English version below ↓

更新日期：2026 年 10 月 27 日

BibleDiary 是一款聖經日記與經文桌布 App。這份政策說明我們如何處理你的資料。營運者：BibleDiary，聯絡信箱 contact@biblediary.app。

日記內容儲存在你的裝置上

你寫下的日記、收藏的經文、讀經計畫紀錄與代禱事項會加密儲存在裝置本機（AES-256-GCM），加密金鑰保存在 iOS Keychain 或 Android Keystore，不會離開裝置。App 不會把你的日記以明文上傳；你另外啟用下方的「跨裝置同步」時，上傳的也只有加密後的內容。代禱事項不在跨裝置同步的範圍內。唯一的例外是你自己選擇匯出的年度回顧書 PDF：裡面的日記文字與經文是可以直接閱讀的明文，只會去到你儲存或分享的地方，我們的伺服器不會收到。

日記附的照片與錄音也加密存在這台裝置上，不會上傳，不進跨裝置同步，也不會放進 iCloud 或 Google 的系統備份。它們會隨你自己匯出的加密備份檔離開裝置；此外，照片也可能以未加密的形式出現在你匯出的年度回顧書 PDF 裡。照片存進去之前會重新存成新檔，GPS 位置與拍攝資訊不會留下。刪除一篇日記或刪除帳號時，對應的照片與錄音會一起刪除。

你也可以另外開啟「日記鎖」，用生物辨識或裝置密碼保護日記畫面；這是選用功能，與資料加密分開運作。

代禱事項與主畫面小工具

一項代禱事項包含：標題、選填的備註、你選來一起禱告的經文、選填的日期、後續紀錄，以及你標記「已禱告」的日子。代禱事項存在你的裝置上，加密方式與日記相同（AES-256-GCM，金鑰在 iOS Keychain 或 Android Keystore）。它們不會上傳，不在跨裝置同步的範圍內，也不計入匿名使用統計。代禱事項依帳號分開存放；沒有登入時寫下的代禱事項，另外存在這台裝置上。

主畫面小工具預設是關閉的。如果你開啟「在小工具顯示代禱」，App 會把每一項還在代禱的事項另外複製一份給小工具：經文內容與出處、你設定的日期，以及是否已標記禱告。小工具上顯示的是一行通用文字，不是事項標題；除非你另外開啟「顯示代禱事項名稱」。開啟之後，看得到你主畫面的人都能讀到標題。備註與後續紀錄不會交給小工具。刪除一項代禱時，該事項、後續紀錄與小工具上的複本都會移除。日記鎖啟用時，小工具不會顯示代禱內容；點擊小工具會開啟 App。小工具顯示代禱時，點擊「已禱告」會記下當天日期，App 下次開啟時存進去。

小工具的這份複本存放在你裝置上 App 專屬的儲存空間（iOS 是 App Group 共用容器）。它由作業系統自己的檔案保護機制保護，不是用日記的加密金鑰加密；不會放進 iCloud 或 Google 的系統備份，也不會上傳。關閉小工具、結束一項代禱或更改標題顯示設定，都會換掉這份複本；刪除帳號會把它一起移除。

帳號與登入

BibleDiary 使用 Firebase Authentication 提供 Google 或 Apple 登入。登入後我們會取得你的帳號識別碼（User ID），以及 Google／Apple 依你的選擇提供的電子郵件地址，用來識別你的帳號、管理購買權益與同步設定。我們不會取得你的密碼。

跨裝置同步（選用，預設關閉）

你可以選擇開啟跨裝置同步，將日記、收藏的經文、讀經計畫與完成紀錄備份到雲端，以便在其他裝置繼續使用。代禱事項、照片與錄音不包含在內。這項功能採用端對端加密：資料會先在你的裝置上用只有你持有的「復原金鑰」加密，才經由我們架設在 Google Cloud Run 的服務上傳到 Firestore（資料儲存於台灣 asia-east1）。我們的伺服器只會看到加密後的內容、帳號識別碼、請求時間與資料筆數等中繼資訊，看不到日記的實際文字。加密金鑰與復原金鑰都不會被上傳，若遺失金鑰，雲端中已加密的資料將無法復原。單純登入不會自動開啟同步，需要你另外明確啟用。

