DutyDone Privacy Policy

Data We Process

Personal shifts, shift-type settings, preferences, and widget snapshots are stored locally on the user's device or in browser storage. When Groups are enabled, DutyDone processes an account identity ID, the display name chosen separately for each Group, Group membership and role, custom shift types (including optional start and finish times), shift assignments, invite status, and limited security records needed to operate the service. Group admins may also enter names, shift types and dated shifts for clearly labelled virtual people; records include their creator and last editor for administration and synchronization. Language, style and Friends-view preferences stay local unless you separately enable private backup. Friends-view choices are scoped to the configured service, your account and the Group; hiding a person from your view does not change Group membership or who can see a shared roster.

Your public-holiday calendar choice is stored locally and does not require device-location access. Holiday dates are bundled with the app. The selected calendar can appear in your calendar views, shared calendar images and home-screen widgets. Widgets use a local snapshot of your saved personal roster and selected holiday information; they do not include personal events, other members' rosters or cloud-account details. Opening an official source link uses your browser and that website's own privacy practices.

Display mode (Follow system, Light or Dark) is a local device preference, separate from the style choice included in optional private backup. Show working hours in dates is a local view preference that can be included in private backup. Scheduled-hours estimates are calculated on your device from saved shift times; they are not attendance or pay records. These display and hours features remain free.

Group safety features also process blocked-identity relationships, content reports, moderation restrictions and action records. A report contains its reason, optional explanation, the relevant Group or member reference and limited selected text needed to assess the report. DutyDone does not copy an entire roster history into a report. Support email may contain the contact address and information the sender chooses to provide.

The App Store's “Contacts” privacy label refers to Group membership and blocking relationships between DutyDone users. DutyDone does not request access to your phone's address book or read or upload its contacts.

DutyDone is for staff scheduling only. Do not enter patient data, clinical notes, health information, or other sensitive workplace records.

Support Identifiers And Account Grants

Versions 1.6 and later provide a DD support identifier through Settings → Support. This uses an existing cloud identity or, after your confirmation and a security check, creates an anonymous cloud identity. The action does not enable Friends or upload your calendar. The service stores a randomly generated DD identifier linked to the cloud account so authorized support operators can locate the relevant account record. The identifier alone cannot authenticate, prove ownership or recover the account.

If you send the identifier to support, your email address and the information you include can be associated with that account while we handle your request. Share it privately with support rather than publicly. Account records can also include a complimentary ad-free grant's state, revision and change time, plus the authorized operator's action, reason and request records. Only specifically authorized operators can look up these records or grant or revoke that access; creating or sharing an identifier does not itself grant it. The retention rules below apply.

Email Recovery And Private Backup — Version 1.6 And Later

Settings → Account & recovery lets you verify an email address to retain access to the same cloud account on another device. Authentication and email providers process the address, verification requests and sign-in records. Linking an email alone does not upload private records or turn on private backup. An unlinked anonymous identity cannot be recovered after its local sign-in is lost; a deleted account cannot be restored.

Private backup is off until you separately confirm it. It uploads the complete personal roster, private and shared events (including notes and reminder choices), and portable preferences such as language, style, calendar view, holiday calendar, tomorrow's reminder settings and Friends-view choices. Private backups are accessible to the account owner through authenticated account access, not to Group members. They are stored by the cloud service; this is not end-to-end encryption. Backups do not contain sign-in tokens, invitation links, advertising or usage-statistics consent, or widget caches.

Recovery previews available synced data or a selected private backup before you confirm replacement of local records. Synced data alone does not include private events or portable preferences. The new device becomes the account's primary writer, so previous devices cannot continue cloud writes with their old sign-in. Friends publication stays paused until a separate confirmation; reminders require a separate choice on the new device. Current Group membership, permissions and account gifts come from the service and cannot be recreated by a backup. A local copy from before recovery is available for seven days.

DutyDone private backups do not include display mode, before-shift reminder settings or scheduling records, Apple purchase status, transaction identifiers or local transaction-handling markers. Restoring a DutyDone account or private backup does not restore an Apple subscription; use Restore purchases with the Apple Account used for the purchase.

Personal Events And Reminders

Event titles, dates, times, colors, repeat rules and exceptions, location text, notes and reminder choices are stored locally. Each event is private by default. Enabling Friends for the roster does not share private events. When you turn on Share with Friends for an event or repeating series, its title, dates, times, color, repeat details, location and notes are uploaded and visible to current members of all your joined Groups, subject to membership, blocking and moderation. Reminder choices remain private. A report of an event can retain a copy of that selected shared event as evidence.

Unsharing or deleting an event removes its published copy after the server confirms the change. An offline or failed update may leave the previous version visible until synchronization succeeds. Shared events are excluded from persistent peer caches and from calendar image exports. Locations are entered manually; DutyDone does not access device location or system calendars.

Optional local reminders ask for notification permission when you select an event reminder, turn on tomorrow's shift reminders or before-shift reminders, or explicitly choose permission recovery. Automatic refresh does not request permission. The device operating system handles scheduled notifications. Event notifications may show the event title and date on the lock screen according to your settings. DutyDone does not register a remote push token. The web app does not send background reminders.

