繁體中文（香港）

私隱

生效日期 2026年10月5日

Haruka 會處理你選擇分享嘅內容，等你可以傾偈、留低片段同使用日常工具。呢度會講清楚乜嘢留喺裝置、乜嘢會交畀伺服器同服務供應商，以及點樣管理。

我哋保存乜嘢

帳戶資料——即你用嚟登入嘅服務（Apple 或者 Google）分享畀我哋嘅帳戶識別碼、名字同電郵地址——你發送畀 Haruka 嘅訊息、你喺日記寫嘅內容，以及你確認保存嘅身心近況記錄——睡眠、精力、心情、飲食、活動同身體狀況。我哋亦會保存你確認咗嘅偏好、成長路線嘅標籤同提議（見「Haruka 成長」），同性格小測結果；只有你開咗帳戶同步，先會保存「我嘅一頁」嘅副本。如果你用 Sign in with Apple 登入，我哋亦會保存一個憑證，等你刪除帳戶嗰陣，我哋可以通知 Apple 終止該項授權。我哋會短期保存技術日誌，用嚟維持服務運作。

如果你揀 Google 登入，Google 嘅登入元件亦會按 Google 嘅私隱政策處理資料。Google 說明，呢個服務可能用帳戶識別碼記錄你同意嘅登入授權，亦可能用 IP 位址估計裝置嘅大概位置，防止欺詐。所用 Google 登入 SDK 嘅私隱聲明亦列出電話號碼、裝置識別碼、使用資料同其他資料，按類別用作登入、保安、服務運作或分析；呢啲係 Google 嘅處理範圍，可能連結到你嘅 Google 帳戶或裝置。Haruka 冇要求額外嘅電話號碼或通訊錄權限，亦冇將 Google 電話號碼匯入 Haruka 帳戶。呢個 SDK 聲明唔會將資料用作跨 App 廣告追蹤。詳情：Google 私隱政策 https://policies.google.com/privacy 同 Google 登入資料說明 https://developers.google.com/identity/sign-in/ios/app-privacy 。

當會員功能開放而你設定咗會員檔案，我哋亦會保存你嘅用戶名、顯示名稱、你建立嘅朋友連結，以及你發佈嘅帖子、留言同反應。

我哋會保存用量記錄，用嚟計算上限同維持服務：用過邊個功能同 AI 服務、處理咗幾多文字、所需時間同估算費用，以及相片數量同大約大小。呢啲用量記錄唔包括訊息內容或者相片，會連結到帳戶，並隨帳戶刪除；下文列明嘅有限保留情況除外。

如果你喺 App 入面提交意見，或者就 Haruka 嘅某個回覆回報問題，我哋會保存你揀嘅類別、你寫嘅備註、你嘅 App 版本編號、裝置平台同 App 語言；如果係回報回覆，亦會記低係關於邊段對話、邊個回覆，等我哋可以跟進。回覆嘅內容本身唔會複製到報告入面。呢啲記錄會連結到你嘅帳戶，並且隨帳戶一併刪除。

點解要保存

用嚟生成回覆、令對話前後連貫、保留你儲低嘅時刻同你確認咗嘅偏好、用你允許嘅片段同近況寫 Haruka 嘅信、畀你睇返自己一段時間嘅身心近況同性格小測結果、喺你開咗同步時將「我嘅一頁」帶去另一部裝置、運作房間狀態，以及支援安全、穩定同日常產品運作。

AI 處理

我哋嘅伺服器會用 Google 嘅 Vertex AI 生成回覆同處理其他 AI 功能。相片、網上搜尋回覆同指定格式嘅解讀只用 Google。請求可能包括最近嘅對話、相關已存記憶同上次對話摘要、你分享嘅日曆內容、你揀咗用嚟傾嘅身心記錄、所附相片、為回覆查到嘅公開資料、你確認咗嘅偏好同由佢哋整理出嚟嘅語氣提示、你開咗先會附上嘅「我嘅一頁」（見「Haruka 成長」），以及語言、時間同時區。符合條件嘅對話結束後，亦可能用嚟整理記憶；當「只傾今次」處理嘅對話唔會加入呢個記憶整理流程。以下情況會咁處理：你帶身心近況記錄入對話時揀「只傾今次」；或者你由「最近的你」嘅一頁、Haruka 寄嚟嘅信、家人近況、超市GaGala嘅草稿、「我記低嘅你」入面一組筆記、「我嘅一頁」、性格小測結果，或者「為你揀」入面關於計劃或者小小約定嘅話題開始傾。一般對話冇呢個開關。你提交嘅會員介紹、帖文、留言、分享同清單文字，亦可能喺公開或者保存之前交畀呢啲供應商作安全檢查。

如果你允許咗 AI 回覆，你傾偈時傳出嘅每則訊息——無論喺房間、喺「搵食」、喺「超市GaGala」，定係問 Haruka 你睇緊嘅內容——都會連同最多六則近期訊息，另外交畀同一個 AI 供應商做自動安全檢查。檢查會睇下有冇跡象顯示你或者其他人可能有危險，例如醫療緊急情況、傷害自己，或者有人受到傷害。如果發現有，Haruka 通常唔會照平時咁回覆，而係顯示一段固定訊息，附上緊急電話或者求助熱線；呢段訊息唔係 AI 寫嘅。呢個檢查有機會漏咗，亦有機會睇錯訊息嘅意思。出現過安全訊息嘅對話，唔會用嚟整理記憶；你返到房嗰陣，Haruka 亦唔會用佢嚟打招呼。我哋嘅短期技術日誌會記低呢個檢查嘅結果，例如顯示咗邊一類安全訊息，但唔會記低你寫嘅內容。

傳啲乜出去，視乎你用緊邊個功能。係我哋嘅伺服器將內容交畀呢啲供應商，唔係你部電話直接傳，所以佢哋收到嘅係內容同我哋伺服器嘅網絡資料，唔係你部電話嘅。佢哋點樣處理，要跟我哋之間嘅服務安排同佢哋自己嘅私隱條款；我哋唔會承諾每間供應商都完全唔保留資料。

Haruka 回覆之後，你部電話會睇下你啱啱傳嗰句有冇提到安排、想食嘅地方或者想去嘅地方，等佢可以出一張卡，例如「加入行事曆？」。我哋嘅伺服器亦可能將嗰句訊息同 Haruka 嘅回覆再交畀同一批 AI 供應商一次，純粹用嚟搵出呢啲安排。搜尋或者思考模式嘅回覆、需要危機支援嘅對話、包含健康記錄嘅對話，同埋附上相片或者其他資料嘅訊息，都唔會咁做。你唔撳，就乜都唔會加。建議會喺我哋嘅伺服器保留最多一日，等佢送到你部電話；永遠唔會用嚟賣廣告，亦唔會交畀商戶。你可以喺「設定」熄咗呢啲卡。

語音回覆

當你要求生成新語音，我哋嘅伺服器會將嗰段已保存嘅 Haruka 回覆，加上簡短語氣指示，交畀第三方語音服務 ElevenLabs，用 Haruka 嘅聲讀出嚟。呢個請求唔會附上成份對話紀錄，播放功能亦唔會錄低你嘅咪高峰；但回覆本身可能提到你之前傾過嘅資料。

預設係手動播放。揀咗自動播放嘅話，都只會喺你開住 App 同對話嗰陣，收到新回覆先自動讀出嚟。你隨時可以停，或者改設定。整新語音會用每月字數，免費帳戶係 3,000 字，按香港時間每個月重新計。語音設定會顯示仲剩幾多；其他服務上限都可能令新語音暫停。

呢部電話會保留你同 Haruka 嘅對話：文字同已經整好嘅錄音，直至你自己刪除，或者刪除帳戶為止。數量冇上限，用嘅係呢部電話嘅儲存空間；喺「設定 → Haruka 嘅聲音」可以睇用咗幾多，亦可以刪除較舊嘅錄音、保留文字。登出之後佢哋會收埋，直到同一個帳戶喺呢部電話再登入。留喺電話嘅呢份副本唔屬於 Haruka 嘅記憶。重聽已有嘅錄音唔會再經 ElevenLabs 整過，亦唔會用多字數。如果錄音檔唔見咗，或者部電話太滿存唔到，你可以自己揀取返伺服器上嘅原錄音；我哋唔會自己靜靜雞整過一段。喺呢度刪除對話或者錄音，都只係喺呢部電話刪除，唔會刪伺服器上嘅對話紀錄或者錄音。

生成嘅原錄音會私密保存喺我哋嘅伺服器，方便取回，目前冇自動到期刪除。刪除帳戶會移除呢啲錄音；少量匿名化用量同防濫用記錄可能仍會保留。ElevenLabs 會按適用嘅服務同私隱條款處理回覆。語音唔保證有指定口音或者完全準確嘅讀音。

記憶

Haruka 可能會記住你選擇分享嘅小細節，令對話更加貼身。記憶係為咗令 Haruka 對你前後一致——唔係公開檔案，Haruka 亦唔會喺對話入面將佢完整讀返畀你聽。你可以喺「設定」刪除你嘅資料。你返到房嗰陣，Haruka 可能會問下你最近傾過嘅一樣嘢，當係打招呼。如果嗰段對話係「只傾今次」，或者有講到健康資料，佢就唔會咁做。喺「Haruka 成長」嘅「我記低嘅你」，你可以睇到 Haruka 由對話記低嘅筆記。為咗用你嘅語言顯示，呢啲筆記可能會交畀 AI 供應商；如果你改寫其中一條，改之前同改之後嘅字句會一齊交畀 AI 供應商檢查，通過先會改。翻譯唔會保存喺我哋嘅伺服器。

你嘅身心近況記錄唔係普通記憶。只有你自己將佢哋帶入對話，Haruka 先會用到。一個方法係喺身心近況面板交付：只包括你揀咗嘅記錄，有效 15 分鐘。另一個方法係將引用咗你某條記錄嘅「最近的你」一頁放入對話草稿，再撳傳送：嗰條記錄就會變成你訊息嘅一部分，留喺對話紀錄入面。第三個方法係 Haruka 寄嚟嘅信：你喺信度揀「帶返房慢慢傾」嗰陣，要開咗「今次傾計加入呢啲近況」，封信用到嘅近況先會一齊帶過去，同面板交付一樣，有效 15 分鐘。無論邊種方法，記錄都會為嗰次回覆交畀 AI 供應商，而嗰段對話之後唔會當成記憶被翻出嚟。

如果你喺對話入面答應咗一個小小約定，佢嘅簡短標題同說明、幾耐一次、Haruka 點樣關心你、而家嘅狀態，同埋佢嚟自邊段對話，都會儲存喺你嘅帳戶。進行緊嘅約定可能會隨你之後嘅對話交畀 AI 供應商，等 Haruka 可以輕輕提一提。你可以喺日記嘅「小小約定」睇返，逐個撳「完成」、「遲啲先」或者「拎返出嚟」；刪除帳戶會一齊刪走。如果安全檢查喺某段對話發現危機，Haruka 唔會喺嗰段對話開新嘅小小約定。

當會員功能開放，會員內容亦永遠唔會用作記憶。你喺會員版面發佈嘅內容，以及你朋友喺嗰度發佈嘅內容，都唔會成為 Haruka 對你嘅記憶。記憶只來自你嘅對話同日記。

Haruka 成長

喺「Haruka 成長」嘅「我哋嘅默契」，你確認咗嘅偏好會用你認可嘅原句，連同你嘅帳戶保存喺我哋嘅伺服器。你喺房間每傳一則一般訊息，最新嘅最多八條偏好會連同對話交畀 AI 供應商，等 Haruka 傾偈時可以參考。搜尋或者思考模式嘅回覆、「只傾今次」嘅對話，同埋講到健康或者危機嘅訊息，都唔會附上；睇落提到健康或者危機嘅偏好亦會略過。呢樣嘢冇獨立嘅開關：每條偏好都可以隨時「修改」或者「唔再記住」。修改會換走原本嘅字句，「唔再記住」會刪走原句；留低嘅記錄唔包括你寫過嘅字。Haruka 可能會由傾偈筆記建議一條偏好，但要你接受先會加入；如果你略過，我哋會留一個唔包括字眼嘅記錄，等佢唔會再建議同一項。如果某個回覆可能用到你嘅偏好，我哋會留低指向嗰個回覆嘅連結（唔係副本），14 日後失效，等你可以喺「回望回覆」話我哋知有冇幫到手。

喺「我嘅一頁」，你可以寫低想 Haruka 點叫你、你幫 Haruka 改嘅花名、呢排忙緊咩、令你開心嘅小事，同埋想佢點樣陪你，亦可以揀學生相同四組性格偏好。呢一頁會儲存喺呢部電話。要你開咗「傾偈時，畀 Haruka 參考呢一頁」，佢先會隨對話傳出；呢個開關預設係熄咗。開咗之後，你喺房間同「搵食」每傳一則訊息，你寫嘅內容，同埋四組偏好揀齊之後嘅四個字母類型，都會經我哋嘅伺服器交畀 AI 供應商；學生相嘅選擇唔會傳出。搜尋或者思考模式嘅回覆、「只傾今次」嘅對話，同埋講到健康或者危機嘅訊息，都唔會附上呢一頁；睇落提到健康或者危機嘅欄目亦會略過。我哋嘅伺服器只會用嚟寫嗰次回覆，唔會保存。你可以隨時熄咗呢個開關。就算冇開呢個開關，你都可以揀同 Haruka 講下呢一頁：內容會先放入草稿畀你睇過先傳，嗰段對話會當「只傾今次」處理。

