1. The Short Version

• Calla stores your health entries in your own private account so they sync across your devices. Security rules restrict every record to your account — with one exception you control: a care-circle share you deliberately create, which lets one person you invite read a scoped summary. See Care circle.
• Calla's free plan shows ads (via Google AdMob). In the EEA, the UK and Switzerland you are asked for consent first and can change your choice at any time in Settings → Privacy → Ad privacy settings. Your health data is never used for advertising, never shared with advertisers, and never sold.
• The AI companion sends chat messages to Google's Gemini to generate replies; nothing is used to advertise to you.
• If you turn on health sync, Calla reads eight kinds of data from Apple Health / Health Connect, and — only if you separately allow it — writes back the water you log and the mindful minutes from its breathing exercise. See Apple Health & Health Connect.
• You can permanently delete your account and every record at any time, directly in the app (Settings → Delete account & data).

2. What Calla Is

Calla is a personal health companion for daily mood check-ins, symptoms, vitals, medications and refills, appointments, journaling, guided breathing, a supportive AI chat, and a family care circle. This policy explains what data the app handles and where it goes.

Calla is a wellness tool, not a medical device, and nothing in the app is medical advice.

3. Data the App Handles

• Account details — your name and email address, used to sign you in and address you in the app. You can sign in with email and password, Sign in with Apple, or Google Sign-In.
• Health entries you log — mood check-ins, sleep, water, steps, symptoms, vital readings (such as blood pressure, heart rate, weight, temperature), medications and dose history, appointments, and journal entries.
• Emergency info you choose to add — blood type, allergies, conditions, and an emergency contact, kept on your profile for your own reference and data exports.
• Photos you attach to a symptom — for example a rash, a swelling, or a wound. These are stored as files in your own private folder in Google Cloud Storage and are readable only by your account. They are never included in a care-circle share.
• Care circle — the names and contact details of family members or carers you add.
• AI chat messages — the conversations you have with the Calla companion.
• Preferences — reminder times, units, goals, theme, and your privacy choices.
• Crash diagnostics — see Crash reporting below.

Calla collects no location data, no contacts from your address book, and no usage analytics. Where ads are personalized only with your consent, and non-personalized otherwise — see Advertising below for exactly what Google receives.

Guest accounts. "Continue as guest" creates a real but anonymous account: it has an internal id but no email, password, or name, so there is nothing to sign back in with. Calla warns you before you sign out of a guest account, and Settings → Protect my account lets you attach an email address, Apple ID, or Google account at any time — after which the same data is recoverable normally.

4. Where Your Data Is Stored

Your entries are stored in Google Firebase (Firestore, Firebase Authentication, and Cloud Storage for photo attachments), which lets your data sync live across your devices. Firestore and Storage security rules restrict every record and every file to your own signed-in account. The only data another account can ever read is a care-circle share you create yourself — see Care circle.

Some data is also kept on your device: a cached copy of your entries so the app works offline, plus a small queue of check-ins and photo uploads that haven't reached the server yet. Android system backups are disabled for Calla, so this local data is not copied into Google Drive backups. It is removed when you delete your account or uninstall the app.

Demo mode: if you try Calla in demo mode, everything stays on your device only and is discarded when you leave the demo — no account is created and nothing is uploaded.

4a. Care Circle (Sharing With Someone Else)

The care circle is the one feature that lets a different person read some of your data, and it only ever happens because you started it.

• When you turn on sharing for someone, Calla writes a snapshot — not your whole account — to a separate record identified by a random invite code you pass to that person.
• The snapshot contains only what the access level you picked allows (for example a summary, or medications and vitals). It never contains your photos, your journal, or your AI chats.
• The record locks to the first account that opens it, so a code that goes astray cannot be used by a second person. You can see who claimed it and when.
• You can set an expiry date when you share, revoke any share instantly, or rotate every active code at once from Circle → Sharing. Revoking or expiring stops the other person seeing anything further.
• Deleting your account deletes every share you created, so nothing readable is left behind.

4b. Crash Reporting

If a build of Calla is configured with crash reporting, an unexpected crash sends a diagnostic report to Sentry so the bug can be fixed. A report contains the error, the code path that produced it, your app version and device model, and an internal account id — not your health entries, journal, photos, or chats. Crash reporting is off when no reporting endpoint is configured for the build.

5. The AI Companion

When you chat with the Calla companion, your messages are sent to Google's Gemini model via Firebase AI Logic to generate a reply. So the companion can respond helpfully, each request also includes a short summary of your recent entries — such as recent check-ins, symptoms, your medication list and latest vitals. Google processes those requests under its cloud terms; Calla does not use your chats for advertising or sell them to anyone.

