私隱政策
Privacy Policy
《打小人・鵝頸橋》 · 最後更新 2026 年 8 月 1 日 · Last updated 1 August 2026
一句話：你寫嘅小人姓名、你上載嘅相、同埋打完之後錄低嗰段片， 由頭到尾只係留喺你部機度，永遠唔會上傳去我哋或者任何人嘅伺服器。
一、完全唔會離開你部機嘅嘢
以下三樣嘢全部喺你部機入面處理同儲存，我哋收唔到、睇唔到、亦都冇能力攞：
- 小人姓名 — 你打落去嘅名，只係畫喺張紙公仔上面。
- 你上載嘅相 — 揀相之後係喺你部機嘅瀏覽器／App 入面直接畫出嚟，唔會上傳。
- 錄低嘅片 — 每一場嘅片係喺你部機生成，你自己揀儲落機定係分享出去。
呢個唔單止係一句承諾，而係結構上做唔到：我哋個資料庫由設計嗰日開始就冇任何一個欄位 可以裝呢啲嘢，亦都冇任何一個介面收得呢啲嘢。
二、唔開戶口，我哋乜都唔會收
你可以用「以訪客身份繼續」直接玩晒成隻遊戲。訪客模式之下，除咗你部機自己嘅本機儲存 （例如你揀咗邊個打手、邊個場景）之外，我哋唔會收集任何個人資料。
三、開咗戶口之後會收集嘅嘢
戶口存在嘅唯一目的，係令你嘅記錄同解鎖內容可以喺唔同裝置之間同步、亦都可以喺重裝之後攞返。 我哋只會儲以下嘢：
- 電郵地址，以及你自己填嘅用戶名或者顯示名稱（可留空）。
- 密碼：只儲經過單向雜湊（bcrypt）之後嘅結果，我哋睇唔到你真正嘅密碼。
- 第三方登入身份：如果你用 Google 或者 Apple 登入，我哋會儲對方提供嘅
用戶識別碼（
sub）同埋對方已驗證嘅電郵地址。用 Apple 登入嘅話， 我哋會加密（AES-256-GCM）儲起 Apple 嘅 refresh token， 好等你喺 App 內刪除戶口嗰陣可以一併撤銷授權。 - 你嘅選擇：目前揀緊邊個打手、邊個場景。
- 遊玩統計：每個打手打咗幾多下、開過幾多場、最後一次玩嘅時間。
- 購買同解鎖記錄：買咗／獲贈咗邊件內容、幾時、交易編號。
- 防濫用計數器：登入／註冊嘗試次數，48 小時之後自動清走。
- 單場最高分：30 秒模式一鋪打得最多嗰次。
呢啲統計純粹係俾你自己睇。我哋唔會俾其他玩家見到、 唔會用嚟賣廣告、亦都唔會賣或者租俾任何第三方。
唯一嘅例外係龍虎榜，而且要你自己開啟。如果你喺 個人檔案入面設定咗你個名，咁你 30 秒模式嘅單場最高分同埋你個名 就會出喺公開排行榜度，全世界見到。冇設定就永遠唔會上榜。 清走個名，幾分鐘之內個榜就會唔見返你（個榜有短暫緩存，唔係即時）。 上榜嘅淨係你個名同單場最高分——你嘅電郵、 你打咗幾多下總數，一律唔會公開。
四、我哋唔會做嘅嘢
- 冇廣告，亦都冇任何廣告追蹤。
- 冇第三方分析工具（冇 Google Analytics、冇 Facebook Pixel、冇同類嘢）。
- 唔會為咗廣告而追蹤你跨 App 或者跨網站嘅行為。
- 唔會賣你嘅資料。
五、我哋用緊嘅第三方服務
- Vercel — 網站同 API 寄存。伺服器日誌會短暫記錄一般請求資料（例如 IP 位址）。
- Neon — 資料庫寄存（上面第三節嗰啲資料）。
- Google／Apple — 你自己揀用嗰陣先會用到嘅登入服務。
- Stripe — 網站版嘅付款處理。信用卡資料由 Stripe 直接處理， 唔會經過我哋，我哋亦都從來冇見過你張卡嘅號碼。
- Resend — 寄驗證電郵。
六、保留幾耐，同點樣刪除
戶口資料一直保留到你刪除戶口為止。你可以喺 App 或者網站入面， 喺「個人資料」度自己刪除戶口——毋須寫信俾我哋。 刪除之後，你嘅戶口、登入身份、選擇同遊玩統計會即時清走。 （為咗會計同退款紀錄，交易記錄可能會按法例要求保留。）
七、兒童
本遊戲並非以兒童為對象。內容包含粗俗嘅廣東話口語，建議成年人玩。 我哋唔會刻意收集兒童嘅個人資料。
八、你嘅權利
你有權查閱、更正或者刪除我哋持有關於你嘅個人資料。 最直接嘅做法係喺 App 入面自行刪除戶口；如果你想用其他方式行使呢啲權利，請用下面嘅電郵聯絡我哋。
九、政策更新
如果呢份政策有實質改動，我哋會更新呢一頁頂部嘅日期。
十、聯絡
有咩私隱相關嘅查詢，請電郵： hillman.chan@starlingmind.ai
English
In one line: the villain's name you type, the photo you upload, and the video recorded at the end of a session never leave your device. They are never uploaded to our servers or anyone else's.
