安心出發隱私權政策
生效日期：2026 年 9 月 16 日
「安心出發」（Set Out）是離線 GPS 軌跡記錄、離線地圖與戶外行程規劃工具。我們的原則是裝置優先、最少資料與明確選擇：沒有帳號、沒有廣告、沒有分析追蹤 SDK。
本政策同時適用於 iOS 版（com.chaohuang.setout）與 Android 版（相容性套件名稱 com.chaohuang.myhmap）。兩個版本的資料處理原則相同；目前Android 版的權限與儲存差異列於第 8 節。
1. 儲存在裝置上的資料
軌跡點、行程統計、沿途照片、GPX 路線、離線地圖、行程規劃與 App 偏好設定會儲存在 App 的私人裝置空間。完整軌跡與照片不會自動上傳，也不會寫入你的照片圖庫。你可在 App 中刪除資料；解除安裝會移除 App 私人空間內的資料。
iOS 版會將匿名安裝識別碼、公開路線刪除 token 與有效分享憑證保存在 Keychain，可能在解除安裝與重新安裝後繼續存在，只用於限額、防止濫用、刪除使用者公開的內容及管理使用者主動建立的分享。
2. 網路服務
- 地圖顯示與離線下載會向圖磚服務請求所需範圍；
- 地點搜尋會將你輸入的搜尋文字送至地理編碼服務；Android 版的反向查詢會送出查詢座標；
- 查詢天氣或記錄沿途天氣時，會將目前座標送至天氣服務，再由該服務向 Open-Meteo 查詢預報；
- 從網址匯入 GPX 時，App 會連線至你指定的 HTTPS 網址。
為降低外部服務負載並在暫時斷線時提供備援，天氣服務會將查詢座標與預報結果暫存在伺服器，最長約 6 小時後移除，不會用這些座標建立帳號、廣告檔案或長期位置歷史。
這些服務可能處理標準連線資訊，例如 IP 位址、請求時間與 User-Agent；我們不用於廣告、分析或跨服務追蹤。
3. 即時位置分享
此功能預設關閉。只有在你正在記錄時，主動按下「分享即時位置」並確認公開提示，App 才會將你輸入的分享名稱，以及最新一筆座標、定位精度、方向、速度與時間傳送至我們的分享服務。名稱與最新位置會公開列在 App 內的公開名單，供所有 App 使用者查看。App 另會建立一條分享連結；這是分開的瀏覽方式，不會讓 App 內的公開名單變成私密。
- 不傳送完整軌跡歷史，也不需要帳號；
- 位置最短每 10 秒嘗試更新一次，通常每 30 秒或移動 50 公尺更新；
- App 公開名單最多顯示最近更新的 10 筆有效分享，並可依分享名稱搜尋；
- 分享最多有效 24 小時；你停止分享或結束記錄時，App 會立即嘗試撤銷；
- 服務只保存最後位置；失效或撤銷後不可讀取，並在 24 小時後從服務端硬刪除；
- 連結的讀取 token 位於網址的
# 後段，不會送至網站伺服器的存取紀錄。
公開名單不需要帳號或 token 即可查看。請勿以不希望公開的真實姓名作為分享名稱；如不再希望公開位置，請立即停止分享或結束記錄。App 會產生隨機匿名安裝識別碼，服務端只保存其雜湊，用於建立分享、檢舉及封鎖濫用來源。分享名稱會經基本不當內容過濾；使用者可在 App 內檢舉分享，管理員可將內容下架或封鎖來源。
4. 公開 GPX 路線庫
只有在你選取已儲存路線或歷史記錄並確認公開提示後，App 才會將路線名稱、活動類型、座標與海拔傳送至公開路線服務，供所有 App 使用者搜尋、預覽與下載。公開前會移除時間戳、作者與裝置資訊、waypoint 及 GPX extensions。公開路線會保存到上傳者刪除或管理員下架為止。
App 會產生匿名安裝識別碼，服務端只保存其雜湊，用於每日上傳限額、防止濫用、檢舉及封鎖。服務也會保存最長兩天的來源網路位址雜湊以限制大量匿名請求，不保存此用途的原始位址。上傳後的刪除 token 保存在裝置上（iOS 為 Keychain，Android 為 App 私人空間的加密儲存），服務端只保存 token 雜湊。每個安裝來源每日最多上傳 10 筆；使用者可檢舉公開路線，管理員可將不當、侵權或危險內容下架。
5. 權限
- 位置：顯示目前位置、記錄軌跡、偏離提醒、當地天氣，以及你主動啟用的即時位置分享。記錄期間可在螢幕鎖定後繼續進行。查看天氣不會啟動軌跡記錄。
- 動作與健身（iOS）／身體活動（Android）：選用；僅在 GPS 暫時中斷時以步數協助估算移動。
- 相機：僅在你於記錄途中主動拍照時使用，照片留在 App 私人空間、不寫入相簿；Android 版另用於控制手電筒發出 SOS 閃光。
- 前景服務與通知（Android）：在關閉螢幕或切換 App 後，持續執行由你主動開始的記錄，並顯示持續通知。
6. 分享、匯出與第三方
匯出 GPX、分享座標、分享即時位置連結，均由你主動發起。第三方 App、地圖網站或你指定的 GPX 網址，依各自的隱私政策處理資料。
7. 兒童隱私
安心出發是一般戶外工具，不以兒童為主要對象，也不會故意蒐集兒童的個人資料。
8. Android 版差異
- Android 版與 iOS 版功能相同（沿途照片、沿途天氣記錄與公開 GPX 路線庫皆有）；軌跡與照片同樣不會自動上傳，只有你確認公開的路線才會送到公開路線庫。
- 相機權限用於沿途拍照與 SOS 手電筒閃光；不錄影、不讀取相簿。
