全球找廁所 / Global Toilet — 隱私政策 / Privacy Policy
更新 / Updated: 2026-09-18
聯絡 / Contact: jamesyang14@gmail.com

## 繁體中文

全球找廁所提供支援地區的廁所與景點搜尋、本機收藏及自願性使用者回饋；不需帳號，也不使用廣告追蹤。附近搜尋會把你的定位、所選地點或地圖中心的經緯度傳送到 API 以取得附近廁所。後端不建立定位歷史，但網路基礎設施可能處理 IP、請求網址及安全日誌。

API、公開搜尋資料與互動資料使用 Cloudflare（Workers、R2、D1）。地圖、地點搜尋與導航使用 Apple 服務；景點圖片可能來自 Wikimedia Commons 或官方旅遊網站；官方營業時間可能由後端讀取指定場館網站。這些服務可能在你所在國家以外處理提供服務所需的網路資訊。

你可自願回報清潔、耗材、可進入性、設施、排隊或更正資訊。更正文字最多 500 字，請勿填寫姓名、聯絡方式或敏感資訊；僅供審核使用。App 為回報產生隨機安裝識別碼，後端只儲存加入伺服器秘密值後的雜湊，用於限流、去重與本人狀態查詢，並不作跨 App 廣告追蹤。

伺服器回報 7 天後到期；排程每 15 分鐘嘗試清除到期回報與相關審核事件。裝置本機保存收藏、快取、待送回報及收據；待送回報 7 天後淘汰，收據最多 50 筆、30 天。移除 App 可清除本機收藏與快取；備份另依你的裝置與服務商保留機制處理。

若社群功能啟用，你可自願投稿 1–5 星及最多 150 個 Unicode 字元的短評；核准後星等、文字、時間與 emoji 反應數可能公開。你確認送出後，後端會將短評文字、星等與內容類型傳送給 DeepSeek 作自動內容審核；不傳送安裝權杖、權杖雜湊、作者別名、廁所識別碼、地址或座標。DeepSeek 無法使用、逾時或未回傳有效決定時，短評維持未公開，並在後續排程重試。社群使用另一個本機隨機權杖及伺服器雜湊，以處理作者操作、限流、去重、檢舉與封鎖；公開資料不含該權杖或雜湊。文章 90 天後到期，排程每 15 分鐘嘗試清除。你可在 App 中清除本人社群文章、反應、檢舉與自己建立的封鎖設定；請勿投稿個人或敏感資訊。

欲詢問或要求刪除回饋，請寄 jamesyang14@gmail.com 並提供收據識別碼與必要說明，不要寄送安裝權杖。由於沒有具名帳號，我們可能需要合理驗證資料所屬。

## English

Global Toilet provides toilet and destination search in supported regions, local favorites and optional feedback. No account is required and we do not use advertising tracking. Nearby search sends the coordinates of your location, selected place or map center to our API to find nearby toilets. We do not keep a location history, although network infrastructure may process IP addresses, request URLs and security logs.

We use Cloudflare, including Workers, R2 and D1, for the API, public search data and interaction data; Apple for maps, place search and navigation; and Wikimedia Commons or official tourism sites for destination images. Our backend may read selected official venue websites for opening hours. These providers may process network information needed to deliver the service, including outside your country.

Optional reports can include cleanliness, supplies, access, facilities, queues or corrections. Corrections are limited to 500 characters; do not include personal or sensitive information. The app creates a random installation identifier; the backend keeps only a server-secret-derived hash for limits, duplicate protection and checking your own status, never for cross-app advertising.

Server reports expire after seven days and a scheduled job attempts deletion of expired reports and moderation events every 15 minutes. Your device stores favorites, cache, queued reports and receipts; queued reports expire after seven days, and receipts are limited to 50 entries for 30 days. Removing the app clears local favorites and cache; device and provider backups follow their respective retention practices.

If community features are enabled, you may submit a 1–5 star rating with a short review of up to 150 Unicode scalars. After approval, its rating, text, time and emoji reaction counts may be public. After you confirm submission, our backend sends the review text, rating and content kind to DeepSeek for automated content moderation; it does not send the installation token, token hash, author alias, restroom identifier, address or coordinates. If DeepSeek is unavailable, times out or does not return a valid decision, the review remains non-public and is retried by a later scheduled run. A separate local random token and server hash support ownership, rate limits, reactions, reports and blocks; neither is public. Posts expire after 90 days and scheduled cleanup runs every 15 minutes. You can clear your own community posts, reactions, reports and blocks in the app. Do not submit personal or sensitive information.

For feedback inquiries or deletion requests, email jamesyang14@gmail.com with your receipt identifier and relevant details, never your installation token. Because we have no named accounts, reasonable ownership verification may be required.