食圖 Fsnap（https://fsnap.app，以下稱「本服務」）是一個不需要註冊帳號的美食連結筆記工具。你的筆記儲存在你自己的裝置上。若本網站啟用匿名使用統計（見第 6 節），部分操作事件（只有功能使用次數與粗略來源，不含筆記的連結網址、店名或內容）會傳送到我們使用的 Supabase 資料庫。以下說明本服務實際會處理哪些資料。
1. 儲存在你裝置上的資料
- 筆記內容（連結網址、標題、預覽圖片網址、描述、從連結中解析出的座標、標籤、建立時間）儲存在瀏覽器的 IndexedDB（資料庫名稱 fsnap-db）。
- 偏好設定儲存在瀏覽器的 localStorage：介面語言（fsnap_lang）、匯出功能解鎖狀態（fsnap_export_unlocked）、是否已略過位置說明（fsnap_geo_prompt_dismissed）、目前的 App 版本（fsnap_app_version，用於更新時清除舊快取），以及啟用匿名使用統計時的匿名 ID 與統計用旗標（fsnap_user_id、fsnap_first_open、fsnap_last_active、fsnap_pwa_installed，見第 6 節）。
- 為了支援離線使用，Service Worker 會快取網站本身的程式與圖示檔案。
- 開發者無法存取以上任何資料。你可以在 App 中刪除筆記，或清除瀏覽器的網站資料／移除 App 來刪除全部資料。
2. 連結預覽（Microlink）
當你儲存一個連結時，App 會把該連結網址傳送給第三方服務 Microlink（api.microlink.io），以取得標題、預覽圖片與描述。Microlink 會收到該網址以及你的 IP 位址等一般連線資訊，並依其隱私權政策處理。請避免儲存含有個人機密資訊的連結。
顯示筆記卡片時，預覽圖片會直接從原始網站的圖片伺服器（例如 Instagram、Facebook）載入；沒有預覽圖時會使用 Unsplash（images.unsplash.com）的預設圖片。這些網站會收到一般的連線資訊。
3. 位置資訊（選用）
本服務不會在開啟網頁時要求位置權限。只有在你需要距離功能、按下「允許使用位置」並同意瀏覽器的權限提示後，才會取得你目前的位置。
位置只在你的裝置上用來計算你與餐廳之間的距離（例如「離我最近」標籤），不會傳送給開發者或任何第三方（包含匿名使用統計）。依當時距離產生的標籤會隨筆記儲存在你的裝置上。你可以隨時在瀏覽器或系統設定中撤銷位置權限，其他功能不受影響。
4. 剪貼簿
只有在你按下「從剪貼簿貼上」時，App 才會讀取剪貼簿內容，並且只用來把其中的連結填入輸入欄位。
5. 網站託管與流量統計
本網站由 Cloudflare Pages 託管。Cloudflare 為了提供網站服務與資安防護，會處理一般連線資訊（例如 IP 位址、瀏覽器類型）。
本網站可能使用 Cloudflare Web Analytics 取得匯總的造訪統計（例如頁面瀏覽次數）。Cloudflare Web Analytics 不使用 cookie，也不會用來追蹤個別使用者。
6. 匿名使用統計（Supabase）
只有在本網站建置時設定了 Supabase 專案，這項功能才會啟用；未啟用時不會送出任何事件，也不會產生匿名 ID。啟用時，App 會把下列事件傳送到我們使用的 Supabase 資料庫（activity_logs 資料表），用來了解功能使用情況（例如每日活躍人數、回訪率、新增筆記數、平台分佈）：
目前狀態：本網站版本「已啟用」匿名使用統計。
- 每筆事件包含：事件名稱、匿名 ID、平台（iOS／Android／網頁，依瀏覽器 User-Agent 判斷）與時間，以及下列少數附加欄位。
- 匿名 ID 是第一次送出事件時隨機產生的識別碼（例如 anon_xxxxxxxx），存在你裝置的 localStorage（fsnap_user_id），用來計算不重複的使用者數與回訪。它不包含你的姓名、帳號、電話或裝置序號。另外 fsnap_first_open、fsnap_last_active、fsnap_pwa_installed 只用來避免重複記錄首次開啟與安裝，並判斷是否距離上次使用超過 30 分鐘。
- 不送出任何筆記內容：筆記的連結網址、店名、筆記 ID、搜尋關鍵字、分類或標籤名稱、位置或座標、剪貼簿內容、預覽圖片與描述，以及你分享給誰。
- 過濾機器人：偵測到自動化瀏覽器（webdriver、headless）、已知爬蟲，或尚未有任何實際操作（點擊、觸控、按鍵、捲動）時，不會送出任何事件，網站預先轉譯時也不會送出。
- 首次開啟（first_open）：每個匿名 ID 只記錄一次，附上粗略的來源：若網址帶有推廣參數 utm_source、utm_medium、utm_campaign，記錄清理後的值（小寫英數字、底線、連字號，最長 32 字）；否則只記錄上一頁網站所屬的分類（google、bing、facebook、instagram、threads、line、ptt、dcard、other、direct），不記錄完整的上一頁網址或路徑。
- 開啟工作階段（session_start）：每次開啟，或超過 30 分鐘沒有操作後再回來時記錄一次，附上是以瀏覽器或已安裝的 App（standalone）開啟。用來計算每日／每週／每月活躍人數與回訪率。
- 安裝 App（pwa_installed）：加到主畫面時，或第一次以已安裝的 App 開啟時記錄一次。
- 新增筆記（note_create）：只記錄新增方式（分享或手動）。
- 開啟連結（go_click）：按下 GO 時記錄一次，不含連結網址。
- 刪除（碰雷）筆記（note_dislike）：只記錄發生了一次刪除，不含筆記 ID。