帳戶同步預設係熄咗，要你撳「同步到我嘅帳戶」先會開。開咗之後，想 Haruka 點叫你、你幫佢改嘅花名、三段回答同學生相嘅選擇，會以一份最新副本保存喺我哋嘅伺服器，等你換咗裝置都搵得返呢一頁。四個字母類型同傾偈參考嘅開關唔會同步；由帳戶取返嘅一頁，傾偈參考會先熄咗。撳「關閉同步」會即刻喺伺服器移除嗰份副本；留低嘅記錄唔包括你寫過嘅字。登出之後，呢一頁會喺呢部電話收埋，直到同一個帳戶再登入；刪除帳戶會喺呢部電話同我哋嘅伺服器一齊清走。

儲存「性格小測」時，你嘅答案會傳去我哋嘅伺服器計出結果。我哋會保存結果（你嘅答案喺四個方向各自偏向邊一邊，同四個字母類型）同日期，唔會保存逐題答案，只會留低一個由答案轉出嚟嘅代碼，用嚟確認之後嘅請求係咪同一份答案。如果你揀「我有之前嘅結果」，我哋會保存你填嘅類型。結果會跟住帳戶保留，直至你刪除帳戶；想早啲刪走，可以電郵 haruka.admin@gmail.com。儲存之後，如果你允許咗 AI 回覆，你揀咗明確一邊嘅題目、你揀嘅選項同結果會交畀 AI 供應商，等 Haruka 寫一段簡短回饋；我哋嘅伺服器唔會保存呢段回饋或者你嘅答案。未做完嘅小測（連同已經答咗嘅題目）同最多十六段回饋會留喺呢部電話；登出之後會收埋，刪除帳戶會清走。你最新嘅結果亦會填入「我嘅一頁」嘅四組偏好，所以要開咗嗰一頁嘅傾偈參考，佢先會隨對話傳出。同 Haruka 傾你嘅類型或者回饋，同「我嘅一頁」一樣：草稿睇過先傳，嗰段對話會當「只傾今次」處理。

「Haruka 成長」入面嘅成長路線，係我哋嘅伺服器喺需要嗰陣，由你確認咗嘅偏好即時計出嚟，路線本身唔會儲存。每條確認咗嘅偏好會有一個標籤，表示佢令 Haruka 偏向感性、理性定幽默，或者三樣都唔係。你喺房間每傳一則一般訊息，一段由你嘅成長路線整理出嚟嘅語氣提示會連同對話交畀 AI 供應商：Haruka 同你有幾熟、佢感性、理性定幽默邊一面最突出，同埋——只有你開咗「傾偈時，畀 Haruka 參考呢一頁」先會有——你嘅四個字母類型。呢段提示永遠唔包括你寫過嘅字；搜尋或者思考模式嘅回覆、「只傾今次」嘅對話，同埋講到健康或者危機嘅訊息，都唔會附上。如果你允許咗 AI 回覆，一段冇敏感內容、符合條件嘅對話完咗之後，同整理記憶用嗰份一樣、已經過濾嘅對話內容，連同最多五條仲未有標籤嘅確認偏好，會再交畀 AI 供應商一次，用嚟幫嗰啲偏好加標籤，亦可能提議幾種固定講嘢方式其中一種。我哋只會保存標籤，同提議嘅代碼、狀態同日期——唔會保存對話入面任何字，亦唔會判斷你嘅性格或者心情。提議要你接受先會計，14 日後失效，唔會畀其他人睇到，你亦可以撳「唔使」。你都可以喺「想佢點變」揀一句固定嘅說話，確認咗就會好似其他偏好咁保存。呢樣嘢冇獨立開關：「唔再記住」一條偏好，佢就唔再計。標籤同提議會隨帳戶一齊刪除。

相片

當你發送或者影相，張相會連同你嘅訊息一齊傳送畀第三方 AI 基礎設施供應商，等 Haruka 可以回應。我哋唔會保存相片本身，只會記低嗰條訊息附咗幾多張相。你同張相一齊寫嘅字，同埋 Haruka 講過張相入面有啲咩，會好似其他訊息一樣留喺對話入面；Haruka 亦可能會記住，等佢之後仍然記得你畀過佢睇咩。如果想刪走呢啲內容，可以電郵 haruka.admin@gmail.com；喺「設定 → 刪除帳戶」刪除帳戶，亦會連同你其他資料一齊刪走。如果你喺 App 入面影相，或者喺今日小運嘅分享圖撳「存入相簿」，喺你允許 Haruka 加入相片嘅情況下，Haruka 會將副本存入你裝置嘅相簿，等你可以留喺自己裝置。做呢樣嘢嗰陣，Haruka 只會要求加入相片，唔會要求睇你嘅相簿。

飲食記錄入面，影或者揀餐點相、營養標籤相都係自選。你同意 AI 處理後，揀咗嘅相會縮細，再經我哋伺服器交畀 Google Vertex AI 辨認或粗略估算營養；請求唔會附上過往健康記錄、飲食目標或者產品條碼。Haruka 唔會將張相保存成伺服器記錄或者存入相簿；暫存處理檔案同預覽會清走。供應商處理安排見上面 AI 部分。只有你確認嘅餐點名、份量、來源同數值會按帳戶分開存喺呢部電話，你可以修改或刪除。登出會收埋，刪帳戶會清除。確認咗嘅飲食摘要可能喺呢部電話嘅「最近的你」顯示；將揀選嘅摘要帶入對話係另一個操作，唔會自動附上餐點相。

搜尋

開咗「搜尋」之後，Haruka 可能會上網查資料，再列出你可以打開嚟睇嘅來源。為咗幫你查，你問題嘅文字——如果係追問，仲會連同你喺同一段對話最近最多兩條搜尋問題——會交畀 Google，由 Google 透過佢嘅 Vertex AI 服務用 Google 搜尋幫你查。你嘅記憶、日記同其他對話內容唔會加入呢次搜尋。如果你附上相片，張相會連同問題交畀 Google 嘅 Vertex AI，等 Haruka 睇得明你問乜；上網搜尋本身只會用文字。

日曆同手帳

如果你連接裝置日曆，Haruka 讀取當中嘅活動，只係為咗喺手帳同你嘅計劃並排顯示，同埋喺朝早小儀式卡顯示；呢啲活動會留喺你裝置，永遠唔會傳送到我哋嘅伺服器，亦唔會用喺對話。你喺手帳建立嘅活動會儲存喺你帳戶，同你嘅計劃同步。只有你揀咗同 Haruka 分享嘅活動先會用喺對話；佢哋亦可能喺呢部電話嘅「最近的你」同話題嘅「為你揀」出現；如果你開咗「最近的你」，我哋嘅伺服器決定寫唔寫輪廓嗰陣，會數一數有幾多個，但唔會讀內容。手帳提醒，以及你收藏嘅路線嘅交通消息，都係喺你裝置上產生嘅通知，唔係由我哋嘅伺服器發出。手帳提醒會顯示計劃嘅標題，唔會顯示地點或者備註，而且可能會喺鎖定畫面出現。我哋唔會出售呢啲資料，亦唔會用作廣告。

日曆共享同你部機嘅日曆分開。你要揀朋友，再向某個行程或者二人日曆發出邀請；對方接受後先加入；未到期嘅待接受邀請可以先顯示行程標題。共享嘅標題、日期、重複設定、地點同備註會存喺我哋伺服器，只顯示畀當時有權限嘅人。有編輯權限嘅人可以修改共享行程。你自己嘅提醒、裝置日曆行程同 AI 偏好唔會複製畀其他人。行程一旦進入共享，就唔會再交畀 Haruka 對話或記憶使用，即使之後停止共享都一樣。刪除朋友或者封鎖會撤銷現有共享權限；重新加朋友唔會自動恢復。二人日曆結束後，各人保留自己建立嘅行程，唔會繼續睇到對方嘅行程。我哋會保留同帳戶相連嘅邀請、權限記錄同唔含內容嘅操作回條，用嚟管理權限同核對重試。刪除帳戶會清除或撤銷該帳戶嘅共享記錄同權限；唔會刪除另一人自己擁有嘅行程。

如果你開咗朝早小儀式，你部電話會預先排好之後最多七朝、每朝一個通知。通知嘅字唔會寫你嘅安排、天氣或者你個名。你撳入去，張卡會喺你部電話砌出嚟：香港天文台嘅天氣資料（查詢唔會註明你係邊個）、你今日嘅安排，同埋你抽咗今日支籤未。如果你七日冇打開 Haruka，提醒會自己停；登出會全部取消。你揀嘅時間同日子只會留喺呢部電話。

通知

除咗喺你部電話度自己產生嘅提醒，Haruka 亦可以由我哋嘅伺服器傳通知畀你：「新玩法同小靈感」、「Haruka 嘅新消息」、「Haruka 寄嚟嘅信」同「你留意緊嘅嘢平咗」。要你開咗——喺「設定 → 你嘅小提醒」，或者喺信箱同平嘢通知嘅畫面——而且 iPhone 准許，先會收到。收邊類、幾點到幾點唔好打擾、時區同語言，全部由你揀。揀邊個收頭兩類通知，永遠唔會用到你嘅對話、記憶或者健康資料；信嘅通知只會喺你封信寫好之後先發，平嘢通知只會喺你留意緊嘅貨品平咗先發。

你嘅選擇——收邊類、幾點到幾點唔好打擾、時區同語言——喺你儲存，或者開咗信或者平嘢通知嗰陣，就會儲存喺我哋嘅伺服器，就算你未開通知都會；之後亦會喺下面講嘅每星期檢查原封不動再儲存一次。打開「你嘅小提醒」、超市GaGala、信箱嘅星期日收信設定，或者喺 iPhone 准許 Haruka 通知嘅情況下打開 App，亦會為你嘅帳戶建立一份乜都未開嘅設定紀錄（如果之前未有）。你開咗通知之後，Apple 畀呢部電話嘅推送地址會傳去我哋嘅伺服器，連同呢次安裝嘅一個隨機識別碼、App 版本，同 iPhone 有冇准許通知。如果你部 iPhone 已經准許 Haruka 通知，而你嘅帳戶至少開咗一類通知，你登入咗打開 App 嗰陣亦會傳送，例如你重新登入之後，或者喺 iPhone 嘅「設定」准許通知之後；除非你喺呢部電話撳過「呢部電話唔再收」。要發通知嗰陣，我哋嘅伺服器會將呢個地址、通知內容、撳落去會開邊一頁，同你嘅帳戶識別碼，交畀 Apple 嘅推送通知服務（APNs），由佢送到你部電話。每次發畀你嘅通知，我哋都會留低紀錄，例如幾時發、Apple 有冇接收。你可以喺「設定 → 你嘅小提醒」撳「呢部電話唔再收」，或者喺 iPhone 嘅「設定」熄咗佢。登出之後，呢部電話就唔會再收，直到你喺呢度再登入；刪除帳戶會喺我哋嘅伺服器刪走推送地址、你嘅選擇同呢啲紀錄。

呢部電話開住通知期間，你打開 App 嗰陣，大約每星期一次，而且只限呢部電話仍然喺你儲存咗嘅時區，App 會將你儲存咗嘅選擇原封不動再傳一次，更新最後儲存嘅時間。唔理部電話喺邊個時區，只要 iPhone 仍然准許通知，App 亦會將呢部電話嘅推送地址、安裝識別碼、App 版本同權限狀態再傳一次，等我哋嘅伺服器知道部電話仲用緊。咁做永遠唔會問你攞權限，亦唔會傳任何新資料。另外，好似上面講，你登入咗打開 App 嗰陣，App 可能會自動為呢部電話開返你帳戶已經開咗嘅通知類別，一樣唔會問你。如果推送地址或者你嘅選擇 30 日冇更新或者儲存過，我哋嘅伺服器就唔會再發通知去呢部電話；所以如果 iPhone 唔再准許通知，或者部電話轉咗去第二個時區而你冇再儲存選擇，通知會喺 30 日內停。呢部電話亦會喺安裝識別碼旁邊，加密保存一個細小紀錄，記低邊個帳戶喺呢度開咗通知，同最後幾時更新。你喺「設定 → 你嘅小提醒」撳「呢部電話唔再收」或者登出，而我哋嘅伺服器收到呢個改動之後，呢部分就會刪走；喺 iPhone 嘅「設定」熄通知，唔會刪走佢。你撳「呢部電話唔再收」嗰陣，呢個紀錄亦會記低呢個帳戶喺呢度熄咗通知，等通知唔會自己開返；嗰個帳戶喺呢度再開通知，呢個註記就會刪走。

位置同城市工具

喺你允許之下，Haruka 會喺你使用 App 期間用你嘅位置，顯示附近車站、規劃路線、搵附近食肆，以及亮起你行過嘅地方。你嘅位置會喺你裝置上同巴士站同 100 米地圖格比對。呢啲一般附近查詢唔會儲存或上傳精確位置。步行路線、儲存泊車位置同自願報料嘅處理方式，會喺下面講明。

你撳「開始跟車」，或者喺足跡撳「開始探索」之後，Haruka 可以喺背景繼續用位置跟車或者記錄足跡。只係打開足跡頁，唔會開始記錄。跟車會按每一程，喺轉車或落車前同到站時提醒你。背景使用需要相應嘅 iOS 定位權限。你可以喺城市工具或者進行中行程卡停止；離開頁面唔會停止正在跟進嘅行程。行程完成、過咗跟進時限，或者持續離開路線太耐，亦會停止。登出或者刪除帳戶會停止兩項活動。

當你規劃步行路線，Haruka 會先用你裝置上儲存嘅行人路網資料畫出路線。如果該路網連接唔到兩點，該段步行嘅起點同終點——如果起點係你目前位置，就包括你目前位置——會傳送畀香港地政總署嘅路線服務，用嚟畫出路徑。當你喺城市工具嘅「搭車」搵地方，你輸入嘅文字會傳送畀香港地政總署嘅位置搜尋服務。實時到站時間、天氣、路面車速、交通消息、停車場同活動資訊，係向公共交通營辦商同香港政府嘅公開數據服務查詢；請求只會註明你睇緊嘅路線、車站或者地區，唔會註明你係邊個。地圖由 Apple Maps 繪製，佢會收到畫面上顯示嘅地圖範圍。Haruka 唔會儲存以上任何請求。

