Firebase Authentication 產生的使用者編號（uid）。用 Apple 或 Google 登入時，Firebase 會收到並保存這組編號，以及 Apple／Google 提供的電子郵件地址（若你用 Apple 的「隱藏我的電子郵件」，收到的是 Apple 的轉寄地址）。電子郵件只用來在設定頁顯示你登入的是哪個帳號。我們不會收到你的密碼。
Futa Trip is a manhole-cover collecting and trip-planning app. Most data stays on your device; only the following is uploaded.
Item
What it is
When
Account identifier and email
A user id (uid) issued by Firebase Authentication. When you sign in with Apple or Google, Firebase receives and stores this id together with the email address Apple or Google provides (an Apple relay address if you use “Hide My Email”). The email is used only to show which account you are signed in with in Settings. We never receive your password.
When you sign in or use cloud features
Nickname
A display name you choose. It appears next to photos you share.
When you set it
Photos you choose to share
The photo, plus the cover area you framed in the app. Uploaded photos are re-encoded and carry no original EXIF — capture time and GPS are stripped.
When you tap “Share with everyone”
Your check-in record
Which covers you checked in at and when, the ids of photos you uploaded, and the photos you liked. Kept in a personal record only you can read, used to restore check-ins on a new phone and to count how many people have been to a cover. No coordinates.
When you check in, upload or like
Routes you share
When you create a download link: that route's contents, name, stop count and date. Links expire after at most 90 days.
When you create a share link
Live Activity push tokens
When you start a trip's Lock Screen / Dynamic Island activity: the push tokens (Apple Push Notification service token and Firebase Cloud Messaging token) and the route id, stored in Cloud Firestore in a record keyed by your account identifier and used only to update that activity from the server.
When you start a trip Live Activity
Reports
The photo you reported, its uploader's account identifier, and the reason you entered. Used only to handle the report.
When you send a report
Bus stop coordinates
When searching bus routes, the names and coordinates of bus stops found are saved to a shared bus-stop database along with the account identifier that wrote them. This is public bus-stop data, not your location.
When you search bus routes
Crash reports
When the app crashes, the stack trace, device model and OS version are sent via Firebase Crashlytics so we can fix the bug. No location, photos or other content. On by default; you can turn it off in Settings.
When the app crashes
2. What stays on your device
Your location, used to show nearby covers sorted by distance, for navigation, and for the trip Live Activity to detect which stop you've reached. While navigation or a trip Live Activity is running, the app uses location in the background (a location icon appears in the status bar). It is never uploaded.
Trip actuals: the times you actually arrived at and left each stop, and your coordinates at those moments, are recorded on the device only.
Check-in photos and albums, including capture time and coordinates. Unless you choose to share a photo, none of it leaves the device.
Trips, routes and notes, unless you create a share link or use iCloud backup.
Photo metadata: when logging a past check-in, the app reads the capture time and location of the photo you pick to verify distance. This happens entirely on device.
3. Where data is stored
Uploaded data is stored in Google Firebase (Cloud Firestore), region asia-northeast1 (Tokyo). Apart from Firebase we run no server of our own. The developer can access this data through the Firebase console and does so only to review reports, troubleshoot problems and carry out deletions.
3.1 iCloud backup
Cloud backup (Pro) and the backup of check-in camera originals are stored in your own iCloud (Apple CloudKit private database) and use your iCloud storage. We cannot read this data.
It contains your collection records, trips, check-in photos and albums (including capture time and coordinates), and encrypted check-in originals.
You can turn off automatic backup in the app's settings, or delete the app's iCloud data in iPhone Settings → Apple Account → iCloud → Manage Storage.
3.2 What is sent when searching routes
When you search train, bus or walking routes, the app sends the origin and destination needed for the search (station names or coordinates) and the time to these route services: Apple Maps, Jorudan, NAVITIME, Yahoo! Transit and Ekispert. Only the search itself is sent — never your account or personal information.
4. Who can see it
Photos you upload and your nickname are public — anyone using the app can see them, like them, or set one as their own display image. Please check that nothing you'd rather keep private is in the frame.
Check-ins are shown only as a number of people, never as names. Your personal record can be read only by you.
Share links are only reachable by someone who has the link.
4.1 Ads (Google AdMob)
The free version shows ads from Google AdMob. With a Pro subscription no ads are shown.
AdMob receives your approximate location (from IP) and ad interactions to serve and measure ads. Only if you allow tracking (ATT) does AdMob also receive your advertising identifier (IDFA) — see Google's policy.
You'll be asked for App Tracking Transparency permission the first time. Declining is fine — AdMob then gets no IDFA and ads are not personalised.
You can change this any time in Settings → Privacy & Security → Tracking.
4.2 Health data (steps)
The step count on the home screen is read-only from Apple Health, with your permission. It stays on your device — never uploaded, shared, or used for ads.
Declining does not affect any other feature.
4.3 Third-party services we use
Google AdMob: ads in the free version (see 4.1).
Firebase Authentication: Apple / Google sign-in and account management; stores your uid and the email address the sign-in provider returns.
Cloud Firestore: storage for the photo wall, likes, nicknames, check-in records, shared routes, reports and push tokens.
Firebase Cloud Messaging: push tokens used to update trip Live Activities from the server.
Firebase Crashlytics: crash reports (stack trace and device model); on by default, can be turned off in Settings.
Apple iCloud (CloudKit): Pro cloud backup, stored in your own iCloud (see 3.1).
The route services used for route searches (see 3.2).
5. What we don't do
We do not sell or trade your data.
We do not collect contacts, call history or browsing history.
Device identifiers: AdMob receives the advertising identifier (IDFA) only if you allow tracking (ATT). There are also push tokens (see 1) and random installation ids that Firebase generates for push and crash reporting. We collect no other device identifiers.
6. Retention and deletion
Photos you upload stay until you delete them or delete your account. You can delete your own photo inside the app, or withdraw all of them at once in Settings.
Delete account sits at the bottom of Settings. It deletes your account and its data: your uploaded photos, likes, nickname, check-in records, share links, push tokens, and related backups on our servers. Your photos disappear from the photo wall and your check-ins stop being counted immediately; deletion of the rest is completed within 30 days. This cannot be undone. Data on this device is not affected.
Share links expire after at most 90 days, and you can revoke one at any time.
On-device data is removed when you delete the app. Backups in iCloud must be deleted from iCloud settings (see 3.1).
7. Children
The app is not directed at children under 13 and does not knowingly collect their personal information.
8. Changes
If this policy changes we will update the date at the top of this page. Significant changes will also be noted in the app.
9. Contact & Support
For questions about the app or this policy, support, account or data requests (such as access, correction or deletion), or to report objectionable content, email us at: