Verital 隱私權政策
最後更新：2026-10-20（草稿，待使用者確認）
資料控制者：Verital（個人經營）（以下稱「我們」）。隱私聯絡信箱：support@veritalai.com。付款資料由 Paddle 以 Merchant of Record 身分蒐集與處理，Paddle 是那部分資料的獨立控制者，見第 3 節。
1. 基本立場
Verital 在你的電腦上運作。你的論文、筆記、稿件、白板、簡報與錄音預設只存在你的電腦（本機資料庫與檔案）。只有下面列出的情況，資料才會離開你的電腦。我們不販售你的資料，不放廣告，App 裡沒有第三方分析或廣告 SDK。
2. 我們處理哪些資料
| 資料 | 什麼時候 | 用途（法律依據） | 放在哪裡、放多久 |
|---|---|---|---|
| 帳號：Email、密碼雜湊或第三方登入識別、登入紀錄 | 註冊、登入 | 識別你、寄驗證信（履行契約） | Supabase（日本東京）；帳號存續期間 |
| 方案、點數與帳務：方案與到期日、點數批次與餘額、Paddle 客戶與訂閱編號及狀態、用量紀錄（時間、模型、token 數、費用、狀態）。用量紀錄沒有可放提示詞的欄位。 | 購買、使用官方 AI | 判斷功能權限、計費、防濫用（履行契約、正當利益） | Supabase；帳號存續期間，帳務紀錄依稅務與會計法令要求的期間保存 |
| 裝置：隨機產生的裝置指紋（不含硬體序號）、作業系統、App 版本、裝置公鑰、最後上線時間 | 登入後 | 授權租約、裝置數上限、同步（履行契約） | Supabase；帳號存續期間 |
| 新手教學進度 | 做教學時 | 跨裝置記住進度 | Supabase |
| 官方 AI 請求：你送出的文字、圖片或片段，及模型回應 | 你使用官方 AI（含生圖、語音合成） | 轉給模型供應商並回傳結果；中斷後恢復可重送的回應（履行契約） | 經我們在 Railway（美國東岸）的閘道轉送至 OpenRouter 及其轉接的模型供應商。閘道會移除用戶端附帶的供應商設定、中繼資料與使用者欄位；用量帳本不保存原始請求本文。部分回傳的文字、圖片與語音會存入 Supabase，供中斷後取回；這些回應可能包含你的內容。 大小限制內的圖片、語音與檢索回應可於 24 小時內取回，過期本文於後續寫入時分批清除，因此實體刪除可能較晚。舊版回應紀錄目前尚無自動刪除。OpenRouter 與各模型供應商也依其各自的資料政策處理你的請求，可能保留一段時間 |
| 學術檢索（官方連線）：關鍵字、DOI | 搜尋文獻、補書目 | 經閘道向 OpenAlex、Crossref、arXiv、PubMed、DBLP、Unpaywall 查詢 | 回應（公開論文資料）暫存 24 小時，供重送與共用快取 |
| 找引用：你要找引用的那一句 | 使用「找引用」 | 送到我們自建的索引服務（Railway），不轉給第三方搜尋；需登入 | 服務程式不保存查詢句子，也關閉了存取日誌 |
| 雲端同步與共編（你開啟時）：工作區、Planner、文獻庫 PDF、共編文件的改動 | 同步、共編 | 在你的裝置與共編成員之間傳遞 | 端對端加密，我們只存密文。我們仍看得到帳號、工作區與列的識別碼、金鑰世代、時間、密文大小、裝置公鑰與共編成員名單。轉送訊息最長 30 天，收件方都確認後即刪；共編信箱超過 30 天且已被快照涵蓋的舊增量每日清除；Planner 加密鏡像持續保存供新裝置與災後恢復；共編附檔的密文放 Cloudflare R2，目前沒有自動清除 |
| 教授批改連結：稿件、評論、教授填的名字 | 你按「傳給教授批改」 | 讓教授不用帳號就能批改 | 在你的電腦加密，金鑰在連結 # 後面，不會送到我們的伺服器。預設 30 天到期；到期或撤銷後，稿件密文每小時清理、評論隨即刪除；教授的修改版本（密文）保留到這條批改連結被刪除或你刪除帳號為止。教授開始批改、連結將到期時，我們寄信到你的 Email（不含稿名） |
| Pro+ 雲端排版（教授改 LaTeX 時） | 預覽編譯 | 在編譯的幾秒內處理原稿 | Railway 上的編譯服務；原稿不存檔，暫存目錄編完即刪，結果 PDF 會短暫快取（有上限） |
| 問卷：題目與填答 | 你發佈問卷 | 讓受訪者填答 | Supabase；預設保留 30 天（可設 1–365 天），每日刪除過期填答；防洗版的暫時識別值一天內清除 |
| 圖庫檢舉：原因、選填聯絡方式、帳號 | 你檢舉一張圖 | 審理檢舉 | Supabase；保存到案件處理完畢，之後作為申訴與統計紀錄保留；你可以寫信要求刪除你留下的聯絡方式 |