你嘅足跡、你為地點標記嘅想去／去過／收藏、你為地點加嘅私人筆記同標籤、你收藏嘅路線同活動、你嘅步行設定，以及你最近喺「搭車」搜尋過嘅地方，全部留喺你裝置，並且按登入嘅帳戶分開保存，唔會同步到你帳戶。登出之後呢啲資料會收埋，直到同一個帳戶喺呢部手機再登入；刪除帳戶就會清除。跟車期間，該路線嘅各站同你落車嘅站會保存喺你裝置，等每程嘅提醒可以發出，行程結束或者你登出就會移除。今次更新之前保存嘅收藏唔屬於任何帳戶：佢哋會收埋留喺手機，直到你放入你嘅帳戶，或者喺「設定」刪除。

當你喺搭車工具用「問 Haruka」提問，而你部手機自己解答唔到，你輸入嘅文字——只係文字，唔包括你嘅位置或者其他任何資料——會傳送到 Haruka 嘅伺服器，再交畀第三方 AI 基礎設施供應商，純粹用嚟理解你問乜；答案之後會喺你裝置上組合出嚟。當你喺對話問 Haruka 天氣、某個地方、附近有咩、活動、泊車，或者巴士、小巴、港鐵幾時到，Haruka 可能會向同一批公開數據服務查答案。如果係關於地方或者行程嘅問題，地名——如果 Haruka 認唔出地名，就係該條訊息嘅文字——會傳送畀香港政府地址查詢服務；如果係交通問題，就只會傳送路線、車站或者港鐵站。呢啲服務只會見到查詢內容，見唔到你嘅帳戶，而佢哋回傳嘅資料只會用喺該次回覆。

喺「駕駛助手」儲存嘅泊車座標同備註只留喺呢部電話，按帳戶分開保存；登出會隱藏，刪除帳戶會清除。揀「附近報料」會將大概範圍交畀我哋伺服器。撳發佈時，只會傳送你確認嘅類別同大概位置，位置會約化到約 100 米格網，畀其他已登入嘅駕駛者睇；唔會公開你個名、私人泊車位置或者備註。報料兩小時後停止顯示，你亦可以提早刪除；過期公開報料會喺服務下次處理請求時清理。被舉報嘅內容會留下獨立審核紀錄，包括類別、更粗略嘅範圍、時間同原因，30 日後列入清理；為咗處理重試同防止濫用，我哋會保留操作編號，同由你揀嘅類別及約化位置計出嘅比對碼，連結到你嘅帳戶；呢啲紀錄24 小時後列入清理。封鎖紀錄會保留到你解除封鎖或者刪除帳戶。刪除帳戶亦會清除你嘅報料、舉報同封鎖紀錄。開啟導航時，目的地會交畀你揀嘅地圖 App。 只有喺更新版發佈提示顯示之後，你再按「公開發佈」提交嘅抄牌報料，先會另外保留一份最少紀錄，用嚟計算今日同之前六個香港日期嘅每日觀察宗數。紀錄包括報料識別碼、連結帳戶嘅作者識別碼、同一個約略位置、觀察時間、到期時間同隱藏狀態，唔包含文字、相片或車牌。資料最多用於統計七日，到期即時唔再計入，並喺下一次定期清理時刪除（正常約每十分鐘執行），或喺之後嘅服務請求時清理；唔保證到期一刻已完成實體刪除。你刪除自己嘅報料或者帳戶，相關統計輸入亦會刪除，即使個別報料已停止公開顯示。封鎖、舉報隱藏同帳戶停用會影響你可以睇到嘅統計。其他已登入使用者只會取得每日宗數、最近觀察時間、收集起始時間、統計範圍、更新時間同完整度，唔會取得保留嘅個別紀錄、識別碼或座標。舊版本未有呢段更新提示嘅報料唔會加入七日紀錄，亦唔會補入之前嘅報料。呢啲係用戶觀察宗數，唔係抄牌機會、風險評分或安全泊車保證。

喺「搵食」問 Haruka 時，服務會收到最多五則近期訊息（包括你今次嘅問題）、最多十六間餐廳嘅公開介紹同識別資料、所選語言同資料日期。如果你開咗「傾偈時，畀 Haruka 參考呢一頁」，你喺「我嘅一頁」寫嘅內容同四個字母類型，亦會隨每則「搵食」訊息傳送（見「Haruka 成長」）；MBTI 唔會當成飲食或健康證據。精確座標、私人收藏同筆記唔會交畀呢個對話服務。如果有按意思搵餐廳嘅功能，你最新嗰個問題亦會交畀 Google 尋找相關餐廳資料；呢次搜尋唔包括個人資料或之前嘅訊息。我哋嘅伺服器唔會將搵食對話或搜尋用嘅轉換結果存成聊天紀錄或者記憶，但會記錄連結帳戶嘅用量同請求次數。如果你問附近有咩食，App 只會喺你部電話讀取目前位置，用嚟揀附近嘅餐廳；位置本身唔會傳送，但揀出嚟嘅餐廳連同佢哋嘅地區同街道，會顯示你大概喺邊。除此之外，只有你確認餐廳之後，獨立嘅路線功能先可以要求用目前位置帶路。

喺「探索」問 Haruka 時，你當前嘅問題、呢次本機對話最多八則較早訊息、語言同所揀工具背景，會經我哋伺服器交畀 Google Vertex AI；亦可能附上有限數量嘅公開餐廳或活動候選資料同資料日期。伺服器可能查閱公開購物目錄，以及香港天文台官方預報或警告；亦可能將有限數量嘅運輸署公開停車場名稱、地址、地區、有資料日期嘅高度限制及時租資料，以及新近公佈嘅空位狀態、數量同時間交畀 AI。唔包括停車場座標，亦唔會傳送你嘅 GPS。涉及駕駛時，伺服器可按現有權限同封鎖規則讀取你登入帳戶可見嘅報料，但只會將該頁全港資料嘅類別數量同最新時間交畀 AI，唔會傳送報料識別碼、作者或者座標。原始 GPS、房間對話記憶、私人備註、個人頁文字同健康附件唔屬於呢個功能嘅請求。我哋唔會將對話存成伺服器聊天記錄或記憶，只保留同帳戶相連嘅用量同頻率限制資料。提問唔會發布報料、儲存行程、下單或開始導航；呢啲操作需要另外確認。

當你叫朋友一齊揀食邊間，一條有編號嘅訊息會經你揀嘅 App 傳出去，你點算嘅回覆只會留喺你部電話。

你去完一個喺 Haruka 揀嘅地方——喺「搵食」揀嘅餐廳，或者你跟車去嘅地方——Haruka 可能會問你感想。如果你揀記低，地方名、你寫嘅說話同日期會記入你嘅日記；你嘅位置、車站同到達時間唔會。佢可能會問嘅行程只會留喺你部電話，你亦可以喺「設定」熄咗呢啲問題。

裝置上嘅城市資料

部分城市資料——車站、路線、地點同地圖圖層——會喺你需要時由 Haruka 伺服器下載到你裝置。呢啲下載內容描述嘅係城市，唔係你。你可以喺「設定」刪除，之後再下載。

今日小運同購物清單

今日小運會喺呢部裝置保存你每日嘅求籤同塔羅抽取紀錄、洗牌次序同揀牌結果、收藏同私人筆記、你答過嘅「有冇共鳴」（如果你揀咗答）、所選星座，以及聲音、觸感同動態效果偏好。揀星座唔需要提供出生日期。移除收藏會清除收藏標記同私人筆記，原本嘅每日抽取紀錄仍會保留。如果你揀咗同 Haruka 傾下，只會將你揀嘅問題放入對話草稿，等你按傳送先送出；唔會附上私人筆記或者個人資料。

我嘅購物清單會保存你喺「今次要買」、「慣買嘢」同「願望清單」確認嘅品項名稱、容量／份量、包裝同數量，以及你為願望設定嘅目標價同希望買到日期。呢啲係你自己記低嘅資料，唔係購買或者付款紀錄。移除品項會改變畫面上嘅清單；之前嘅品項資料仍可能留喺用嚟避免重複儲存嘅本機更改紀錄，直到該帳戶嘅本機資料被清除。

產品頁嘅營養數字嚟自 App 內置嘅公開資料——同類食物嘅一般數值（澳洲紐西蘭食品標準局 FSANZ、美國農業部 USDA FoodData Central），以及部分產品本身嘅公開紀錄（Open Food Facts、USDA FoodData Central）——顯示嗰陣唔會傳送任何資料。致敏資料只會嚟自產品喺 Open Food Facts 嘅紀錄。當產品頁有條碼紀錄，或者你選擇網上查產品，Haruka 先會上網查 Open Food Facts；只會傳送嗰個條碼，或者你提交嘅產品名稱。查到嘅資料會喺呢部裝置保留 7 日。掃碼喺你部裝置讀取條碼，唔會儲存或者上傳相機影像。產品相片只會喺你啟用後下載，亦可以獨立移除。公開資料同圖片服務會收到一般網絡資料，例如 IP 位址；請求唔會包含你嘅帳戶識別碼、購物清單、飲食選擇、私人筆記或者記低嘅價格。

如果你揀「影營養標籤」，張相會經我哋嘅伺服器傳送一次去 Google 嘅 Vertex AI，讀出標籤上印住嘅數字。只會傳送張相——唔包括係邊件產品、條碼、你嘅清單或者飲食選擇。張相唔會存入你嘅相簿，Haruka 亦唔會保存。Google 按佢嘅雲端服務條款代我哋處理，唔會用嚟訓練佢嘅 AI 模型；按呢啲條款，Google 可能會短暫保留，例如暫存最多 24 小時，或者喺佢嘅系統懷疑有濫用時保留更耐。你確認嘅數字只會連同嗰件產品存喺呢部電話，直到你刪除或者刪除帳戶；唔會同步到我哋嘅伺服器，亦唔會同屋企人分享。我哋嘅伺服器只會保存你影標籤嘅次數（用嚟計每日同每月上限）同上面講嘅用量記錄；兩者都唔包括相片、數字或者產品。

你記低嘅價格包括店舖、金額、包裝份量同日期，方便比較自己見過嘅價格。資料會同你帳戶嘅本機購物資料一齊留喺呢部裝置；唔係商戶即時價格或者已確認存貨，Haruka 亦唔會代你落單。

呢啲本機紀錄會喺同一部裝置按帳戶分開保存，唔會同步到 Haruka 伺服器，亦唔會傳畀商戶；下面講嘅屋企清單同平嘢通知除外。登出之後會隱藏，直到同一個帳戶喺呢部裝置再次登入。確認刪除帳戶後，亦會清理該帳戶喺呢部裝置嘅本機紀錄。呢啲購物清單同「會員版面」提到嘅共享清單係分開嘅。

超市價格表、歷史價格同擴展零售目錄都係嚟自消委會及已註明零售來源嘅公開產品資料。手機可能下載公開資料集，或者向我哋伺服器查產品資料。零售目錄請求會用你嘅登入階段傳送搜尋字詞、類別、所揀來源同頁面游標，唔會將私人清單、備註或健康記錄交畀商店。少量公開目錄快取會留喺呢部電話。產品相可能向已註明嘅來源讀取，對方會收到 IP 地址等一般連線資料。如果你揀同 Haruka 傾產品或清單，只有你保留嘅行會放入對話草稿，撳「傳送」先會送出；呢段討論唔會加入長期記憶。

商店連結會喺 Safari 打開嗰間店自己嘅網站，搜尋嗰件產品嘅名稱；有啲店就係打開佢哋嘅主頁。之後就由店舖網站按佢自己嘅條款處理你嘅瀏覽。Haruka 唔會喺連結加入任何關於你嘅資料——冇帳戶、清單或者追蹤碼——亦永遠唔會代你登入、落購物車或者買嘢。如果你分享清單，只會經裝置嘅分享選單傳出品項名稱同數量。

每月使費會將你剔咗做買咗嘅品項加埋，價錢用消委會價，除非你自己改。平咗提示會將消委會每日價同你部電話上次見到嘅價錢比較。你為願望清單品項設嘅提醒，係喺你部電話產生嘅通知，會寫你自己打嘅品項名。以上全部留喺呢部電話。

如果你開咗平嘢通知，你留意緊嘅最多 30 件貨品嘅消委會編號，同你設嘅目標價，會傳去我哋嘅伺服器，等佢每日同當日價錢比較，再發一個唔寫產品名嘅通知畀你。我哋只會保存每日有幾多件平咗嘅數字，保留 14 日。熄咗平嘢通知，你嘅留意清單會即刻喺我哋嘅伺服器刪走；刪除帳戶亦會刪走。佢永遠唔會用嚟做推廣，亦唔會交畀商戶。

喺超市GaGala問 Haruka 關於一味餸或者一件產品，常煮嘅餸會喺你部電話直接答。其他問題會經我哋嘅伺服器交畀上面講嘅 AI 供應商，連同產品嘅公開資料、你保留附上嘅飲食選擇，以及——只有你喺嗰次問題開咗、又剔咗最少一個數字先會——一段最多四個過去 7 日 Apple 健康約數嘅簡短摘要（見「身心近況」）。傳送之前你會睇到全部內容。回答唔會儲存喺我哋嘅伺服器，亦唔會加入記憶。用咗健康摘要嘅回答唔會顯示任何產品、品牌、價錢或者商店連結；你嘅數字永遠唔會用嚟排列產品、做推廣，亦唔會畀商戶用。你嘅飲食選擇會留喺呢部電話，直到你連同問題一齊傳送。

