隱私權政策

生效日期：2026 年 9 月 25 日（2026 年 9 月 26 日修訂：回報不當回覆會保存 90 天；登入後若同意通知，會保存推播 token。同日再修訂：想你通知改經 Google Firebase 送達。提醒與事後關心會存在 D1，到點經 Firebase 送出。同日再修訂：語音輸入由 Apple 轉成文字，聲音不送到柴助的伺服器。同日再修訂：狗狗檔案與照護紀錄存在伺服器，用來顯示與讓柴助回應，可隨時刪除。同日再修訂：你選擇上傳的狗狗大頭照會壓縮、移除位置資訊後存在 Cloudflare，不會用於 AI。2026 年 10 月 6 日修訂：加入 Google AdMob 獎勵廣告（柴柴打工、看廣告免費補簽）與 App 追蹤透明度（ATT）詢問；補上氣溫散步的位置、拒絕柴梗圖的相機與照片、記帳資料與使用統計的說明）。開發者：Guocheng Shan（個人開發者）。聯絡：shibadaybot@gmail.com。

這份說明只寫柴助 App 與 shibasuke-api.shibasuke.workers.dev 這支程式實際在做的事。

我們收集什麼

留在這支手機上的：

出生年份。只用來判斷是否滿 13 歲，不會上傳。
聊天紀錄、登入狀態、顯示名稱，以及用 Apple 登入時的使用者識別碼。
一組隨機的匿名裝置編號，存在 Keychain。每次連線會放在 X-Shibasuke-Device。
成長進度的本機副本，以及小工具上的表情和一行狀態。

送到 Cloudflare D1 的：

匿名裝置編號與建立時間。
「調皮小狗」與「新生幼犬」的聊天內容、回覆、情緒標籤與時間。新生幼犬從第一句就說人話；灰色字幕是可選的真心話，有寫才會存。模型失敗、逾時或達到用量上限時，改用手機上預先寫好的叫聲，那則不會送到 OpenAI。危機語句不會送給模型。
每日訊息則數、短時間內的請求次數。另外有全站合計的請求數與 token 數，裡面沒有你的句子。
登入後：Apple 或 Google 的使用者識別碼、你授權時提供的名字、email（Google 只在信箱已驗證時保存；Apple 可能是隱藏信箱）、以及用來撤銷授權的 refresh token（有拿到才存）。Session 只存雜湊，不存明文。
成長進度：階段、訊息計數、有聊天的日期、時區、是否已看過長大慶祝。不含聊天原文。Apple 與 Google 不會因為 email 相同就合成同一個帳號。
鬧彆扭的狀態：程度，以及已經哄了幾句。哄完，或刪除帳號、匿名資料時會刪掉。不含聊天原文。
登入後，若你同意「柴助想你了」：這支手機的 Firebase Cloud Messaging 註冊 token（push token）、IANA 時區，以及開關。Firebase 也會向 Google 建立一組安裝識別碼，只用來把通知送到這支手機。只用來在你當地傍晚，於離開的第 2、4、7 天各傳最多一則。不拿來追蹤或廣告，也不會在深夜或清晨傳。關掉開關、登出、刪除帳號，或 Google 說這個 token 不能用時，會刪掉或不再使用。
你請柴助記住的提醒，以及柴助自己排的事後關心：短標題、到點要說的那一句、時間和狀態。你明確要的提醒由這支手機在時間到時通知。事後關心仍經 Firebase 送到這支手機。送出、你劃掉，或刪除帳號、匿名資料時會刪掉。
你從模型回覆長按送出的回報：那則回覆、上一則你說的話、原因、附註、App 版本和時間。用來檢查並改善安全。手機沒有伺服器上的訊息編號，所以這裡留的是文字。
狗狗檔案（名字，以及選填的生日和體重）與照護紀錄（散步、吃飯、排便、洗澡、體重、看醫生、疫苗、驅蟲、備註和時間）。用來在 App 顯示，也讓柴助回覆時知道狗狗的名字和最近幾筆紀錄。沒有建立狗狗檔案時，不會收集這些，聊天也不會使用這項功能。
狗狗大頭照的 key。檔案在 Cloudflare R2，不在 D1。聊天不會把大頭照送給模型。
若你訂閱「柴助 Plus」：Apple 回傳的 original transaction id、產品 id、到期時間、環境（Sandbox 或 Production），以及購買時綁定的 app account token（對應你的柴助帳號 UUID）。用來決定每日訊息上限。Apple 的 Server Notifications 也會更新這些欄位。刪除帳號時一併刪除。