Tomorrow's shift reminders are off by default. Their time, days-off choice and notification-content preference stay local unless included in your optional private backup, and are not shared with Groups. Detailed notifications can show the shift date, code, name, optional working hours and selected holiday information; the generic option shows a prompt to open DutyDone for the date without shift or holiday details. This option applies only to tomorrow's shift reminders; event notifications keep their own settings. Content may appear on the lock screen. Reminders use saved information, check a limited range of future dates and share available device notification capacity. Opening the app refreshes them; delivery time and sound depend on device, notification, battery and Focus settings.

Before-shift reminders are a separate free option, off by default. Their enabled state, lead time and content choice stay on this device and are not shared with Groups or included in private backup. They use saved working times and the device's local time zone, and skip days off, unassigned dates and shifts without working times. Generic content prompts you to open the app; detailed content can show shift information and working times on the lock screen. This content choice does not change tomorrow's or event reminders. The operating system receives the notification content to schedule and display it; open the app after a time-zone change and regularly to refresh the limited upcoming schedule.

Cloud-account deletion also erases shared events and their synchronization records, and makes retained local events private. Reset all DutyDone data also removes local events and cancels their device reminders. Recent event synchronization records expire after 30 days; a limited current synchronization state remains until account deletion.

Group Visibility

Current members of a Group can view each other's complete shift history, including duties created before joining and future duties, subject to blocking and moderation restrictions. Each real member can modify only their own personal roster. A personal roster is the same across all Groups the person joins; DutyDone does not create a different personal roster for each Group.

If you have already enabled Group sharing, opening the app may load your Group list and the current month for your default or only Group before you open Friends. This uses the existing Group permissions and keeps other members' loaded data in memory, without a persistent offline copy. Personal-only use does not make these Group requests.

Group admins can add a clearly labelled virtual person and enter a name, shift types and dated shifts for that Group. Current members can view this record; current admins can edit or delete it. A virtual person has no DutyDone account, cloud identity or invitation. Its record remains with the Group if the admin who created it leaves. Deleting the virtual person removes its current Group-visible name, shift types and roster; deleting the Group removes its virtual records. Limited recent synchronization records may remain for the period described below. Copies already seen or saved by others cannot be recalled. Contact support if a virtual record is inappropriate.

Find a day compares selected real and virtual rosters for up to three months on your device. A blank date is not treated as a day off. Your selected people are remembered locally by Group and member reference. DutyDone does not create cloud date proposals, chats or recipient replies. You can review and edit a suggested message before choosing a device or browser sharing option. Its default text is a short invitation listing one to three dates with weekdays and years, followed by a question asking which dates work for the recipient; it does not include names, Group names, shifts, private events, invitation links or recipients. The final text you choose may be sent to the destination you select; DutyDone does not receive replies from that service. This feature does not request access to your device contacts, location or system calendar.

Blocking prevents two identities from reading each other's shared rosters across their common Groups. It does not delete duties, remove memberships or transfer administrator roles. Limited identity and role information needed for Group administration may remain, with neutral labels where required. A block remains until the person who created it unblocks the other identity, or the relevant identity is deleted. Content already seen, captured or saved by another person cannot be recalled. Other members' roster content is not retained in persistent offline caches; viewing it requires a current online connection.

Reports and moderation notes are private from other Group members. Authorized DutyDone operators use them to investigate and act on harmful content, including hiding a Group or restricting an identity. Shared text is filtered for objectionable content; filtering can miss content or incorrectly flag legitimate text. Users can report problems or contact support about a moderation decision.

Leaving a Group removes that Group's access for the departing identity. Deleting a Group removes its memberships, invites, and Group records. Other Groups and the user's local personal roster are unaffected.

Service Providers

Cloud hosting, identity, website security and email providers process data needed to run the features you use. Connection and security records may include an IP address and approximate city or country inferred from it, device or browser information, authentication and request events, response timing and abuse signals. We use these records to operate, troubleshoot and protect DutyDone; they are separate from optional usage statistics. This IP-derived approximate area is included in the App Store's “Location” privacy label. DutyDone does not request GPS or device-location access or read your precise location. When a Google banner is requested, Google may also infer approximate location from IP addresses as explained below.

Creating or joining a Group, creating a cloud identity for a DD support identifier or email linking, or requesting recovery sign-in may run an anti-bot check that processes browser connection characteristics and the site origin. See the Cloudflare Turnstile Privacy Addendum.

Support email is handled through the studio's email service. The studio owner uses the sender's email address and supplied content only to answer and follow up on support requests, not for advertising, marketing or transfer to another customer-service system.

Provider connection, authentication and security records may have different retention periods from DutyDone's optional statistics. Providers retain and delete their operational records under their applicable terms and legal requirements; contact support for a privacy request.

DutyDone does not sell personal data.

Optional Apple Subscription

Where offered in the iOS app, monthly support removes ads while the subscription is active. Personal calendars, Friends, events, reminders and backup remain free. Apple handles purchase confirmation, payment and subscription billing through your Apple Account. DutyDone's purchase integration does not receive your payment-card details, Apple Account password or Apple Account email address.

