Dear Elsewhere

版本：2026-10-29 · 生效日期：2026 年 10 月 29 日

一、隐私政策

本政策依据欧盟《通用数据保护条例》（GDPR）编写，说明 Dear Elsewhere（下称「本服务」）收集哪些个人数据、为什么收集、交给谁处理、保存多久，以及你享有的权利。

1. 数据控制者与联系方式

本服务由 【运营者姓名】 个人运营，是你个人数据的控制者。与隐私有关的任何请求，请发邮件至 privacy@dear-elsewhere.com，我们会在 30 天内答复。

2. 我们处理哪些数据

我们不使用广告、分析或追踪 Cookie，不出售数据，不做用户画像，也不进行自动化决策。上传照片时，应用会在你的设备上重新编码图片，原图中的 EXIF 信息（包括拍摄位置 GPS）会被去除。

3. 谁能看到你的数据

• 所有登录用户：你的用户 ID、名字、国家、头像（为了让朋友能按 ID 加你）。
• 你的好友：你的全部打卡、照片及其评论。只有互相确认的好友才能看到，你可以随时删除好友。
• 私信：只有收发双方能看到。
• 群聊：群名、成员名单和消息只有群成员能看到，新成员看不到入群之前的消息；你转发到群里的章，群成员能看到那几张照片，退群后就看不到了。群成员能看到你读到了哪条消息（「几人已读」）。
• 只有你自己：邮箱、生日，以及你在设置里选的语言和主题色。

4. 数据处理者（代我们处理数据的服务商）

以上服务商均与我们签有符合 GDPR 第 28 条的数据处理协议。数据传到欧盟以外（例如美国）时，依据欧盟委员会的标准合同条款（SCC）和/或欧美数据隐私框架（EU-US DPF）提供保护。

5. 地图与地点搜索

为了显示地图和搜索地点，你的浏览器会直接向以下服务请求数据，对方会收到你的 IP 地址，以及你正在查看的地图区域或搜索词：

• 天地图（中国，国家基础地理信息中心）：中国境内的底图、卫星图，以及盖章时查询地名、搜索地点
• Esri（美国）：国际底图，以及中国境外的地名查询和地点搜索

这些服务商独立负责自己的数据处理，请参阅它们各自的隐私政策。你可以在地图右上角切换底图。请注意：中国目前没有欧盟的「充分性认定」。

6. 保存期限

• 账号数据保存到你注销账号为止。注销后立即删除，数据库备份中的副本最迟在 30 天内被覆盖。
• 你删除的单条打卡会留下一个不含内容的删除标记，用来同步到你的其他设备；照片会立即删除。
• 服务器日志由服务商保存，一般不超过 90 天。

7. 安全措施（GDPR 第 32 条）

• 传输加密：所有连接只使用 HTTPS（TLS）。
• 存储加密：数据库和照片存储使用 AES-256 磁盘加密；备份同样加密。
• 密码只保存 bcrypt 哈希，任何人（包括我们）都看不到原始密码。
• 数据库对每张表启用行级权限（RLS），每个请求都按「只能访问自己和好友授权的数据」校验；照片存放在私有存储桶中，只有你本人登录后、或你的好友通过短时有效的签名链接才能访问。
• 注册需要邀请码；生产环境的密钥不会出现在网页代码中。
• 你的打卡还会缓存在你自己设备的浏览器（IndexedDB）中，方便离线使用。请勿在公共设备上保持登录。

如果发生可能危害你权利的数据泄露，我们会在知悉后 72 小时内报告监管机构，并及时通知受影响的用户。

8. 你的权利

你随时可以行使以下权利：

• 访问与可携带（第 15、20 条）：在「设置 → 数据」中点「下载我的数据」，获得账号、好友、评论、私信、群聊的 JSON 文件；点「导出备份」获得全部打卡和照片；点「下载照片」按年份和地点打包照片。
• 更正（第 16 条）：在「编辑资料」和各条打卡中直接修改。
• 删除（第 17 条）：在「设置 → 数据」中点「注销账号」，你的账号、资料、打卡、照片、好友关系、评论、私信和你在群里发的消息会被立即永久删除。
• 限制处理、反对处理（第 18、21 条）以及撤回同意（第 7 条）：发邮件给我们。撤回同意不影响撤回前处理的合法性。
• 投诉（第 77 条）：你可以向你所在欧盟成员国的数据保护监管机构投诉。

9. 本地存储

本服务只使用功能所必需的浏览器存储：登录凭证、界面语言和主题色、同步进度、离线打卡缓存。这些数据不会用于追踪，所以无需征得 Cookie 同意。

10. 年龄要求

你必须年满 16 周岁才能注册。如果我们得知未满 16 周岁的用户注册，将删除其账号。

二、服务条款

1. 服务内容

Dear Elsewhere 是一个记录旅行足迹的个人项目，目前仅限受邀用户使用、免费提供。注册即表示你同意本条款和上面的隐私政策。

2. 账号

• 注册需要有效的邀请码和你能收信的邮箱。请妥善保管密码，你需要对自己账号下的操作负责。
• 每人只能注册一个账号，不得转让。

3. 你的内容

• 你上传的照片、文字和打卡的所有权归你。
• 你授予我们一项有限许可：仅为向你和你选择的好友提供服务，而存储、处理和展示这些内容。账号注销时，这项许可随之终止。
• 请只上传你有权分享的内容。不得上传违法内容、侵犯他人权利或隐私的内容（例如未经同意的他人私密照片）、骚扰或仇恨内容。

4. 使用规范

不得攻击、扫描或干扰服务，不得绕过权限访问他人数据，不得批量注册或用自动化手段滥用服务，不得用本服务发送垃圾信息。

5. 暂停与终止

你可以随时注销账号。如果你严重违反本条款，我们可以暂停或删除你的账号，并尽可能事先通知你。本服务作为个人项目可能停止运营；停止前我们会至少提前 30 天通知，让你有时间导出数据。

6. 免责声明

本服务按「现状」免费提供，我们会尽力保证服务稳定、数据安全，但不保证不中断或没有错误。建议定期导出备份。在法律允许的最大范围内，我们不对间接损失承担责任；但这不排除或限制因故意、重大过失，或造成人身伤害而依法应承担的责任，也不影响你作为消费者依法享有的强制性权利。

7. 条款变更

条款发生重要变化时，我们会在应用内或通过邮件提前通知，并在需要时请你重新同意。

8. 适用法律

本条款适用运营者所在地法律；如果你是欧盟消费者，仍享有你居住国法律提供的强制性保护。

Version 2026-10-29 · Effective 29 October 2026

1. Privacy Policy

This policy follows the EU General Data Protection Regulation (GDPR). It explains which personal data Dear Elsewhere (“the service”) collects, why, who processes it, how long it is kept, and what rights you have.

1. Controller and contact

The service is run by 【Operator name】 as an individual, who is the controller of your personal data. For any privacy request, email privacy@dear-elsewhere.com. We reply within 30 days.

2. What we process

We use no advertising, analytics or tracking cookies. We do not sell data, build profiles or make automated decisions about you. Photos are re-encoded on your device before upload, which strips EXIF metadata, including GPS location.

3. Who can see your data

• All signed-in users: your handle, name, country and avatar (so friends can add you).
• Your friends: all your check-ins, photos and their comments. Only friends you have both confirmed can see them, and you can remove a friend at any time.
• Messages: only the sender and the recipient.
• Group chats: the group name, member list and messages are visible only to members, and new members can’t see messages from before they joined. Members can see the photos of a stamp you share in the group until they leave. Members can also see how far you have read (“Read by 3”).
• Only you: your email, birthday, and the language and theme you chose in Settings.

4. Processors

Each processor is bound by a data processing agreement under Art. 28 GDPR. Transfers outside the EU (e.g. to the US) are protected by the European Commission’s Standard Contractual Clauses and/or the EU-US Data Privacy Framework.