匯出備份

你可以在 App 的「設定」→「備份」，把日記、草稿、收藏的經文、讀經計畫、代禱事項（含後續紀錄），以及日記附的照片與錄音匯出成一個備份檔，檔案會以你自訂的密碼加密後才寫入裝置。備份檔只存在你的裝置與你自行分享的位置，我們不會收到這份檔案。

購買

BibleDiary 的付費功能由 Apple App Store 或 Google Play 完成付款，並由 RevenueCat 協助驗證與同步購買權益。BibleDiary 與 RevenueCat 會處理你的帳號識別碼、購買的商品與平台，藉此確認你的權益；我們不會收到或保存完整的信用卡號。訂閱與免費試用由商店管理，到期自動續訂與取消都在商店的訂閱管理進行；購買前，系統商店會顯示實際價格。

匿名使用統計（預設開啟，可關閉）

為了知道哪些功能真的有人在用，以及發現技術問題，App 會記錄功能使用與技術錯誤的次數，不含日記、經文與身分。只有下面十四種時候會送出紀錄，每筆帶的內容也只有列出來的這些，沒有任何自由輸入的文字：

• App 啟動：不附帶其他內容。
• 完成首次引導流程：附上介面語言。
• 打開 Plus 頁面：附上介面語言，以及從哪裡打開。開啟位置只會是這八種之一：設定頁面（settings）；儲存、套用或收藏使用 Plus 圖片的桌布，或打開使用這類圖片的收藏（art_export）；每日換圖（daily_wallpaper）；年度回顧書（yearbook）；經文庫裡上鎖的圖片（library_tile）；選圖列裡上鎖的圖片（wallpaper_tray）；新手引導結尾（onboarding）；價值時刻提示（value_moment）。
• 沒有購買就關閉 Plus 頁面：附上介面語言，以及這次打開它的位置（上述八種之一）。
• 存下一張桌布（存到相簿，或在 Android 設為鎖定畫面）：附上桌布上的經文是中文字（zh）還是拉丁字母（en；所有使用拉丁字母的經文版本皆歸為 en），以及桌布的樣式名稱。
• 打開「怎麼設為桌布」或小工具的說明：不附帶其他內容。
• 把經文圖傳給朋友（分享面板送出之後）：不附帶其他內容。
• 買下 Plus：附上方案名稱（annual 年訂、monthly 月訂、lifetime 買斷三種之一）；如果是在 Plus 頁面上購買，也會附上這個頁面的開啟位置（上述八種之一）。不附帶帳號或任何內容。
• 從通知打開 App：附上是每日經文通知（verse_notice）還是寫日記提醒（writing_reminder）。
• 開始今日靈修：不附帶其他內容。
• 走完今日靈修（按下最後的「完成」，或在最後一步設為桌布）：不附帶其他內容。
• 把一天的讀經計畫標為已讀：附上計畫的固定代號（內建計畫是 whole-bible、new-testament、gospels、psalms、proverbs、genesis、john、acts 其中之一，自訂計畫一律記為 custom）和第幾天的數字，不附計畫名稱與經文範圍。
• 存下一篇日記（新增或修改）：只附上它是從今日靈修來的（flow）還是直接寫的（direct），不含長度、日期、經文或內容。
• App 發生錯誤或未處理的 Promise 拒絕：只附上固定的技術錯誤名稱（例如 TypeError、Error 或 UnhandledRejection）與彙總次數，每次頁面工作階段最多計入 10 次。自訂錯誤名稱、錯誤訊息、堆疊、網址、檔名、行號與使用者內容都不會傳送。

其中跟習慣有關的幾筆（通知、今日靈修、讀經計畫、日記）只表示該動作發生過；讀經計畫另外帶計畫代號與第幾天，除此之外沒有日記、代禱、經文或計畫內容。

這些紀錄只會送到開發者自己架設在 Cloudflare 上的伺服器（biblediary.app），沒有經過任何第三方分析服務。每台裝置在第一次開啟 App 時會產生一組隨機編號，跟著每筆紀錄送出；伺服器收到後，會立刻把它和一組祕密鹽值、當週週次一起雜湊，只留下雜湊值的前 16 個字元，連同收到的時間存下。原始編號不會被儲存，雜湊值每週都會換一組，無法跨週追蹤同一台裝置。它與你的 email、帳號、裝置識別碼或廣告識別碼都無關。我們不會收到你的日記、經文、姓名、檔名或錯誤訊息。你可以隨時在 App 的「設定」→「隱私」關閉「分享匿名使用統計」，關閉後就不會再送出任何一筆。

協助我們提供服務的廠商

• Google Firebase：Google／Apple 登入（Firebase Authentication），以及跨裝置同步的密文儲存（Firestore）與刪除帳號；我們的同步與刪除帳號服務執行在 Google Cloud Run。
• RevenueCat：驗證與同步 Plus 的購買權益。
• Cloudflare：代管 biblediary.app 網站、接收上述匿名使用次數，以及提供 App 下載的桌布圖片（攝影與插畫）與字體檔。
• Sentry（Functional Software, Inc.）：接收 App 的當機與錯誤報告，讓我們找出並修正問題。報告包含錯誤類型、程式堆疊、App 版本、裝置型號與系統版本，以及 App 是否卡住或異常結束；不含帳號、email、日記、代禱或經文內容，錯誤訊息裡引號內的文字會先在手機上遮掉。

日記內容不會以明文交給上述任何一家。

我們不會做的事

• 不會在背景讀取或掃描你的日記內容。
• 不會把日記內容傳給任何第三方，也不會拿去訓練模型。
• 不會出售你的個人資料。
• 沒有廣告，也沒有跨 App 或跨網站的追蹤。上述匿名使用統計只計算功能被使用的次數。

刪除帳號與資料

你可以在 App 的「設定」→「帳號」永久刪除帳號。刪除時會一起移除：我們伺服器上這個帳號的加密同步資料、你的登入帳號（用 Apple 登入的，也會撤銷 Apple 的登入授權），以及這台裝置上屬於這個帳號的日記、收藏、讀經計畫、代禱事項與小工具上的複本、照片與錄音和提醒設定。確認刪除前，App 會提醒你先匯出備份；刪除後無法復原。沒有登入時寫下的日記與代禱事項不屬於任何帳號，只存在這台裝置上，解除安裝 App（或在裝置設定中清除 App 資料）就會一併清除。App Store／Google Play 的購買紀錄由商店保管，刪除帳號不會影響你在商店已完成的購買。

兒童隱私

BibleDiary 不是針對兒童設計的 App，我們不會刻意收集兒童的個人資料。

政策更新

若本政策有重大變更，我們會更新本頁的「更新日期」，並視情況在 App 內另行通知。

聯絡方式

如對隱私權、資料存取或刪除有任何問題，請寄信至 contact@biblediary.app。

---

BibleDiary Privacy Policy

Last updated: October 27, 2026

BibleDiary is a Bible journal and verse wallpaper app. This policy explains how we handle your data. Operator: BibleDiary, contact contact@biblediary.app.

Your journal stays on your device

Your journal entries, bookmarks, reading-plan records and prayer requests are encrypted and stored locally on your device (AES-256-GCM); the encryption key is kept in iOS Keychain or Android Keystore and never leaves your device. The app never uploads your journal text in readable form; cross-device sync below, which you turn on yourself, uploads only encrypted content. Prayer requests are not part of cross-device sync. The one exception is a year book PDF you choose to export: it contains your journal text and verses in readable form, and it goes only where you save or share it; our servers do not receive it.

Photos and voice notes attached to entries are encrypted on this device too. They are never uploaded, never part of cross-device sync, and kept out of iCloud and Google system backups. Both leave the device in an encrypted backup you export yourself; photos can also appear, unencrypted, in a year book PDF you export. Photos are saved as new files before they are stored, so GPS location and camera data are not kept. Deleting an entry, or your account, deletes the photos and voice notes that belong to it.

