Privacy Policy隐私政策
Privacy by architecture, not by promise.
Guardian is built so that the safety data it needs in order to protect you stays on your phone. We have no account for you and no personal profile. We do not receive your location history, your microphone audio, your emergency contacts, or your activity history — the judgement that decides whether you are in danger is made on the phone itself.
A small amount of technical information is sent to naidraug.com in three situations only: licence activation, trial control, and the optional family response page. Exactly what leaves the phone is set out below, in full.隐私靠架构，不靠承诺。
Guardian 的设计前提是：保护你所需要的安全数据，留在你的手机上。我们没有你的账号，也不建立任何个人档案。我们不会收到你的位置历史、麦克风音频、紧急联系人或活动历史——判断你是否处于危险之中的那个决策，是在手机本机完成的。
只有在三种情况下，才会有少量技术信息发送到 naidraug.com：授权激活、试用控制，以及可选的家人认领页。究竟哪些信息会离开手机，下文逐项、完整说明。
1. What we collect一、我们收集什么
We do not collect or monitor your personal safety data. The location, microphone audio, emergency contacts, and activity signals that Guardian uses all stay on your phone. There is no account, no sign-up, no login, and no user profile of any kind.我们不收集、也不监测你的个人安全数据。Guardian 所使用的位置、麦克风音频、紧急联系人与活动信号，全部保留在你的手机上。没有账号、没有注册、没有登录，也不存在任何形式的用户档案。
A limited amount of technical information does reach our server, and we describe every piece of it in section 4. We would rather tell you exactly what that is than claim we receive nothing at all.确实有少量技术信息会到达我们的服务器，第四节把其中每一项都写清楚了。与其宣称「我们什么都不接收」，我们宁愿准确告诉你那到底是什么。
2. Data the app uses on your phone二、App 在手机本地使用的数据
All of the following stays on the device. None of it is uploaded, and none of it is accessible to us.以下数据全部保留在设备本地，不上传，我们也无法访问。
| Data数据 | Why用途 | Where it goes去向 |
|---|---|---|
| Microphone audio麦克风音频 | Detecting a whistle; detecting the spoken words "help help" / "救命救命"识别哨声；识别求救唤醒词 "help help" / 「救命救命」 | Analysed in memory only. Audio is never written to a file, never stored, never uploaded, and never sent to any speech service. Recognition runs offline on the phone.仅在内存中做特征分析。音频绝不写入文件、绝不存储、绝不上传、绝不发送给任何语音服务。识别全程在手机本地离线完成。 |
| Location位置 | Attaching your coordinates to an emergency message so help can find you在求救短信中附上你的坐标，以便他人找到你 | Read at the moment of an alarm, placed into the emergency SMS as a map link, and discarded. No location history, no trail, no upload. Your coordinates are never read when no alarm is happening.仅在报警发生的那一刻读取，拼进求救短信作为地图链接，随即丢弃。不记录位置历史、不生成轨迹、不上传。没有报警时不读取你的坐标。 |
| Emergency contacts紧急联系人 | Knowing who to call and text when an alarm fires报警时知道该打给谁、发给谁 | Stored in the app's private storage on the phone. Never uploaded. We never see these names or numbers. The apps do not read your phone's address book — you type the contacts in yourself.存放在手机上 App 的私有存储中。绝不上传。我们永远看不到这些姓名与号码。App 不读取你手机的通讯录——联系人由你自己手动输入。 |
| Motion and phone-activity signals运动与手机活动信号 | Noticing prolonged inactivity; pausing the inactivity timer while you are travelling in a vehicle发现长时间无活动；在乘车移动期间暂停无活动计时 | Processed on the device as simple counts and states. Not uploaded. We do not record which apps you open — only whether the phone was being used at all.在设备上以简单的计数与状态形式处理。不上传。我们不记录你打开了哪些 App——只判断手机当时有没有人在使用。 |
| Home Wi-Fi identifier (SeniorGuardian only)家庭 Wi-Fi 标识（仅 SeniorGuardian） | The optional away-from-home reminder可选的「出门未归提醒」功能 | Off by default. When you switch it on, the app checks roughly once every five minutes — and again whenever the phone reconnects to Wi-Fi — which network it is currently attached to, so it can tell whether you are still at home. Android treats reading a network identifier as location access, so your phone may report a high number of location accesses while this feature is on. What the app learns from it is only "still on the home network" or "not on the home network" — never where you actually are. Only the one Wi-Fi you set as "home" is stored, on the device, for matching; no other network is ever recorded, and nothing is uploaded.默认关闭。开启后，App 大约每五分钟一次、以及手机每次重新连上 Wi-Fi 时，会查看当前连接的是哪一个网络，据此判断你是否还在家。Android 把读取网络标识视为一次位置访问，因此该功能开启期间，你的手机可能报告出很高的位置访问次数。但 App 从中得到的只有「还在家里那个网络上」或「不在」两种结果，绝不知道你实际身在何处。仅存储你设为「家」的那一个 Wi-Fi，存在设备本地用于比对；绝不记录任何其他网络，也不上传任何内容。 |
| Diagnostic log file诊断日志文件 | Letting us help you if something goes wrong出问题时便于协助你排查 | Written to the app's own folder on the phone, capped in size and rotated. Phone numbers and licence codes are masked before writing; coordinates are not written. It is never uploaded, and we cannot retrieve it — it only reaches us if you deliberately send it to us for support.写入手机上 App 自己的目录，有大小上限并自动轮转。写入前电话号码与授权码已做脱敏处理，坐标不写入。绝不上传，我们也无法主动取回——只有你为了排障主动发给我们时它才会到我们手上。 |
3. How an alarm is sent三、求救是如何发出的
When an alarm fires, your phone places the calls and sends the text messages itself, through your own mobile carrier. The alert does not pass through a naidraug server, and it does not need an internet connection. We never receive or store the emergency call or the message itself, and we never receive the coordinates that go into it.报警触发时，是你的手机通过你自己的移动运营商，亲自拨出电话、发出短信。求救不经过 naidraug 的任何服务器，也不需要互联网连接。我们绝不接收、也不保存求救电话或短信本身，更不会收到短信里的坐标。
One qualification, stated plainly: if the family response page is used, a minimal coordination record does exist on our server for up to 48 hours. It is described in section 4(c). Apart from that record, we hold nothing about the alarm.这里有一处必须讲明的限定：如果使用了家人认领页，我们的服务器上确实会存在一条最小化的协调记录，最长保留 48 小时，详见第四节 (c)。除这条记录之外，我们不掌握关于这次报警的任何内容。
4. When the app does contact our server四、App 会在什么情况下访问我们的服务器
The app itself contacts naidraug.com in three cases. All three go to naidraug.com and nowhere else. We do not send any of this information to analytics, advertising, AI, or other third-party data services.App 自身会访问以下地址的情况有三种，且全部只访问 naidraug.com，不访问任何其他地址。我们不会把这些信息发送给任何统计分析、广告、AI 或其他第三方数据服务。
a. Activating your licencea. 激活授权
When you enter a licence code, the app sends that code together with a pseudonymous device identifier. The identifier is a one-way value whose only purpose is to recognise the same installation or device again, for licensing and to prevent unauthorised reuse. We call it pseudonymous rather than anonymous because it is deliberately persistent: it identifies a device across reinstalls. It is never combined with your name, phone number, contacts, location, microphone audio, or safety activity, because we do not hold any of those.当你输入激活码时，App 会连同一个假名化设备标识一并发送。该标识是一个单向值，唯一用途是再次认出同一个安装实例或同一台设备，用于授权与防止未经授权的重复使用。我们称它为「假名化」而非「匿名」，因为它被刻意设计为持久的：它能在重装之后仍然识别出同一台设备。它绝不会与你的姓名、电话号码、联系人、位置、麦克风音频或安全活动数据关联——因为那些我们根本没有。