5. Maps and place search

To show maps and search for places, your browser contacts these services directly. They receive your IP address and the map area or search term you are viewing:

• Tianditu (China, National Geomatics Center of China): base map and satellite imagery inside China, plus place-name lookup and place search there
• Esri (USA): international base map, plus place-name lookup and place search outside China

Each of these services is responsible for its own processing; see their privacy policies. You can switch base maps from the top-right corner of the map. Note that China has no EU adequacy decision.

6. Retention

• Account data is kept until you delete your account. It is then deleted immediately; copies in database backups are overwritten within 30 days.
• When you delete a single check-in, an empty deletion marker is kept so the deletion syncs to your other devices. Its photos are deleted at once.
• Server logs are kept by our providers, normally for no more than 90 days.

7. Security (Art. 32 GDPR)

• Encryption in transit: HTTPS (TLS) only.
• Encryption at rest: the database, photo storage and backups use AES-256 disk encryption.
• Passwords are stored only as bcrypt hashes. Nobody, including us, can see your password.
• Row-level security on every table checks each request, so you can access only your own data and what friends have shared with you. Photos are in a private bucket, reachable only by you when signed in or by your friends through short-lived signed links.
• Sign-up requires an invite code. Production secrets are never shipped in the web page.
• Your check-ins are also cached in your own browser (IndexedDB) for offline use. Do not stay signed in on shared devices.

If a breach is likely to put your rights at risk, we will notify the supervisory authority within 72 hours of becoming aware of it, and tell affected users without undue delay.

8. Your rights

• Access and portability (Art. 15, 20): in Settings → Data, use “Download my data” for a JSON file of your account, friends, comments, messages and group chats, “Export backup” for all check-ins and photos, and “Download photos” to save photos by year and place.
• Rectification (Art. 16): edit your profile and check-ins directly.
• Erasure (Art. 17): use “Delete account” in Settings → Data. Your account, profile, check-ins, photos, friendships, comments, messages and group messages you sent are permanently deleted at once.
• Restriction, objection (Art. 18, 21) and withdrawing consent (Art. 7): email us. Withdrawing consent does not affect processing that happened before.
• Complaint (Art. 77): you can complain to the data protection authority of your EU member state.

9. Local storage

We use only strictly necessary browser storage: your sign-in session, interface language and theme, sync progress and offline check-in cache. None of it is used for tracking, so no cookie consent is needed.

10. Age

You must be at least 16 years old to sign up. If we learn that someone under 16 has signed up, we will delete the account.

2. Terms of Service

1. The service

Dear Elsewhere is a personal project for recording your travels. It is currently invite-only and free. By signing up you agree to these terms and the privacy policy above.

2. Your account

• Sign-up requires a valid invite code and an email address you can receive mail at. Keep your password safe; you are responsible for activity on your account.
• One account per person. Accounts may not be transferred.

3. Your content

• You own the photos, text and check-ins you upload.
• You give us a limited licence to store, process and display them, only to provide the service to you and the friends you choose. The licence ends when you delete your account.
• Only upload content you have the right to share. Do not upload anything illegal, anything that infringes other people’s rights or privacy (such as private photos of others without consent), or harassing or hateful content.

4. Acceptable use

Do not attack, scan or disrupt the service, bypass permissions to reach other people’s data, mass-register or abuse it with automation, or use it to send spam.

5. Suspension and termination

You can delete your account at any time. If you seriously breach these terms, we may suspend or delete your account, with notice where possible. As a personal project the service may shut down; if so, we will give at least 30 days’ notice so you can export your data.

6. Disclaimer

The service is provided free and “as is”. We do our best to keep it running and your data safe, but cannot promise it will be uninterrupted or error-free, so please export backups regularly. To the extent permitted by law we are not liable for indirect losses. This does not exclude or limit liability for intent, gross negligence or personal injury, or your mandatory rights as a consumer.

7. Changes

We will tell you in the app or by email before material changes take effect, and ask for your consent again where required.

8. Governing law

These terms are governed by the law of the operator’s place of residence. If you are an EU consumer, you keep the mandatory protections of the law of your country of residence.