隱私權政策

生效日期:2026 年 10 月 12 日

「麻糬派對」是多人一起玩的手機團康遊戲(鋪路餐車、三秒亂鬥、夜遊鬼校舍、宴會大廚、易碎搬家公司),由麻糬派對營運團隊(個人開發者)提供(以下稱「我們」)。這份政策照實說明我們收集哪些資料、拿來做什麼、保存多久、你可以怎麼刪掉。網頁版和 App(iOS / Android)適用同一份政策。

1. 我們收集的資料

資料	內容	為什麼需要 · 保存多久
帳號編號與登入憑證	第一次打開遊戲時伺服器產生的隨機帳號編號;登入憑證(伺服器只存雜湊值),以及登入裝置的類型(例如「iOS · Safari」,從瀏覽器資訊判斷)	認出「這是你的進度」、讓你看到並登出其他裝置。憑證 90 天沒用就失效
暱稱、外觀與收藏	你自己取的暱稱(最多 12 個字)、擁有和穿著的外觀、扭蛋券、碎片、金幣、存起來的搭配	顯示在房間、名片、結算畫面;保存收藏。保存到刪除帳號
遊戲紀錄	關卡星等、成就、累計統計、每日任務、季票進度、扭蛋保底次數、遊戲裡的信箱(補償、禮物、申訴結果)	保存進度、頒獎。信箱每個帳號最多留 200 封
遊玩日期與來源	每天一筆:哪一天(台灣時間)有打開遊戲、從哪一種 App / 網頁進來(從 Google Play 安裝的 Android App、其他方式安裝的 Android App、iOS App、網頁),以及那天大約打開幾次。不含位置或其他裝置資訊	確認測試與服務狀況(例如封閉測試的測試人員有沒有在玩:用他們報名用的 Gmail 跟綁定 Google 的信箱雜湊比對,這份名單不存在伺服器上)。60 天後自動刪除
好友與最近一起玩的人	好友碼、好友名單、好友邀請、封鎖名單、聊天 / 私訊設定;最近 20 位一起玩的人(公開名片代碼、暱稱、外觀、時間)	加好友、邀請、封鎖。保存到刪除帳號
聊天訊息	好友私訊和派對房聊天的內容(原文與過濾後的文字)、快捷語句、表情。會自動擋掉連結、電話號碼和不當字詞(規則與字詞表,不使用 AI)	讓大家聊天、處理檢舉。30 天後自動刪除
檢舉、停權與申訴	檢舉的原因與補充說明,以及被檢舉訊息前後的對話紀錄(雙方的名片代碼、暱稱、訊息);檢舉人連線的 IP 與裝置識別碼的加鹽雜湊。停權的原因與期間、你寫的申訴與回覆	處理檢舉、防止濫用。檢舉紀錄保存 180 天;停權與申訴紀錄保存到停權結束後 180 天(永久停權在停權期間持續保存)
出生年月	第一次購買前請你填的出生年、月(不收日期),填了之後不能自己改	判斷未成年購買規則(家長同意、每月上限、未滿 13 歲不能買付費扭蛋)。保存到刪除帳號
購買紀錄	商店(App Store / Google Play)、交易編號、商品、金額、購買國家(商店提供)、是否未成年與是否勾選家長同意、時間、發了哪些內容;退款與發貨的稽核紀錄	確認付款、避免重複發貨、處理退款與爭議、帳務。長期保存(刪除帳號後去除身分保存,見第 6 點)
抽卡紀錄	每一抽(免費和付費)的時間、機台、花費、結果、是否重複、保底	讓你查詢、核對機率。你可以看 180 天,伺服器保存 200 天後刪除
推播通知(選擇性)	你開啟通知時,瀏覽器推播服務給的訂閱網址與金鑰(網頁版),或 Apple 推播服務(APNs)的裝置代碼(iOS App);通知開關、安靜時段、時區、語言	送好友邀請等通知。關掉通知、代碼失效或刪除帳號時刪除
綁定的登入(選擇性)	Google:Google 帳號代碼(sub)與電子信箱的雜湊值。LINE:LINE 使用者代碼的雜湊值(不拿信箱、名字、大頭照)。Apple:Apple 使用者代碼的雜湊值與電子信箱(含 Apple 的隱藏信箱)的雜湊值,以及 Apple 給的授權憑證(刪帳號時用來撤銷授權)。雜湊是單向運算,無法還原成信箱;信箱本身不保存在伺服器,只存在你自己的裝置上給你看	換裝置時把資料拿回來;封閉測試期間也用 Google 信箱的雜湊確認測試人員有沒有在玩(見「遊玩日期與來源」)。保存到解除綁定或刪除帳號
裝置識別碼與 IP 的雜湊(防止濫用)	裝置識別碼(這台裝置自動產生的隨機代碼)與 IP 位址的加鹽雜湊(單向運算,原本的值不保存)。只用在沒有綁定登入的訪客帳號	帳號因違規被停權時,暫時擋下同一台裝置或同一個網路再開訪客帳號。裝置雜湊 90 天、IP 雜湊 7 天。另外,限制開房 / 登入次數時會用到 IP 和裝置識別碼,只放在伺服器記憶體,不寫進資料庫
兌換碼	你換過哪一組兌換碼(兌換碼本身只存雜湊值)	一組碼一個帳號只能換一次。保存到刪除帳號
排行榜	鋪路餐車每日挑戰、易碎搬家無盡模式的排行榜:暱稱、名片代碼、成績	顯示排行。每日挑戰保存 60 天、無盡模式 9 週
房間裡的即時資料	遊戲房、派對房的成員、操作、表情;好友上線狀態	讓大家一起玩。只放在伺服器記憶體,房間結束 / 離線就消失,不寫進資料庫