App 內含 Google AdMob 的獎勵廣告 SDK，只用在你自己點下的「柴柴打工」與「觀看 1 支廣告免費補簽」。沒有橫幅、插頁或原生廣告。不出售個人資料。App 不讀取聯絡人。位置只用在「氣溫散步」提醒，相機只用在「拒絕柴梗圖」，都要你先同意系統詢問，說明在下面。選狗狗大頭照時用系統選圖，不會取得整本相簿，也不會開相機。想你通知沒有加入 Firebase Analytics。

你按麥克風時，這支手機會問麥克風和語音辨識。你說的話由 Apple 的語音辨識轉成文字。手機支援在裝置上辨識時，聲音留在這支手機；不支援時，才交給 Apple 的語音服務。柴助的伺服器不接收、也不保存這段聲音。只有你看過並按送出的文字，才會跟打字一樣送出。

狗狗檔案與照護紀錄存在伺服器，用來顯示，也讓柴助回應。你可以隨時刪掉單筆照護紀錄。刪除帳號，或沒登入時刪除這台裝置的匿名資料，會把狗狗檔案和照護紀錄一起刪掉。

你選擇上傳的狗狗大頭照會壓縮、移除位置資訊後存在 Cloudflare，只有你看得到，不會用於 AI，可隨時刪除。手機先把長邊縮小、存成 JPEG，再上傳。伺服器只在 D1 記下這張大頭照的 key，檔案放在不公開的空間。不會送給 OpenAI。

記帳（柴柴存錢筒）

你記的每一筆帳存在 Cloudflare D1：金額、分類（餐飲、交通、娛樂、購物、日常、其他）、品項名稱、備註、日期、滿意度（有填才存）、來源（手動、照護紀錄或聊天），以及建立與修改時間。另外也存：每月預算、柴幣餘額與每筆柴幣異動、連續記帳與補記的日期、連續天數里程碑、App 內購買的柴幣包與補記卡紀錄（Apple 交易編號、產品、環境）、用柴幣換的道具與目前穿戴、你設定的暱稱，以及獎勵廣告紀錄。登入後這些歸在你的帳號；沒登入時歸在這台裝置的匿名編號。用來顯示帳本、預算、柴幣與連續天數。

你在聊天裡說花了多少錢時，那則訊息會照下面「聊天會送到 OpenAI」送出，由模型整理成一筆帳。每次聊天也會附上一段本回合狀態給模型：你設定的暱稱、每月預算、本月剩餘、今天花了多少與預算狀態，用來提醒你別亂花。不會附上每一筆明細。

第一次使用時，你可以選「最希望柴柴幫你改善什麼」（控制衝動購物、清楚知道錢花哪去、存下第一筆錢三選一，可略過）。這個理財目標存在伺服器的使用者設定裡，每次聊天會附上一句給模型，讓本柴的建議更貼近你的目標；刪除帳號或匿名資料時會一併刪除。

你在 App 刪掉一筆帳時，它會先標記為已刪除並從畫面消失（幾秒內可以復原），資料列仍留在伺服器，直到你刪除帳號或匿名資料。

App 也會記錄使用統計事件，例如打開 App、記了一筆（分類、金額取整數、輸入方式）、刪了一筆、送出聊天（只記字數）、商城與小工具的操作、連續天數。以帳號或匿名裝置編號記錄，用來了解功能有沒有人用。不含聊天內容，也不含帳目的品項名稱或備註。