To be precise about the licence code itself: it is a code we issued, not information about you. Our server already holds the list of codes we have generated. Activating simply matches what you typed against that list and records which device claimed it, so that the same purchase cannot be reused on unlimited devices and so that we can honour it when you reinstall or change phones.关于激活码本身，说得更准确一些：那是我们签发的一串凭证，不是关于你的信息。我们的服务器上本来就存有我们生成过的码的清单。激活所做的事，只是把你输入的内容与这份清单比对，并记录下这张码被哪台设备认领——以免同一笔购买被无限次用在不同设备上，也便于你重装或换手机时我们能兑现它。
b. Trial check-inb. 试用签到
During the free trial the app occasionally sends the same pseudonymous device identifier plus the product name and app version, so that the trial cannot simply be restarted by reinstalling. No personal data is sent.免费试用期间，App 会偶尔发送同一个假名化设备标识，以及产品名与版本号，用于防止通过重装无限重开试用。不发送任何个人数据。
c. The family response pagec. 家人认领页
When an internet connection is available, the first alert message from any of the three apps includes a response link so that family members can mark "I'll take care of this", and the others can see that somebody is on the way. When the alarm creates that page, the only thing the phone sends is which product raised the alarm.在联网可用时，三款 App 的第一条求救短信都会附带一个链接，家人可在页面上点击「我来处理」，其他人便能看到已经有人在处理。报警创建该页面时，手机发送的内容只有一项：是哪个产品发出的报警。
The page then holds a randomly generated page identifier, the time it was created, which product raised the alarm, whether anyone has responded, the display name a family member chooses to type in, the time they responded, and whether they later handed the response back. Nothing else. No phone numbers, no address-book data, no location, no audio, and no message content is stored there. All of it is deleted automatically after 48 hours.此后，该页面保存的内容是：一个随机生成的页面标识、创建时间、是哪个产品发出的报警、是否已有人响应、家人自愿填写的显示姓名、其响应时间，以及此后是否又交还了响应。除此之外别无他物。不保存任何电话号码、通讯录数据、位置、音频或短信内容。全部内容在 48 小时后自动删除。
Treat the link as private. It contains a long random code that cannot be guessed, so in practice only the people who received the alert message can open it — but anyone who obtains a valid link can view the page and change the response state. If the phone has no internet at that moment, the link is simply left out and the alarm proceeds exactly as normal.请把这个链接视为私密链接。它含有一段无法猜测的长随机码，因此实际上只有收到求救短信的人才能打开——但任何取得有效链接的人，都可以查看该页面并改变其响应状态。若手机当时没有网络，短信里就不带这个链接，报警照常完整进行。
d. Ordinary web server recordsd. 常规的网站服务器记录
Like nearly every web server, ours writes standard connection records for the requests above: the IP address the request came from, the time, the address requested, and the browser or app identification string the device sends. We use these only to keep the service running and secure. We do not use web analytics, advertising trackers, or profiling of any kind on these pages, and we do not use these records to build a picture of any person.与几乎所有网站服务器一样，我们的服务器会为上述请求写入标准的连接记录：请求来源 IP 地址、时间、被请求的地址，以及设备发送的浏览器或应用标识字符串。这些记录仅用于维持服务运行与安全。我们不在这些页面上使用任何网页统计、广告追踪或用户画像手段，也不会用这些记录去拼凑关于任何人的信息。
5. What we never do五、我们绝不做的事
- We do not sell or rent personal information, and we do not use Guardian data for advertising or behavioural profiling. There is nothing to sell.我们不出售、不出租个人信息，也不将 Guardian 数据用于广告或行为画像。没有可卖的东西。
- Guardian data is never used to train AI models. Your voice, your movement, and your daily patterns are not training material, and they never reach us in the first place.Guardian 的数据绝不用于训练 AI 模型。你的声音、你的活动、你的日常规律都不是训练素材——它们本来就不会到达我们这里。