2. 麥克風、感應器、相機與照片

• 麥克風(選擇性):三秒亂鬥有幾個小遊戲(例如吹蠟燭)可以對麥克風吹氣。遊戲只在你的手機上即時計算「聲音有多大」,不錄音、不辨識說話內容、不傳到任何伺服器。不給權限也能改用點的玩。
• 動作感應器(選擇性):三秒亂鬥的傾斜、搖一搖,同樣只在手機上計算,不會傳出去。
• 相機:不使用。
• 照片:拍照亭、結算合照、名片圖是在你的手機上畫出來的,不會上傳;只有你按「存照片」或「分享」時,才會存進你的裝置或交給你選的 App。iOS App 存照片時會打開系統的分享面板,由你選「儲存影像」。
• 「新聞台聲音」是在你的裝置上即時合成的咕嚕聲加上預錄的片段,不會錄音,也不會把文字或聲音送到語音服務。

3. 我們不收集的資料

• 位置(GPS)、聯絡人、通訊錄、相簿內容
• 電話、真實姓名、完整生日(只有購買前的出生年月)
• 廣告追蹤代碼(IDFA / 廣告 ID)。遊戲裡沒有廣告,也沒有第三方分析或追蹤工具

4. 誰看得到你的資料

• 其他玩家:看得到你的暱稱、外觀,以及你的公開名片(成就數、收藏數、最愛的成就、幾項累計統計)。好友看得到你的上線狀態(可以設成隱身)。你開成公開的派對房,大廳裡的人看得到房名、房主暱稱和成員的暱稱與外觀。好友碼只有你自己看得到(除非你分享)。看不到你的帳號編號和登入資料。
• 聊天對象:私訊只有互為好友、沒有封鎖的人收得到;派對房聊天只有房裡的成員收得到。
• 我們:只為了營運、處理檢舉與申訴、退款與客服而查看。
• 我們不會出售或出租你的資料,也不會拿來投放廣告。

5. 第三方服務

• 主機 Fly.io:伺服器和資料庫放在 Fly.io 的東京機房。
• Cloudflare:只提供網域 mochiparty.app 的 DNS(把網址對到伺服器),不經手遊戲資料。
• 登入:Apple、Google、LINE(你選擇綁定時才會用到)。iOS App 使用 Sign in with Apple、Google Sign-In 與 LINE SDK;網頁版的 Google 登入按鈕從 accounts.google.com 載入、LINE 登入會轉到 LINE 的登入頁。這些服務會依它們自己的隱私權政策處理你的登入;我們只收到一張登入憑證(ID token),用公開金鑰驗證後取出上面第 1 點列的代碼與信箱雜湊。
• 付款:Apple App Store、Google Play。付款由 Apple / Google 處理,我們拿不到你的信用卡或付款資料,只收到交易編號、商品、國家等交易資訊。
• 推播:你開啟通知時,通知會經過 Apple 推播服務(APNs)或你瀏覽器的推播服務(例如 Google、Mozilla、Apple、Microsoft)送到你的裝置;通知內容只有標題和一句話(例如好友的暱稱)。
• 字型和程式庫都放在我們自己的伺服器 / App 裡,不會從其他網站載入。