氣溫散步提醒與位置

只有柴助 Plus 使用者打開「氣溫散步」提醒時，App 才會詢問「使用 App 期間」的位置權限，而且只要求大概位置（降低精確度），不使用背景定位。拿到的經緯度只存在這支手機，用來向 Open-Meteo（api.open-meteo.com）查未來 7 天每天的最高氣溫；30°C 以上的日子，就在當天早上 8 點排一則本地通知。經緯度也用來判斷南半球或北半球，好調整換毛與皮膚季節提醒的月份。查詢時由這支手機直接把經緯度送給 Open-Meteo（對方也會看到你的 IP 位址），不會經過、也不會存到柴助的伺服器。關掉「氣溫散步」就不再查詢；也可以在 iPhone 的「設定」關掉位置權限。

拒絕柴梗圖：相機與照片

做梗圖時，你可以用系統選圖挑一張照片（不會取得整本相簿），或在你同意相機權限後拍一張。圖卡在這支手機上畫好。按儲存時，App 只要求「加入照片」權限把圖存進相簿，讀不到你的其他照片；分享時用系統分享選單，暫存檔分享完就刪除。

預設的梗圖文字是 App 內建的，不連網。只有你按「柴助幫我吐槽」時，這張照片才會重新壓縮成 JPEG（長邊最多 1280 像素），送到柴助的伺服器再轉給 OpenAI 產生文字。伺服器不保存照片，也不保存產生的文字，只記一筆請求次數做速率限制。OpenAI 的保留與不訓練說明，和下面「聊天會送到 OpenAI」相同。

獎勵廣告（Google AdMob）

只有你主動點「柴柴打工」或「觀看 1 支廣告免費補簽」時，App 才會載入並播放一支廣告。看完才給獎勵：柴柴打工每天一次 20 柴幣；免費補簽每天一次。柴助 Plus／VIP（含終身）不會看到廣告，獎勵直接給。

廣告由 Google AdMob 提供。播放時，Google 的 SDK 會直接從這支手機收集：IP 位址（可推估大概位置）、裝置與系統資訊、廣告互動（曝光、點擊、是否看完）、效能與當機診斷資料，以及在你允許追蹤時的廣告識別碼（IDFA）。用途是投放與衡量廣告、防止詐騙與無效流量。Google 依其政策處理這些資料，詳見 Google 如何使用合作夥伴網站或應用程式的資料與 Google 隱私權政策。

為了確認廣告確實看完，App 會把柴助的使用者識別碼（已登入時）和一組每次隨機產生的編號交給 AdMob 的驗證欄位，不含名字、email、聊天、記帳或狗狗資料。柴助的伺服器（Cloudflare D1）只記下：你哪一天領了哪一種獎勵、那組隨機編號、是否以 Plus 免廣告領取，以及發出的柴幣，用來確保每天一次。刪除帳號或匿名資料時一併刪除。

追蹤（App 追蹤透明度）

第一次播放廣告前，iPhone 會跳出系統詢問「是否允許追蹤」。允許時，Google 可以用這支手機的廣告識別碼（IDFA）顯示較相關的廣告；不允許時，Google 拿不到 IDFA，廣告照樣播放（可能比較不相關），獎勵照樣給。你可以隨時到「設定 › 隱私權與安全性 › 追蹤」更改。柴助自己不使用 IDFA。

想你通知會經過 Google Firebase

伺服器不會直接連 Apple 的推播伺服器。你同意通知後，手機把 Firebase 的註冊 token 存到 Cloudflare D1。到了該傳的傍晚，Worker 用我們自己的 Google 服務帳戶（不是你的 Google 登入）向 Google 換一張短效憑證，再把標題「柴助」、那一句固定台詞和 token 交給 Firebase Cloud Messaging。Google 再交給 Apple 送到手機。這段只為了把通知送達。