For users in regions where Google services are not reachable (such as mainland China), chat and sync requests travel through a relay server operated by the developer in Hong Kong (Tencent Cloud). The relay passes your requests through to the same services and does not store your data; while in transit it is processed on Tencent Cloud's Hong Kong infrastructure.

The AI companion offers supportive conversation only — it is not a doctor and its replies are not medical advice. In an emergency, contact local emergency services.

6. Advertising

Calla's free plan shows a small banner ad on a few everyday screens (such as Home, Trends, and the journal). Ads are provided by Google AdMob.

• Consent comes first. If you are in the European Economic Area, the United Kingdom, or Switzerland, Calla shows a Google-certified consent message (Google's User Messaging Platform) before the advertising SDK starts, and no ad request is made until you have answered it. You can reopen that message and change or withdraw your choice at any time in Settings → Privacy → Ad privacy settings.
• If you do not consent to personalized ads — and everywhere a consent message is not required — ads are non-personalized: chosen from general, contextual signals rather than a profile built from your behaviour.
• Even non-personalized ads use device identifiers for purposes such as frequency capping, aggregate reporting, and fraud prevention. On iOS, Calla does not request App Tracking Transparency permission, so the advertising identifier is not available for cross-app tracking. Google's Mobile Ads SDK declares device-identifier collection in its own privacy manifest.
• Your health entries, journal, photos, AI chats, and any data imported from Apple Health or Health Connect are never shared with AdMob or used to target ads. Ads never appear on the AI chat, vitals detail, or emergency-info screens.
• To serve and measure ads and to limit ad fraud, AdMob receives basic technical information such as your device type and model, coarse region, and the ad request itself. See Google's advertising notice and Google's ads processor terms for details.
• An in-app upgrade removes ads entirely.

7. Apple Health & Health Connect (Optional)

Health sync is off until you turn it on. When you do, Calla asks the system for read access to eight kinds of data from Apple Health (iOS) or Health Connect (Android):

• steps, sleep, heart rate, weight,
• blood pressure, body temperature, blood glucose, and water intake.

Imported readings are stored alongside the vitals you log manually, in your own account.

Writing back. Calla can also put two things it created itself back into the platform store, so your other apps stay in step: the water you log in Calla, and the mindful minutes from Calla's breathing exercise (mindful sessions are iOS-only — Health Connect has no equivalent record). Write access is requested separately from read access and only when you enable it, so you can import without ever letting Calla write. Calla never writes any other kind of record, and never authors a reading it did not measure.

• Health data is never used for advertising or marketing, never sold, and never shared with third parties for their own purposes.
• Health data is never included in a crash report.
• You can turn sync or write-back off at any time in Settings, or revoke access in your device's health settings.

8. Reminders and Notifications

Medication, check-in, and appointment reminders are scheduled locally on your device. Your health data is not sent to a push-notification service.

9. Sharing and Export

Nothing is shared unless you choose to share it. Settings → Export builds a plain-text summary of your data that you can send wherever you like — for example to a doctor. The export happens through your device's own share sheet.

10. Data Retention and Deletion

• Your data is kept in your account until you delete it. Individual entries can be edited or deleted in the app.
• Settings → Delete account & data permanently erases, in this order: every care-circle share you created; every photo attachment in Cloud Storage; every check-in, reading, symptom, medication, appointment, journal entry and chat message; the offline queues and cached data on your device; and finally the account itself.
• The same erasure runs server-side as well, triggered by the account's removal. It covers the cases a phone cannot — a deletion made from a support request or an administrative tool, or a device that lost connection halfway through — and it sweeps the same set: your data tree, your Storage folder, shares you own, references held by people you shared with, and internal rate-limit counters. It retries until it completes.
• Deletion takes effect immediately and cannot be undone. See the Delete Account page for details.
• Uninstalling the app removes locally cached data from your device.
• Backups: Firebase keeps short-lived operational backups of its databases as part of running the service; deleted records age out of those within 30 days.

10a. Your Privacy Controls

Settings → Privacy collects the choices that matter in one place:

• Ad privacy settings — reopen the consent message, or change/withdraw your choice (where applicable).
• AI companion — turn the AI off entirely, or stop your recent entries being included as context with each message.
• Crash reporting — turn diagnostic reports off.
• Privacy mode — hide entry details from notifications, blur the app in the task switcher, and block screenshots and screen recording.
• App lock — require Face ID, fingerprint or your device passcode to open Calla.
• Care-circle sharing — see every active share, when it was claimed and by whom, set expiry dates, and rotate all codes at once.