On your device, DutyDone uses Apple's StoreKit to verify transactions and check subscription status. The app processes the product identifier, transaction and original-transaction identifiers, verification dates, expiry or grace-period dates and renewal status. Current status is held in memory and checked again through StoreKit; it is not a permanent paid flag in your calendar data. The app does not upload these transaction details or receipts to DutyDone's cloud service, Google advertising or optional DutyDone usage statistics. It does not link the Apple purchase to your DutyDone cloud identity.

To record transaction handling safely, the app keeps a small local journal of hashed transaction markers, limited to the latest 128 entries. These markers do not grant subscription access. They have no timed expiry: older entries are replaced as new entries are recorded. They are excluded from device backups and DutyDone private backups. In-app data reset and cloud-account deletion do not clear this journal; clearing the app's device storage or uninstalling removes it.

The studio views only aggregate sales, financial and subscription reports from Apple and does not use individual subscriber activity reports. These aggregate reports are separate from data uploaded by the app. Apple's account, billing and purchase records follow its own practices; see App Store & Privacy. Your DutyDone recovery email and cloud account are separate from the Apple Account used to buy the subscription. Deleting DutyDone data or the app does not cancel Apple billing or erase Apple's records. See subscription support to restore, manage or cancel a subscription.

Advertising in Native Apps

Supported native app versions may show Google Mobile Ads banners within the app. The app may check DutyDone's website to see whether advertising is available; this can create the connection records described above. The web app does not request ads. In DutyDone 1.3 for iOS, we request ads only after Apple's App Tracking Transparency (ATT) authorization and any applicable ad consent. Starting with version 1.4, denying ATT does not itself turn off advertising: when applicable Google ad-consent requirements permit a request, the app may show non-personalized ads. Apple restricts access to the advertising identifier (IDFA) when ATT permission is not authorized. The app does not use that refusal as permission for cross-app tracking, and disables Google's publisher first-party ID. The calendar remains usable regardless of your choice. Android follows applicable ad-consent requirements. Eligible requests ask for non-personalized ads, and an in-app privacy-options entry appears when required. On supported iOS builds, Settings → Tracking permission lets you check your choice and, when iOS permits, request it even while banners are off; opening that entry does not itself request an ad or start Google ad consent. You can also change ATT permission in iOS Settings → Privacy & Security → Tracking, and use the app's advertising privacy options when offered. Optional DutyDone usage statistics are a separate choice.

Our ad integration does not send personal shift or event content, Group rosters or invitations, cloud account IDs, or DutyDone usage-statistics IDs to Google. Google and its ad SDK may process IP addresses (and approximate location inferred from them), app or device identifiers, ad and app interactions, and performance or diagnostic information for ad delivery, measurement, and fraud prevention. Non-personalized ad requests can still use mobile identifiers for frequency capping and aggregated reporting; they are not a promise of no tracking or no device-data processing. See Google's ad-serving modes, iOS data-disclosure guidance and Android data-disclosure guidance.

Optional Usage Statistics

Where available, Settings → Usage statistics is off by default. If you turn it on, DutyDone receives a random reporting identifier, platform, server receipt time and counts of selected screens and button actions. Reports contain no calendar content, names, Group IDs, invitation links, input text, location, screen recordings or tap coordinates. This does not require a Group identity; the application does not link the reporting identifier to that identity.

The app offers a short consent choice after you first successfully save your personal schedule and choose Done. Nothing is reported before you choose Share usage statistics. Your choice is remembered, so accepting or declining prevents repeated automatic prompts. You can change it at any time in Settings → Usage statistics. Declining or stopping sharing keeps only a local disabled preference without a reporting identifier. Resetting all app data clears this preference.

Offline or failed statistics reports are dropped. The reporting identifier rotates after 30 days on a subsequent launch. Only authorized operators can access aggregate statistics. Turning the setting off stops reporting and removes the local identifier. Previously received reports expire after 30 days; operator setting-change records expire after 90 days. Provider connection and security records follow their own terms, so a random identifier does not mean all connection data is anonymous.

We also keep limited counts of Group creation and invitation attempts to prevent abuse. They contain no invitation links or submitted content and expire after 30 days. Usage limits may pause cloud operations; the local personal calendar remains usable.

Retention

Local data remains until the user resets DutyDone, clears browser or app data, or uninstalls the app, subject to the local reminder and transaction-handling exceptions described here. Shared roster data remains while the account belongs to at least one Group. For unlinked anonymous identities, never joining a Group or leaving the last Group starts a 30-day cleanup grace period, subject to the account-grant exception below. Cleanup rechecks membership and anonymous-account status before deletion. Email-linked accounts are excluded from this anonymous-identity cleanup. Existing unused anonymous identities newly covered by the rule receive at least 30 days from its activation.

An active complimentary ad-free grant can retain an otherwise eligible anonymous identity, its DD identifier, grant records and limited safety or synchronization records. It does not extend retention of the orphaned shared roster or event content: that content is removed under the ordinary cleanup rule. Revoking an active grant starts a separate 30-day identity grace period; the unlinked identity becomes eligible for cleanup once both grace periods have elapsed and it still belongs to no Group. Revocation does not extend the original content deadline. Confirmed cloud-account deletion overrides this exception and removes the identifier and grant records.