喺超市GaGala同 Haruka 傾買咩好，你嘅問題會連同呢段對話最近最多五句、對話入面出現過嘅產品編號，同埋你由邊件產品開始問（如果有），經我哋嘅伺服器交畀上面講嘅 AI 供應商。伺服器會揀出相關嘅公開產品資料（消委會價錢一覽嘅名稱同分類，同埋公開營養同致敏紀錄）一齊交畀 AI；產品資料唔係由你部電話傳出。你保留附上嘅飲食選擇，同埋——只有你喺嗰次問題開咗、又剔咗最少一個數字先會——「身心近況」一節講嘅 Apple 健康簡短摘要，會連同嗰次問題傳送；傳送之前你會睇到。用咗健康摘要嘅回答唔會顯示任何產品、品牌、價錢或者商店。對話只會留喺呢部電話（最多三十句，附健康摘要嗰次唔會留低），你可以隨時清除；登出之後會收埋，刪除帳戶會清走。我哋嘅伺服器唔會儲存對話，亦唔會加入記憶，只會記錄連結帳戶嘅用量同請求次數，包括有冇附上健康摘要（只記有定冇，永遠唔記數字）。回答係一般資訊，唔係醫療意見。

屋企清單會同你喺家人近況連結咗嘅家人共用。我哋嘅伺服器會保存每張清單嘅名稱、每個人喺清單用嘅名，同每樣品項嘅數量、備註、邊個加、邊個買咗同幾時；清單上每個人都睇到。儲存之前，我哋嘅伺服器會檢查字眼有冇威脅、色情、侮辱或者自殘內容。如果你舉報一樣品項，我哋會保存舉報同被舉報字眼嘅副本，等有真人睇。你離開或者被移出清單，你加過嘅品項會留畀其他人；刪除帳戶會刪走你加過嘅品項，同你喺每張清單嘅位置。如果你剔咗其他人加嘅品項做買咗，你刪除帳戶之後，佢哋仍然會見到已買同時間，但唔會再見到你個名。屋企清單永遠唔會用作記憶，亦唔會走入你同 Haruka 嘅對話。

只有你喺今日小運結果撳「分享」，Haruka 先會喺你部電話整一張圖：張卡、標題、一句解讀、日期，同埋一個掃咗會打開 Haruka App Store 頁面嘅二維碼。你嘅私人筆記、帳戶同其他關於你嘅資料永遠唔會喺圖入面。去邊度由你喺裝置嘅分享選單揀，或者存入相簿——咁做只會要求加入相片嘅權限。「淨係分享文字」就會改為傳送結果文字同日期。張圖會喺 App 嘅暫存位置保留最多一日。如果你經另一個 App 傳送，共享副本就由嗰個 App 處理；刪除 Haruka 帳戶唔會收返已分享嘅內容。

身心近況

身心近況預設係關閉，要你自己開啟。開啟之後，你確認嘅睡眠、精力、心情、飲食、活動同身體狀況記錄會儲存喺你帳戶，等你可以睇返自己一段時間嘅狀態。Haruka 只會記錄你確認嘅內容；任何一條記錄你都可以修正、標記為「唔係講我」，或者刪除。刪除單一記錄會令佢喺你嘅圖表、匯出同 Haruka 面前隱藏，但該條記錄仍然會留喺你帳戶，直到你喺面板清除所有身心近況資料，或者刪除帳戶。除咗記低記錄，同埋喺你帶入對話時用，身心近況仲有一個獨立、可選嘅用途：「用嚟寫信」，等 Haruka 寄嚟嘅信可以用到你嘅近況（見「Haruka 寄嚟嘅信」）。佢預設係熄咗，要你喺「管理資料」自己開。

你嘅身心近況記錄會保存喺你帳戶，直到你清除佢哋或者刪除帳戶。你可以隨時喺身心近況面板暫停記錄，或者清除所有記錄，亦可以喺嗰度預覽匯出你嘅記錄。當你將記錄交付到某段對話，該啲記錄會連同你嘅訊息，為該次對話傳送畀第三方 AI 基礎設施供應商。熄咗「用嚟寫信」唔會暫停記錄，亦唔會清除任何記錄，但會移除你已有嘅信（見「Haruka 寄嚟嘅信」）。刪除帳戶會將佢哋全部移除。

Apple 健康係自選嘅只讀功能。喺身心近況連接之後，你可以揀畀 Haruka 讀取最近 30 日嘅步數、睡眠、靜息心率、心率變異、靜觀時間同運動記錄。呢啲數值喺裝置記憶體顯示，唔會自動分享。喺「最近的你」，你可以將睡眠同步數放入對話草稿，睇過之後再自己按傳送；其他數字永遠唔會放入呢份草稿。你傳送嘅數字會交畀我哋嘅伺服器同 AI 供應商，並以健康訊息嘅形式留喺對話紀錄，只限嗰段對話：永遠唔會變成身心近況記錄或者記憶，亦唔會用嚟做對話摘要、返房打招呼或者計劃建議。登出或者停止同步會清除裝置上嘅數值，唔會刪除你已經傳送嘅訊息。裝置只會按帳戶保存你嘅連接設定。你可以喺管理資料停止同步，亦可以喺 Apple 健康更改讀取權限。Haruka 唔會修改 Apple 健康嘅記錄。喺超市GaGala，你亦可以為某一個問題附上一段簡短摘要：你自己剔要加入邊幾個過去 7 日嘅約數，最多四個——平均每日步數、平均每晚睡眠、平均靜息心率同運動次數——未剔就乜都唔會附上。傳送嘅內容就係你睇到嘅預覽，最多 300 字；問完就會自動熄返，唔會儲存喺我哋嘅伺服器，亦唔會用作記憶。

家人近況

家人近況係自選功能。你自己揀邀請上顯示嘅稱呼、分享邀請碼，再確認邊位申請者可以傳近況畀你。稱呼由各人自訂，唔代表已核實身份；接受之前，請同你想連接嘅家人核對連接碼。我哋嘅伺服器會保存雙方帳戶識別碼、呢啲稱呼、分享權限，以及附有作者、類型同時間嘅文字卡。計劃只代表作者未確認嘅打算。家人或者幫你付款嘅人唔會因此睇到你同 Haruka 嘅對話、個人資料或者 Apple 健康。文字卡唔會自動加入 AI 對話或者長期記憶。如果你喺某段近況撳「同 Haruka 傾吓呢段」，只有你保留嘅部分會放入對話草稿，要你撳傳送先會送出。之後佢會好似你其他對話訊息一樣，經我哋嘅伺服器交畀 AI 供應商，並留喺你嘅對話紀錄；不過嗰段對話會當「只傾今次」處理，永遠唔會加入長期記憶。寫嗰位唔會收到通知。

雙方都可以移除文字卡或者停止連接，只有作者可以更正自己張卡。停止連接會由服務移除該連接嘅文字卡同共享稱呼；想再連接，要重新邀請同確認。已結束、被拒絕或者過咗期嘅邀請同連接，會留低簡單紀錄，保留到刪除帳戶。每次改動我哋亦會留低紀錄——只有基本資料同一個還原唔到內容嘅代碼，唔包括文字卡內容——超過 30 日後，會喺該帳戶下次使用 Haruka 時清走。任何一方刪除帳戶，都會移除相關共享文字卡、連接同呢啲紀錄。移除功能無法刪走對方已保存嘅副本或者截圖。邀請碼同文字卡只會喺顯示期間留喺你部手機；你離開 App 或者轉帳戶就會清走，返嚟時會重新確認你而家嘅權限。

近況同稱呼儲存之前，我哋嘅伺服器會檢查有冇威脅、色情、侮辱或者自殘字眼；擋低咗嘅字唔會儲存。如果你舉報收到嘅近況，我哋會保留呢個舉報——邊個舉報、邊位寫嘅近況、屬於邊個連結同邊段近況、你揀嘅原因、被舉報嗰段字嘅副本，同我哋點處理——等有真人跟進。即使之後近況被移除、連接已經停止，或者其中一方封鎖咗對方，呢個舉報連同嗰段字嘅副本都會保留，直到任何一方刪除帳戶。寫嗰位唔會收到通知。如果你封鎖某人，我哋會保留封鎖紀錄，令你哋之後喺家人近況唔可以再連結。會員功能用嘅都係同一個紀錄，所以會員功能開放畀你之後，封鎖亦會喺嗰度生效，你亦可以喺「設定」解除。任何一方刪除帳戶，相關嘅舉報同封鎖紀錄都會一齊刪除。

邊個睇到

你同 Haruka 嘅對話、你嘅日記同身心近況記錄，只有你同運作 Haruka 所需嘅系統可以接觸。我哋唔會出售你分享嘅內容。只有為咗安全同日常運作，員工先可能有限度接觸。

會員版面唔同，因為佢哋嘅目的就係畀人睇到。當會員功能開放，你喺嗰度發佈嘅內容你嘅朋友睇到。下面一節會講清楚範圍。

有啲你加嘅內容，就算冇會員功能都會有其他人睇到：屋企清單上嘅品項，清單上每個人都睇到；產品留言，所有用 Haruka 嘅人都會睇到，連同你揀嘅名。留言公開之前，我哋嘅伺服器會檢查，包括上面講嘅 AI 安全檢查。每個地方都可以舉報或者封鎖，我哋會保存舉報同封鎖紀錄，等有真人跟進。你可以刪除自己嘅留言，刪除帳戶亦會刪走。以上全部都唔會成為 Haruka 嘅記憶。

會員版面

會員功能會分階段推出。呢一節講嘅嘢，要等會員功能喺你嘅 App 開放之後先適用。

會員檔案係自願設定嘅。如果你設定咗，你會揀一個用戶名同顯示名稱，並且可以發送同接受朋友邀請、寫短帖、留言同做出反應。

你發佈嘅內容你嘅朋友睇到。你嘅用戶名、顯示名稱同頭像，同你連結嘅會員睇到。「可以透過用戶名搜尋到你」預設係關閉，要你開啟，之後亦可以再關閉。會員頭像只可以由 App 內置嘅圖片揀——冇相片上載。你嘅會員計劃只會喺你自己嘅檔案顯示：其他會員睇唔到，你亦睇唔到佢哋嘅。

當你舉報帖子、留言或者會員，我哋會保存舉報，等有人可以處理，亦可以留意重複情況。被舉報嗰個唔會知道係邊個舉報。當你封鎖某人，我哋亦會保存記錄。被封鎖嗰個唔會收到通知。

你可以隨時刪除自己嘅帖子同留言。刪除帳戶會移除你嘅會員檔案、你嘅連結，以及你發佈過嘅所有內容。

當分享同共用清單功能開放，我哋亦會保存你傳畀朋友嘅標題同附言、收件人同已讀狀態，以及一齊用清單所需嘅清單名稱、備註、項目同成員資料。分享項目會顯示畀收件人；共用清單同修改內容會顯示畀清單成員。呢啲記錄唔會變成 Haruka 嘅記憶。

話題

共享話題係自願參與，預設關閉。如果你開啟，你最近對話訊息嘅文字——每次最多幾百條，包括你開啟之前發送過嘅訊息——會傳送畀第三方 AI 基礎設施供應商，用嚟標記當中觸及嘅主題，等 Haruka 可以為社群推薦共享話題。你嘅訊息同你嘅原話永遠唔會顯示畀其他用戶。其他人睇到嘅，只係我哋團隊預先寫好嘅主題標題同開場白，嚟自一份固定嘅日常話題清單，永遠唔係你嘅說話。一個主題要經過私隱過濾，並且至少有兩個唔同嘅人嘅對話提到過，先會出現。你可以隨時關閉；之後你嘅訊息就唔會再為話題而被讀取。

呢個承諾係關於你嘅私人對話同日記。當會員功能開放，你喺會員版面寫嘅嘢係你選擇分享嘅，你嘅朋友可以睇到——見上面「會員版面」。

話題入面亦有「為你揀」，係由你部電話揀出嚟，來源包括 Haruka 由對話記低嘅筆記、你喺日記留低嘅片刻、你同 Haruka 分享嘅計劃，同埋你完成咗嘅小小約定。除咗用你嘅語言顯示 Haruka 嘅筆記（見「記憶」），揀嘅時候唔會傳送任何嘢。如果你揀咗其中一個，佢嘅內容會放入對話草稿，要你撳傳送先會送出；你打開過或者略過咗邊啲話題，只會記喺呢部電話。

最近的你

最近的你預設係關閉，要你自己喺日記或者「設定」開啟。開啟之後，大約每星期一次，Haruka 會睇你最近發送畀佢嘅訊息（最多 40 條，講健康嘅同安全檢查標記咗嘅唔計），將其中最多 24 條嘅簡短節錄（每條最多 200 字），連同最多三頁 Haruka 喺你最近傾完偈之後寫嘅日記頁標題（永遠唔包括你自己寫嘅片刻，亦唔包括嗰啲頁嘅全文），傳送畀同一批第三方 AI 基礎設施供應商，寫出一個關於你最近日子嘅簡短、溫柔嘅小輪廓，並將呢個輪廓儲存喺你帳戶，等你可以再打開睇。為咗決定嗰個星期夠唔夠內容寫，佢亦會數一數你同 Haruka 分享咗幾多個計劃、有幾多個小小約定改咗狀態，同你用咗幾多次搜尋，但唔會讀入面寫咩；只有呢啲數字會同輪廓一齊保存，而且永遠唔會交畀 AI 供應商。輪廓永遠唔係評分，永遠唔會用到你嘅身心近況記錄，亦唔會用作記憶。關閉之後就唔會再有新嘅輪廓，已有嘅亦會收埋；輪廓會隨帳戶一併刪除。

喺輪廓下面，呢部電話亦會用你留低嘅片刻、你確認咗嘅身心近況記錄（身心近況開住嗰陣）、你同 Haruka 分享嘅計劃、你完成咗嘅小小約定，同埋（如果有連接）Apple 健康嘅睡眠同步數，砌出一日或者一星期嘅短頁。呢啲頁喺你部電話砌出嚟，唔經 AI，亦唔會儲存。除非你揀同 Haruka 傾其中一頁，否則乜都唔會傳出：揀咗之後，內容會放入對話草稿，Apple 健康數字要你剔咗先會加入，亦要你撳傳送先會送出。嗰段對話會當「只傾今次」處理。