6. 保存多久、怎麼刪除

• 各項資料的保存期間寫在第 1 點的表格裡;沒寫期限的,保存到你刪除帳號為止。
• 刪除方式:遊戲裡「設定 → 刪除我的帳號與資料」,確認兩次後立刻刪除;打不開遊戲也可以寫信給我們代為刪除。
• 會刪掉的:玩家資料與收藏、出生年月、綁定的登入與登入憑證、好友 / 邀請 / 封鎖、你送出的聊天訊息與你的私訊對話、推播訂閱、信箱、你送出的檢舉、申訴、兌換紀錄、遊玩日期紀錄、裝置與 IP 雜湊;別人「最近一起玩」清單裡的你也會拿掉。有綁定 Apple 登入的,會同時向 Apple 撤銷授權。
• 去除身分後保留的(帳號編號換成無法還原的雜湊值,不再對應到任何玩家資料):
  • 購買訂單與稽核紀錄:帳務、退款與爭議處理需要,並避免同一張收據被重複領取。稽核紀錄裡只有公開名片代碼。
  • 抽卡紀錄:到期(200 天)刪除。
  • 針對你的檢舉與停權紀錄:到期刪除(見第 1 點),用來維持停權效力與處理爭議;檢舉附的對話紀錄(含暱稱與訊息)也保存到期滿。
• 排行榜上的暱稱會留到排行期滿(最長 9 週)。
• 維運用的資料庫備份與快照會在 30 天內隨輪替刪除。

7. 存在你裝置上的資料

瀏覽器(或 App)的本機儲存會存:登入憑證、暱稱和外觀的暫存、音量 / 無障礙 / 語言設定、麥克風與感應器的選擇;綁定 Google / Apple 時的電子信箱只存在這裡、只給你自己看。另外,裝置識別碼(防止濫用,見第 1 點)存在本機儲存、IndexedDB 和一個名為 pg_dev 的 cookie(最長 400 天),只會送回我們自己的伺服器。清除瀏覽器 / App 資料就會刪掉;沒有綁定登入的話,訪客帳號刪掉後就找不回來了。

8. 兒童

遊戲適合 13 歲以上,不是為 13 歲以下兒童設計的。玩的時候不需要提供任何個人資料;請不要在暱稱或聊天裡放真實姓名、學校或電話。未滿 18 歲購買前要取得父母或法定代理人同意。家長想刪除孩子的資料,可以用上面的刪除功能,或寫信給我們。

9. 安全

所有連線都用 HTTPS 加密;登入憑證在伺服器只存雜湊值。請不要把你的裝置或登入分享給別人(遊戲裡分享的名片、房號、好友碼都不含帳號編號或登入資料)。

10. 政策變更

如果政策有重要變更,我們會更新這一頁的生效日期,並在遊戲裡通知。

11. 聯絡我們

營運者:麻糬派對營運團隊(個人開發者)。對隱私有任何問題,或要查詢、更正、刪除你的資料,請寫信到 rr900306@gmail.com(請附上好友碼)。其他問題見客服頁。

服務條款 · 客服與聯絡

Privacy Policy

Effective: October 12, 2026

Mochi Party is a multiplayer party game for phones (Road Truck, 3-Second Scramble, Night School Ghosts, Forest Feast, Fragile Movers), provided by Mochi Party (individual developer) ("we"). This policy explains, plainly, what we collect, why, how long we keep it and how you can delete it. It covers both the web version and the apps (iOS / Android).

