24h Privacy Policy

This document is a translation. If there is any difference, the Traditional Chinese version prevails.

Effective date: October 22, 2026

The 24h Team ("we" or "us") provides the "24h" app (the "Service"). We care about your privacy. This policy explains how we collect, use, store, and protect your personal data.

1. What data we collect

How we use phone permissions:

• Location: Accessed only when you send your location or share live location. We don't track you in the background. Live location is deleted when it expires or when you tap stop.
• Camera: Used when you take photos or videos to send in chats, scan QR codes, or snap business cards or receipts. Business cards, receipts, and QR codes are recognized only on your phone and are not uploaded.
• Microphone: Used to record voice messages, Moments recordings, and for Voice Input. "Voice Input" and "Transcribe" are recognized only on your phone. Your voice is not uploaded to the cloud for recognition.
• Photos: We use the system photo picker and read only the photos you choose. We write to your photo gallery only when you save to your phone.
• Notifications: Used to show new messages, invites, and event reminders.
• Biometrics (fingerprint, face): Passcode Lock uses your phone's built-in unlock feature. We never get your fingerprint or face data, and your Passcode Lock code is stored only on your phone.
• Contacts: Read only after "Find friends from contacts" becomes available and you tap it (not available yet).

We do not read your text messages, call logs, data from other apps, or photos on your phone that you haven't selected.

2. How we use this data

• To provide the Service's features: sign-in, adding friends, chats, groups, Album, Moments, shared Calendar, event reminders, Expenses, Diary, and the Assistant.
• To send push notifications: new messages, friend and group invites, Nudges, and more.
• To let your friends see your profile (name, profile photo, status, birthday month and day).
• To let friends who subscribe to your Calendar see your "Busy" times. They can't see event names, places, or notes unless they are also invited to that event.
• To keep the Service safe, for example by stopping blocked people from messaging you, letting you view and sign out of other signed-in devices, handling reports, and limiting AI usage to prevent abuse.
• Period records are used only to estimate your next period on your own phone screen and show it on your own Calendar. Estimates are for reference only and are not medical advice.
• To analyze the causes of crashes and errors, handle problem reports you send, fix issues, and improve stability.
• To compile usage statistics for each feature (for example, how many people use the app each day and which features are used often) to improve the Service. These statistics are not used for ads and are never sold.

We never sell your personal data, and we never use your chats, diary, period records, or mood to target ads. Period records are never provided to any third party.

2-1. AI features of the 24h Assistant

• The Assistant first uses the app's built-in rules to understand what you type (for example, "lunch 120" to log an expense, or logging weight or mood). These are handled only by 24h and are not sent to AI.
• For sentences the rules can't understand, the app explains how it works and asks for your consent before first use. After you agree, the text you type and your most recent Assistant messages are sent by 24h's servers to Google Cloud's Vertex AI (Gemini model) to generate a reply.
• Text only: Your photos, voice, location, period records, and regular chat or group messages are never sent to AI.
• 24h's servers don't store your conversations with AI. We only record your monthly usage count (to apply the Free and Pro usage limits and prevent abuse). Google handles this content under the Google Cloud enterprise terms of service and does not use it to train models.
• Your Assistant chat history is stored under your account. Only you can see it, and you can delete it at any time.
• You can turn off the Assistant in "Me → Assistant."

3. Data from Google (Google Calendar)

We read the following data only after you tap "Link Google Calendar" and agree on Google's authorization screen.

What data we access

• The email of the Google account you authorize (to show which account you've linked).
• Your Google Calendar list: the name and color of each calendar and whether it's your primary calendar (so you can choose which ones to sync).
• Events from the calendars you select, from the past 30 days to the next 180 days: name, start and end time, whether it's all-day, location, description, and last updated time.
• We don't read event attendee lists, meeting links, or attachments, and we don't read calendars you haven't selected.
• We use only two "read-only" permissions: calendar.calendarlist.readonly (calendar list) and calendar.events.readonly (events). We never add, edit, or delete anything in your Google Calendar.

How we use it

• Only to show these events on your own 24h Calendar, and, when you tap "Share to chat," to fill in the event details so you can create an invite.
• It is never used for ads, marketing, user behavior analysis, or training AI models, and it is never sold.