- 功能使用次數：搜尋（search_use，每個工作階段最多一次，不含關鍵字）、篩選（filter_use，只記錄是依標籤或分類）、建立分類（category_create，不含名稱）、編輯筆記（note_edit）、備份匯出與匯入（backup_export、backup_import，只記錄 json 或 csv）、分享解鎖（share_unlock，不含分享對象）。
- 舊版曾記錄的事件：v2.4.0 之前，App 每次開啟都會記錄 app_install，並在新增或開啟筆記時記錄 note_create／view_page／note_dislike，其中含筆記的連結網址、標題或筆記 ID。v2.4.0 起已完全停止收集這些內容，舊事件類型也不再送出；先前已記錄的舊資料依下方保存期間處理，你也可以來信要求刪除。
- 權限：匿名使用者只能新增事件，無法讀取任何紀錄；只有登入的管理員可以讀取。Supabase 會處理一般連線資訊（例如 IP 位址），並依其隱私權政策處理。
- 保存期間：12 個月。統計資料不用於廣告、不販售，也不與第三方分享。
- 清除本網站的瀏覽器資料會刪除你裝置上的匿名 ID（之後會產生新的 ID）。若要刪除已送出的紀錄，請來信聯絡我們（見第 10 節）。
7. 分享、匯出與匯入
- 「分享解鎖」使用你裝置的原生分享功能（不支援時改為複製到剪貼簿），本服務不會知道你分享給誰。
- CSV 與 JSON 的匯出、匯入都完全在你的裝置上處理，檔案不會上傳。
- 透過邀請連結（?ref=）開啟時，只會顯示歡迎訊息，不會記錄或上傳邀請資訊。
8. 本服務不做的事
- 一般使用者不需要也無法註冊帳號（帳號登入僅供管理員讀取統計）。
- 不設定 cookie，目前也不顯示任何廣告。
- 不販售、不出租任何資料。
9. 政策變更
若本政策有任何變更，我們會更新本頁內容與生效日期。
Fsnap (https://fsnap.app, the "Service") is a food-link note-taking tool that does not require an account. Your notes are stored on your own device. If anonymous usage stats are enabled on this site (see section 6), some usage events (feature-use counts and a coarse traffic source only — never the URL, name or content of your notes) are sent to the Supabase database we use. This policy describes exactly what data the Service handles.
1. Data stored on your device
- Notes (link URL, title, preview image URL, description, coordinates parsed from the link, tags, creation time) are stored in your browser's IndexedDB (database "fsnap-db").
- Preferences are stored in localStorage: UI language (fsnap_lang), export unlock status (fsnap_export_unlocked), whether you dismissed the location explanation (fsnap_geo_prompt_dismissed), the current app version (fsnap_app_version, used to clear old caches after updates), and, when anonymous usage stats are enabled, an anonymous ID and a few stats flags (fsnap_user_id, fsnap_first_open, fsnap_last_active, fsnap_pwa_installed; see section 6).
- For offline use, a Service Worker caches the site's own code and icon files.
- The developer cannot access any of this data. You can delete notes in the app, or clear the site's browser data / uninstall the app to remove everything.
2. Link previews (Microlink)
When you save a link, the app sends that URL to the third-party service Microlink (api.microlink.io) to fetch its title, preview image and description. Microlink receives the URL and standard connection data such as your IP address, and handles it under its own privacy policy. Please avoid saving links that contain confidential personal information.