1. What we collect

Data	What it is	Why · how long
Account ID and sign-in key	A random account ID our server creates the first time you open the game; a sign-in key (the server stores only a hash of it) and the kind of device you signed in on (e.g. "iOS · Safari", from browser information)	To recognise your progress and let you see and sign out other devices. A key expires after 90 days without use
Nickname, outfits & collection	The nickname you choose (up to 12 characters), outfits you own and wear, tickets, shards, coins, saved outfits	Shown in rooms, on player cards and results; keeps your collection. Kept until you delete your account
Game records	Level stars, achievements, totals, daily quests, season pass progress, gacha pity counters, your in-game mailbox (compensation, gifts, appeal results)	Progress and awards. Up to 200 mailbox messages per account
Play dates and source	One record per day: which days (Taiwan time) you opened the game, and from which kind of app or web you came in (the Android app installed from Google Play, an Android app installed another way, the iOS app, or the web), plus roughly how many times that day. No location or other device information	Checking testing and service status (for example, whether closed-test testers are playing: we match the Gmail address they signed up with against the email hash of a linked Google sign-in; that list is not stored on our server). Deleted automatically after 60 days
Friends & recent players	Friend code, friend list, friend requests, block list, chat / DM settings; the last 20 players you played with (public card code, nickname, outfit, time)	Adding, inviting and blocking. Kept until you delete your account
Chat messages	Friend DMs and party-room chat (original and filtered text), quick phrases and emotes. Links, phone numbers and inappropriate words are blocked automatically (rules and word lists, no AI)	Chatting and handling reports. Deleted automatically after 30 days
Reports, suspensions & appeals	The reason and note of a report, plus the conversation around the reported message (both players' card codes, nicknames and messages); salted hashes of the reporter's IP and device identifier. Suspension reasons and periods, your appeals and our replies	Handling reports and preventing abuse. Reports are kept for 180 days; suspensions and appeals until 180 days after the suspension ends (permanent suspensions are kept while they last)
Birth year and month	Asked before your first purchase (no day), and can't be changed by you afterwards	Applying the rules for minors (parental consent, monthly limit, no paid gacha under 13). Kept until you delete your account
Purchase records	Store (App Store / Google Play), transaction ID, product, price, purchase country (from the store), whether you were a minor and confirmed parental consent, time, what was delivered; audit records of deliveries and refunds	Confirming payment, preventing double delivery, refunds, disputes and accounting. Kept long-term (de-identified after account deletion, see section 6)
Gacha history	Every pull (free and paid): time, machine, cost, result, duplicate, pity	So you can check it and verify the odds. You can see 180 days; the server keeps 200 days, then deletes it
Push notifications (optional)	When you turn notifications on: the subscription address and keys from your browser's push service (web), or the Apple Push Notification service (APNs) device token (iOS app); notification switches, quiet hours, time zone, language	Friend invites and other notifications. Deleted when you turn notifications off, the token stops working, or you delete your account
Linked sign-in (optional)	Google: your Google account identifier (sub) and a hash of your email. LINE: a hash of your LINE user ID (no email, name or photo). Apple: a hash of your Apple user ID and of your email (including Apple's private relay address), plus the authorization token Apple gives us (used to revoke access when you delete your account). Hashes are one-way and can't be turned back into your email; your email itself is never stored on our server, only on your own device so you can see it	Restoring your data on a new device; during closed testing, the Google email hash is also used to check whether testers are playing (see "Play dates and source"). Kept until you unlink or delete your account
Hashed device identifier and IP (abuse prevention)	Salted, one-way hashes of a device identifier (a random code your device creates) and your IP address; the original values are not stored. Only for guest accounts with no linked sign-in	If an account is suspended, to temporarily stop new guest accounts from the same device or network. Device hashes 90 days, IP hashes 7 days. Limits on how often you can create rooms or sign in also use your IP and device identifier, in server memory only — never written to the database
Redeem codes	Which codes you redeemed (codes themselves are stored only as hashes)	Each code works once per account. Kept until you delete your account
Leaderboards	Road Truck daily challenge and Fragile Movers endless mode: nickname, card code, score	Showing rankings. Daily challenge 60 days, endless mode 9 weeks
Live room data	Members, inputs and emotes in game and party rooms; friends' online status	Playing together. Kept in server memory only and gone when the room ends or you go offline; never written to the database

2. Microphone, sensors, camera and photos

• Microphone (optional): a few 3-Second Scramble mini-games (such as blowing out candles) let you blow into the microphone. The game only measures how loud it is, on your phone, in real time. Nothing is recorded, no speech is recognised, and nothing is sent to any server. Without permission you can tap instead.
• Motion sensors (optional): tilting and shaking in 3-Second Scramble are also computed on your phone only.
• Camera: not used.
• Photos: the photo booth, team photos and player-card images are drawn on your phone and never uploaded. They are only saved to your device or handed to an app you choose when you tap "Save" or "Share". In the iOS app, saving opens the system share sheet, where you choose "Save Image".
• The "news voice" is babble synthesised on your device plus pre-recorded clips. Nothing is recorded, and no text or audio is sent to any speech service.