Storage

• Imported events are stored in Google Firebase's data center in Taiwan (asia-east1), and security rules allow only you to read them.
• Authorization credentials are stored only in the Google sign-in component on your phone and are not saved to our servers.
• Events are synced again each time you open the app. Events deleted on Google, or from calendars you've unselected, are deleted from 24h.

Sharing

• The content of your Google Calendar events (name, location, notes, attendees) is never provided to anyone, including your friends. Friends who subscribe to your Calendar only see "Busy" for that time and can't see what the event is. When you disconnect Google, these busy times are deleted as well. (Updated 2026-10-22)
• Only when you tap "Share to chat" and send it yourself do we use that event's name, time, location, and notes (which you can edit before sending) to create a new 24h event that the people you invite can see.
• Except as required by law, we do not transfer Google user data to third parties.

Deletion

• In "Calendar Settings → Import Calendar → Google Calendar → Disconnect": all events and settings imported from Google are deleted immediately, and 24h's authorization is revoked.
• You can also go to "Third-party apps & services" in your Google Account (https://myaccount.google.com/connections ) to remove 24h's access. 24h will stop reading at the next sync, and you can then disconnect in the app to delete imported data.
• When you delete your 24h account, all data imported from Google is deleted and the authorization is revoked.
• 24h events you've shared yourself are not deleted when you disconnect. You can delete them yourself on the event page.

Google API Limited Use disclosure

24h's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

24h's use and transfer of information received from Google APIs will comply with the Google API Services User Data Policy, including the "Limited Use" requirements.

4. Who can see your data

• You: Everything.
• All users: Your name, profile photo, status, and 24h ID.
• Friends: Your profile (including birthday and social links; friends set to "Chat Only" can't see these), content you share with them, your chats together, shared Albums and events, and your busy times (if they subscribe to your Calendar).
• Group members: Your messages, photos, videos, voice messages, and files in the group, content you upload to the group Album, your name on Polls and Sign-up Cards, and your profile.
• Moments: Only the people you choose when posting (all friends, Close Ones only, or specific friends) can see them.
• Location: Only members of the chat that received the message can see it. Live location is shown only during the sharing period.
• Strangers: If you turn on "Let others find me by ID," people who know your 24h ID can see your profile and add you as a friend. You can turn this off in "Friend Permissions," or turn on "Block Messages" so only friends can message you.
• Private notes, Diary, period records, Personal Ledger, Stash, Assistant chats, and the content of events imported from Google: Only you can see them. (Google events only appear as "Busy" times to friends who subscribe to your Calendar, so they know you're unavailable.) Period records never appear on one-on-one or group Calendars, in the busy times friends see when they subscribe to your Calendar, or in Free Days you share.
• 24h administrators: Can see only reported content and problem reports you send, to handle reports and reply to you. They can't see your private data.

5. Where data is stored and who processes it

The Service uses Google's services to store, transfer, and process data. Google is a service provider that processes data on our behalf:

• Firebase Authentication: Sign-in and accounts.
• Cloud Firestore: Text data, stored in Google's data center in Taiwan (asia-east1).
• Cloud Storage (Firebase): Photos, videos, voice messages, and files, stored in Google Cloud's data centers in Asia (multi-region). The text database (Cloud Firestore) is in Taiwan (asia-east1).
• Firebase Cloud Messaging: Sends push notifications. Notifications show the sender's name and the beginning of the message. When you turn on "Hide content in notifications," notifications only show "You have a new message."
• Google Cloud Vertex AI (Gemini): AI replies for the Assistant. It processes only the text you send; see Section 2-1.
• Firebase Crashlytics: Crash and error logs, kept according to Google's settings (about 90 days).
• Google Analytics for Firebase: App usage statistics. We've turned off advertising ID collection, Google signals, and ad personalization. We use only the account ID and never send names, emails, or any message content. Data is automatically deleted by Google after 2 months.
• Firebase App Check: Confirms that connections come from the genuine app.

Data is encrypted in transit. Google processes this data under its privacy policy and data processing terms.