1. What never leaves your device
These three things are processed and stored entirely on your device. We cannot receive, see, or retrieve them:
- The effigy name you type — it is only drawn onto the paper effigy.
- Any photo you upload — it is drawn locally and never transmitted.
- The session recording — generated on your device; you alone decide whether to save or share it.
This is structural, not just a promise: our database has no column that could hold any of these, and no endpoint accepts them.
2. Without an account we collect nothing
You can play the entire game by tapping "continue as a guest". In guest mode we collect no personal data at all — only your device's own local storage remembers your chosen character and backdrop.
3. What we store if you create an account
An account exists solely so your progress and unlocked content sync across devices and survive a reinstall. We store:
- Your email address, plus an optional username or display name.
- Your password, stored only as a one-way bcrypt hash — we never see the password itself.
- Third-party sign-in identity: if you use Google or Apple, we store the
provider's user identifier (
sub) and the email address the provider verified. For Apple we additionally store an encrypted (AES-256-GCM) refresh token, so that deleting your account in-app can also revoke that authorisation. - Your current selection of character and backdrop.
- Play statistics: slaps, sessions and last-played time per character.
- Purchase and unlock records: which item, when, and the transaction id.
- Anti-abuse counters for sign-in and registration attempts, automatically purged after 48 hours.
- Best single score: your highest count in one 60-second ritual.
These statistics are for your eyes only. They are never shown to other players, never used for advertising, and never sold or rented to anyone.
The one exception is the leaderboard, and you have to switch it on yourself. If you set your name in your profile, your best single 60-second score and that name appear on a public leaderboard. Without a name you never appear on it. Clearing your name removes you from the board within a few minutes (the board is briefly cached, not instant). What is published is the name and the single best score, and nothing else — never your email, never your lifetime totals.
4. What we do not do
- No advertising and no advertising identifiers.
- No third-party analytics (no Google Analytics, no Facebook Pixel, nothing of the kind).
- No tracking of your activity across other apps or websites.
- We do not sell your data.
5. Third-party services we use
- Vercel — website and API hosting; server logs briefly record ordinary request data such as IP address.
- Neon — database hosting for the data in section 3.
- Google / Apple — sign-in, only if you choose it.
- Stripe — payment processing on the website. Card details go directly to Stripe; they never pass through us and we never see your card number.
- Resend — sending verification emails.
6. Retention and deletion
Account data is kept until you delete your account. You can delete your account yourself from the profile screen in the app or on the website — no email to us required. Your account, sign-in identities, selections and play statistics are removed immediately. Transaction records may be retained where accounting or tax law requires it.
7. Children
This game is not directed at children. It contains crude colloquial Cantonese and is intended for adults. We do not knowingly collect personal data from children.
8. Your rights
You may access, correct or delete the personal data we hold about you. The quickest route is the in-app account deletion; for anything else, email us at the address below.
9. Changes
If this policy changes materially, we will update the date at the top of this page.
10. Contact
Privacy enquiries: hillman.chan@starlingmind.ai