| 客服信件 | 你寫信給我們 | 回覆你 | 我們的信箱 |
更新檢查：App 會向 updates.veritalai.com 取得版本清單，我們的伺服器因此看得到你的 IP 位址與版本。當機回報目前未啟用（沒有設定回報位址就完全不啟動，若日後啟用會先更新本政策）。
3. 我們把資料交給誰
- Paddle（Merchant of Record）：處理付款、收據、稅務、退款與詐欺防範。你的卡號只在 Paddle 的付款框輸入，我們看不到；我們只收到客戶與訂閱編號、方案、狀態與期間。見 Paddle 隱私權政策。
- 處理者：Supabase（帳號、授權、帳本、加密同步與信箱）、Cloudflare（網頁、R2 儲存、Workers、寄信、TURN 中繼；內容已加密）、Railway（AI 閘道在美國東岸；編譯服務與找引用索引也在美國東岸）、OpenRouter 及其轉接的模型供應商。
- 法律要求時，給主管機關；以及我們的律師、會計等專業顧問。
- 你自己啟動的功能，資料直接從你的電腦送出、不經過我們：自帶金鑰的模型供應商、Google 翻譯、DuckDuckGo／Tavily／Brave 搜尋、YouTube、Zotero、Hugging Face（下載本機模型）等。
- 我們不出售個人資料。
4. 自帶金鑰、本機模型與去識別化
自帶金鑰時，請求從你的電腦直接送到你選的供應商，不經過我們，金鑰存在你電腦的系統鑰匙圈。語音、OCR、AI 偵測等本機模型在你的電腦上執行，不連網。去識別化（設定中選用，預設關閉）開啟後，送出前會在你的電腦上把人名、機構、地名與個資換成代號。
5. 你的權利
你可以查詢、閱覽、複製、更正、刪除你的個人資料，也可以要求限制或反對處理、要求資料可攜，或撤回同意。歐盟與英國使用者另有申訴於所在地監管機關的權利。請寫信到 support@veritalai.com，我們會在 30 天內回覆。App 內自助匯出全部資料與刪除帳號的功能尚未完成，完成前由我們人工處理；刪除帳號後 30 天內刪除個人資料，法令要求保存的帳務紀錄除外。你本機的資料本來就在你的電腦上，隨時可匯出。
6. 國際傳輸
我們的服務商位於日本、美國等地，你的資料可能被傳到你所在國家以外。
7. 安全
傳輸使用 TLS；同步、共編與批改為端對端加密；資料庫以列級存取控制，每人只能讀自己的資料；官方金鑰只存雜湊。本機資料庫目前沒有另外加密，建議開啟 macOS 的 FileVault 或 Windows 的 BitLocker。
8. Cookie 與網站
官網沒有 cookie 橫幅，語言偏好只存在你瀏覽器的本機儲存空間；官網載入 Google Fonts 字型。結帳頁的付款框由 Paddle 提供，可能設定 Paddle 自己的必要 cookie。
9. 兒童
本服務不以未滿 13 歲的兒童為對象。
10. 變更
重大變更會在生效前於 App 與網站公告。
Verital Privacy Policy
Last updated: 2026-10-20 (draft, pending owner review)
Data controller: Verital, a sole proprietorship ("we", "us"). Privacy contact: support@veritalai.com. Payment data is collected and handled by Paddle as Merchant of Record. Paddle is an independent controller of that data; see section 3.
1. The short version
Verital runs on your computer. Your papers, notes, manuscripts, whiteboards, slides and recordings are stored only on your computer by default, in a local database and files. Data leaves your machine only in the cases listed below. We don't sell your data and we don't run ads, and the app contains no third-party analytics or advertising SDK.