The latest private backup has no seven-day expiry and remains until you delete private backups or the account. We retain up to three previous versions from the preceding seven days. Older historical versions become unavailable and are pruned. Stop automatic backup prevents future uploads; it does not delete saved versions. Delete private backups also turns off automatic backup and makes all saved versions immediately unavailable from the live service after confirmation. You must explicitly enable automatic backup again to create new versions. Deleting the cloud account also removes its private backups.

To prevent a previously due shift reminder from being sent again, DutyDone keeps a limited local record of reminder dates, attempted times and scheduling status, without shift names, event content or cloud identity. These records are an exception to in-app reset: resetting reminder preferences or all DutyDone data does not erase them. Old dated records are pruned as reminder scheduling runs. They are not uploaded; clearing the app's device storage or uninstalling removes the local record.

Recent synchronization and abuse-prevention records are deleted after 30 days. Expired or revoked invites are deleted 30 days after expiry or revocation. Group action records expire after 90 days. Group, membership and invite records are deleted when their Group is deleted.

Content reports and their moderation action records are retained for at most 90 days from creation. Deleting an account removes its associated explanations, selected content and identifying references from live safety records. Restrictions remain until removed or the relevant identity or Group is deleted. A limited non-content deletion marker may remain for 30 days so recovery copies cannot bring a deleted account back.

Separate application-data disaster-recovery copies, if created, are encrypted and kept for no more than 7 days. These operational copies are not the user-controlled private backups described above and do not provide a personal recovery source. Service-provider operational copies may be retained under their own terms, including after live deletion. Support correspondence is kept only as needed to handle the request and related follow-up.

Calendar Image Sharing

Settings → Share calendar image creates an image controlled by the user. Saving or sharing it is initiated by the user through browser or operating-system services. DutyDone does not receive a copy.

Deleting Your Cloud Account And Removing Data

Settings → Cloud account → Delete cloud account is available while a cloud identity is enabled. The flow lists any Groups that must first be left or deleted. A final administrator can transfer administration or delete that Group. After those steps, confirming deletion removes the cloud identity, linked email access and private backups, and clears Group caches and synchronization state while retaining the personal roster on the device. Reset all DutyDone data performs cloud deletion first when a cloud identity exists, then removes the local personal roster and settings. Failed requests can be retried; an unconfirmed cloud deletion does not silently clear the personal roster. If another device has become the primary writer, use Account & recovery before requesting deletion again.

You can also request cloud-account, shared-data, private-backup or support-correspondence deletion by emailing support@waaistudio.com without reinstalling the app. See the deletion request instructions. We will clarify the scope and verify ownership before acting. A message from an email address or a display name alone does not prove account ownership. Unlinked anonymous identities have no recovery email; if the identity cannot be reliably identified, we will explain the limitation. Do not send passwords, verification codes, session tokens, invitation links or identity documents.

Before changing devices or clearing app data, link and verify an email through Account & recovery and separately enable private backup if you want private records included. Only data still present in the selected cloud source can be restored. Without linked email, losing the anonymous sign-in prevents account recovery. Deleting an account cannot be undone through email recovery or an old backup. Uninstalling the app is not a substitute for deleting the cloud account.

Files already saved or shared must be removed from their destination by the user. Removing the app does not remove copies held by other users or destinations selected by the user.

Deleting the app, resetting local data, deleting private backups or deleting your DutyDone cloud account does not cancel an Apple subscription. Manage or cancel it separately in Apple subscription settings.

Contact

Privacy, deletion, and support questions: support@waaistudio.com

Instructions and moderation appeals: DutyDone Support.

繁體中文私隱政策

生效日期：2026 年 10 月 27 日。

日程名稱、日期、時間、顏色、重複規則及個別日期修改、地點文字、備註和提醒選擇均儲存在本機，亦可包括在你另行選擇的私人備份中。每個日程預設私人；啟用班表的朋友功能不會自動分享私人日程。開啟某個日程或重複系列的「分享給 Friends」後，其名稱、日期、時間、顏色、重複資料、地點及備註會作為共享資料上傳，讓所有已加入群組的現有成員查看，並受成員資格、封鎖及內容處理限制。提醒選擇不會分享。檢舉日程可保留該項已分享日程作為證據。

取消分享或刪除日程，須待伺服器確認後才會移除雲端副本；離線或同步失敗時，朋友可能暫時仍看到舊版本。其他成員的日程不會儲存在持久離線快取；班表圖片不包含日程。地點由你手動輸入，DutyDone 不讀取裝置定位或系統行事曆。

主動選擇日程提醒、開啟明日更份提醒或上班前提醒，或選擇恢復通知權限時，App 才會要求通知權限；自動更新不會要求權限。裝置系統負責排程通知，並可能依設定在鎖定畫面顯示日程名稱和日期。DutyDone 不註冊遠端推播權杖，網頁版不發送背景提醒。