6. How long we keep data

• We keep your data for as long as your account exists.
• Photos, videos, voice messages, and files in chats are automatically deleted 7 days after they're sent. Photos and videos saved to an Album are kept permanently until you or the group creator deletes them.
• Live location is deleted when the sharing time ends or when you tap stop.
• Unsent messages are removed from both people's screens, and the original text is deleted from the database.
• Crash logs are automatically deleted by Google after about 90 days.
• Raw app usage records are kept for 2 months. After that, only daily totals without personal data are kept. When you delete your account, we also ask Google to delete your usage records.
• After you delete your account, we delete your profile, friend connections, private notes, events you created, to-dos, Busy Hours, Diary, period records, Personal Ledger, Stash, scheduled messages, events imported from Google, and your 24h ID, revoke Google Calendar authorization, and remove you from all groups. Messages you sent in one-on-one chats remain in the other person's chat but no longer show your name. Photos and videos you uploaded to one-on-one and group Albums are permanently deleted 90 days after your account is deleted.
• Assistant chats, Things to Do, cards and rewards, monthly net worth reports, Care Mode invitations, Moments you posted (including photos), Today's Mood shares, problem reports, and AI usage counts are also deleted when you delete your account. Your comments and likes on other people's Moments, and reports you submitted, are kept. See the account deletion page for details.
• Purchase records (after Pro becomes available for purchase): To prevent the same purchase from being used more than once and to handle refunds, our servers keep purchase and subscription records (without payment details) for 5 years. Payment records themselves are kept by Google Play.

7. Your rights

Under Taiwan's Personal Data Protection Act, you can:

• Request access to and view your data: Most data can be viewed directly in the app, and you can also download a copy in "Account Security → Export my data."
• Supplement or correct your data: Edit it in "Edit Profile."
• Stop sharing usage data: Turn off "Help improve 24h" in "Me → Privacy & Permissions." After you turn it off, app usage data is no longer sent.
• Stop using the Service and delete your data: Delete your account yourself in "Me → Account Security → Delete account." Deletion can't be undone. If you don't have the app, you can request deletion by email by following the instructions on the account deletion request page.
• Other requests: Email 24happ.office@gmail.com and we'll reply within 30 days.

8. Children's and minors' privacy

The Service is for users aged 13 and older. Users under 18 must have consent from a parent or legal guardian before using it. Children under 13 should not use the Service. If we find that we have mistakenly collected a child's personal data, we will delete it immediately.

9. Security measures

We use database security rules so that each piece of data can be read and written only by the people who should see it, and we encrypt data in transit and at rest. Accounts registered by email must verify their email before use. We also use Firebase App Check to confirm connections come from the genuine app. However, no online service can guarantee 100% security, so please keep your account password safe.

10. Policy updates

If we make major changes to this policy, we will notify you in the app. If you continue to use the Service after an update, you agree to the updated policy.

11. Contact us

If you have any privacy questions, please contact: 24happ.office@gmail.com

2026-10-20 supplement (to be merged into the official version)

• Your birthday and displayed social links are visible only to your friends. Your name, profile photo, status, and 24h ID are visible to all users. (Merged into Section 4 on 2026-10-22)
• Your chats with "24h Support" are stored only under your account, and only you can see them. Replies are currently automatic, based on keywords in the app, and are not sent to any third-party service. If you tap "Email us," your phone's email app is used to send an email to the official 24h address.
• If we switch to AI support in the future, we will update this policy and ask for your consent first.
• Project Ledgers are visible only to members selected for the Ledger. For Subgroups that require approval, applicants can't see any content until they're approved.
• Period, symptom, mood, flow, and BBT records are visible only to you (as of 2026-10-22, "Share cycle with Close Ones" has been removed; see below).
• The "Report for Doctor" PDF is created on your phone and is not uploaded to 24h's servers. You decide who to send it to.
• Private Reminders are local notifications on your phone that don't go through our servers, and the notification text never mentions periods.

2026-10-22 supplement (to be merged into the official version)