10b. Your Rights

Depending on where you live (for example under the GDPR or the UK GDPR), you have rights to access, correct, export, restrict, and erase your personal data, and to object to certain processing. Calla is built so you can exercise most of these yourself and immediately: Settings → Export produces a full copy of your data, every entry is editable in the app, and Settings → Delete account & data erases everything. For anything else — or to raise a complaint — write to wksunshine@gmail.com. You also have the right to complain to your local data-protection authority.

Calla's legal basis for handling your health entries is your consent, given by choosing to record them; for optional features (health sync, AI chat, care-circle sharing, personalized ads, crash reporting) it is the separate consent you give when turning each one on, which you can withdraw at any time by turning it back off.

11. Children

Calla is intended for adults managing their own wellbeing and is not directed at children under 13.

12. Changes

If this policy changes, the updated version will be published at the same URL with a new effective date.

13. Contact

Questions about this policy: wksunshine@gmail.com

1. 簡要說明

• Calla 將您的健康記錄儲存在您私人的帳號中，以便在您的裝置之間同步。安全規則確保每筆記錄僅限您本人的帳號存取 — 唯一的例外由您自己掌控：您主動建立的關懷圈分享，讓您邀請的一位對象可讀取範圍受限的摘要。詳見關懷圈。
• Calla 免費方案會顯示廣告（透過 Google AdMob）。若您位於歐洲經濟區、英國或瑞士，我們會先徵求您的同意，您也可隨時在設定 → 隱私 → 廣告隱私設定中變更或撤回選擇。您的健康資料絕不用於廣告、不會提供給廣告商，也絕不出售。
• AI 夥伴會將聊天訊息傳送至 Google 的 Gemini 以產生回覆；您的資料不會被用於向您投放廣告。
• 若您開啟健康同步，Calla 會從 Apple 健康／Health Connect 讀取八類資料；僅在您另行允許時，才會將您記錄的飲水量與呼吸練習的正念分鐘數寫回。詳見 Apple 健康與 Health Connect。
• 您可隨時直接在應用程式內（設定 → 刪除帳號與資料）永久刪除您的帳號及所有記錄。

2. 關於 Calla

Calla 是您的個人健康夥伴，提供每日心情打卡、症狀記錄、生命體徵、用藥與補藥提醒、預約管理、日記、引導式呼吸、暖心的 AI 聊天，以及家庭關懷圈。本政策說明應用程式處理哪些資料，以及資料的去向。

Calla 是健康輔助工具，不是醫療器材，應用程式中的內容皆不構成醫療建議。

3. 應用程式處理的資料

• 帳號資料 — 您的姓名和電子郵件地址，用於登入及在應用程式中稱呼您。您可使用電子郵件密碼、Apple 登入或 Google 登入。
• 您記錄的健康資料 — 心情打卡、睡眠、飲水、步數、症狀、生命體徵（如血壓、心率、體重、體溫）、藥物及服藥記錄、預約及日記。
• 您選擇填寫的緊急資訊 — 血型、過敏、疾病及緊急聯絡人，保存在您的個人檔案中，供您參考及匯出資料時使用。
• 您為症狀附加的照片 — 例如皮疹、腫脹或傷口。這些照片以檔案形式儲存在 Google Cloud Storage 中您專屬的私人資料夾，僅限您的帳號讀取，且絕不納入關懷圈分享。
• 關懷圈 — 您新增的家人或照顧者的姓名及聯絡方式。
• AI 聊天訊息 — 您與 Calla 夥伴的對話。
• 偏好設定 — 提醒時間、單位、目標、主題及您的隱私選擇。
• 當機診斷資料 — 詳見下方「當機回報」一節。

Calla 不收集位置資料、不讀取您的通訊錄，也沒有使用分析。個人化廣告僅在取得您同意後才會投放，否則一律為非個人化廣告 — Google 究竟會收到哪些資料，詳見下方「廣告」一節。

訪客帳號。「以訪客身分繼續」會建立一個真實但匿名的帳號：它有內部識別碼，但沒有電子郵件、密碼或姓名，因此沒有任何可用來重新登入的憑證。Calla 會在您登出訪客帳號前提出警告，您也可隨時透過設定 → 保護我的帳號綁定電子郵件、Apple ID 或 Google 帳號 — 綁定後即可正常復原相同的資料。

4. 資料儲存位置

您的記錄儲存在 Google Firebase（Firestore、Firebase 驗證，以及儲存照片附件的 Cloud Storage），讓資料能在您的裝置間即時同步。Firestore 與 Storage 安全規則確保每筆記錄與每個檔案僅限您本人的帳號存取。其他帳號唯一能讀取的資料，是您自行建立的關懷圈分享 — 詳見關懷圈。