- 匿名安裝識別碼與分享憑證保存在 App 私人空間，解除安裝即移除，且不納入 Android 雲端備份或裝置直接轉移。
- 軌跡資料庫、偏好設定與離線地圖不納入 Android 雲端備份；使用 Android 裝置直接轉移時，系統可能依設定移轉行程紀錄與部分偏好設定。
9. 安全與政策更新
所有外部服務連線使用 HTTPS，但沒有任何傳輸或儲存方式能保證絕對安全。手機定位、電量、網路與地圖都可能失效；本 App 不取代正式地圖、離線備援、行程留守或緊急通訊設備。本政策功能或法規變更時會更新日期。
開發者：Chao Huang。隱私、支援、內容檢舉或安全問題請聯絡：[email protected]。安全、隱私或明顯不當的公開內容檢舉，目標在 24 小時內審查處理。
Set Out Privacy Policy
Effective date: September 16, 2026
Set Out (安心出發) is an offline GPS track recorder, offline-map, and outdoor trip-planning tool. Our principles are device-first storage, minimal data, and explicit choices: no account, no advertising, and no analytics SDK.
This policy applies to both the iOS app (com.chaohuang.setout) and the Android app (compatibility package com.chaohuang.myhmap). Both follow the same data practices; Android-specific permission and storage differences are listed in section 8.
1. Data stored on your device
Track points, trip statistics, photos taken en route, GPX routes, offline maps, trip plans, and app preferences are stored in the app's private device storage. Full tracks and photos are never uploaded automatically and photos are never added to your photo library. You can delete data in the app; uninstalling removes data in the app's private storage.
On iOS, the anonymous installation identifier, public-route deletion tokens, and active-share credentials are stored in Keychain and may remain after uninstalling and reinstalling. They are used only for limits, abuse prevention, deleting content you published, and managing shares you explicitly created.
2. Network services
- Map viewing and offline downloads request needed areas from the tile service.
- Place search sends the text you enter to a geocoding service; reverse lookups on Android send the query coordinate.
- Weather lookup and weather logging send the current coordinate to the weather service, which requests forecasts from Open-Meteo.
- Importing GPX from a URL connects to the HTTPS address you provide.
To reduce upstream load and provide temporary outage fallback, the weather service caches requested coordinates and forecast responses on the server for up to approximately six hours. It does not use these coordinates to create accounts, advertising profiles, or a long-term location history.