When note cards are displayed, preview images load directly from the original site's image servers (e.g. Instagram, Facebook); if there is no preview, a default image from Unsplash (images.unsplash.com) is used. Those sites receive standard connection data.
3. Location (optional)
The Service does not ask for location permission when the page loads. Your current location is obtained only after you use a distance feature, tap "Allow location" and accept the browser permission prompt.
Location is used only on your device to calculate the distance between you and a restaurant (e.g. the "Nearest" tag). It is never sent to the developer or any third party (including anonymous usage stats). Tags generated from the distance at that time are stored with the note on your device. You can revoke location permission at any time in your browser or system settings; other features keep working.
4. Clipboard
The app reads your clipboard only when you tap "Paste from clipboard", and only to fill the link field.
5. Hosting and analytics
The site is hosted on Cloudflare Pages. To deliver and protect the site, Cloudflare processes standard connection data (such as IP address and browser type).
The site may use Cloudflare Web Analytics for aggregated visit statistics (such as page views). Cloudflare Web Analytics does not use cookies and is not used to track individual users.
6. Anonymous usage stats (Supabase)
This feature is active only if a Supabase project was configured when this site was built; otherwise no events are sent and no anonymous ID is created. When active, the app sends the following events to the Supabase database we use (table activity_logs) to understand how features are used (e.g. daily active users, return rate, notes added, platform split):
Current status: anonymous usage stats are ENABLED in this version of the site.
- Every event contains: the event name, an anonymous ID, the platform (iOS / Android / web, derived from the browser user agent) and a timestamp, plus the few extra fields listed below.
- The anonymous ID is a random identifier (e.g. anon_xxxxxxxx) created when the first event is sent and stored in your device's localStorage (fsnap_user_id). It is used to count unique users and returns, and does not contain your name, account, phone number or device serial. fsnap_first_open, fsnap_last_active and fsnap_pwa_installed only prevent duplicate first-open/install events and tell whether 30 minutes have passed since your last use.
- No note content is ever sent: never a note's URL, name, ID, your search text, category or tag names, location or coordinates, clipboard contents, preview images and descriptions, or whom you share with.
- Bot filtering: no events are sent when an automated browser (webdriver, headless) or a known crawler is detected, or before any real interaction (click, touch, key press, scroll); nothing is sent while the site is pre-rendered.
- First open (first_open): recorded once per anonymous ID with a coarse traffic source: if the URL carries the campaign parameters utm_source, utm_medium or utm_campaign, the sanitized values (lowercase letters, digits, underscore and hyphen, at most 32 characters); otherwise only the category of the referring site (google, bing, facebook, instagram, threads, line, ptt, dcard, other, direct) — never the full referrer URL or path.
- Session start (session_start): recorded when the app is opened, or when you return after 30 minutes of inactivity, with whether it ran in a browser or as an installed app (standalone). Used for daily / weekly / monthly active users and return rate.
- App installed (pwa_installed): recorded once when you add the app to your home screen, or the first time it is launched as an installed app.
- Note added (note_create): only how it was added (shared or manual).
- Link opened (go_click): one event when you tap GO, without the URL.
- Note removed as "Bad" (note_dislike): only that a removal happened, without the note ID.
- Feature-use counts: search (search_use, at most once per session, no search text), filter (filter_use, only whether by tag or category), category created (category_create, no name), note edited (note_edit), backup export and import (backup_export, backup_import, only json or csv), share to unlock (share_unlock, without the recipient).
- Events recorded by older versions: before v2.4.0 the app recorded app_install on every open and note_create / view_page / note_dislike when you added or opened notes, including the note's URL, title or note ID. Since v2.4.0 none of this is collected any more and those older event types are no longer sent; data recorded earlier is handled under the retention period below, and you can ask us to delete it.
- Access: anonymous users can only add events and cannot read any records; only a signed-in administrator can read them. Supabase processes standard connection data (such as IP address) under its own privacy policy.
- Retention: 12 months. Stats are not used for advertising, not sold and not shared with third parties.
- Clearing this site's browser data deletes the anonymous ID on your device (a new one is created later). To delete events already sent, please contact us (see section 10).
7. Sharing, export and import
- "Share to unlock" uses your device's native share sheet (or copies to the clipboard when unavailable). The Service does not know whom you share with.
- CSV and JSON export and import are processed entirely on your device; files are not uploaded.
- Opening an invite link (?ref=) only shows a welcome message; the invite is not recorded or uploaded.
8. What the Service does not do
- Regular users do not need to, and cannot, create an account (sign-in exists only for the administrator to read stats).
- No cookies are set, and no ads are currently shown.
- No data is sold or rented.
9. Changes
If this policy changes, we will update this page and its effective date.