Haruka 寄嚟嘅信

信箱要你打開先會用；而且要你允許咗 AI 回覆先會準備信，就算最後封信冇經 AI 寫都一樣。Haruka 會用你收藏嘅片段，連同你確認咗嘅身心近況記錄寫信——永遠唔會用 Apple 健康嘅數字——所以要喺身心近況嘅「管理資料」入面，「記低同整理」同「用嚟寫信」都開住，先會有信。「用嚟寫信」預設係熄咗，只會喺你喺嗰度撳開，或者喺信箱頁撳「好，用嚟寫信」先會開；打開信箱或者開「每個星期日收信」，都唔會幫你開。開住嗰陣，你確認咗嘅近況同收藏片段嘅字句，連同日期，可能會交畀上面講嘅 AI 供應商寫信。如果 AI 寫信未開，或者我哋每月嘅 AI 預算就快用完，就唔會交任何嘢畀 AI 供應商，封信會直接用你自己嘅說話整理，唔經 AI。如果 AI 出錯、用時太耐，或者寫出嚟嘅內容用唔到，封信亦會改用你自己嘅說話整理。信會儲存喺你嘅帳戶，最多 90 日。停用信箱會移除已保存嘅信，刪除帳戶會全部刪走。

如果你開咗「每個星期日收信」，我哋嘅伺服器會每星期喺香港時間星期六夜晚到星期日朝早之間，唔使你打開 App，睇下有冇足夠新片段，每星期最多寫一封。如果你亦開咗「信到咗通知我」，通知會喺你所在時區嘅星期日朝早送到，永遠唔會顯示信嘅內容。停止星期日收信唔會移除你已經有嘅信。每封信會喺信箱保留 90 日；之後就打唔開，而信嘅內容會喺你下次用信箱嗰陣，或者你刪除帳戶嗰陣，由我哋嘅伺服器清走。移除一封信會清走佢嘅內容，同佢連去你片段嘅連結；我哋只會保留一個唔包括內容嘅簡短紀錄，記低嗰個星期有過一封信（即係日期），直到你刪除帳戶，免得同一封信重複寫。如果一封信用到嘅片段或者身心近況記錄被修改或者刪除，或者嗰個片段嚟自嘅對話被刪除，嗰封信亦會被移除。如果你熄咗「用嚟寫信」、暫停記錄，或者清除身心近況，就唔會再寫新信；我哋嘅伺服器一收到呢個改動，所有已有嘅信嘅內容都會清走，每週來信同星期日收信亦會停；之後再開返，兩樣都唔會恢復。以上情況都唔會刪除你原本嘅片段同記錄，只係清除身心近況會連你嘅記錄一齊清走。

遲啲先拆

當你喺「遲啲先拆」寫信畀未來嘅自己，封信嘅標題同內容、你揀嘅拆信日子，同埋未寫完嘅草稿，都會儲存喺你嘅帳戶。冇 AI 會讀，亦唔會用作記憶。未到拆信日子，App 唔會顯示封好嘅信嘅內容。如果你揀同 Haruka 傾一封已經拆咗嘅信，內容會放入對話草稿，要你撳傳送先會送出；送出之後就係一則普通對話訊息。刪除一封信，佢嘅標題、內容同拆信日子會即刻喺我哋嘅伺服器刪走，搵唔返。喺舊版 Haruka 刪除嘅信，會喺刪除後 30 日內喺我哋嘅伺服器刪走。刪除帳戶會全部刪走。

分析

Haruka 使用 PostHog 了解 App 嘅使用情況同運作是否穩定。分析記錄嘅係你點樣使用產品——App 幾時開啟或者轉去背景、打開咗邊啲畫面同功能、房間載入用咗幾耐、新手導覽行到邊一步、有冇打開通知，以及每個動作嘅簡單事實，例如用咗邊種對話模式、有冇附上相片、你用邊個服務登入同登入有冇成功、你嘅 AI 資料分享選擇、你揀嘅回覆語言、你分享咗邊類嘢（唔包內容）、回覆同工具要等幾耐先出、搜尋有冇搵到嘢（唔包你搜尋嘅字），同你有冇允許通知——連同你嘅用戶識別碼、呢次安裝嘅一個隨機識別碼、你嘅 App 版本、裝置類型、iOS 版本、語言同螢幕尺寸。App 出錯時，亦會傳送一份錯誤報告：錯誤類型、一段已刪走電郵地址、連結、數字同引號內文字嘅簡短錯誤訊息，以及喺 Haruka 程式碼邊度出錯。錯誤報告唔會包括你嘅對話或者你寫嘅任何內容。PostHog 喺正常處理請求時亦會收到你嘅 IP 地址；我哋已要求佢唔要由 IP 地址推算位置，而佢會將呢啲資料儲存喺美國。佢唔會記錄你寫嘅內容、你嘅身心近況記錄、你嘅 Apple 健康數字或者你嘅位置。你可以隨時喺「設定」關閉分析數據。關閉之後，Haruka 會即刻停止由呢部裝置傳送分析同錯誤報告；登出之後，呢個選擇都會留喺呢部裝置。你刪除帳戶之後，Haruka 會停止以你嘅用戶識別碼記錄分析，但已經記錄嘅事件唔會被刪除：佢哋會留喺 PostHog，同你以前嘅用戶識別碼連結，直到 PostHog 自己嘅保留期結束。第三方系統點樣保留自己嘅日誌，唔喺我哋控制範圍。

刪除

你可以喺 App 入面申請刪除 Haruka 帳戶同 App 資料：打開「設定」，揀「刪除帳戶」。確認之後，你嘅帳戶會被登出，我哋喺運作中數據庫持有嘅你嘅資料會被移除。如果你係用 Apple 登入，我哋亦會要求 Apple 終止 Haruka 嘅 Sign in with Apple 授權。

當中包括你嘅身心近況記錄、你嘅 AI 請求記錄同意見、你嘅「最近的你」輪廓、Haruka 寄嚟嘅信同你喺「遲啲先拆」寫嘅信、你嘅小小約定、你確認咗嘅偏好連同成長路線嘅標籤同提議、性格小測結果、同步咗嘅「我嘅一頁」副本、你加落屋企清單嘅品項同你喺清單嘅位置、你嘅產品留言、你嘅平嘢通知留意清單，以及（當會員功能開放時）你嘅會員檔案、朋友連結，同你發佈嘅帖子、留言同反應。佢哋係被移除，唔係以空白名字留低。保存喺你裝置嘅資料——足跡、地點標記同筆記、收藏嘅路線同活動、「搭車」嘅最近搜尋、城市工具設定、「我嘅一頁」、未做完嘅性格小測同小測回饋——亦會同時清除；仍在進行嘅跟車或者探索會停止，喺呢部電話排好嘅提醒（例如朝早小儀式）亦會取消。已存入相簿嘅相片、已下載嘅城市資料，以及語言、聲音等裝置設定，會留喺你裝置。

刪除帳戶亦會移除你收過同寄過嘅分享、你嘅共用清單成員記錄，以及你加入嘅清單項目。如果仲有其他成員，清單名稱、清單備註同佢哋嘅項目會保留畀佢哋用，清單擁有權會交畀其中一位成員。冇成員留下嘅清單會一併刪除。

資料控制

你可以喺「設定 → 刪除帳戶」刪除帳戶同我哋持有嘅你嘅資料。喺「Haruka 成長」，你可以修改或者唔再記住每條確認咗嘅偏好、改寫記憶筆記，亦可以熄咗「我嘅一頁」嘅傾偈參考或者帳戶同步。改寫筆記要你允許咗 AI 回覆，因為新字句會先交畀 AI 供應商檢查，App 會喺傳送之前問你；唔允許嘅話，可以電郵我哋更正筆記。日記入面嘅頁——你留低嘅片刻，同 Haruka 喺傾完偈之後寫嘅頁——同你嘅小小約定，喺 App 入面唔可以逐頁或者逐個刪除：刪除帳戶會全部刪走；想早啲刪走某一頁或者某個約定，可以電郵我哋。你同 Haruka 嘅對話亦會留喺呢部電話。喺「設定 → Haruka 嘅聲音」可以喺呢部電話刪除，但只會刪走電話上嘅副本；伺服器上嘅對話紀錄，要刪除帳戶或者電郵我哋先會刪走（見「語音回覆」）。如需查閱、匯出、更正資料，或者刪除個別內容，請電郵 haruka.admin@gmail.com。Haruka 唔會喺對話入面將你嘅完整記憶或者內部上下文倒晒出嚟——呢類要求經「設定」同支援處理，唔係喺對話問 Haruka。

請注意

刪除帳戶之後，為咗安全、防止欺詐、遵守法律、備份還原或者技術運作所需，部分有限記錄可能會保留一段時間。

請注意

如果你可能有危險，請聯絡當地緊急服務。Haruka 唔係危機支援服務。

年齡

Haruka 供 13 歲或以上人士使用。如果你未滿 18 歲，要得到父母或者監護人同意先可以用，亦請同佢哋一齊睇呢份聲明。呢個要求涵蓋城市工具、身心近況，以及（會員功能開放畀你之後）會員版面——喺嗰度你會見到其他會員，佢哋亦會見到你。

語言

呢份聲明會以你為 App 揀嘅語言顯示。如果各語言版本有出入，以英文版為準。

聯絡

私隱查詢或者資料要求，請聯絡：

haruka.admin@gmail.com

最後更新 · 2026年10月5日

English

Privacy

Effective 5 October 2026

Haruka processes what you choose to share so you can chat, keep memories and use daily tools. This page explains what stays on your device, what goes to our servers and service providers, and how to manage it.

What we store

Account information — the account identifier, name and email address your sign-in provider (Apple or Google) shares with us — the messages you send to Haruka, the entries you write in your journal, and the 身心近況 records you confirm — sleep, energy, mood, food, activity and body notes. We also keep the preferences you confirm, with the labels and suggestions of your growth path (see “Growing with you”), your Personality check-in results and, only if you turn on account sync, a copy of “A page about you”. If you use Sign in with Apple, we also keep a credential from Apple that lets us tell Apple to end that authorisation when you delete your account. We keep technical logs for short periods to keep the service running.

If you choose Google sign-in, Google’s sign-in components also process data under Google’s privacy policy. Google explains that the service may use an account identifier to record sign-in grants you authorise and an IP address to estimate the device’s general location for fraud prevention. The privacy declaration for the Google Sign-In SDK used by Haruka also lists phone numbers, device identifiers, usage data and other data, used, depending on the category, for authentication, security, service operation or analytics. This describes Google’s processing and may be linked to your Google account or device. Haruka does not request additional phone-number or address-book permissions or import a Google phone number into your Haruka account. The SDK declares that it does not use this data for cross-app advertising tracking. See Google’s privacy policy at https://policies.google.com/privacy and its sign-in data disclosure at https://developers.google.com/identity/sign-in/ios/app-privacy .

When member features are available and you set up a member profile, we also store your handle, your display name, the friend connections you make, and the posts, comments, and reactions you create.

We keep usage records to apply limits and maintain the service: which feature and AI service handled a request, how much text was processed, its duration and estimated cost, and the count and approximate size of attached photos. These usage records do not contain message text or photos. They are linked to your account and removed with it, subject to the limited retention described below.

If you send feedback or report a Haruka reply from inside the app, we store the category you chose, the note you write, your app release version, your device platform and app language, and — for a reply report — which conversation and reply it concerns, so we can look into it. The reply text itself is not copied into the report. These records are linked to your account and are deleted with it.

Why we store it

To generate replies, help continuity between sessions, keep the moments you save and the preferences you confirm, write Haruka’s letters from the moments and check-ins you allow, show you your own 身心近況 and Personality check-in results over time, bring “A page about you” to another device if you turn on sync, operate the room state, and support safety, reliability, and routine product operations.

AI processing

Our servers use Google’s Vertex AI to generate replies and other AI features. Photos, web-search replies and structured reading requests use Google only. A request can include recent conversation messages, relevant saved memories and a previous-chat recap, calendar details you shared, wellbeing records you chose for discussion, attached photos, public information looked up for the reply, the preferences you confirmed, a style note made from them, “A page about you” if you turn it on (see “Growing with you”), and your language, time and time zone. Eligible conversations may also be processed when they end to prepare memory notes. Chats kept to that chat only are left out of that memory process. That happens when you choose “Just this once” while bringing in 身心近況 records, and when you start a chat from a 最近的你 page, a letter from Haruka, a family update, a Shopping lists draft, a group of notes in “What I remember”, “A page about you”, a Personality check-in result, or a For you topic about a plan or a tiny promise. Ordinary chats have no switch for this. Member profile text, posts, comments, and shared or list text you submit may also be sent to these providers for a safety check before publication or saving.

If you have allowed AI replies, each message you send in chat — in the room, in Food, in Shopping lists, and when you ask Haruka about something you are reading — is also sent to the same AI provider, together with up to six recent messages, for an automatic safety check. The check looks for signs that you or someone else may be in danger, such as a medical emergency, self-harm or someone being hurt. If it finds one, Haruka usually shows a fixed message with emergency or hotline numbers instead of her usual reply; the AI does not write that message. The check can miss things or misread a message. A conversation where a safety message was shown is not used to prepare memory notes or for the room greeting. Our short-term technical logs record the result of this check, such as which kind of safety message was shown, never what you wrote.

What is sent depends on the feature. It is our servers, not your phone, that pass it to these providers, so they receive what is sent and our servers’ network details rather than your phone’s. Their processing follows our service arrangements and their own privacy terms. We do not promise that every provider keeps nothing.