明日更份提醒預設關閉；除非包括在你選擇的私人備份中，提醒時間、是否包括休息日及通知內容選擇均留在本機，不會分享給群組。詳細通知可顯示更份日期、簡碼、名稱、自選上下班時間及所選日曆的假期資訊；簡略選項只提示開啟 DutyDone 查看指定日期，不顯示更份或假期詳情。這個選項只適用於明日更份提醒，日程通知沿用各自的設定。通知內容可能顯示在鎖定畫面。提醒按已儲存的資料檢查有限的未來日期，並共用裝置可用的通知容量；開啟 App 會更新提醒。送達時間及聲音受裝置、通知、省電及專注模式設定影響。

上班前提醒是另一項免費選擇，預設關閉。啟用狀態、提前時間及內容選項只儲存在此裝置，不會分享給群組或包括在私人備份中。提醒按已儲存的工作時間及裝置本機時區安排，略過休息日、未排更日期及沒有工作時間的更份。簡略內容提示你開啟 App；詳細內容可在鎖定畫面顯示更份資料及工作時間。此選擇不會更改明日或日程提醒。裝置系統會接收通知內容作排程及顯示；轉換時區後及日常使用時，請開啟 App 更新有限範圍的待發提醒。

刪除雲端帳戶會同時移除已分享日程和同步紀錄，並把保留的本機日程設回私人；「重設所有 DutyDone 資料」亦會移除本機日程和取消其裝置提醒。最近的日程同步紀錄會在 30 日後到期；有限的當前同步狀態會保留至帳戶刪除。

DutyDone 是以本機儲存為主的輪班月曆。除非你主動啟用群組分享或私人備份，個人班表及偏好均留在裝置或瀏覽器本機。群組可使用毋須電郵或密碼的匿名雲端身份；在 1.6 及之後版本，你亦可另行連結及驗證電郵，以便復原帳戶。「朋友」中自選顯示的人物及次序按服務、帳戶和群組分開儲存，並可包括在私人備份中；在自己的畫面隱藏人物不會改變群組成員資格，亦不會限制其他成員查看已分享的更表。DutyDone 不要求手機通訊錄或公開個人檔案。請勿輸入病人資料、臨床紀錄、健康資訊或其他敏感工作資料。

顯示模式（跟隨系統、淺色或深色）是本機裝置偏好，與可包括在私人備份中的風格選擇分開。「日期格顯示上下班時間」是本機檢視偏好，可包括在私人備份中。排班時數估算由裝置按已儲存的班別時間計算，並非實際出勤或薪酬紀錄。這些顯示及時數功能繼續免費。

1.6 及之後版本可從「設定 → 支援」取得 DD 支援識別碼。此功能會沿用現有雲端身份，或經你確認及完成安全驗證後建立匿名雲端身份；這個操作不會開啟朋友功能或上載班表。服務會保存隨機產生、與雲端帳戶關聯的 DD 識別碼，讓獲授權的支援人員找到相關帳戶記錄。識別碼本身不能用作身份驗證、證明擁有權或復原帳戶。

如你向支援提供識別碼，處理要求時，你的電郵地址及來信資料便可能與該帳戶關聯。請私下向支援提供，不要公開。帳戶記錄亦可包括免費免廣告授權的狀態、修訂及更改時間，以及獲授權人員的操作、原因和請求紀錄。只有另獲指定權限的營運人員可查閱這些記錄或授予、撤銷該權益；產生或分享識別碼本身不會取得該權益。相關保留安排見下文。

「設定 → 帳戶與復原」讓你驗證電郵，以在另一裝置繼續使用同一雲端帳戶。身份驗證及電郵供應商會處理電郵地址、驗證要求及登入紀錄。單靠連結電郵不會上載私人記錄或開啟私人備份。未連結電郵的匿名身份如遺失本機登入狀態，便無法復原；已刪除帳戶亦無法還原。

私人備份須經你另行確認才會開啟，內容包括完整個人更表、私人及共享日程（包括備註和提醒選擇），以及語言、風格、月曆檢視、假期日曆、明日提醒及朋友檢視等可轉移設定。備份只供帳戶擁有人通過帳戶驗證存取，不會提供給群組成員；資料由雲端服務儲存，並非端對端加密。備份不包含登入權杖、邀請連結、廣告或使用統計同意，以及小工具快取。

復原會先預覽可用的已同步資料或所選私人備份，再由你確認取代本機記錄。只有同步資料的來源不包含私人日程或可轉移設定。新裝置會成為主要寫入裝置，舊裝置無法再以原有登入繼續雲端寫入。朋友分享須另行確認才會恢復發佈，提醒亦須在新裝置另行開啟。目前的群組成員資格、權限及帳戶贈送權益以服務上的狀態為準，備份不能重建已移除的權利。復原前的本機副本可使用七日。

DutyDone 私人備份不包含顯示模式、上班前提醒設定或排程紀錄、Apple 購買狀態、交易識別碼或本機交易處理標記。復原 DutyDone 帳戶或私人備份不會恢復 Apple 訂閱；請使用購買時的 Apple 帳戶，另行執行「恢復購買」（繁體台灣介面作「回復購買」）。