- There is no advertising in these apps, and no advertising identifier is used.这些 App 内没有任何广告，也不使用任何广告标识符。
- There are no analytics, tracking, or crash-reporting services of any kind, from us or from anyone else. The apps contain no third-party analytics or advertising software.不含任何形式的统计、追踪或崩溃上报服务，无论来自我们还是来自他人。App 中没有任何第三方统计或广告组件。
- We never record audio. We never store your location. We never upload your contacts.我们绝不录音。绝不存储你的位置。绝不上传你的联系人。
- We do not "sell" or "share" your personal information as those terms are defined under the California Consumer Privacy Act (CCPA/CPRA) or the General Data Protection Regulation (GDPR) — for the simple reason that we never collect it in the first place.按照加州消费者隐私法（CCPA/CPRA）与欧盟通用数据保护条例（GDPR）对相关术语的定义，我们不「出售」也不「共享」你的个人信息——原因很简单：我们从一开始就没有收集过。
For completeness, the full list of outside parties involved: emergency calls and text messages are delivered by your own mobile carrier; purchases are processed by Google Play; and our website runs on commercial hosting infrastructure, as every website does. The apps themselves contain no analytics, advertising, crash-reporting, cloud AI, or third-party safety-monitoring components of any kind.为求完整，这里列出全部涉及的外部方：求救电话与短信由你自己的移动运营商完成投递；购买由 Google Play 处理；我们的网站运行在商业托管基础设施上——所有网站都是如此。App 本身不含任何统计分析、广告、崩溃上报、云端 AI 或第三方安全监测组件。
6. Permissions, and why each one is needed六、权限，以及每一项为何必要
These permissions are strictly required for the core functionality of the apps — providing automated emergency contact and rescue signalling when the user is incapacitated. None of them is used for any secondary purpose.上述权限是本系列 App 实现核心功能（即在用户失能时自动发起紧急联络与求救）的绝对必要条件。其中没有任何一项被用于次要用途。
- Microphone (RECORD_AUDIO) — to hear a whistle or a spoken call for help. Audio is analysed in memory and never stored.麦克风（RECORD_AUDIO）——用于听见哨声或喊出的求救词。音频仅在内存中分析，绝不存储。
- Send SMS (SEND_SMS) — to send the emergency message to your contacts from your own phone.发送短信（SEND_SMS）——用于从你自己的手机向联系人发出求救短信。
- Make calls (CALL_PHONE) — to call your emergency contacts when an alarm fires.拨打电话（CALL_PHONE）——报警时用于拨打你的紧急联系人。
- Phone state (READ_PHONE_STATE) — to notice that a call is in progress, so the alarm can stop escalating once you have actually spoken to someone.电话状态（READ_PHONE_STATE）——用于识别通话正在进行，以便你真的和人通上话之后停止后续轮次。
- Location, including in the background (ACCESS_FINE_LOCATION, ACCESS_BACKGROUND_LOCATION) — read ONLY at the exact moment an alarm triggers, solely to attach current coordinates to the emergency message. An alarm can happen while the screen is off or the app is in the background, which is why background access is declared. Your coordinates are never read continuously and no movement trail is ever built. One qualification, stated in full below: if you switch on the optional away-from-home reminder, the app periodically reads which Wi-Fi network the phone is connected to, and Android counts that as location access.位置（含后台，ACCESS_FINE_LOCATION、ACCESS_BACKGROUND_LOCATION）——仅在报警触发的那一刻读取，唯一用途是把当前坐标附进求救短信。报警可能发生在熄屏或 App 处于后台时，这正是需要声明后台定位的原因。绝不持续读取你的坐标，也绝不构建任何移动轨迹。这里有一处限定，下文完整说明：若你开启了可选的「出门未归提醒」，App 会周期性读取手机当前连接的是哪一个 Wi-Fi 网络，而这在 Android 的口径中属于一次位置访问。
- Physical activity (ACTIVITY_RECOGNITION) — to notice movement, so that prolonged inactivity can be distinguished from ordinary daily life.身体活动（ACTIVITY_RECOGNITION）——用于感知活动，以便把「长时间无活动」与正常日常生活区分开。