部分資料也會保存在您的裝置上：包括供離線使用的記錄快取，以及尚未送達伺服器的少量打卡與照片上傳佇列。Calla 已停用 Android 系統備份，因此這些本機資料不會被複製到 Google 雲端硬碟備份中。當您刪除帳號或解除安裝應用程式時，這些資料即會移除。

示範模式：若您以示範模式試用 Calla，所有資料僅存在於您的裝置上，離開示範模式時即會清除 — 不會建立帳號，也不會上傳任何資料。

4a. 關懷圈（與他人分享）

關懷圈是唯一讓其他人能讀取您部分資料的功能，且一律由您主動開啟。

• 當您為某人開啟分享時，Calla 會寫入一份快照（並非您的整個帳號）到一筆獨立記錄中，該記錄以一組隨機邀請碼識別，由您交給對方。
• 快照僅包含您所選存取層級允許的內容（例如摘要，或藥物與生命體徵），絕不包含您的照片、日記或 AI 聊天。
• 該記錄會鎖定給第一個開啟它的帳號，因此即使邀請碼外流，也無法被第二個人使用。您可以看到是誰在何時認領的。
• 您可在分享時設定到期日、隨時立即撤銷任一分享，或在關懷圈 → 分享中一次輪替所有有效邀請碼。撤銷或到期後，對方即無法再看到任何後續內容。
• 刪除帳號時會一併刪除您建立的所有分享，不會留下任何可讀取的內容。

4b. 當機回報

若某個 Calla 版本已設定當機回報，發生非預期當機時會將診斷報告傳送至 Sentry 以便修正問題。報告內容包含錯誤本身、產生錯誤的程式路徑、您的應用程式版本與裝置型號，以及一組內部帳號識別碼 — 不包含您的健康記錄、日記、照片或聊天內容。若該版本未設定回報端點，當機回報即為關閉狀態。

5. AI 夥伴

當您與 Calla 夥伴聊天時，您的訊息會透過 Firebase AI Logic 傳送至 Google 的 Gemini 模型以產生回覆。為了讓夥伴給出貼心的回應，每次請求也會附上您近期記錄的簡短摘要 — 例如近期打卡、症狀、藥物清單及最新生命體徵。Google 依其雲端服務條款處理這些請求；Calla 不會將您的聊天用於廣告，也不會出售給任何人。

對於無法連接 Google 服務的地區（如中國大陸）的使用者，聊天及同步請求會經由開發者在香港營運的中繼伺服器（騰訊雲）傳送。中繼伺服器僅將您的請求轉發至相同的服務，不會儲存您的資料；傳輸過程中資料會經過騰訊雲香港的基礎設施處理。

AI 夥伴僅提供陪伴式對話 — 它不是醫生，其回覆不構成醫療建議。如遇緊急情況，請聯絡當地緊急服務。

6. 廣告

Calla 的免費方案會在部分日常畫面（如首頁、趨勢及日記）顯示小型橫幅廣告，廣告由 Google AdMob 提供。

• 同意優先。若您位於歐洲經濟區、英國或瑞士，Calla 會在廣告 SDK 啟動之前顯示 Google 認證的同意訊息（Google 使用者訊息平台 UMP），在您回覆之前不會發出任何廣告請求。您可隨時在設定 → 隱私 → 廣告隱私設定中重新開啟該訊息，變更或撤回您的選擇。
• 若您不同意個人化廣告 — 以及在所有無須顯示同意訊息的地區 — 廣告一律為非個人化：依一般情境訊號選取，而非依您的行為建立的個人檔案。
• 即使是非個人化廣告，仍會使用裝置識別碼，用於頻率控制、彙總報表及防詐等目的。在 iOS 上，Calla 不會請求「App 追蹤透明度」權限，因此廣告識別碼無法用於跨應用程式追蹤。Google 行動廣告 SDK 已在其隱私資訊清單中聲明會收集裝置識別碼。
• 您的健康記錄、日記、照片、AI 聊天，以及從 Apple 健康或 Health Connect 匯入的任何資料，絕不會與 AdMob 分享，也不會用於投放廣告。AI 聊天、生命體徵詳情及緊急資訊畫面上絕不會出現廣告。
• 為投放及衡量廣告並防止廣告詐騙，AdMob 會接收基本技術資訊，例如您的裝置類型與型號、粗略地區及廣告請求本身。詳情請參閱 Google 的廣告說明及 Google 廣告資料處理條款。
• 應用程式內升級可完全移除廣告。