公眾假期日曆的選擇儲存在本機，毋須讀取裝置定位；假期日期隨 App 提供。所選日曆可顯示在月曆、分享的月曆圖片及桌面小工具。小工具使用已儲存個人更表及所選假期資訊的本機快照，不包含個人日程、其他成員更表或雲端帳戶資料。開啟官方來源連結時會使用瀏覽器，並適用該網站的私隱處理方式。

啟用群組後，我們會處理帳戶身份編號、每個群組中的顯示名稱、成員資格及權限、班別（包括自選的上下班時間）、值班日期、邀請狀態和必要安全紀錄。群組管理員亦可為清楚標示的虛擬人物輸入名稱、班別和逐日更表；紀錄包括建立者及最後編輯者，供群組管理和同步使用。安全功能亦會處理封鎖關係、檢舉原因、你自願提供的簡短說明、相關群組或成員及有限的指定文字，以及內容處理狀態和操作紀錄；不會把完整更表歷史複製到檢舉中。寄往支援信箱的電郵會包含你的聯絡地址及自願提供的資料。

App Store 私隱標籤的「通訊錄／聯絡人」指 DutyDone 群組成員及封鎖關係，並非手機通訊錄。DutyDone 不要求讀取手機通訊錄的權限，也不會讀取或上傳其中的聯絡人。

如果你已啟用群組分享，開啟 App 時可能會先載入群組清單，以及預設或唯一群組的當月資料，方便稍後開啟「朋友」。這些讀取沿用現有群組權限；已載入的其他成員資料只保留在記憶體，不建立持久離線副本。只使用本機個人更表時，不會發出這些群組請求。

群組的現有成員可查看彼此分享的完整更表，包括加入前及未來的安排，並受封鎖及安全措施限制。每位真人成員只能修改自己的個人更表；同一份個人更表會用於所有加入的群組。群組管理員可新增清楚標示的「虛擬人物」，為該群組代填名稱、班別和逐日更表；現有成員可查看，現任管理員可修改或刪除。虛擬人物沒有 DutyDone 帳戶、雲端身份或邀請。建立它的管理員離開後，紀錄仍屬於群組；刪除虛擬人物會移除群組目前可見的名稱、班別及更表，刪除整個群組亦會移除所屬虛擬紀錄。有限的最近同步紀錄可按下述期限保留。其他人已看過或保存的副本無法收回。如紀錄不妥，可聯絡支援。退出群組會移除該群組對離開者的存取權；刪除群組會移除其成員資格、邀請及群組紀錄，不影響其他群組或本機個人更表。

「搵日子」（繁體台灣介面作「找日子」）會在裝置上比較最多三個月內所選真人及虛擬人物的更表；未填日期不當作休假。所選人物會按群組及成員在本機記住；DutyDone 不會建立日期提案、聊天室或收件回覆的雲端紀錄。你可先核對並修改建議訊息，再選擇裝置或瀏覽器的分享方式。預設文字是一段簡短邀請，列出一至三個日期（包括星期及年份），再詢問對方哪個日子方便。預設文字不含姓名、群組名稱、班別、私人日程、邀請連結或收件者。你最後選定的文字可傳送到你選擇的服務；DutyDone 不會收取該服務的回覆。此功能不要求讀取裝置通訊錄、定位或系統行事曆的權限。

封鎖某個身份後，雙方無法在共同群組讀取彼此的班表；封鎖不會刪除值班紀錄、移除成員或轉移管理權。群組管理需要的有限身份及權限資料可能仍然保留，並在需要時顯示中性標籤。封鎖會保留至建立封鎖的一方解除封鎖，或相關身份被刪除。已看過或另存的內容無法收回。其他成員的班表不會保存在持久離線快取中，查看時需要保持連線。

其他成員無法讀取檢舉或內容處理備註。獲授權的 DutyDone 管理人員會用這些紀錄調查不當內容，並可隱藏群組或限制身份。分享文字會經過內容過濾，但可能漏判或誤判；可檢舉問題或聯絡支援提出異議。

提供雲端託管、身份驗證、網站安全及電郵服務的供應商，會處理提供你所用功能所需的資料。連線及安全紀錄可能包括 IP 位址、由此推算的城市或國家、裝置或瀏覽器資訊、驗證及請求事件、回應時間和防濫用訊號。這些資料用於營運、故障排查及保護 DutyDone，與自願使用統計分開。App Store 私隱標籤的「位置」包括這種由 IP 推算的粗略地區；DutyDone 不要求 GPS 或裝置定位權限，也不會讀取精確位置。請求 Google 橫幅廣告時，Google 亦可能按下文所述由 IP 推算粗略位置。支援電郵只由工作室負責人用於回覆及跟進要求，不用於廣告、營銷或轉交其他客服系統。DutyDone 不出售個人資料。

建立或加入群組、為 DD 支援識別碼或連結電郵而建立雲端身份，或要求復原登入時，反機械人驗證可能處理瀏覽器連線特徵及網站來源；詳見 Cloudflare Turnstile 私隱附錄。供應商的連線、驗證及安全紀錄可有不同於 DutyDone 自願使用統計的保留期限，並按適用條款及法律要求保留和刪除；如有私隱要求，請聯絡支援。