After Haruka replies, your phone looks at the message you just sent for a plan, a place to eat or somewhere to go, so it can offer a card such as “Add to planner?”. Our servers may also send that message and Haruka’s reply to the same AI providers once more, only to find such a plan. This never happens for Search or thinking replies, crisis conversations, conversations that include health records, or messages with a photo or other details attached. Nothing is added until you tap. A suggestion is kept on our server for up to a day so it can reach your phone, and it is never used for advertising or shared with shops. You can turn these cards off in Settings.

Voice replies

When you request a new voice reply, our server sends that saved Haruka reply, with a short speaking-style instruction, to ElevenLabs, a third-party voice service that reads it aloud in Haruka’s voice. It does not receive your whole transcript for this request, and this playback feature does not record your microphone. A reply may itself contain information you discussed.

Manual playback is the default. If you choose automatic playback, only new replies in an open, foreground conversation can start it. You can stop playback or change the setting. New generation uses a monthly allowance of 3,000 characters on a free account, starting again each calendar month, Hong Kong time. Remaining usage is shown in voice settings. Other service limits can also pause new generation.

This phone keeps your conversations with Haruka — their text and any recordings already made — until you delete them or delete your account. There is no limit on how many; they use this phone’s storage, and Settings → Haruka’s voice shows how much and lets you delete older recordings while keeping the text. Signing out hides them until the same account signs in again on this phone. This copy on your phone is not part of Haruka’s memory. Replaying a recording you already have plays the saved file, without another ElevenLabs recording, and uses no more of your allowance. If a file is missing, or the phone was too full to keep it, you can choose to get the original recording back from our server; we never quietly make a new one. Deleting conversations or recordings here deletes them from this phone only — not your chat history or recordings on our server.

Original generated audio is stored privately on our server so it can be recovered. It has no automatic expiry. Account deletion removes this audio; limited anonymised accounting and abuse-prevention records can remain. ElevenLabs processes the submitted reply under its applicable service and privacy terms. Voice recordings are not a promise of a particular accent or pronunciation.

Memory

Haruka may remember small details you choose to share so conversations feel more personal. Memory keeps Haruka consistent for you — not as a public profile, and not something Haruka will read back to you as a full export inside chat. You can delete your data from Settings. When you come back to the room, Haruka may greet you by asking about something you talked about recently. She never does this for a conversation kept to that chat only, or one that included health details. In “Growing with you”, “What I remember” shows notes Haruka has kept from your chats. To show them in your language, they may be sent to the AI provider, and if you rewrite one, the old and new words are sent to be checked before the note changes. These translations are not saved on our servers.

Your 身心近況 records are not ordinary memory. Haruka uses them in a chat only when you bring them in yourself. One way is the 身心近況 panel: that hand-over covers only the records you chose and lasts 15 minutes. Another is to put a 最近的你 page that quotes one of your notes into your chat draft and tap Send: the note is then part of your message and stays in your chat history. The third is a letter from Haruka: when you choose “Talk about this in our room”, the letter’s check-ins come along only if you turn on “Include these check-ins in this conversation”, and they are then handed over like the panel’s, for 15 minutes. In each case the records go to the AI providers for that reply, and that conversation is never recalled as memory.

If you agree to a tiny promise in chat, its short title and note, how often it comes up and how Haruka checks in, its status and the chat it came from are stored in your account. Your active promises may go with your later chats to the AI provider, so Haruka can mention them lightly. You can see them under Tiny promises in your journal and mark each one Done, Later or Bring back; they are deleted with your account. Haruka does not start a promise in a conversation where the safety check found a crisis.

When member features are available, member content is never used as memory. Nothing you post on a member surface, and nothing your friends post there, becomes part of what Haruka remembers about you. Memory comes from your chats and your journal only.

Growing with you

In “Growing with you”, the preferences you confirm under “Our understanding” are kept on our servers with your account, in the exact words you approved. With each ordinary message you send in the room, up to eight of the newest go with your conversation to the AI provider so Haruka can keep them in mind. They are not sent with Search or thinking replies, chats kept to that chat only, or messages about health or a crisis, and preferences that appear to mention health or a crisis are left out. There is no separate switch for this: you can “Edit” or “Forget” each preference at any time. Editing replaces the old words and Forget removes them; what stays behind holds none of your words. Haruka may suggest a preference from her chat notes, but nothing is added unless you accept it; if you set a suggestion aside, we keep a record without its words so it is not suggested again. When a reply may have used one of your preferences, we keep a link to that reply (never a copy) so you can tell us in “Reply review” whether it helped; the link expires after 14 days.

On “A page about you”, you can write what Haruka should call you, your nickname for her, what has your attention lately, the little things that make you happy and how you would like her to be there for you, and choose a student photo and four personality preferences. The page is saved on this phone. It goes with your chats only after you turn on “Let Haruka use this page in chats”, which starts off. From then on, with each message you send in the room and in Food, your words, and your four-letter type once all four preferences are chosen, go through our servers to the AI provider; your photo choice never does. Nothing from the page is sent with Search or thinking replies, chats kept to that chat only, or messages about health or a crisis, and entries that appear to mention health or a crisis are left out. Our servers use it only for that reply and do not save it. You can turn the switch off at any time. Even with the switch off, you can choose to talk the page through with Haruka: the words go into a draft you check before sending, and that chat is kept to that chat only.

Account sync stays off until you choose “Sync with my account”. Then what Haruka calls you, your nickname for her, your three answers and your photo choice are kept on our servers as one current copy, so the page can come with you to another device. Your four-letter type and the chat switch are not synced, and a page brought in from your account arrives with the chat switch off. “Turn off sync” removes that copy from our servers straight away; what remains holds none of your words. Signing out hides the page on this phone until the same account signs in again; deleting your account removes it from this phone and from our servers.

When you save a “Personality check-in”, your answers are sent to our servers to work out the result. We keep the result, which is how your answers lean in each of the four directions and your four-letter type, with its date; we do not keep your answers, only a code made from them so a later request can be checked against them. If you choose “I already know my type”, we keep the type you enter. Results stay with your account until you delete it; to have them removed sooner, email haruka.admin@gmail.com. After you save, if you have allowed AI replies, the questions where you picked a clear side, the options you picked and your result are sent to the AI provider so Haruka can write a short reflection; our servers do not keep the reflection or your answers. This phone keeps a check-in you have not finished, with your answers so far, and up to sixteen reflections; signing out hides them and deleting your account removes them. Your latest result also fills the four preferences on “A page about you”, so it reaches your chats only if that page’s switch is on. Talking your type or a reflection through with Haruka works like the page: you check the draft first, and that chat is kept to that chat only.

The growth path in “Growing with you” is worked out on our servers from the preferences you have confirmed whenever it is needed; the path itself is not stored. Each confirmed preference gets a label for which of Haruka’s sides it leans to — caring, logical or playful — or none. With each ordinary message you send in the room, a short style note made from your path goes to the AI provider with your conversation: how well Haruka knows you, which side leads, and your four-letter type only if “Let Haruka use this page in chats” is on. The note never contains your words, and it is not added to Search or thinking replies, chats kept to that chat only, or messages about health or a crisis. If you have allowed AI replies, when an eligible conversation without sensitive topics ends, the same filtered conversation used for memory, plus up to five of your confirmed preferences that have no label yet, goes to the AI provider once more, to label those preferences and perhaps suggest one of a few fixed ways of talking. We keep only the labels, and a suggestion’s code, status and dates — no words from the conversation, and no judgement about your personality or mood. A suggestion counts only if you accept it; it lapses after 14 days, is never shown to anyone else, and you can choose “No thanks”. You can also pick a fixed sentence under “Nudge her”; once you confirm it, it is saved like any other preference. There is no separate switch: forget a preference and it stops counting. The labels and suggestions are deleted with your account.

Photos

When you send or take a photo, it is sent together with your message to the third-party AI infrastructure providers so Haruka can answer. We don't keep the photo itself, only a note of how many photos were attached to that message. What you wrote with the photo and what Haruka said about it are saved with the conversation like any other message, and Haruka may remember them, so she still knows what you showed her. To have them removed, email haruka.admin@gmail.com, or delete your account in Settings → Delete Account, which removes them with the rest of your data. If you take a photo inside the app, or tap Save image on a Daily Luck card, Haruka adds a copy to your device photo library when you allow it to add photos, so you can keep it on your device. For this, Haruka asks only to add photos, not to see your library.

In the meal diary, taking or choosing a meal or nutrition-label photo is optional. After you agree to AI processing, the selected image is resized and sent through our servers to Google Vertex AI for recognition or a rough nutrition estimate. The request does not include past Health records, your diet targets or a product barcode. Haruka does not save that photo as a server record or in your photo library; temporary processing files and the preview are cleared. Provider processing follows the AI terms described above. Only the meal name, portion, source and figures you confirm are saved in an account-separated ledger on this phone; you can edit or delete them. Signing out hides them and deleting the account clears them. Confirmed meal summaries may appear in Recent You on this phone. Sending a selected summary into chat is a separate action; no meal photo is attached automatically.

Search

When Search is on, Haruka may look things up on the web and show sources you can open to check. To do this, the text of your question — and, for a follow-up, up to two of your recent Search questions in the same chat — is sent to Google, which looks it up with Google Search through its Vertex AI service. Your memories, journal and other chat messages are not added to that search. If you include a photo, it goes to Google’s Vertex AI with your question so Haruka can understand it; the web search itself uses text only.

Calendar & Planner

If you connect your device calendar, Haruka reads its events only to show them next to your plans in the Planner and on your morning ritual card; they stay on your device and are never sent to our servers or used in chat. Events you create in the Planner are saved to your account so they sync with your plans. Only the ones you choose to share with Haruka are used in chat; they can also appear in 最近的你 and in For you in Topics on this phone, and if 最近的你 is on, our server counts them, without reading them, when it decides whether to write. Planner reminders and traffic notices for the routes you save are notifications made on your device, not sent from our servers. A planner reminder shows the plan’s title, never its place or note, and it can appear on your lock screen. We do not sell this information or use it for advertising.

Calendar sharing is separate from your device calendar. You choose a friend and send an invitation to a particular plan or a two-person calendar; the other person must accept. A pending, unexpired invitation can show the plan title before acceptance. Shared titles, dates, recurrence, places and notes are saved on our servers and shown only to people with current access. A person with editing permission can change the shared plan. Your private reminders, device-calendar events and AI preferences are not copied to anyone else. Once a plan enters sharing, it is excluded from Haruka chat and memory even if sharing later ends. Removing a friend or blocking them revokes existing shared access; adding them again does not restore it. When a couple calendar closes, each person keeps access to their own plans, not the other person’s. We retain account-linked invitation/access records and content-free operation receipts to enforce permissions and reconcile retries. Account deletion removes or revokes the account’s shared records and access; another person’s independently owned plans are not deleted.

If you turn on the morning ritual, your phone schedules one notification a morning for up to the next seven days. Its words never include your plans, the weather or your name. When you open it, your phone puts the card together: the Hong Kong Observatory forecast (the request names no one), your plans for today and whether you have drawn today’s fortune. The reminders stop on their own if you don’t open Haruka for seven days, and signing out cancels them. Your chosen time and days stay on this phone.

Notifications

Besides the reminders made on your phone, Haruka can send notifications from our servers: “Ideas for using Haruka”, “What’s new with Haruka”, “Letters from Haruka” and “Price drops you’re watching”. You get them only after you turn them on — in Settings → Little hellos, or on the letters or price alert screens — and your iPhone allows them. You choose which kinds, the quiet hours, the time zone and the language. Choosing who gets the first two kinds never involves your chats, memories or health data; a letter notice is sent only when your letter has been written, and a price alert only when something you watch has got cheaper.

Your choices — which kinds, quiet hours, time zone and language — are saved on our server when you save them or switch on letter or price-drop notices, even before you turn notifications on, and are re-saved unchanged by the weekly check described below. Opening Little hellos, Shopping lists or the Sunday letters settings in your mailbox, or opening the app while your iPhone allows Haruka’s notifications, also creates a settings record for your account with nothing turned on, if there is none yet. When you turn notifications on, the push address Apple gives this phone is sent to our server, together with a random identifier for this installation, the app version and whether your iPhone allows notifications. It is also sent when you open the app signed in, if your iPhone already allows Haruka’s notifications and your account has at least one kind turned on — for example after you sign in again, or after you allow notifications in your iPhone’s Settings — unless you tapped “Turn off on this phone” here. To deliver one, our server passes that address, the notification’s words, the screen it opens and your account identifier to Apple’s push notification service (APNs), which delivers it to your phone. We keep a record of each notification sent to you, such as when it was sent and whether Apple accepted it. You can turn them off in Settings → Little hellos (“Turn off on this phone”) or in your iPhone’s Settings. Signing out stops them on this phone until you sign in again here, and deleting your account removes the push address, your choices and these records from our server.

While notifications are on for this phone, about once a week when you open the app — and only while this phone is still in the time zone saved with your choices — it re-sends your saved choices unchanged, which updates when they were last saved. In any time zone, and only if your iPhone still allows notifications, it also re-sends this phone’s push address, installation identifier, app version and permission, so our server knows the phone is still in use. This never asks for permission and never sends anything new. Opening the app signed in can also switch this phone back on by itself for the kinds your account already has turned on, as described above, still without asking. Our server stops sending to this phone if its push address or your choices have gone 30 days without being refreshed or saved, so notifications stop within 30 days if your iPhone no longer allows them, or if this phone has moved to another time zone and you have not saved your choices again. This phone also keeps a small encrypted record, next to the installation identifier, of which account turned notifications on here and when they were last refreshed. That part is removed when you tap “Turn off on this phone” in Settings → Little hellos, or sign out, once our server has received that change. Turning notifications off in your iPhone’s Settings does not remove it. When you tap “Turn off on this phone”, the record also keeps a note that this account turned notifications off here, so they are not switched back on by themselves; the note is removed when that account turns them on here again.

