儲存搜尋、付款紀錄或任何其他 Google 產品，我們亦沒有自己的 Google API 密鑰。若您改用電郵地址與 密碼註冊，則完全不會存取任何 Google 資料。

Google 用戶資料的用途

僅用於營運您所要求的登入：建立您的 KokoTrac 帳戶、在本裝置或其他裝置再次登入時認出您、為新帳戶發送 六位數驗證碼，以及在您自己的畫面上顯示您的名稱。該等資料從不用於廣告、建立畫像、推薦、評分， 亦不用於對您作出任何自動決定。

Google 用戶資料的共用、轉交或披露

資料會交予我們的基礎設施供應商 Convex（convex.dev），由其代我們儲存帳戶紀錄，並與執行登入的 Google 本身。我們不會為本政策所述用途以外的任何目的轉交或披露您的 Google 用戶資料。我們不出售、不出租， 亦不與廣告商、分析服務供應商或資料中介分享該等資料，因為我們並沒有使用上述任何服務。我們不會使用 Google 用戶資料開發、訓練或為任何機器學習或 AI 模型提供基礎，亦不會使用 Google API 生成任何 AI 內容， 包括非合意親密影像（NCII）。

Google 用戶資料的保護

與 Google 之間的每項請求，以及與我們後端之間的每項請求，均透過具備 TLS 加密的 HTTPS 傳輸，故資料在 傳輸過程中經過加密。密碼由身份驗證供應商雜湊保存，明文密碼從不儲存。登入憑證帶有到期時間並儲存於 伺服器端。帳戶紀錄只載有上述四項資料，絕不公開。存取權限僅限於簽入與維持程式運作所需的服務。

要求刪除 Google 用戶資料

刪除帳戶即會刪除該等資料。登入後開啟設定 → 帳戶 → 刪除帳戶，帳戶紀錄、登入憑證、 雲端備份、裝置清單與邀請紀錄都會一併移除，所儲存的電郵地址、顯示名稱、個人相片網址及 Google 帳戶 識別碼亦隨之刪除。若您已無法登入，請以帳戶所用的電郵地址寄信至 support@kokotrac.com 要求刪除，我們會在 30 天內移除該帳戶的資料。刪除後我們不會保留任何 Google 用戶資料副本，只有第五節 所述短暫的營運日誌與加密備份除外。