These services may process standard connection information such as IP address, request time, and User-Agent. We do not use it for advertising, analytics, or cross-service tracking.
3. Live Location
This feature is off by default. Only after you explicitly tap “Share Live Location” while recording and confirm the public disclosure does the app send the share name you enter and your latest coordinate, accuracy, heading, speed, and time to our sharing service. The name and latest location appear in the app's public list for all app users. The app also creates a separate sharing link; this separate way to view a share does not make the in-app list private.
- No full track history is sent and no account is required.
- Updates are attempted no more often than every 10 seconds and normally after 30 seconds or 50 metres of movement.
- The public app list shows up to the 10 most recently updated active shares and supports share-name search.
- A share lasts for at most 24 hours. Stopping sharing or ending a recording attempts immediate revocation.
- The service stores only the latest position. A revoked or expired share cannot be read and is hard-deleted from the service 24 hours later.
- The link's viewer token is after
# in the URL, so it is not sent to web-server access logs.
The public list can be viewed without an account or token. Do not use a real name that you do not want made public. Stop sharing or end the recording immediately if you no longer want your location listed. The app creates a random anonymous installation identifier, and the service keeps only its hash to create shares, handle reports, and block abusive sources. Share names pass basic objectionable-content filtering. Users can report a share in the app, and moderators can remove content or block its source.
4. Public GPX route library
Only after you select a saved route or recorded trip and confirm the public disclosure does the app send its name, activity, coordinates, and elevation to the public route service for all app users to search, preview, and download. Timestamps, creator and device details, waypoints, and GPX extensions are removed first. A public route remains available until its uploader deletes it or a moderator removes it.
The app creates an anonymous installation identifier. The service stores only its hash for daily upload limits, abuse prevention, reports, and blocking. It also keeps a source-network-address hash for at most two days to limit bulk anonymous requests; the original address is not retained for this purpose. The deletion token returned after upload stays in the device Keychain, and the service stores only its hash. Each installation can upload up to 10 routes per day. Users can report public routes, and moderators can remove inappropriate, infringing, or unsafe content.
5. Permissions
- Location: current position, track recording, route-deviation alerts, local weather, and the Live Location feature you explicitly enable. Recording can continue while the screen is locked. Viewing weather does not start track recording.
- Motion & Fitness (iOS) / Physical activity (Android): optional; helps estimate movement from steps during temporary GPS loss.
- Camera: used only when you explicitly take a photo while recording; photos remain in private app storage and are never added to your photo library. On Android it also controls the flashlight for SOS signaling.
- Foreground service and notifications (Android): keep a recording you started running while the screen is off or another app is open, with a persistent notification.
6. Sharing, export, and third parties
GPX export, coordinate sharing, and Live Location links are all actions you initiate. Third-party apps, map websites, and GPX URLs you choose handle data under their own privacy policies.
7. Children's privacy
Set Out is a general outdoor utility, is not directed primarily at children, and does not knowingly collect children's personal data.
8. Android differences
- The Android app has the same features as iOS (photos en route, weather logging, and the public GPX route library). Tracks and photos are likewise never uploaded automatically; only a route you explicitly confirm is sent to the public route library.
- The camera permission is used for photos en route and the SOS flashlight. The Android app does not record video or read your photo library.
- The anonymous installation identifier and share credentials are kept in the app's private storage, are removed on uninstall, and are excluded from Android cloud backup and device-to-device transfer.
- The track database, preferences, and offline maps are excluded from Android cloud backup. Android device-to-device transfer may move trip records and some preferences, depending on system settings.
9. Security and policy updates
All external service connections use HTTPS, but no transmission or storage method is completely secure. Phone location, battery, network, and maps can fail; this app does not replace an official map, offline backup, trip safety contact, or emergency communication equipment. This policy's date changes when features or legal requirements change.
Developer: Chao Huang. For privacy, support, content reports, or security concerns, contact [email protected]. We aim to review safety, privacy, or clearly inappropriate public-content reports within 24 hours.