Location & city tools

With your permission, Haruka uses your location while you are using the app to show the stops around you, plan a route, find places to eat nearby, and light up the ground you have walked. Your position is compared with bus stops and 100-metre map cells on your device. These routine nearby lookups do not upload or save your precise position. The walking-route, saved parking and voluntary report features are described below.

After you start following a ride (Follow this ride) or tap Start exploring in Footprints, Haruka can keep using location in the background to follow that trip or record Footprints. Opening Footprints alone does not start recording. Each ride can remind you before its transfer or alighting stop and when you arrive. Background use requires the relevant iOS location permission. You can stop from City Tools or the ongoing-trip card; leaving the page does not stop an active trip. Trips also stop when completed, too old or away from the route for too long. Signing out or deleting your account stops both activities.

When you plan a walking route, Haruka first draws it from the pedestrian network stored on your device. If that network cannot connect the two points, the start and end of that walk — including your current position, when that is the start — are sent to the Hong Kong Lands Department route service so the path can be drawn. When you search for a place in Getting there in City Tools, the words you type are sent to the Hong Kong Lands Department location search service. Live arrival times, weather, road speeds, traffic notices, car-park and event information are requested from the transport operators’ and the Hong Kong Government’s public open-data services; a request names the route, stop or area you are looking at, not you. Maps are drawn by Apple Maps, which receives the map area on screen. Haruka does not store any of these requests.

Your footprint trail, the places you mark as want / visited / favourite, the private notes and tags you attach to places, the routes and events you save, your walking settings, and your recent searches in Getting there stay on your device, kept separately for each account that signs in on it. They are not synced to your account. Signing out hides them until that account signs in again on this phone; deleting your account erases them. While you follow a bus trip, the route’s stops and the stop you get off at are kept on your device so each leg’s alerts can fire, and are removed when the trip ends or when you sign out. Favourites saved before this update are not attached to any account: they stay on the phone, hidden, until you add them to your account or delete them in Settings.

When you ask 問 Haruka a question in the transit tool that your phone cannot work out on its own, the words you typed — and nothing else, not your location — are sent to Haruka’s servers and passed to the third-party AI infrastructure providers only to work out what you are asking; the answer is then put together on your device. When you ask Haruka in chat about the weather, a place, what is nearby, events, parking, or when a bus, minibus or train is coming, Haruka may look the answer up from the same public open-data services. For a place or journey question the place name — or, when Haruka cannot pick one out, the text of that message — is sent to the Hong Kong Government address lookup service; for a transport question only the route, stop or station is sent. These services see the query, not your account, and what they return is used only for that reply.

In Driving, your saved parked-car coordinates and note stay on this phone, separately for your account. Signing out hides them; deleting your account erases them. Choosing Nearby reports sends an approximate area to our server. Publishing sends only the category and approximate location you confirm, rounded to about a 100-metre grid, for other signed-in drivers to see. Your name, private car location and note are not published. Reports stop appearing after two hours; you can delete yours earlier. Expired public reports are removed when the service next handles a request. A report that is flagged leaves a separate moderation record with its category, a coarser area, time and reason; these records are eligible for cleanup after 30 days. To handle retries and limit misuse, we keep operation identifiers and a comparison code derived from the chosen category and rounded location, linked to your account; these become eligible for cleanup after 24 hours. Blocks remain until you unblock the person or delete your account. Account deletion also removes your report, flag and block records. Opening directions sends the destination to your chosen maps app. Only enforcement reports you submit by pressing Publish publicly after the updated publication notice is shown also create a separate minimal record for daily observation counts over the current and previous six Hong Kong dates. This includes the report identifier, account-linked author identifier, the same approximate location, observation time, expiry time and hidden status, without text, photos or licence plates. These inputs are used for up to seven days and excluded immediately at expiry. They are removed by the next periodic cleanup, normally scheduled about every ten minutes, or a later service request; physical deletion at the exact expiry instant is not guaranteed. Deleting your own report or account also deletes its corresponding input, even after the individual report has stopped appearing publicly. Blocks, hidden flags and account suspension affect which observations a reader can count. Other signed-in users receive only daily counts, latest observation time, collection start, window, update time and completeness, not retained individual records, identifiers or coordinates. Reports from older versions without this updated notice do not enter seven-day history, and earlier reports are not backfilled. These are counts of user observations, not enforcement probabilities, risk scores or guarantees of safe parking.

When you ask Haruka in Food, the service receives up to five recent messages including your current question, up to sixteen public restaurant descriptions and their identifiers, your chosen language and the date of that data. If you have turned on “Let Haruka use this page in chats”, what you wrote on “A page about you” and your four-letter type are sent with each Food message too (see “Growing with you”); MBTI is not treated as dietary or health evidence. Exact coordinates, private favourites and private notes are not sent to this chat service. When meaning-based restaurant search is available, your latest question is also sent to Google to find related restaurant records; this separate search does not include your profile or earlier messages. Our server does not save the Food conversation or search representation as chat history or memory, but records account-linked usage and rate-limit information. If you ask for places near you, the app reads your current location on your phone only to pick nearby restaurants; your location itself is not sent, but the restaurants picked, with their districts and streets, show roughly where you are. Apart from that, only after you confirm a restaurant can the separate directions feature request your current location.

When you ask Haruka in Explore, your current question, up to eight earlier messages from that local session, language and chosen tool context go through our servers to Google Vertex AI. Bounded public restaurant or event candidates and their data dates may accompany them. Our server may look up public shopping catalogue facts and official Hong Kong Observatory forecasts or warnings. It may also send a limited set of public Transport Department carpark names, addresses, districts, dated height and hourly-rate facts, and fresh published vacancy status, counts and times to AI. Carpark coordinates are excluded; this feature does not send your GPS. For Driving, it may read reports visible to your signed-in account under the existing access and block rules, but only category counts and the latest report time from that Hong Kong-wide page go to AI—not report identifiers, authors or coordinates. Raw GPS, room-chat memory, private notes, profile text and Health attachments are not part of this feature’s request. We do not save the conversation as server chat history or memory; we keep account-linked usage and rate-limit metadata. Asking does not publish a report, save a plan, place an order or start navigation. Those actions require separate confirmation.

When you ask friends where to eat, a numbered message goes out through the app you choose, and any replies you count stay on your phone.

After you visit a place you picked in Haruka — a restaurant from Food, or a place you followed a ride to — Haruka may ask how it went. If you choose to save your answer, the place’s name, what you wrote and the date go into your journal; your location, stops and arrival times do not. The visits it may ask about are kept on your phone only, and you can turn these questions off in Settings.

City data on your device

Some city data — stops, routes, places and map layers — is downloaded from Haruka’s servers to your device when you need it. These downloads describe the city, not you. You can delete them from Settings and download them again later.

Daily Luck & shopping lists

Daily Luck keeps your dated fortune and tarot draws, shuffled card order and card choice, saved readings and private notes, whether a reading resonated with you (if you choose to answer), chosen zodiac sign, and sound, haptic and motion preferences on this device. Choosing a zodiac sign does not ask for your birth date. Removing a saved reading clears its saved marker and private note; the original daily draw remains. If you choose to talk about a reading, only the selected question is placed in your conversation draft. It is sent only when you tap Send; your private reading notes and profile are not attached.

My shopping lists keeps the item names, sizes, pack details and quantities you confirm in This trip, Usual buys and Wish list, plus any target price and purchase date you set for a wish. These are your own notes, not purchase or payment records. Removing an item changes the visible list; earlier item details can remain in local edit records used to prevent duplicate saves until the account’s local data is cleared.

Nutrition facts on a product page come from public data built into the app — typical values for that kind of food (Food Standards Australia New Zealand; USDA FoodData Central) and, for some products, that product's own public record (Open Food Facts; USDA FoodData Central) — so showing them sends nothing. Allergen details come only from a product's Open Food Facts record. Haruka looks up Open Food Facts online only when a product page has a barcode on record, or when you choose online product lookup; only that barcode, or the product name you submit, is sent. The facts are kept on this device for 7 days. Scanning reads the barcode on your device without saving or uploading a camera image. Product photos are downloaded only when you enable them; you can remove the downloaded photos separately. The public data and image services receive normal network details such as your IP address. Your account identifier, shopping lists, diet choices, private notes and recorded prices are not included in these requests.

If you choose Photograph nutrition label, the photo is sent once through our servers to Google’s Vertex AI to read the numbers printed on the label. Only the photo is sent — not which product it is, its barcode, your lists or your diet choices. The photo is not saved to your photo library, and Haruka does not keep it. Google processes it for us under its Cloud terms and does not use it to train its AI models; under those terms Google may hold it briefly, for example in a cache for up to 24 hours, or longer if its systems flag possible abuse. The numbers you confirm are saved only on this phone with that product until you delete them or your account; they are not synced to our servers or shared with your household. Our server keeps only a count of your label reads, to apply daily and monthly limits, and the usage records described above; neither contains the photo, the numbers or the product.

Prices you record include the shop, amount, pack size and date, so you can compare your own observations. They stay with your account’s local shopping data on this device. They are not live merchant prices or confirmed stock, and Haruka does not make a purchase for you.

These local records are kept separately for each account on this device. They are not synced to Haruka’s servers or sent to merchants, except as described below for Home lists and price alerts. Signing out hides them until the same account signs in again on this device. Confirmed account deletion also runs cleanup of that account’s local records on this device. These shopping lists are separate from the shared lists described under Member surfaces.

Supermarket price lists, price history and the wider retail catalogue are public product information from the Consumer Council and the named retail sources. Your phone may download public datasets or ask our server for product facts. A retail-catalogue request sends your search words, category, chosen source and page cursor under your signed-in session; it does not send your private lists, notes or Health records to shops. A limited public catalogue cache stays on this phone. Product pictures can be requested from their credited source, which receives normal network details such as your IP address. If you choose to discuss a product or list with Haruka, only the lines you keep enter the chat draft and are sent when you tap Send; that discussion does not enter long-term memory.

A store link opens that shop’s own website in Safari, searching for the product name — or, for some shops, their home page. From there the shop’s site handles your visit under its own terms. Haruka adds nothing about you to the link — no account, list or tracking code — and never signs in, fills a cart or buys anything for you. If you share a list, only the item names and quantities go out, through your device’s share sheet.

Monthly spending adds up the items you tick as bought, at Consumer Council prices unless you change them. Price-drop cards compare each day’s Consumer Council prices with the last prices this phone saw. A reminder you set for a wish item is a notification made on your phone, and it shows the item name you typed. All of this stays on this phone.

If you turn on price alerts, the Consumer Council codes of up to 30 items you watch, and any target prices you set, are sent to our server so it can check them against each day’s prices and send you a notification that does not name the product. We keep only a daily count of matches, for 14 days. Turning price alerts off deletes your watch list from our server straight away, and deleting your account removes it too. It is never used for marketing or shared with shops.

When you ask Haruka about a dish or a product in Shopping lists, everyday dishes are answered on your phone. For anything else, your question goes through our servers to the AI providers described above, with the product’s public facts, the diet choices you keep attached, and — only if you switch it on for that question and tick at least one figure — a short summary of up to four rounded seven-day Apple Health figures (see “身心近況”). You see all of it before you send. Answers are not saved on our server or added to memory. An answer that uses your Health summary shows no products, brands, prices or store links, and your readings are never used to rank products, for marketing or by shops. Your diet choices stay on this phone until you send them with a question.

When you chat with Haruka about what to buy in Shopping lists, your question, up to five earlier messages from that chat, the product codes shown in it and the product you started from go through our servers to the AI providers described above. Our server adds the relevant public product facts (Consumer Council names and categories, and public nutrition and allergen records); product facts are not sent from your phone. The diet choices you keep attached, and — only if you switch it on for that question and tick at least one figure — the short Apple Health summary described under “身心近況”, are sent with that question, and you see them before you send. An answer that uses your Health summary shows no products, brands, prices or stores. The conversation stays on this phone (up to thirty messages; a message sent with a Health summary is not kept) and you can clear it any time; signing out hides it and deleting your account removes it. Our server does not save the conversation or add it to memory; it records account-linked usage and rate-limit information, including whether a Health summary was attached (yes or no only, never the figures). Answers are general information, not medical advice.

Home lists are shared with family members you are connected with in Family updates. Our server stores each list’s title, the name each person chose for the list, and each item with its quantity and note, who added it, who bought it and when; everyone on the list can see them. Before words are saved, our server checks them for threats, sexual content, insults and self-harm. If you report an item, we keep the report and a copy of the reported words so a person can review it. When you leave a list or are removed, the items you added stay for the others; deleting your account removes the items you added and your place on every list. If you ticked off an item someone else added, it stays ticked for the others after you delete your account, with the time but without your name. Home lists are never used as memory or in chats with Haruka.

Only when you tap Share on a Daily Luck result does Haruka make a picture of it, on your phone: the card, its title, a short line from the reading, the date and a code that opens Haruka’s page on the App Store. Your private note, your account and anything else about you are never on it. You choose where it goes in your device’s share sheet, or save it to Photos, which asks only for permission to add photos. Share as text sends the result text and date instead. The picture is kept in the app’s temporary storage for up to a day. If you send it through another app, that app handles the copy; deleting your Haruka account does not recall it.

身心近況

身心近況 is off until you turn it on. When you do, the sleep, energy, mood, food, activity and body notes you confirm are stored in your account so you can see how you have been over time. Haruka records only what you confirm, and you can correct any record, mark it as not yours, or delete it. Deleting a single record hides it from your charts, your export and Haruka, but the entry stays in your account until you erase all 身心近況 data from the panel or delete your account. Besides keeping your records and using them when you bring them into a chat, 身心近況 has a separate, optional use: “Use for letters”, which lets Haruka’s letters draw on your check-ins (see “Letters from Haruka”). It is off until you turn it on in Manage data.

Your 身心近況 records are kept in your account until you erase them or delete your account. You can pause recording, or erase every record, from the 身心近況 panel at any time, and you can preview an export of your records there. When you hand records over to a chat, those records are sent with your messages to the third-party AI infrastructure providers for that conversation. Turning “Use for letters” off does not pause recording or erase any record, but it removes the letters you have (see “Letters from Haruka”). Deleting your account removes them all.

