一、資料蒐集與處理

消費紀錄：由您主動輸入，或在您同意並開啟相關功能後，由付款通知／捷徑帶入；預設儲存於裝置本機。您可建立加密備份快照（.404backup；亦可匯入較舊的 .json／.zip）自行保管。備份以您設定的密碼加密，密碼不會上傳至我們的伺服器，亦不會寫入備份檔內容；檔案可由您存放到自己的 iCloud Drive、Google Drive、本機 Files 或其他位置。App 亦可於本機保留最近數份安全快照。我們不會代管您的雲端空間，亦不會代為上傳完整記帳明細。

自動記帳相關資訊（需您自行開啟）：Android 若開啟「通知存取」，本 App 可能讀取您允許範圍內、與付款相關的通知內容，僅用於協助整理記帳；處理以您的手機為主，可隨時在系統設定關閉。iOS 若使用系統捷徑或自動化，可能依您設定把付款資訊帶入記帳頁；是否自動儲存由您在 App 內決定。

帳戶顯示名稱僅作本機 persona 用途，無需註冊，亦不上傳至我們的伺服器。

發票／掃描資料：相機畫面以即時辨識為主，僅用於完成掃描與填單。

我們不要求您提供完整信用卡卡號、有效期限或安全碼（CVV）。

生物辨識（Face ID／Touch ID）用於本機解鎖 App；若您已於本機保存備份密碼，亦可在建立加密備份時快速驗證。不會上傳生物特徵。

二、技術性資料蒐集

匿名識別碼：為回饋試算、加碼池參考等網路功能，App 可能產生並保存一組隨機匿名 id，與電郵或真實身分無關。

裝置與診斷資料：為維持穩定性，可能處理必要的錯誤／當機診斷資料（例如錯誤堆疊、裝置型號、App 版本）。

IP 地址：可能用於推斷地區與貨幣預設，不作精準定位或直接識別特定個人。

三、第三方服務與傳輸

僅在您使用需連線之功能時，App 可能向下列服務傳送必要資料：

Cloudflare（Workers／D1）：提供信用卡公開資訊、回饋試算、商家提示、遠端設定等 API；為完成試算或同步加碼池參考，可能傳送交易摘要（如金額、類別、商家名稱、匿名 id）。

匯率 API：為顯示匯率，可能向第三方匯率服務請求資料。

Apple／Google：404 PRO 訂閱狀態由商店與訂閱權益服務處理；若您登入 404 Network，會使用 Sign in with Apple／Google 登入。診斷服務可能處理必要的錯誤／當機資料。我們不經手完整付款卡號。

我們不會把「通知存取」讀到的原始通知全文上傳到我們的伺服器；若該筆已成為您的記帳紀錄，後續僅在您使用需連線功能時，依上列方式傳送必要摘要。

四、權限控管

您可隨時於系統設定撤回相機、通知、通知存取或生物辨識權限，並可在 App 內關閉自動入帳。撤回或關閉後僅影響相關功能，不影響手動記帳等核心功能。

五、資料刪除與保存

您可於 App 內刪除本機資料、清除紀錄或自行刪除備份檔。解除安裝 App 亦會移除本機儲存之資料。

若您曾以 Apple／Google 登入 404 Network（社群卡腳本），可於「設定 → 我的帳戶」或「設定 → 資料管理」刪除該雲端帳號；我們會清除與該帳號相關的社群腳本與登入綁定，並依適用流程撤銷登入授權。刪除 Network 帳號不會刪除本機記帳資料，亦不會取消您透過 App Store／Google Play 購買的 404 PRO 訂閱（請於系統訂閱管理取消）。

本機資料將保留至您自行刪除、卸載 App 或重設裝置。經網路傳送之試算或匿名彙總資料，保存期間依服務營運與法規要求處理。

六、兒童與未成年人

本服務非以蒐集兒童個資為目的。若監護人認為未成年人不當提供個資，請聯絡我們協助處理。

七、聯絡方式

隱私請求

[email protected]

訂閱／付款

[email protected]

1. Data Collection

Transactions are entered by you, or brought in from payment notifications / shortcuts after you enable those features; stored on your device by default. You may create encrypted backup snapshots (.404backup; older .json / .zip can still be imported) for your own safekeeping. Backups are encrypted with a password you choose; that password is never uploaded to our servers and is not written into the backup file. You may save the file to your own iCloud Drive, Google Drive, on-device Files, or another location. The app may also keep a few recent on-device safety snapshots. We do not host your cloud storage and do not upload your full ledger for you.

Auto Add is optional. On Android, notification access (if enabled) is used only to help fill expense fields; processing is mainly on-device. On iOS, Shortcuts/automations follow your setup; auto-save is controlled in the app.

Display name is a local persona only — no account registration or server upload is required.

Camera/scan data is used only to complete scanning workflows (primarily real-time decoding).

We do not require full card numbers, expiry dates, or CVV.

Biometric authentication (Face ID / Touch ID) is used for local app unlock; if a backup password is saved on this device, it may also unlock quick encrypted backups. Biometric data is not uploaded.

2. Technical Data

Anonymous identifier: for reward estimates and cap-reference features, the app may keep a random anonymous id unrelated to your email or real identity.

Diagnostic data: necessary crash/error diagnostics (stack traces, app version, device model) may be processed to improve reliability.

IP address: may be used to infer region/currency defaults; not for precise location tracking.

3. Third-party Services

When you use online features, limited data may be sent to Cloudflare (Workers / D1) for public card info, reward estimates, merchant hints, and remote configuration — including transaction summaries such as amount, category, merchant name, and anonymous id.

Exchange-rate APIs may be queried to display conversion rates.

Apple / Google: 404 PRO subscription status is handled by the stores and subscription entitlement services; Sign in with Apple / Google is used only if you sign in to 404 Network. A diagnostics service may process necessary crash/error data. We do not receive your full payment card number.

We do not upload the full raw text of notifications read via Notification access to our servers.

4. Control & Deletion

You may revoke Camera, Notifications, Notification access, or Biometric permissions anytime, and turn off auto-save in the app. Manual bookkeeping remains available.

Delete local records in-app or uninstall the app to remove on-device data.

If you signed in to 404 Network (community card scripts) with Apple or Google, you can delete that cloud account in Settings → My Account or Settings → Data. We remove related community scripts and sign-in bindings and revoke authorization where applicable. Deleting the Network account does not erase on-device ledger data and does not cancel a 404 PRO subscription purchased through the App Store / Google Play — manage that in system Subscriptions.

Contact

Privacy

[email protected]

Billing

[email protected]