You can also optionally enable a Journal Lock, protected by biometrics or your device passcode. This is a separate, opt-in feature.

Prayer requests and the home-screen widget

A prayer request is a title, optional details, the verse you chose to pray with, an optional date, follow-up notes, and the days you marked as prayed. Prayer requests are stored on your device and encrypted the same way as your journal (AES-256-GCM, key in iOS Keychain or Android Keystore). They are never uploaded, are not part of cross-device sync, and are not counted in the anonymous usage counts. Requests are kept per account on the device; requests written while not signed in are kept separately on this device.

The home-screen widget is off by default. If you turn on "Send prayers to the widget", the app gives the widget a separate copy of each request you are still praying for: the verse text and reference, the date if you set one, and whether you have marked it prayed. The widget shows a generic line instead of the request's title unless you also turn on "Show prayer titles"; if you turn that on, anyone who can see your home screen can read the title. Details and follow-up notes are never given to the widget. Deleting a request also removes its follow-up notes and widget copy. When Journal Lock is on, the widget shows no prayer content; tapping it opens the app. When the widget is showing a request, tapping its "Prayed" button records the day, and the app saves it the next time it opens.

The widget's copy is kept in app-private storage on your device (the shared app group container on iOS). It is protected by the operating system's own file protection, not by the journal encryption key, it is kept out of iCloud and Google system backups, and it is never uploaded. Turning the widget off, ending a request or changing the title setting replaces the copy; deleting your account removes it.

Account and sign-in

BibleDiary uses Firebase Authentication for Google or Apple sign-in. After you sign in, we receive your account identifier (User ID) and the email address Google/Apple chooses to share, used to identify your account and manage purchase entitlements and sync settings. We never receive your password.

Cross-device sync (optional, off by default)

You may choose to enable cross-device sync to back up entries, bookmarks, reading plans and completion records to the cloud so you can continue on another device. Prayer requests, photos and voice notes are not included. This feature is end-to-end encrypted: data is encrypted on your device with a recovery key that only you hold, before being uploaded through our service on Google Cloud Run to Firestore (stored in Taiwan, asia-east1). Our servers only see the encrypted content plus metadata such as account ID, request time and record counts — never the plaintext of your journal. Neither the encryption key nor the recovery key is ever uploaded; if you lose it, encrypted cloud data cannot be recovered. Signing in alone never turns sync on; you must enable it explicitly.

Exported backups

In the app's Settings → Backup you can export your entries, drafts, bookmarks, reading plans, prayer requests (with their follow-up notes) and the photos and voice notes attached to entries as one backup file; the file is encrypted with a password you choose before it is written to your device. Backup files stay on your device and wherever you choose to share them; we never receive a copy.

Purchases

Paid features in BibleDiary are billed through the Apple App Store or Google Play, and RevenueCat helps verify and sync your purchase entitlement. BibleDiary and RevenueCat process your account identifier, purchased product and platform to confirm your entitlement; we never receive or store your full card number. Subscriptions and free trials are managed by the store, including automatic renewal and cancellation in its subscription settings; the store shows the actual price before purchase.

Anonymous usage counts (on by default, can be turned off)

So we can tell which features people actually use and identify technical problems, the app counts feature uses and technical errors. Never your entries, verses, or identity. Records are sent only at the fourteen moments below, carry only what is listed, and never include free-typed text:

• The app starts: nothing else is attached.
• You complete onboarding: the interface language.
• You open the Plus page: the interface language, and where it was opened from. There are only eight possible places: Settings (settings); saving, applying or favoriting a wallpaper with a Plus picture, or opening a favorite that uses one (art_export); daily wallpaper change (daily_wallpaper); the year book (yearbook); a locked picture in the Library (library_tile); a locked picture in the wallpaper tray (wallpaper_tray); the end of onboarding (onboarding); and a value-moment prompt (value_moment).
• You close the Plus page without buying: the interface language, and where that page was opened from (one of the same eight places).
• You save a wallpaper (to your photos, or as the lock screen on Android): whether the verse on it is in Chinese ("zh") or in Latin script ("en", used by all Latin-script translations), and the name of the wallpaper style.
• You open the "How to set it" or widget instructions: nothing else is attached.
• You send a verse picture to a friend (once the share sheet completes): nothing else is attached.
• You buy Plus: the plan name (one of three: annual, monthly or lifetime) and, when you buy on the Plus page, where that page was opened from (one of the same eight places). Nothing about your account or your content is attached.
• You open the app from a notification: whether it was the daily verse notification (verse_notice) or the writing reminder (writing_reminder).
• You start 今日靈修, the guided daily devotion: nothing else is attached.
• You finish the guided daily devotion (tap the final "Done", or set the wallpaper on its last step): nothing else is attached.
• You mark a reading-plan day as done: the plan's fixed code (for the built-in plans, one of whole-bible, new-testament, gospels, psalms, proverbs, genesis, john or acts; any plan you made yourself is recorded as custom) and the day number. The plan's name and its passages are not sent.
• You save a journal entry (new or edited): only whether it came from the guided devotion (flow) or was written directly (direct), with no length, date, verse or content.
• An app error or an unhandled promise rejection occurs: only fixed technical error names (for example, TypeError, Error or UnhandledRejection) and aggregated occurrence counts, with at most 10 occurrences counted per page session. Custom error names, messages, stack traces, URLs, file names, line numbers and user content are never sent.

The records about your daily habits (notifications, the guided devotion, reading plans and entries) only say that the action happened; a reading plan adds its code and the day number, and nothing else. There is no entry, prayer, verse or plan content in any of them.

These records go only to the developer's own server at biblediary.app, hosted on Cloudflare; no third-party analytics service is involved. Each device generates a random number the first time the app opens and sends it with every record. On arrival the server hashes it together with a secret salt and the current week, and keeps only the first 16 characters of that hash, with the time it arrived. The original number is never stored, and the hash changes every week, so one device cannot be followed from one week to the next. It is unrelated to your email, your account, your device identifier or any advertising identifier. We never receive your entries, verses, name, file names or error messages. You can turn "Share anonymous usage counts" off at any time in the app under Settings → Privacy, and nothing further is sent.

Service providers

• Google Firebase: Google or Apple sign-in (Firebase Authentication), storage of encrypted sync data (Firestore), and account deletion. Our sync and account-deletion service runs on Google Cloud Run.
• RevenueCat: verifies and syncs your Plus purchase.
• Cloudflare: hosts the biblediary.app website, receives the anonymous usage counts above, and serves the wallpaper pictures (photographs and illustrations) and font files the app downloads.
• Sentry (Functional Software, Inc.): receives the app's crash and error reports so we can find and fix problems. A report carries the error type, stack trace, app version, device model and OS version, and whether the app froze or quit unexpectedly; it never carries your account, email, journal, prayers or verses, and quoted text in error messages is masked on the phone first.

None of them receives your journal content in readable form.

What we don't do

• We do not read or scan your journal content in the background.
• We do not send your journal content to any third party, and we do not use it to train models.
• We do not sell your personal data.
• No advertising, and no tracking across apps or websites. The anonymous usage counts above only count how often features are used.

Deleting your account and data

You can permanently delete your account in the app under Settings → Account. This removes the account's encrypted sync data from our servers and your sign-in account (if you signed in with Apple, that authorization is revoked too), and, on this device, the entries, bookmarks, reading plans, prayer requests, the widget's copy of them, photos, voice notes and reminder settings that belong to the account. Before you confirm, the app reminds you to export a backup first; a deletion cannot be undone. Entries and prayer requests written while not signed in belong to no account and live only on this device; uninstalling the app (or clearing its data in your device settings) removes them. Purchase records are held by the App Store and Google Play; deleting your account does not affect a purchase you already made there.

Children's privacy

BibleDiary is not directed at children, and we do not knowingly collect personal data from children.

Changes to this policy

If we make material changes to this policy, we will update the date above and, where appropriate, notify you in the app.

Contact

For any privacy, access or deletion questions, contact contact@biblediary.app.