- Notifications, foreground service, battery-optimisation exemption, start on boot — to keep protection running continuously and to restore it after a restart. Without these, Android would silently stop the app in the background, which is precisely when protection is most needed.通知、前台服务、电池优化豁免、开机自启——用于让守护持续运行、并在重启后恢复。没有这些，Android 会在后台悄悄杀掉 App——而那恰恰是最需要守护的时候。
- Wi-Fi state (ACCESS_WIFI_STATE) and nearby devices (BLUETOOTH_CONNECT), SeniorGuardian only — the Wi-Fi permission is used by the optional away-from-home reminder; the nearby-devices permission is used only to notice that a Bluetooth device connected or disconnected, as one more sign of daily activity. We do not scan for, catalogue, or record the devices around you. Only the one Wi-Fi you set as "home" is kept.Wi-Fi 状态（ACCESS_WIFI_STATE）与附近设备（BLUETOOTH_CONNECT），仅 SeniorGuardian——Wi-Fi 权限用于可选的「出门未归提醒」；附近设备权限仅用于感知蓝牙设备的连接与断开，作为日常活动的又一个迹象。我们不扫描、不编目、不记录你周围的设备。只保留你设为「家」的那一个 Wi-Fi。
7. Children七、儿童
These apps are not directed at children, and we do not knowingly collect information from anyone. Because Guardian is not directed to children and we do not knowingly collect personal information from children, no data about a child is collected either.这些 App 并非面向儿童设计，我们也不会明知故意通过这些 App 收集儿童的个人信息。
8. Keeping your data, and deleting it八、数据的保存与删除
Your contacts, settings, and diagnostic log live only on your phone. Uninstalling the app deletes all of them permanently. We cannot delete them for you, because we never had them.你的联系人、设置与诊断日志只存在于你的手机上。卸载 App 即永久删除全部内容。我们无法代你删除，因为我们从来就没有过这些数据。
On our side, we hold your licence record together with its pseudonymous device identifier, and we keep them only for as long as is reasonably necessary to validate the licence, prevent unauthorised reuse, and honour your right to reinstall or move to a new phone. A one-time purchase is a lifetime promise, so we keep enough to honour it — and nothing beyond that. Family response pages are deleted automatically after 48 hours. Ordinary web server connection records are kept only for 14 days, after which they are rotated out automatically.在我们这一侧，保存的是你的授权记录及其关联的假名化设备标识；保存期限仅为验证授权、防止未经授权的重复使用，以及兑现你重装或更换手机权利所合理必要的时间。一次买断是终身承诺，因此我们保留足以兑现该承诺的信息——仅此而已。家人认领页在 48 小时后自动删除。常规的网站服务器连接记录保留 14 天，之后由系统自动轮转删除。
To request access to, or deletion of, the server-side licence record associated with your device, write to contact@naidraug.com. Please note that deleting the licence record also removes our ability to recognise your purchase, so you would need your original licence code to activate again.如需查询或删除与你设备关联的服务器端授权记录，请写信至 contact@naidraug.com。请注意：删除授权记录的同时，也会使我们失去识别你此前购买的能力，届时你需要用原始激活码重新激活。
9. Payments九、支付
Purchases are handled by Google Play. We never see your card details. Google's own privacy policy governs the payment itself.购买由 Google Play 处理。我们永远看不到你的银行卡信息。支付环节本身适用 Google 自己的隐私政策。
10. Changes to this policy十、本政策的变更
If this policy changes, the date at the top of this page changes with it. If a change ever means the apps handle data differently from how this page describes, we will say so plainly rather than quietly editing the wording.本政策如有变更，页面顶部的日期会随之更新。如果某次变更意味着 App 处理数据的方式与本页描述不同，我们会明确说明，而不会悄悄改动措辞。
11. Contact十一、联系方式
naidraug LLC, California, United States
Email: contact@naidraug.comnaidraug LLC，美国加利福尼亚州
邮箱：contact@naidraug.com