1. Who we are一、我们是谁
TripHipo is an iPhone app made by an independent developer. This policy covers the app and this website. Contact: [email protected].TripHipo 是一款由独立开发者制作的 iPhone 应用。本政策适用于该 App 和本网站。联系方式：[email protected]。
2. What stays on your device二、留在你设备上的数据
All of the following is stored only in the app's own storage on your iPhone. We cannot see it, and it is not backed up to us:以下所有内容只存放在你 iPhone 上 App 自己的存储空间里。我们看不到，也不会备份到我们这里：
- Trips, daily plans, places, dates and travel companions you add你添加的行程、每日安排、地点、日期和同行人
- Expenses, budgets and currency settings支出、预算和币种设置
- Saved guides and the links or text you pasted in收藏的攻略，以及你粘贴进来的链接或文案
- Bookings, vouchers, passport and document photos, and emergency notes预订、凭证、证件照片和紧急信息
- Your conversations with the hippo planner你和河马规划师的对话记录
Document photos are additionally protected by Face ID or your passcode. If your iPhone backs up to iCloud, this data may be included in that backup — that is Apple's backup, under your Apple Account, not ours.证件照片额外受 Face ID 或密码保护。如果你的 iPhone 开启了 iCloud 备份，这些数据可能被包含在该备份中——那是苹果的备份，在你自己的 Apple 账户下，与我们无关。
3. Your anonymous account三、你的匿名账号
The first time you use something that needs our server — asking the hippo, publishing a trip, travelling together — the app creates an account for you in the background. There is no sign-up: no email, no password, no name, no phone number. It is a random identifier and nothing else.第一次用到需要我们服务器的功能时——问河马、发布行程、开同行——App 会在后台给你建一个账号。没有注册流程：没有邮箱、没有密码、没有姓名、没有手机号。它就是一串随机标识，仅此而已。
It exists for three reasons: a published trip needs an author, a shared trip needs to know who is in it, and the free allowances have to be counted against someone. If you give yourself a display name, that name is stored with the account and shown on trips you publish — it is the one piece of the account you choose.它存在的理由有三个：发布的行程得有个作者，共享的行程得知道谁在里面，免费额度得记在某个人头上。如果你给自己起了一个昵称，这个昵称会和账号一起保存，并显示在你发布的行程上——那是账号里唯一由你决定的部分。
Because it is anonymous, it lives on this phone only. We have no way to recognise you on a new device, and no way to give the account back if the phone is lost. Delete it any time: Menu → Data & privacy → Delete my account.正因为它是匿名的，它只存在于这台手机上。我们没有办法在新设备上认出你，手机丢了也无法找回。随时可以删除：侧边栏 → Data & privacy → Delete my account。
4. What the hippo planner sends, and where四、河马规划师发送什么、发到哪
When you send a message to the hippo planner, the following goes out over an encrypted connection:当你给河马规划师发消息时，以下内容会通过加密连接发出：
- The message you typed or dictated, and the recent messages in that conversation你输入或口述的那条消息，以及该对话中最近的几条消息
- Only if you turn on "Use my trip": a summary of that trip — its name, destination, dates and the plans already on it仅当你打开「带上我的行程」时：该行程的概要——名称、目的地、日期，以及已有的安排
- When you ask the planner to change a trip, the details of the change it proposes当你让规划师修改行程时，它所提议的改动内容
The request passes through our own relay server, hosted on Supabase in Singapore, and on to the language model provider, Volcano Engine Ark (Beijing Volcano Engine Technology Co., Ltd.), whose servers are in mainland China. The relay exists so that no API key has to be stored on your phone, and so that the app keeps working when a model is retired. It forwards the request and the reply; it does not keep a copy of your conversation. What it does record is described in section 8.请求会先经过我们自己的中转服务器（部署在 Supabase 新加坡区域），再转发给语言模型服务商火山方舟（北京火山引擎科技有限公司），其服务器位于中国大陆。设中转的目的，是让 API 密钥不必存放在你的手机上，也让模型下线时 App 还能继续工作。它只负责转发请求和回复，不保存你的对话副本。它确实记录的东西，见第八节。
Because your message is processed by that provider, please don't type anything into the planner you wouldn't want a third party to process — passport numbers, card numbers, or other people's personal details. The app never sends your expenses, document photos, contacts, or precise location to the planner.由于你的消息会由该服务商处理，请不要在规划师里输入你不希望第三方处理的内容——护照号、卡号，或其他人的个人信息。App 不会把你的账本、证件照片、通讯录或精确位置发给规划师。