Apple Health is optional and read-only. If you connect it from 身心近況, you choose whether Haruka can read the last 30 days of steps, sleep, resting heart rate, heart rate variability, mindful minutes and workout records. These readings are held in memory on your device and are not shared automatically. In 最近的你, you can add your sleep and steps to a chat draft, review it and send it yourself; your other readings never go into that draft. Readings you send are shared with our servers and AI providers and stay in your chat history as a health message for that chat only: they never become 身心近況 records or memories, and are never used for a recap, a room greeting or a plan suggestion. Signing out or stopping sync clears the local readings, but does not delete messages you already sent. Only your connection preference is saved on this device for your account. You can stop syncing in Manage data and change read access in Apple Health. Haruka never changes your Apple Health records. In Shopping lists, you can also attach a short summary to one question: you tick which of up to four rounded seven-day figures to include — average daily steps, average nightly sleep, average resting heart rate and number of workouts — and nothing is attached until you tick one. What is sent is exactly the preview you see, at most 300 characters; it switches off again after that question, and it is not stored on our server or used as memory.

Family updates

Family updates are optional. You choose the name shown on an invitation, share its code yourself, and accept the specific person who requests to send you updates. Names are self-chosen, not verified identities; compare the connection code with your intended family member before accepting. Our servers store both participants’ account identifiers, these names, the sharing permission and text cards with their author, type and timestamps. Plans remain the author’s unconfirmed plans. Family members and people who pay for you do not gain access to your Haruka conversations, profile or Apple Health. Cards are not automatically added to AI conversations or long-term memory. If you choose “Talk this through with Haruka” on an update, only the part you keep goes into your chat draft, and it is sent only when you tap Send. It then goes through our servers to the AI provider like your other chat messages and stays in your chat history, but it is kept to that chat and is never added to long-term memory. The person who wrote it is not told.

Either participant can remove a card or end the connection; only its author can correct a card. Ending the connection removes its cards and shared names from the service, and reconnecting requires a new invitation and acceptance. A short record of each invitation or connection that ended, was declined or expired stays until account deletion. We also keep a record of each change — basic details and a code that cannot be turned back into the text, never the card itself — and clear these records after 30 days, the next time that account uses Haruka. Deleting either participant’s account removes their shared cards, connections and these records. Removal cannot erase copies or screenshots already kept by the other person. Invitation codes and card text stay on your phone only while they are on screen; they are cleared when you leave the app or switch account, and your current access is checked again when you come back.

Before an update or a name is saved, our server checks the words for threats, sexual content, insults and self-harm; words it stops are not saved. If you report an update you received, we keep the report — who made it, who wrote the update, which connection and update it was, the reason you chose, a copy of the reported words and what we decided — so a person can review it. The report, including its copy of the words, stays even after the update is removed, the connection ends or one of you blocks the other, until either person deletes their account. The writer is not told. If you block someone, we keep a record of the block so the two of you cannot connect again in Family updates. It is the same record member features use, so once they are available to you the block applies there too, and you can undo it in Settings. Reports and blocks are deleted when either person deletes their account.

Who can see it

Your chats with Haruka, your journal, and your 身心近況 records are private to you and to the systems needed to run Haruka. We do not sell what you share. Limited staff access is possible only for safety and routine operations.

Member surfaces work differently, because being seen is the point of them. When member features are available, what you post there is visible to your friends. The section below says exactly what that covers.

Some things you add are seen by other people even without member features: items on a Home list by everyone on that list, and comments on products by everyone who uses Haruka, with the name you chose. Before a comment is published our servers check it, including the AI safety check described above. You can report or block from each of these places, and we keep reports and blocks so a person can act on them. You can delete your own comments, and deleting your account removes them. None of this becomes Haruka’s memory.

Member surfaces

Member features are rolling out gradually. This section applies to you only once member features are available in your app.

A member profile is optional. If you set one up, you choose a handle and a display name, and you can send and accept friend requests, write short posts, comment, and react.

Content you post is visible to your friends. Your handle, display name, and profile picture are visible to the members you connect with. Being findable by handle search is off until you turn it on, and you can turn it off again. Member profiles use a picture from the set that comes with the app — there is no photo upload. Your membership plan is shown only on your own profile: other members never see it, and you never see theirs.

When you report a post, a comment, or a member, we store the report so a person can act on it and so we can see repeat patterns. The person you report is not told who reported them. When you block someone, we store that too. The person you block is not told.

You can delete your own posts and comments at any time. Deleting your account removes your member profile, your connections, and everything you posted.

When sharing and shared lists are available, we also store the captions and notes you send to friends, the recipient and read status, and the list titles, notes, items and membership needed to collaborate. A shared item is shown to its recipient; a shared list and its edits are shown to its members. These records are separate from Haruka’s memory.

Topics

Shared Topics are optional and off by default. If you turn them on, the text of your recent chat messages — up to a few hundred at a time, including messages you sent before you turned it on — is sent to the third-party AI infrastructure providers to tag the themes they touch, so Haruka can suggest shared Topics for the community. Your messages and your exact words are never shown to other users. What others see is only a theme title and opening line our team wrote in advance, from a fixed list of everyday subjects, never your words. A theme appears only after privacy filtering and once at least two different people’s chats have touched it. You can turn this off anytime; from then on your messages are no longer read for Topics.

This promise is about your private chats and your journal. When member features are available, what you write on a member surface is something you chose to share, and your friends can read it — see Member surfaces above.

Topics also has a For you shelf that your phone picks from notes Haruka keeps from your chats, moments you keep in your journal, plans you shared with Haruka and tiny promises you completed. Apart from showing Haruka’s notes in your language (see Memory), nothing is sent to pick them. If you choose one, its words go into a chat draft that is sent only when you tap Send, and the topics you open or set aside are remembered only on this phone.

最近的你 (your recent shape)

最近的你 is off until you turn it on, from the journal or from Settings. When it is on, about once a week Haruka looks at up to forty of your recent messages to her, leaving out messages about health and ones the safety check flagged, and sends short excerpts of at most 24 of them (each cut to 200 characters), with the titles of up to three journal pages Haruka wrote after your recent chats (never the moments you write yourself, and never the pages’ full text), to the same third-party AI infrastructure providers to write a short, gentle outline of your recent days. It stores that outline in your account so you can open it again. To decide whether a week has enough to write about, it also counts how many plans you shared with Haruka, how many tiny promises changed and how often you used Search, without reading what they say; only those numbers are kept with the outline, and they are never sent to the AI providers. The outline is never a score, never draws on your 身心近況 records, and is not used as memory. Turning it off stops new outlines and hides existing ones; the outlines are deleted with your account.

Below the outline, this phone also puts together short pages for a day or a week, from moments you kept, your confirmed 身心近況 notes (while 身心近況 is on), plans you shared with Haruka, tiny promises you marked done and, if connected, Apple Health sleep and steps. These pages are built on your phone without AI and are not saved. Nothing from them is sent unless you choose to talk about one: it then goes into your chat draft, Apple Health readings are added only if you tick them, and it is sent only when you tap Send. That chat is kept to that chat only.

Letters from Haruka

Letters are off until you open your mailbox, and a letter is prepared only if you have allowed AI replies, even when it ends up written without AI. Haruka writes a letter from moments you saved together with 身心近況 check-ins you confirmed — never from Apple Health readings — so letters come only while “Keep and organise” and “Use for letters” are both on in 身心近況 → Manage data. “Use for letters” is off by default and turns on only when you tap it there, or tap “Yes, use for letters” on the letters page; opening your mailbox or turning on Sunday letters never turns it on. While it is on, the words of your confirmed check-ins and saved moments, with their dates, may be sent to the AI providers described above to write a letter. If AI writing is off or our monthly AI budget is nearly used up, nothing is sent to an AI provider and the letter is put together from your own words without AI. If the AI fails, takes too long or writes something we can’t use, the letter is put together from your own words in the same way. Letters are stored in your account for up to 90 days. Turning letters off removes them, and deleting your account removes them all.

If you turn on Sunday letters, our server checks once a week, between Saturday evening and Sunday morning Hong Kong time, without you opening the app. It looks for enough new moments and writes at most one letter a week. If you also turn on letter notifications, the notification comes on Sunday morning your time and never shows what the letter says. Stopping Sunday letters does not remove letters you already have. Each letter stays in your mailbox for 90 days; after that it can no longer be opened, and its words are erased from our servers the next time your mailbox is used, or when you delete your account. Removing a letter erases its words and its links to your moments. We keep only a short record, without any content, that a letter existed for that week (its dates) until you delete your account, so the same letter is not written again. A letter is also removed if a moment or check-in it used is changed or deleted, or if the chat that moment came from is deleted. If you turn off “Use for letters”, pause recording or erase your 身心近況 data, no new letters are written; as soon as our server receives that change, the words of every letter you have are erased and weekly and Sunday letters are switched off. Turning it back on brings back neither. None of this deletes your original moments or check-ins, except that erasing your 身心近況 data also erases your check-ins.

Letters for later

When you write to your future self in Letters for later, the letter’s title and words, the opening day you choose and any unfinished draft are stored in your account. No AI reads them and they are not used for memory. The app shows a sealed letter’s words only from its opening day. If you choose to talk about an opened letter, it goes into your chat draft and is sent only when you tap Send; from then on it is an ordinary chat message. Deleting a letter removes it, with its title, words and opening day, from our servers straight away, and it can’t be recovered. A letter you delete in an earlier version of Haruka is removed from our servers within 30 days of being deleted. Deleting your account removes all of them.

Analytics

Haruka uses PostHog to understand how the app is used and whether it is working reliably. Analytics records how you use the product — when the app opens or goes to the background, which screens and features you open, how long your room took to load, how far you got in the first-time guide, whether you opened a notification, and simple facts about each action such as the chat mode used, whether a photo was attached, which sign-in provider you used and whether sign-in worked, your AI sharing choices, the reply language you chose, what kind of thing you shared (never what it said), how long a reply or a tool took to appear, whether a search found nothing (never what you searched for) and whether you allowed notifications — together with your account identifier, a random identifier for this installation, your app version, device type, iOS version, language and screen size. When something in the app goes wrong, it also sends an error report: the kind of error, a short error message with email addresses, links, numbers and quoted text removed, and where in Haruka’s code it happened. Error reports never include your conversations or anything you write. PostHog also receives your IP address as part of normal request handling; we ask it not to derive a location from it, and it stores this data in the United States. It does not record what you write, your 身心近況 records, your Apple Health readings or your location. You can turn analytics off at any time in Settings. Once it is off, Haruka stops sending analytics and error reports from this device straight away, and the choice stays on this device after you sign out. When you delete your account, Haruka stops recording analytics under your account identifier, but the events already recorded are not deleted: they stay with PostHog, linked to your former account identifier, until PostHog’s own retention period ends. We do not control how third-party systems retain their own logs.

Deletion

You can request deletion of your Haruka account and app data from inside the app: open Settings and choose “Delete Account”. When you confirm, your account is signed out and the data we hold about you in our active database is removed. If you signed in with Apple, we also ask Apple to end the Sign in with Apple authorisation for Haruka.

That includes your 身心近況 records, your AI request records and feedback, your 最近的你 outlines, your letters from Haruka and your Letters for later, your tiny promises, your confirmed preferences and your growth path’s labels and suggestions, your Personality check-in results, the synced copy of “A page about you”, the items you added to Home lists and your place on them, your comments on products, your price-alert watch list, and, when member features are available, your member profile, your friend connections, and the posts, comments, and reactions you created. They are removed, not left behind under a blank name. Data kept on your device — your footprints, place marks and notes, saved routes and events, recent searches in Getting there, City Tools settings, “A page about you”, an unfinished Personality check-in and your check-in reflections — is erased at the same time, any bus trip or Explore session still running is stopped, and reminders scheduled on this phone, such as the morning ritual, are cancelled. Photos saved to your photo library, downloaded city data, and device settings such as language and sound stay on your device.

Deleting your account also removes shares you sent or received, your shared-list membership and the list items you added. If other members remain, the shared list’s title and note and their items stay available to them, and ownership passes to a remaining member. A list with nobody left is deleted.

Data controls

You can delete your account and the data we hold about you from Settings → Delete Account. In “Growing with you”, you can edit or forget each preference you confirmed, rewrite a memory note, and turn off chat use or account sync for “A page about you”. Rewriting a note needs AI replies to be allowed, because the new words are checked by the AI provider first, and the app asks you before sending them; otherwise you can email us to correct a note. Pages in your journal — the moments you keep and the pages Haruka writes after a chat — and your tiny promises can’t be deleted one at a time in the app: deleting your account removes them all, and you can email us to have a particular page or promise removed sooner. Your conversations with Haruka are also kept on this phone. Settings → Haruka’s voice lets you delete them there, which removes only the phone copy; your chat history on our servers is removed when you delete your account or ask us by email (see Voice replies). For access, export, correction or deletion of specific items, email haruka.admin@gmail.com. Haruka will not dump your full memory or internal context inside chat — these requests are handled through Settings and support, not by asking Haruka in conversation.

Please note

When you delete your account, some limited records may remain for a period where needed for security, fraud prevention, legal compliance, backup recovery, or technical operations.

Please note

If you may be in danger, please contact your local emergency services. Haruka is not a crisis service.

Age

Haruka is for people aged 13 or older. If you are under 18, you need a parent’s or guardian’s permission to use it — please read this statement together with them. This covers the city tools, 身心近況, and, once member features are available to you, the member surfaces, where you can see other members and they can see you.

Language

This statement is shown in the language you chose for the app. If the versions ever differ, the English version governs.

Contact

For privacy questions or data requests:

haruka.admin@gmail.com

Last updated · 5 October 2026