聊天會送到 OpenAI

調皮小狗與新生幼犬的新訊息，都會連同最近幾則對話（預設 8 則）和固定的角色說明，經由 OpenAI 的 Chat Completions API 產生回覆。新生幼犬用的是較短的角色說明，回覆上限也較小；灰色真心話只有模型有寫才會出現。我們不要求 OpenAI 儲存這些對話，組織層級的 API 呼叫紀錄也已關閉。OpenAI 依其政策，仍可能為濫用監測保留 API 請求最多 30 天，之後刪除；這段保留不在本 App 的控制範圍內。依 OpenAI 對 API 的預設政策，這些資料不會用來訓練模型。詳見 OpenAI 的資料控制說明。

句子裡若出現「不想活」「活著沒意思」「想死」「自殺」或「活不下去」，這則話不會送給模型。App 會顯示求助卡：安心專線 1925、生命線 1995、張老師 1980，緊急時 119 或 110。這種訊息若已寫進伺服器，之後也不會放進送給模型的歷史。

AI 回覆可能不正確，不能取代醫師、諮商、法律或其他專業建議。有緊急危險請聯絡當地緊急服務。

保存多久

聊天沒有自動到期，會留到你在 App 裡刪除。登出只會讓這次的 session 失效，不刪聊天。回報保留 90 天後刪除。刪除帳號或匿名資料不會提早刪掉已經送出的回報，這樣才檢查得了。鬧彆扭的那一列會在消氣，或你刪除帳號、匿名資料時刪掉。推播 token 留到你關掉通知、登出、刪除帳號，或 Google 回報這個 token 已經失效。提醒與事後關心留到送出、你劃掉，或刪除帳號、匿名資料。狗狗檔案與照護紀錄留到你刪掉，或刪除帳號、匿名資料。狗狗大頭照留到你移除它，或刪除狗狗檔案、帳號、匿名資料。記帳資料（包含你刪掉、已從畫面隱藏的帳）、柴幣、獎勵廣告紀錄與使用統計事件，留到你刪除帳號或匿名資料。位置經緯度只在這支手機上。

在 App 內刪除

已登入時，伺服器會刪掉這個帳號的聊天、每日用量、速率計數、session、綁定的裝置列、成長進度、鬧彆扭狀態、推播 token、提醒、狗狗檔案、照護紀錄、狗狗大頭照、記帳資料（每筆帳、每月預算、柴幣、連續記帳、內購柴幣包與補記卡紀錄、道具、暱稱、獎勵廣告紀錄）、使用統計事件、訂閱狀態，以及名字、email、登入識別碼和 refresh token。接著會嘗試撤銷授權：Google 有 refresh token 就呼叫 Google 的撤銷網址；Apple 有 refresh token 且開發者金鑰已設定，就呼叫 https://appleid.apple.com/auth/revoke。沒有 token 或 Apple 金鑰尚未設定時，撤銷會略過，資料仍會刪除。手機上接著清掉聊天、登入狀態和小工具內容。出生年份仍留在這支手機，直到你刪除 App。

沒有登入時，伺服器只接受這支手機 Keychain 裡的匿名裝置編號，刪掉該編號的聊天與回覆、用量、速率計數、成長進度、鬧彆扭狀態、提醒、狗狗檔案、照護紀錄、狗狗大頭照、記帳資料、使用統計事件和裝置列。刪不掉別的裝置，也刪不掉已經綁到登入帳號的資料。成功之後，手機會清掉聊天、出生年份、登入狀態和小工具，換一組新的匿名編號，並回到第一次打開時的年齡確認。網路失敗時手機上的資料會留著，可以再試一次。

年齡

柴助給 13 歲以上的人使用。App 用出生年份擋住未滿 13 歲，這個年份不上傳。未滿 18 歲請先得到家長或監護人同意。程式沒有另外蒐集或查核家長同意。

聯絡

隱私問題請寫到 shibadaybot@gmail.com。

Privacy policy

Effective 25 September 2026 (revised 26 September 2026: reports of a reply are kept for 90 days; a push token is kept only while notifications stay on; miss-you notes are delivered through Google Firebase; reminders and follow-ups are stored and sent through Firebase; voice input is transcribed by Apple and the audio is not sent to Shibasuke’s servers; a dog profile and care logs are stored on the server so they can be shown and used in replies, and can be deleted at any time; the dog portrait you choose to upload is compressed, location information is removed, and it is stored on Cloudflare and is not used for AI; revised 6 October 2026: Google AdMob rewarded ads (柴柴打工 work shifts and the free streak repair) and the App Tracking Transparency prompt were added, and the location use for heat-walk reminders, camera and photos for refusal memes, ledger data, and usage analytics are now described). Developer: Guocheng Shan (individual). Contact: shibadaybot@gmail.com.