3. What we do not collect

• Location (GPS), contacts, address book, your photo library
• Phone number, real name, full date of birth (only year and month before purchasing)
• Advertising identifiers (IDFA / advertising ID). There are no ads and no third-party analytics or tracking tools

4. Who can see your data

• Other players see your nickname, outfit and public player card (number of achievements, collection size, favourite achievement, a few totals). Friends see whether you're online (you can go invisible). If you make a party room public, people in the lobby see its name, the host's nickname and the members' nicknames and outfits. Only you see your friend code (unless you share it). Nobody sees your account ID or sign-in details.
• Chat: DMs reach only mutual friends who haven't blocked each other; party chat reaches only members of that room.
• We look at data only to run the service, handle reports and appeals, refunds and support requests.
• We never sell or rent your data and never use it for advertising.

5. Third-party services

• Hosting: Fly.io — our server and database run in Fly.io's Tokyo region.
• Cloudflare — DNS only for the domain mochiparty.app (pointing the address at our server); game data does not pass through it.
• Sign-in: Apple, Google, LINE (only if you choose to link). The iOS app uses Sign in with Apple, Google Sign-In and the LINE SDK; on the web, the Google button loads from accounts.google.com and LINE sign-in goes to LINE's login page. These services handle your sign-in under their own privacy policies. We only receive a sign-in credential (ID token), check it with their public keys, and keep only the identifiers and email hash listed in section 1.
• Payments: Apple App Store, Google Play. Apple / Google process the payment; we never see your card or payment details, only transaction information such as the transaction ID, product and country.
• Push: if you turn notifications on, they are delivered through Apple's push service (APNs) or your browser's push service (e.g. Google, Mozilla, Apple, Microsoft). A notification contains only a title and one line (such as a friend's nickname).
• Fonts and libraries are served from our own server / bundled in the app; nothing is loaded from other websites.

6. Retention and deletion

• How long each item is kept is listed in the table in section 1. Anything without a period is kept until you delete your account.
• How to delete: in the game, open Settings → "Delete my account and data" and confirm twice. It is deleted immediately. If you can't open the game, email us and we'll do it for you.
• Deleted: your profile and collection, birth year and month, linked sign-ins and sign-in keys, friends / requests / blocks, chat messages you sent and your DM conversations, push subscriptions, mailbox, reports you filed, appeals, redeem records, play-date records, device and IP hashes. You're also removed from other players' "recent players" lists. If you linked Apple, we also revoke the authorization with Apple.
• Kept in de-identified form (the account ID is replaced by an irreversible hash and no longer points to any player data):
  • Purchase orders and audit records: needed for accounting, refunds and disputes, and to stop the same receipt being claimed twice. Audit records contain only a public card code.
  • Gacha history: deleted when it expires (200 days).
  • Reports and suspensions concerning you: deleted when they expire (see section 1); they keep suspensions in force and help resolve disputes. The conversation attached to a report (including nicknames and messages) is also kept until it expires.
• Your nickname stays on leaderboards until that ranking period ends (at most 9 weeks).
• Operational database backups and snapshots are removed within 30 days as they rotate.

7. Data stored on your device

Your browser's (or the app's) local storage keeps your sign-in key, a cached nickname and outfit, volume / accessibility / language settings and your microphone and sensor choices. When you link Google / Apple, your email is kept only here, for you to see. The device identifier (abuse prevention, see section 1) is kept in local storage, IndexedDB and a cookie named pg_dev (up to 400 days), and is only sent back to our own server. Clearing browser / app data removes all of this; without a linked sign-in, a removed guest account cannot be recovered.

8. Children

The game is intended for players aged 13 and over and is not designed for children under 13. It asks for no personal information to play; please don't put real names, schools or phone numbers in nicknames or chat. Under 18, purchases need a parent or guardian's consent. Parents can delete a child's data with the delete option above or by emailing us.

9. Security

All connections use HTTPS, and the server stores only hashes of sign-in keys. Don't share your device or sign-in with others (player cards, room codes and friend codes never contain your account ID or sign-in details).

10. Changes

If we make important changes, we'll update the effective date on this page and let you know in the game.

11. Contact

Operator: Mochi Party (individual developer). For privacy questions, or to access, correct or delete your data, email rr900306@gmail.com (please include your friend code). For anything else, see the Support page.

Terms of Service · Support