自選 Apple 訂閱

在提供訂閱的 iOS App 中，每月支持可於訂閱有效期間移除廣告。個人月曆、朋友、日程、提醒及備份功能繼續免費。Apple 透過你的 Apple 帳戶處理購買確認、付款及訂閱收費。DutyDone 的購買整合不會收到付款卡資料、Apple 帳戶密碼或 Apple 帳戶電郵地址。

DutyDone 在裝置上使用 Apple StoreKit 驗證交易及檢查訂閱狀態，會處理產品識別碼、交易及原始交易識別碼、驗證日期、到期或付款寬限期日期，以及續期狀態。目前狀態保留在記憶體中，並透過 StoreKit 重新檢查，不會成為班表資料內永久的已付款標記。App 不會把這些交易資料或收據上傳到 DutyDone 雲端服務、Google 廣告或 DutyDone 自願使用統計，亦不會把 Apple 購買與 DutyDone 雲端身份連結。

為安全記錄交易處理，App 會保留一份小型本機紀錄，最多包含最近 128 項以雜湊方式產生的交易標記。標記不能授予訂閱使用權，沒有按時間自動到期的期限；新增標記時會取代較舊項目。它們不會包括在裝置備份或 DutyDone 私人備份中。App 內重設資料及刪除雲端帳戶不會清除這份紀錄；清除裝置上的 App 儲存空間或解除安裝會移除它。

工作室只查看 Apple 的銷售、財務及訂閱總數報表，不會使用個別訂閱者活動報告。這些總數報表與 App 上傳的資料分開。Apple 的帳戶、付款及購買紀錄按其處理方式保留，詳見 App Store 與私隱說明。DutyDone 復原電郵及雲端帳戶與購買訂閱的 Apple 帳戶分開。刪除 DutyDone 資料或 App 不會取消 Apple 收費或刪除 Apple 的紀錄；恢復、管理及取消訂閱的步驟請參閱訂閱支援。

支援的原生 App 版本可能在 App 內顯示 Google Mobile Ads 橫幅廣告。App 可能連接 DutyDone 網站檢查能否顯示廣告，並產生上述連線紀錄；網頁版不會請求廣告。在 DutyDone 1.3 的 iOS App，只有取得 Apple App 追蹤透明度（ATT）授權及適用的廣告同意後，才會請求廣告。由 1.4 版本起，拒絕 ATT 本身不會關閉廣告：當 Google 的適用廣告同意要求容許請求時，App 仍可能顯示非個人化廣告。未獲 ATT 授權時，Apple 會限制存取廣告識別碼（IDFA）。App 不會把拒絕視為跨 App 追蹤的許可，並會停用 Google 的發布者第一方識別碼。無論選擇如何，更表仍可使用。Android 依適用的廣告同意要求處理。獲准請求時，App 只要求非個人化廣告，並在有需要時提供重新管理私隱選項的入口。支援的 iOS 版本可從「設定 → 追蹤權限」查看選擇，並在 iOS 允許時提出權限請求，即使橫幅廣告關閉仍可使用；打開此入口本身不會請求廣告或啟動 Google 廣告同意。你亦可在 iPhone「設定 → 私隱與安全性 → 追蹤」更改 ATT 授權，並在 App 提供廣告私隱選項時使用該選項。DutyDone 的自願使用統計是獨立選擇。

我們的廣告整合不會向 Google 傳送個人更表或日程內容、群組更表或邀請、雲端帳戶編號，亦不會傳送 DutyDone 的使用統計編號。Google 及其廣告 SDK 可能為廣告顯示、成效量度及防欺詐處理 IP 位址（及由此推算的粗略位置）、App 或裝置識別碼、廣告和 App 互動，以及效能或診斷資料。非個人化廣告仍可能使用流動裝置識別碼限制顯示次數及製作彙總報告；非個人化不等於完全不追蹤或不處理裝置資料。詳見 Google 的廣告模式說明、iOS 資料披露指引及 Android 資料披露指引。

提供使用統計選項的版本會在「設定 → 使用統計」提供預設關閉的選項。同意後，DutyDone 會收取隨機統計編號、平台、伺服器收件時間，以及指定畫面和按鈕的使用次數；不包含更表或日程內容、姓名、群組編號、邀請連結、輸入文字、定位、螢幕錄影或點擊座標。統計不需要群組身份，App 不會將統計編號與群組身份連結。

首次成功儲存個人班表並按「完成」時，App 會提供一次簡短的統計同意選擇；按「同意分享統計」前不會回報。選擇會保留，同意或不同意後均不再自動詢問，可隨時從「設定 → 使用統計」更改。拒絕或停止分享只在本機保留關閉偏好，不保留統計編號；重設所有 App 資料會清除這項偏好。

離線或失敗的統計回報會丟棄；統計編號滿 30 日後會於下次啟動時更換。只有獲授權的營運人員可讀取彙總資料。關閉選項會停止回報並移除本機統計編號；已收取資料於 30 日後到期，設定變更紀錄保留 90 日。供應商的連線及安全紀錄按其條款處理，隨機編號不代表所有連線資料均無法識別裝置。