This notice describes only what the Shibasuke app and the worker at shibasuke-api.shibasuke.workers.dev actually do.

What we collect

On the phone: birth year (used only to check the age of 13, not uploaded); chat; sign-in state; display name; the Apple user id when you use Sign in with Apple; a random anonymous device id in the Keychain, sent as X-Shibasuke-Device; a local copy of growth progress; and the widget’s emotion and one status line.

On Cloudflare D1: the device id and when it was created; puppy-stage and newborn-stage chat text, replies, emotion labels, and timestamps (a newborn speaks from the first message; the grey line is an optional true feeling and is stored only when the model writes one; if the model fails, times out, or a cap is hit, the phone uses a built-in bark instead and that fallback line is not sent to OpenAI); daily message counts and short-window rate counts; site-wide request and token totals that do not contain your words; after sign-in, the Apple or Google user id, the name you shared, email when the provider gives one (Google only if the address is verified; Apple may hide it), a refresh token when we received one, and a hash of the session token rather than the token itself; growth stage, message count, active days, time zone, and whether the growth celebration was seen. Growth rows do not include chat text. Apple and Google accounts are not merged when the email matches. A sulk episode stores only its level and how many messages have soothed it, until the sulk ends or the account or anonymous device is deleted. If you turn on「柴助想你了」while signed in, we also store this phone’s Firebase Cloud Messaging registration token (a push token), an IANA time zone, and the on/off switch. Firebase also creates an installation id at Google, used only to deliver the note to this phone. That is used only to send at most one note on local evenings of day 2, day 4, and day 7 away. It is not used for tracking or advertising, and it is not sent overnight or in the morning. The app does not include Firebase Analytics. The token is removed when you turn notifications off, sign out, delete the account, or Google says the token is no longer valid. A report you send from a model reply stores that reply, the message you sent just before it, the reason, an optional note, the app version, and the time, so it can be reviewed for safety. The phone does not receive server message ids, so the text is what is kept.

We do not sell personal information. The app includes Google AdMob’s rewarded-ad SDK, used only when you tap 柴柴打工 or the free streak repair. There are no banner, interstitial, or native ads. The app does not read your contacts. Location is used only for heat-walk reminders and the camera only for refusal memes, each after you allow the system prompt, as described below. The dog portrait is chosen in the system picker, which does not grant access to the whole photo library and does not open the camera.

When you tap the microphone, this phone asks for the microphone and speech recognition. Apple’s speech recognition turns what you say into text. If this phone supports on-device recognition, the audio stays on the phone. If it does not, Apple’s speech service does the recognition. Shibasuke’s servers do not receive or store that audio. Only the text you review and choose to send is transmitted, the same way as a typed message.

A dog profile and care logs are stored on the server. They are used to show the record in the app and so Shibasuke can reply with the dog’s name and a few recent logs. You can delete a log at any time. Deleting the account, or deleting this device’s anonymous data while signed out, deletes the dog profile and care logs too. Nothing is collected until you save a dog profile.

The dog portrait you choose to upload is compressed, location information is removed, and then it is stored on Cloudflare. Only you can see it. It is not used for AI, and you can delete it at any time. The phone shrinks the long edge and saves a JPEG before upload. D1 stores only the object key. The file is kept in a private bucket and is not sent to OpenAI.