5. Microphone and speech五、麦克风与语音
Speaking to the planner uses Apple's on-device speech recognition. The audio never leaves your iPhone and we never receive a recording. The resulting text is then handled exactly like anything you typed.对河马说话使用的是苹果的端上语音识别。录音不会离开你的 iPhone，我们也拿不到任何录音。识别出的文字随后与你手打的文字一视同仁。
The microphone is also used for face-to-face conversation translation, which follows the same rule.麦克风同样用于面对面的对话翻译，规则相同。
6. Camera, photos and location六、相机、照片与位置
- Camera and photo library: used to capture or pick images for translation, guides and vouchers. Images are processed on your device. Text translation may use Apple's on-device translation, or — if that language isn't available offline — the text is sent to the planner as described in section 4. The image itself is never uploaded.相机与相册：用于拍摄或选取图片，做翻译、存攻略和凭证。图片在你的设备上处理。文字翻译优先使用苹果的端上翻译；若该语言无法离线翻译，则按第四节的方式把文字发给规划师。图片本身不会被上传。
- Location: used only while you're using the app, to find places near you and to open navigation. Your location is handled by Apple Maps on your device and is not sent to us or stored.位置：仅在你使用 App 时用于查找附近地点和发起导航。位置由设备上的苹果地图处理，不会发给我们，也不会被存储。
7. Trips you publish, and trips you share七、你发布的行程，和你共享的行程
Publishing. Publishing a trip as a Creation puts its route on our servers, and only when you tap publish. What goes up is the route: day structure, place names, times and the notes you wrote, plus the title and the display name you chose. What never goes up, published or not: your spending, bookings, vouchers, travel buddies, saved documents and photos.发布。把行程发布成一份 Creation，会把它的路线放到我们的服务器上，而且只在你点击发布时发生。上传的是路线本身：天数结构、地点名称、时间，以及你写的备注，加上标题和你选的昵称。无论发不发布都不会上传的：你的账目、预订、凭证、同行人、保存的证件和照片。
Anyone holding the Creation's code or link can open it, so treat a published trip as public. You can take it down at any time, which stops it resolving for everyone; copies already cloned into someone else's app stay with them, because those are now their trips.任何拿到该 Creation 短码或链接的人都能打开它，所以请把已发布的行程当作公开内容。你可以随时下架，下架后它对所有人都不再解析；但别人已经复刻到自己 App 里的副本会留在他们那儿，因为那已经是他们自己的行程了。
Travelling together. Opening a trip up to the people coming with you puts the same kind of route data on our servers, visible to the people who joined with your code. Money stays on each person's own phone; what is shared is the days and the plans. Close the trip and it stops being reachable.同行。把行程开放给同行的人，同样会把这一类路线数据放到我们的服务器上，对用你的码加入的人可见。账目留在各自的手机上，共享的是日程和安排。关闭同行后，它就不再可达。
We do not tolerate objectionable content. Every published trip carries a report button, and you can block an author so that nothing they publish reaches you again. We review reports and remove content that breaks these rules, and we block accounts that repeat it. If you believe something should come down, report it in the app or write to [email protected].我们不容忍违规内容。每个已发布的行程都有举报入口，你也可以屏蔽某个作者，让他发布的一切都不再出现在你这里。我们会审核举报，移除违规内容，并封禁屡次违规的账号。如果你认为某内容应当下架，请在 App 内举报，或写信到 [email protected]。
8. What we keep on our servers, and for how long八、我们在服务器上留下什么、留多久
Alongside the content you chose to publish or share, we keep two small operational records. Both are tied to the anonymous account id and to nothing else — no name, no email, no device identifier, no advertising id.除了你主动发布或共享的内容之外，我们还会保留两类很小的运行记录。两者都只关联匿名账号 id，不关联别的——没有姓名、没有邮箱、没有设备标识、没有广告 id。
- A line per AI request, kept 180 days. Which kind of request it was, which model answered, whether it succeeded, how long it took, how many tokens it used, and a one-way fingerprint of the prompt. Not the text you wrote — the fingerprint cannot be turned back into it. This is how we see what the service costs and spot a stolen key being run in a loop.每次 AI 请求一行，保留 180 天。请求属于哪一类、哪个模型回答的、成功与否、耗时多久、用了多少 token，以及提示词的一段单向指纹。不包含你写的文字——那段指纹无法还原成原文。我们靠它看清服务的成本，并发现被盗的密钥在循环调用。