我們亦會保留有限的建立群組及邀請嘗試次數，以防止濫用；這些紀錄不包含邀請連結或提交內容，並於 30 日後到期。使用限額可能暫停雲端操作，本機個人更表仍可使用。

本機資料會保留至你重設、清除 App 或瀏覽器資料或解除安裝，但須注意本文所述本機提醒及交易處理紀錄的例外。分享更表會在帳戶仍加入至少一個群組時保留。未連結電郵的匿名身份如從未加入群組，或離開最後一個群組，會開始 30 日清理寬限期，並受下述帳戶授權保留例外規限。刪除前會再次檢查群組資格及匿名帳戶狀態；已連結電郵的帳戶不屬這項匿名身份清理範圍。首次納入規則的既有閒置匿名身份，由規則啟用起獲至少 30 日寬限期。最近的同步及防濫用紀錄於 30 日後刪除；過期或撤銷的邀請會於 30 日後刪除；群組操作紀錄保留 90 日。

有效的免費免廣告授權可保留原已符合清理條件的匿名身份、DD 識別碼、授權記錄及有限的安全或同步紀錄，但不會延長已不屬任何群組的分享更表或日程內容的保留期；這些內容仍按一般清理規則移除。撤銷有效授權後，身份另有 30 日寬限期；兩項寬限期均已屆滿、仍未連結電郵且沒有加入任何群組時，身份才符合清理條件。撤銷授權不會延長原來的內容保留期限。已確認的雲端帳戶刪除會優先執行，並移除識別碼及授權記錄。

最新私人備份沒有七日到期限制，會保留至你刪除私人備份或帳戶；另外最多保留過去七日內的三個舊版本。較舊的歷史版本會無法使用並被清理。「停止自動備份」只停止日後上載，不會刪除已存版本。「刪除私人備份」亦會關閉自動備份，並在確認後令所有已存版本立即無法從線上服務取得。須由你再次明確開啟自動備份，才會建立新版本。刪除雲端帳戶亦會移除其私人備份。

為避免再次發送已到期的更份提醒，DutyDone 會在本機保留有限的提醒日期、嘗試時間及排程狀態紀錄，不包含班別名稱、日程內容或雲端身份。這些紀錄屬 App 內重設的例外：重設提醒設定或所有 DutyDone 資料不會清除它們；再次執行提醒排程時會清理較舊的日期紀錄。紀錄不會上傳，清除裝置上的 App 儲存空間或解除安裝會移除本機紀錄。

檢舉及內容處理操作紀錄各自最多保留至建立後 90 日。刪除帳戶時，線上安全紀錄中與其相關的說明、指定內容及可識別參照會被移除。限制保留至解除或相關身份／群組刪除。為避免復原副本令已刪除帳戶重新出現，有限的不含內容刪除標記可保留 30 日。

另行建立的應用資料災難復原副本會加密並於最多 7 日後刪除。這些營運副本與上述由用戶控制的私人備份不同，不能作為個人復原來源。供應商的操作副本按其條款保留，亦可能在資料從線上服務刪除後繼續保留。支援電郵只會在處理要求及相關跟進所需期間保留。

「設定 → 分享班表圖片」會依你要求產生圖片，再透過裝置或瀏覽器儲存或傳送。DutyDone 不會收到副本。已儲存、寄出或由他人持有的圖片須由你在相應接收位置另行處理。

啟用雲端身份後，可從「設定 → 雲端帳戶 → 刪除雲端帳戶」開始刪除。畫面會列出需要先退出或刪除的群組；最後一位管理員可轉移管理權或刪除該群組。確認後會移除雲端身份、已連結電郵的存取權、私人備份、群組快取及同步狀態，裝置上的個人班表則保留。「重設所有 DutyDone 資料」會在存在雲端身份時先完成雲端刪除，再清除本機班表及設定；失敗時可重試，未確認成功前不會直接清除個人班表。如另一裝置已成為主要寫入裝置，請先使用「帳戶與復原」，再要求刪除。

你亦可電郵至 support@waaistudio.com，申請刪除雲端帳戶、分享資料、私人備份或支援來信，毋須重新安裝 App。請參閱刪除申請指引。我們會先確認範圍及核實擁有權；單憑某個地址寄來的電郵或顯示名稱不能證明帳戶擁有權。未連結的匿名身份沒有復原電郵；如無法可靠識別身份，我們會說明限制。請勿傳送密碼、驗證碼、session token、邀請連結或身份證明文件。

更換裝置或清除 App 資料前，請先在「帳戶與復原」連結及驗證電郵；如要保留私人記錄，須另行開啟私人備份。只能還原所選雲端來源中仍然存在的資料。未連結電郵的匿名登入一旦遺失，便無法復原帳戶。已刪除帳戶不能透過電郵復原或舊備份還原。解除安裝 App 不能代替刪除雲端帳戶。

刪除 App、重設本機資料、刪除私人備份或 DutyDone 雲端帳戶，均不會取消 Apple 訂閱。請另行到 Apple 訂閱設定管理或取消。

私隱、刪除、支援或內容處理異議：support@waaistudio.com。亦可參閱支援頁面。