Ledger (柴柴存錢筒)

Each expense you log is stored on Cloudflare D1: amount, category (food, transport, entertainment, shopping, daily, other), item name, note, date, satisfaction rating (only if you set one), source (manual, care log, or chat), and when it was created and changed. We also store your monthly budget, coin balance and every coin change, logged and repaired streak days, streak milestones, in-app purchases of coin packs and streak savers (Apple transaction id, product, environment), items bought with coins and the one being worn, the nickname you set, and rewarded-ad records. These belong to your account when signed in, or to this device’s anonymous id when not. They are used to show the ledger, budget, coins, and streak.

When you mention spending in chat, that message is sent as described in “Chat is sent to OpenAI” below, and the model turns it into a ledger entry. Each chat turn also gives the model a short status line: your nickname, monthly budget, what is left this month, what you spent today, and the budget status, so it can warn you about overspending. Individual entries are not included.

On first use you can pick what you most want Shiba to help with (rein in impulse buys, know where your money goes, or save your first stash; one of three, and you can skip it). This money goal is stored on the server in your user settings, and each chat turn includes one line about it so 本柴’s advice fits your goal. It is deleted when you delete your account or anonymous data.

When you delete an entry in the app, it is marked deleted and hidden (you can undo it for a few seconds). The row stays on the server until you delete the account or anonymous data.

The app also records usage events, such as opening the app, logging an entry (category, amount rounded to whole dollars, input method), deleting an entry, sending a chat message (length only), shop and widget actions, and streak days. They are keyed by your account or anonymous device id and used to see which features are used. They do not include chat text or the item names or notes of your entries.

Heat-walk reminders and location

Only when a Shibasuke Plus user turns on the heat-walk reminder does the app ask for location permission while using the app, and it asks only for approximate location. Background location is not used. The coordinates stay on this phone and are used to ask Open-Meteo (api.open-meteo.com) for the next 7 days’ daily high temperature; on days of 30°C or more, a local notification is scheduled for 8 a.m. The coordinates are also used to tell the northern from the southern hemisphere so the shedding and skin season reminders use the right months. This phone sends the coordinates directly to Open-Meteo (which also sees your IP address). They do not pass through and are not stored on Shibasuke’s servers. Turning heat walk off stops the lookups, and you can turn off location permission in iPhone Settings.

Refusal memes: camera and photos

To make a meme you can pick one photo in the system picker (which does not grant access to the whole library), or take one after you allow camera access. The card is drawn on this phone. Saving asks only for add-to-Photos permission, which cannot read your other photos. Sharing uses the system share sheet, and the temporary file is deleted afterward.

The default meme lines are built into the app and need no network. Only when you tap 柴助幫我吐槽 (“roast it for me”) is the photo re-encoded as a JPEG (long edge at most 1280 pixels), sent to Shibasuke’s server, and passed to OpenAI to write the text. The server does not store the photo or the generated text; it only counts the request for rate limiting. OpenAI retention and no-training terms are the same as in “Chat is sent to OpenAI” below.

Rewarded ads (Google AdMob)

An ad loads and plays only when you tap 柴柴打工 (work shift) or 觀看 1 支廣告免費補簽 (watch one ad for a free streak repair). The reward is given only after the ad finishes: the work shift pays 20 coins once a day, and the free streak repair works once a day. Shibasuke Plus / VIP (including lifetime) never sees ads; the reward is granted directly.

Ads are provided by Google AdMob. While an ad plays, Google’s SDK collects directly from this phone: IP address (which can estimate approximate location), device and system information, ad interactions (impressions, taps, whether the ad was completed), performance and crash diagnostics, and the advertising identifier (IDFA) if you allow tracking. Google uses this to serve and measure ads and to prevent fraud and invalid traffic, under its own policies: How Google uses information from sites or apps that use its services and the Google Privacy Policy.

To confirm an ad was completed, the app passes your Shibasuke user id (when signed in) and a random per-ad code to AdMob’s verification fields. It does not include your name, email, chat, ledger, or dog data. Shibasuke’s server (Cloudflare D1) records only which reward you claimed on which day, that random code, whether it was claimed through Plus without an ad, and the coins granted, so each reward stays once a day. These rows are deleted with the account or anonymous data.