• Multiple accounts: You can sign in to up to 5 24h accounts on one phone. Your phone remembers the name, profile photo, and 24h ID of these accounts so you can switch easily, but it doesn't remember emails or passwords. When you switch accounts, the previous account's data on screen and in memory is cleared. Settings such as Passcode Lock and recent searches are kept separately for each account, and local reminders for other accounts are canceled. You can "Remove" an account on the sign-in page at any time.
• Data you enter about other people: External contacts you note in events (for example, someone's LINE account), names of friends you sign up on a Sign-up Card, and names of Virtual Members you add to a Project Ledger are other people's data that you provide. Only people who can see that event, group, or Ledger can see it. Please enter it only with the person's consent. You can delete it at any time.
• Sign-up Cards: When you sign up for an event in a group, group members can see your name and sign-up order, and the organizer can mark whether you've checked in or paid. Events you sign up for are added to your own Calendar (only you can see them).
• Snap Receipt: Receipt photos are processed only on your phone using your phone's built-in text recognition and are not uploaded. Only the items and amounts you confirm and add to a Ledger are saved to your Ledger.
• Cards and rewards: We record only the card names and reward % you enter. We don't collect card numbers, expiration dates, or any payment details. Only you can see them.
• Monthly net worth reports, trip personal budgets, and cash balances: Only you can see them.
• Spent today home screen widget: If you add it to your phone's home screen, today's spending amount is shown there, and anyone who picks up your phone can see it. When "Hide Amounts" is on, it shows ＊＊＊＊ instead. It's cleared when you switch accounts or sign out.
• Voice messages: Voice messages you send are stored in Google Cloud Storage. Only members of that chat can play them, and they're automatically deleted after 7 days. "Voice + Text" and "Transcribe" are recognized only on your phone, and your voice is not uploaded to the cloud for recognition. (Merged into Sections 1 and 6)
• Photos, videos, and files: Photos, videos, and files sent in chats are visible only to members of that chat and are automatically deleted after 7 days. Photos and videos saved to an Album are kept permanently until you or the group creator deletes them. Diary photos and files in your Stash are visible only to you. Files are stored in Google Cloud Storage (Firebase), with access limited by security rules. (Merged into Sections 1, 4, and 6)
• Phone number (available only after Blaze is enabled): When you sign up, sign in, or link with a phone number, we send an SMS verification code through Google Firebase. Your phone number is visible only to you and is not shown on your profile. When "Let others find me by phone number" is on, people who know your number can find your account (matching uses encrypted hashes).
• Problem reports: When you tap "Report a problem" in the Assistant or Support, we receive what you write, the category, your account ID, app version, phone model, and Android version. Only 24h administrators can see it, and it's used to find problems and reply to you. Please don't include passwords or other people's personal data in reports. (Merged into Sections 1 and 4)
• Today's Mood sharing: Only the mood you choose and a one-line message are shared with the people you choose, and they can no longer see it after 23:59 that day. Your diary, other moods, and period data are never shared.
• Display and Care Mode: Settings such as text size, lunar calendar, and reminders are stored in your account, and only you can see them. When a family member suggests Care Mode, it's turned on only with your consent.
• Assistant AI chats and translation: (Merged into Section 2-1) Before first use, the app explains how it works and asks for your consent. Your questions and your most recent Assistant messages are sent by 24h's servers to Google's Gemini (Vertex AI) to generate a reply. 24h doesn't record the conversation content, only the monthly usage count. Google processes it under its enterprise terms of service and doesn't use it to train models. Your Assistant chat history is stored under your account, only you can see it, and you can delete it at any time.
• Ads (after AdMob launches): The free version shows Google AdMob native ads on a few pages (for example, the bottom of the Expenses statistics page, below the Calendar, and on the Draw a Card result page). No ads are shown for Pro or during the free trial. AdMob may use your advertising ID, device info, approximate location (estimated from IP), and ad interaction records to show and measure ads. We never provide chat, diary, period, mood, health, Album, Moments, or similar data to advertisers, and we don't use this data for personalized ads. No ads appear on Chats, Assistant, Diary, Period, Mood, Close Ones, Moments, or Album pages. You can turn off "Personalized ads" in "Privacy," after which you'll see only non-personalized ads. Google's explanation: https://policies.google.com/technologies/partner-sites
• Files after account deletion: Photos and videos you uploaded to one-on-one and group Albums are permanently deleted 90 days after your account is deleted. During those 90 days they stay in the Album, with the uploader shown as "Deleted User." If you want to keep them, please download them before deleting your account. (Merged into Section 6)
• Period data (updated 2026-10-22): Period, symptom, mood, flow, temperature, and ovulation and fertile window predictions are visible only to you and are never shared with anyone (including Close Ones, friends, and groups), and are never used for ads. The former "Share cycle with Close Ones" feature has been removed, and any previous sharing status is deleted automatically.