2. What we process
| Data | When | Purpose (legal basis) | Where it lives and for how long |
|---|---|---|---|
| Account: email, password hash or third-party login ID, sign-in records | You register or sign in | Identify you, send verification emails (contract) | Supabase (Tokyo, Japan); while your account exists |
| Plan, points and billing: plan and expiry, point lots and balance, Paddle customer and subscription IDs and status, usage records (time, model, token counts, cost, status). The usage records have no field that could hold a prompt. | You buy, or use the official AI | Decide what you can use, bill you, prevent abuse (contract, legitimate interests) | Supabase; while your account exists. Billing records are kept as long as tax and accounting law requires |
| Devices: a randomly generated device fingerprint (no hardware serial number), operating system, app version, device public key, last-seen time | After you sign in | Licence lease, device limit, sync (contract) | Supabase; while your account exists |
| Tutorial progress | While you follow the tutorial | Remember progress across devices | Supabase |
| Official AI requests: the text, images or excerpts you send, and the model's reply | You use the official AI (including image generation and speech synthesis) | Forward to a model provider and return the result; recover eligible responses after interrupted requests (contract) | Relayed through our gateway on Railway (US East) to OpenRouter and the model providers it routes to. The gateway strips provider settings, metadata and user fields that the app attaches. We do not keep the original request body in the usage ledger. Some returned text, images and audio are stored in Supabase for retry recovery; those responses may contain your content. Size-limited image, speech and lookup responses can be replayed for 24 hours; expired bodies are removed in bounded batches on later writes, so physical deletion can occur later. Legacy response records do not yet have automatic deletion. OpenRouter and each model provider also handle your request under their own data policies and may retain it |
| Scholarly search (official connection): keywords, DOIs | You search for papers or complete references | Looked up through the gateway at OpenAlex, Crossref, arXiv, PubMed, DBLP and Unpaywall | The responses (public paper metadata) are kept for 24 hours for retries and a shared cache |
| Find citations: the sentence you want a citation for | You use "Find citations" | Sent to our own index service on Railway, not to third-party search engines; sign-in required | The service doesn't keep the sentence, and its access log is switched off |
| Cloud sync and co-editing (when you turn them on): workspaces, Planner, library PDFs, co-edited document changes | Syncing or co-editing | Move data between your devices and your co-editors | End-to-end encrypted; we store ciphertext only. We can still see your account, workspace and row identifiers, key epochs, timestamps, ciphertext sizes, device public keys and a co-editing member list. Relayed messages are kept up to 30 days and deleted once every receiving device confirms; old co-editing mailbox items older than 30 days that a newer snapshot already covers are cleared daily; the encrypted Planner mirror is kept for new devices and disaster recovery; ciphertext of co-editing attachments sits in Cloudflare R2 with no automatic clean-up yet |
| Advisor review links: manuscript, comments, the name your advisor types | You press "Send to advisor" | Let your advisor review without an account | Encrypted on your computer. The key sits after the # in the link and never reaches our servers. Links expire after 30 days by default; once expired or revoked, the encrypted manuscript is removed (hourly clean-up) and comments are deleted at once. The advisor's encrypted edit versions are kept until the review link is deleted or you delete your account. When an advisor starts reviewing, or a link is about to expire, we email you (never with the manuscript title) |
| Pro+ cloud typesetting (advisor edits LaTeX) | Preview compile | Process the source for the few seconds a compile takes | Our compile service on Railway; the source isn't stored, the temporary directory is removed when the compile ends, and the resulting PDF may be cached briefly (size-limited) |
| Surveys: questions and responses | You publish a survey | Let respondents answer | Supabase; 30 days by default (you can set 1–365), expired responses are deleted daily; the temporary throttling token is deleted within a day |
| Figure reports: reason, optional contact, account | You report a figure | Review the report | Supabase; kept until the case is closed, then retained as an appeal and statistics record; you can email us to delete the contact details you gave |
| Support email | You write to us | Reply to you | Our mailbox |
Update checks: the app fetches a version list from updates.veritalai.com, so our server sees your IP address and app version. Crash reporting is currently off (it does not start at all without a configured endpoint); if we ever turn it on, we'll update this policy first.
3. Who we share data with
- Paddle (Merchant of Record) handles payments, receipts, tax, refunds and fraud prevention. Your card number goes only into Paddle's payment form; we never see it. We receive only a customer and subscription ID, plan, status and billing period. See Paddle's privacy notice.
- Service providers: Supabase (accounts, licences, billing ledger, encrypted sync and mailboxes), Cloudflare (web hosting, R2 storage, Workers, email sending and TURN relay; relayed content is encrypted), Railway (AI gateway in US East; the compile and citation-index services are also in US East), and OpenRouter with the model providers it routes to.
- Authorities, and our lawyers and accountants, where the law requires or advice is needed.
- Features you start yourself send data straight from your computer, not through us: model providers you connect with your own key, Google Translate, DuckDuckGo, Tavily or Brave search, YouTube, Zotero, Hugging Face (downloading local models) and similar.
- We do not sell personal data.
4. Your own keys, local models and de-identification
With your own API key, requests go from your computer directly to the provider you chose, not through us, and the key is kept in your computer's keychain. Local models for speech, OCR and AI-writing detection run on your machine and need no network. De-identification is optional and off by default; when you turn it on in Settings, names, organisations, places and other personal identifiers are replaced with placeholders on your computer before anything is sent out.
5. Your rights
You may ask to access, receive a copy of, correct or delete your personal data, to restrict or object to processing, to data portability, and to withdraw consent. Users in the EU and UK can also complain to their local supervisory authority. Email support@veritalai.com and we'll reply within 30 days. In-app self-service export and account deletion are not finished yet, so we handle those requests by hand for now. After an account is deleted we remove personal data within 30 days, except billing records the law requires us to keep. Your local data already lives on your computer and you can export it any time.
6. International transfers
Our providers are in Japan, the United States and elsewhere, so your data may be transferred outside your country.
7. Security
We use TLS in transit. Sync, co-editing and review links are end-to-end encrypted. The database applies row-level access control so each person can read only their own rows, and official API keys are stored only as hashes. The local database on your computer is not separately encrypted today; we recommend turning on FileVault (macOS) or BitLocker (Windows).
8. Cookies and our website
Our website has no cookie banner. Your language choice is stored only in your browser's local storage, and the site loads fonts from Google Fonts. On the checkout page, the payment form is provided by Paddle and may set Paddle's own strictly necessary cookies.
9. Children
The Service is not directed at children under 13.
10. Changes
We'll announce material changes in the app and on our website before they take effect.