Tracking (App Tracking Transparency)

Before the first ad plays, iOS asks whether to allow tracking. If you allow it, Google may use this phone’s advertising identifier (IDFA) to show more relevant ads. If you do not, Google does not get the IDFA; ads still play (possibly less relevant) and you still get the reward. You can change this at any time in Settings › Privacy & Security › Tracking. Shibasuke itself does not use the IDFA.

Miss-you notes go through Google Firebase

The server does not connect to Apple’s push servers. After you allow notifications, the phone stores a Firebase registration token on Cloudflare D1. On the evening it is due, the worker uses our own Google service account (not your Google sign-in) to get a short-lived credential, then sends the title, one fixed line, and the push token to Firebase Cloud Messaging. Google hands that to Apple for delivery to the phone. This is only so the note can arrive.

Chat is sent to OpenAI

A puppy-stage or newborn-stage message is sent to the OpenAI Chat Completions API with the last few turns (8 by default) and a fixed character prompt. The newborn prompt is shorter and the output cap is smaller. The grey true-feelings line appears only when the model writes one. We do not ask OpenAI to store those conversations, and organization-level API call logging is turned off. Under OpenAI’s policy, API requests may still be kept for abuse monitoring for up to 30 days and then deleted. That retention is outside this app’s control. By OpenAI’s default API policy, this data is not used to train models. See OpenAI’s data controls.

If a message contains a crisis phrase the app looks for, that message is not sent to the model. The app shows Taiwan helplines 1925, 1995, and 1980, and 119 or 110 for emergencies. A stored crisis line is also left out of later history sent to the model.

AI replies can be wrong. They are not medical, counseling, legal, or other professional advice. In an emergency, contact local emergency services.

How long we keep it

Chat does not expire on a timer. It stays until you delete it in the app. Signing out only invalidates that session. It does not delete chat. Reports are deleted after 90 days. Deleting an account or anonymous device data does not delete a report early, so it can still be reviewed. A sulk row is deleted when the sulk ends, or when you delete the account or anonymous device data. A push token stays until you turn notifications off, sign out, delete the account, or Google reports that the token is no longer valid. A reminder you ask for is stored as a short title, the line to show, and the time, and this phone notifies you when that time comes. A follow-up scheduled after something you mention keeps the same fields and is sent through Firebase. Both stay until they are delivered, you cancel them, or you delete the account or anonymous data. The dog portrait stays until you remove it, delete the dog profile, or delete the account or anonymous data. Ledger data (including entries you deleted, which are hidden), coins, rewarded-ad records, and usage events stay until you delete the account or anonymous data. Location coordinates stay on the phone.

Deleting in the app

When you are signed in, the server deletes that account’s messages, daily counts, rate-limit rows, sessions, linked device rows, growth, sulk episode, push tokens, reminders, dog profile, care logs, the dog portrait, ledger data (entries, monthly budget, coins, streaks, coin-pack and streak-saver purchase records, items, nickname, rewarded-ad records), usage events, name, email, sign-in ids, and refresh token. It then tries to revoke access: Google’s revoke endpoint when a refresh token was stored, and Apple’s https://appleid.apple.com/auth/revoke when an Apple refresh token was stored and the developer key is configured. If the token or the Apple key is missing, revocation is skipped and the data is still deleted. The phone then clears chat, sign-in state, and the widget. The birth year stays on the phone until you delete the app.

When you are not signed in, the server accepts only the anonymous device id from this phone’s Keychain. It deletes that id’s chat and replies, usage, rate-limit row, growth, sulk episode, reminders, dog profile, care logs, the dog portrait, ledger data, usage events, and device row. It cannot delete another device, or data already attached to a signed-in account. After the server succeeds, the phone clears chat, the birth year, sign-in state, and the widget, replaces the anonymous id, and returns to the age check from the first launch. If the network fails, the phone keeps its data so you can try again.

Age

Shibasuke is for people 13 and older. The app blocks younger birth years locally and does not upload the year. If you are under 18, use the app only with a parent or guardian’s permission. The app does not collect or verify that permission.

Contact

Privacy questions: shibadaybot@gmail.com.