- A line per view or clone of a published trip, kept 90 days. Counts for the author, plus — if it is the first code a brand-new install ever uses — a note of which trip brought you here.已发布行程每次被打开或复刻一行，保留 90 天。用于给作者看的计数；如果这是一个全新安装首次使用的码，还会记下是哪份行程把你带来的。
Deleting your account removes your published trips, your codes, your shared trips and your allowance counters. The two operational records above are kept but the account id is erased from them, so they no longer point at anyone.删除账号会清除你发布的行程、你的码、你共享的行程和你的额度计数。上述两类运行记录会保留，但其中的账号 id 会被抹掉，因此它们不再指向任何人。
9. What we do not do九、我们不做的事
- No advertising, and no sale or sharing of data with advertisers or data brokers没有广告，不向广告商或数据经纪商出售、共享任何数据
- No third-party analytics or attribution SDKs, and no tracking across other apps or websites不接入任何第三方统计或归因 SDK，不跨 App、跨网站追踪
- No profile of you, and no use of your content to train any model不建立关于你的画像，不用你的内容训练任何模型
- No email address, phone number or real name is ever asked for or stored从不索取、也不存储邮箱、手机号或真实姓名
10. This website十、本网站
This site is hosted on Cloudflare Pages. It sets no cookies and runs no analytics. Fonts are served from this site itself, not from a third party. Cloudflare processes standard request data (such as IP address) to serve pages and block abuse; see Cloudflare's own privacy documentation. The language toggle stores your choice in your browser only. A Creation page (/h/…) asks our server for that trip's title, cities and author name so it can show you what you were sent — nothing about you is sent with that request.本站托管在 Cloudflare Pages。不设置 Cookie，不运行任何统计。字体由本站自己提供，不走第三方。Cloudflare 会处理标准的请求数据（如 IP 地址）以提供服务和防止滥用，详见 Cloudflare 自己的隐私说明。语言切换只把你的选择存在你自己的浏览器里。Creation 页面（/h/…）会向我们的服务器查询该行程的标题、城市和作者昵称，以便把别人发给你的东西显示出来——这个请求不携带任何关于你的信息。
11. Children十一、儿童
TripHipo is not directed at children under 13, and we do not knowingly collect information from them. The app asks for no personal information at any point.TripHipo 不面向 13 岁以下儿童，我们也不会有意收集他们的信息。App 在任何环节都不索取个人信息。
12. Your choices十二、你的选择
- Delete the account: Menu → Data & privacy → Delete my account. Removes everything we hold in the cloud, immediately and for everyone.删除账号：侧边栏 → Data & privacy → Delete my account。立刻清除我们云端持有的全部内容，对所有人生效。
- Delete what's on the phone: delete the app. Your trips are local, so removing TripHipo removes them.删除手机上的数据：删除 App。行程都在本地，卸载即清除。
- Revoke a permission: iOS Settings → TripHipo. Turning off the microphone, camera, photos or location disables those features but keeps everything else working.撤回权限：系统设置 → TripHipo。关闭麦克风、相机、照片或位置只会停用对应功能，其余照常使用。
- Stay entirely local: if you never open the hippo planner, never publish and never travel together, nothing is sent anywhere and no account is ever made.完全本地使用：只要你不打开河马规划师、不发布、不开同行，就不会有任何内容发出，也不会创建任何账号。
- Ask us anything: to request access, correction or deletion, or to exercise rights under GDPR, CCPA or China's PIPL, write to [email protected]. We'll reply within 30 days.任何问题都可以问：如需查询、更正或删除，或行使 GDPR、CCPA、《个人信息保护法》下的权利，写信到 [email protected]，我们会在 30 天内回复。
13. Changes十三、政策变更
Features that would change any of the above — a real sign-in, cloud backup of your trips, anything that would tie your trips to a name — are not in the app yet. Before any of them ships, this policy will be updated and the date at the top will change. Material changes will also be announced in the app.会改变上述任何一点的功能——真正的登录体系、行程云备份、任何会把你的行程与真实身份关联起来的东西——目前都还不在 App 里。在它们上线之前，本政策会先更新，页首日期会随之变化。重大变更也会在 App 内公告。
Questions about this policy: [email protected]关于本政策的疑问：[email protected]