7. Apple 健康與 Health Connect（可選）

健康同步預設為關閉，需由您主動開啟。開啟後，Calla 會向系統請求讀取 Apple 健康（iOS）或 Health Connect（Android）中的八類資料：

• 步數、睡眠、心率、體重，
• 血壓、體溫、血糖及飲水量。

匯入的讀數會與您手動記錄的生命體徵一同儲存在您自己的帳號中。

寫回資料。Calla 也可將兩項由它自己產生的資料寫回平台，讓您的其他應用程式保持同步：您在 Calla 記錄的飲水量，以及 Calla 呼吸練習的正念分鐘數（正念記錄僅限 iOS — Health Connect 沒有對應的記錄類型）。寫入權限與讀取權限分開請求，且僅在您啟用時才會請求，因此您可以只匯入資料而完全不讓 Calla 寫入。Calla 絕不寫入其他任何類型的記錄，也絕不產生非它自己測量的讀數。

• 健康資料絕不用於廣告或行銷、絕不出售，也絕不為第三方自身目的與其分享。
• 健康資料絕不會包含在當機報告中。
• 您可隨時在「設定」中關閉同步或寫回功能，或在裝置的健康設定中撤銷存取權。

8. 提醒與通知

用藥、打卡及預約提醒都在您的裝置本機排程。您的健康資料不會傳送至推播通知服務。

9. 分享與匯出

除非您主動分享，否則不會分享任何資料。「設定 → 匯出」會產生一份純文字的資料摘要，您可自由傳送至任何地方 — 例如給醫生。匯出透過您裝置本身的分享功能進行。

10. 資料保留與刪除

• 您的資料會保留在您的帳號中，直到您刪除為止。您可在應用程式內編輯或刪除個別記錄。
• 「設定 → 刪除帳號與資料」會依序永久清除：您建立的所有關懷圈分享；Cloud Storage 中的所有照片附件；每一筆打卡、讀數、症狀、藥物、預約、日記和聊天記錄；裝置上的離線佇列與快取資料；最後是帳號本身。
• 相同的清除作業也會在伺服器端執行，由帳號的移除觸發。它涵蓋手機無法處理的情況 — 例如透過客服請求或管理工具進行的刪除，或裝置在中途斷線 — 並清除相同範圍：您的資料樹、您的 Storage 資料夾、您擁有的分享、分享對象持有的參照，以及內部的流量限制計數器。此作業會持續重試直到完成。
• 刪除立即生效且無法復原。詳情請參閱刪除帳號頁面。
• 解除安裝應用程式會移除裝置上的本機快取資料。
• 備份：Firebase 在提供服務的過程中會保留短期的資料庫營運備份；已刪除的記錄會在 30 天內從這些備份中淘汰。

10a. 您的隱私控制項

設定 → 隱私將所有重要選擇集中在同一處：

• 廣告隱私設定 — 重新開啟同意訊息，或變更／撤回您的選擇（適用地區）。
• AI 夥伴 — 完全關閉 AI，或停止在每則訊息中附帶您近期記錄作為脈絡。
• 當機回報 — 關閉診斷報告。
• 隱私模式 — 在通知中隱藏記錄細節、在多工切換畫面中模糊化應用程式，並封鎖螢幕擷取與螢幕錄影。
• 應用程式鎖定 — 開啟 Calla 時需通過 Face ID、指紋或裝置密碼驗證。
• 關懷圈分享 — 檢視所有有效分享、認領時間與認領者、設定到期日，並可一次輪替所有邀請碼。

10b. 您的權利

依您所在地區的法規（例如 GDPR 或英國 GDPR），您享有存取、更正、匯出、限制及刪除您個人資料的權利，並可反對特定的資料處理行為。Calla 的設計讓您能自行且即時行使其中大部分權利：設定 → 匯出可產生您資料的完整副本，每一筆記錄都可在應用程式內編輯，而設定 → 刪除帳號與資料則會清除所有內容。其他事項 — 或提出申訴 — 請來信 wksunshine@gmail.com。您亦有權向當地的資料保護主管機關提出申訴。

Calla 處理您健康記錄的法律依據是您的同意，即您選擇記錄它們的行為；至於選用功能（健康同步、AI 聊天、關懷圈分享、個人化廣告、當機回報），依據則是您在開啟各該功能時另行給予的同意，您可隨時透過關閉該功能撤回。

11. 兒童

Calla 是為管理自身健康的成年人設計，並非以 13 歲以下兒童為對象。

12. 政策變更

若本政策有所變更，更新版本將發布於相同網址，並附上新的生效日期。

13. 聯絡方式

關於本政策的問題，請聯絡：wksunshine@gmail.com