1. 前言

本隱私權政策說明「光之點名簿」(以下簡稱「本服務」,網址 https://xivrc.com)如何蒐集、使用、儲存及保護你的個人資料。使用本服務即表示你已閱讀並瞭解本政策。本政策為服務條款之一部分。

2. 資料控管者

本服務之個人資料控管者為 Mesker @ 鳳凰。如需行使你的權利或有任何隱私相關疑問,請依第 15 條聯繫我們。

3. 我們蒐集哪些資料

3.1 透過 Discord 登入取得

本服務僅以 Discord OAuth 進行登入。當你授權登入時,我們會自你的 Discord 取得並儲存:

• Discord 使用者 ID(唯一識別碼)
• Discord 顯示名稱／使用者名稱(global name 或 username)
• Discord 頭像圖片網址

我們不會取得你的 Discord 密碼,也不會存取你的私訊或伺服器內容。

3.2 你主動提供的資料

• FFXIV 角色名稱(選填)
• 遊戲伺服器(World)(選填)
• 預設職業(選填)
• 外觀主題偏好(淺色／深色／系統)
• 出席回報：你對各場次的回覆(出席／不出席／部分出席),以及「部分出席」時你可填寫的可行時段
• 團隊相關資料：你所建立或加入的團隊、於團隊中的身分(隊長／成員)與職業設定

3.3 自動蒐集的技術性資料

• 登入工作階段(Session)：以加密的工作階段權杖(JWT)儲存於 Cookie,用以維持你的登入狀態。
• 操作紀錄(稽核紀錄)：為維護安全與管理,系統會記錄部分管理性操作(例如停權、資料變更)之時間、操作者與對象。
• 技術性連線資訊：如 IP 位址、瀏覽器類型等,可能於伺服器或前端防護服務(Cloudflare)之層級被暫時處理,用於維持連線、安全防護與即時同步(Server-Sent Events)。

4. 蒐集目的與依據

我們蒐集及使用上述資料,目的在於:

1. 提供登入與身分識別;
2. 提供並維運出席管理、排班、成團判斷與統計等核心功能;
3. 在你所屬團隊內對其他成員顯示必要之識別與出席資訊;
4. 維護服務之安全、防止濫用與進行必要之管理;
5. 遵循法令義務。

處理之依據包括:履行你我間之服務關係所必要、你的同意(就選填資料)、以及我們維運服務之正當利益。

5. Cookie 與類似技術

本服務使用必要性 Cookie 以維持登入工作階段(名稱如 __Secure-authjs.session-token)。此類 Cookie 為服務運作所必需,停用將無法正常登入。前端安全防護服務(Cloudflare)亦可能基於安全目的設置必要性 Cookie。本服務不使用行銷或追蹤性 Cookie。

6. 我們如何使用你的資料

我們僅在第 4 條所述目的與必要範圍內使用你的資料。我們不會販售、出租你的個人資料,也不會將其用於與本服務無關之行銷。

7. 資料之分享與第三方

我們不會將你的個人資料揭露予第三方,但下列情形除外:

• 服務運作所必需之第三方：
  • Discord：用於登入驗證(資料處理適用 Discord 之隱私政策)。
  • Cloudflare：作為 CDN、DNS 與安全防護,你的連線會經其網路(適用 Cloudflare 之隱私政策)。
  • 憑證機構(Let's Encrypt／Google Trust Services 等)：用於簽發 HTTPS 憑證。
• 團隊內部之揭露：你的角色名稱、職業與出席狀態,會在你所加入之團隊內對該團隊之其他成員及管理者顯示(此為本服務核心功能之必要範圍)。
• 法律要求：於法令要求、主管機關或司法程序要求時,我們得於必要範圍內揭露。

8. 資料儲存位置與跨境傳輸

本服務之資料庫自架於營運者位於台灣之伺服器(NAS),並定期進行備份。惟因本服務使用 Discord、Cloudflare 等位於境外(例如美國)之服務,部分技術性資料可能於境外被處理或傳輸。使用本服務即表示你瞭解並同意此等必要之跨境處理。

9. 資料保留期間

• 你的帳號與相關資料,於你使用本服務期間及為達成前述目的之必要期間內保存。
• 出席與統計資料於團隊存續期間保存,以維持歷史統計之完整。
• 稽核紀錄基於安全目的保存一段合理期間。
• 當你要求刪除、帳號被移除或資料已無保存必要時,我們將刪除或去識別化,惟法令另有要求者不在此限。備份中之資料將於備份輪替週期內一併移除。

10. 資料安全

我們採取合理之技術與管理措施保護你的資料,包括:全站 HTTPS 加密傳輸、以 Discord OAuth 進行驗證、權限控管(一般成員、隊長、平台管理者分層)、以及對外服務埠之防護。惟請注意,網路傳輸與儲存無法保證絕對安全。

11. 你的權利

在適用法律範圍內,你就你的個人資料享有下列權利:

• 查閱與取得副本
• 更正或補充：角色名稱、伺服器、預設職業、主題等,你可自行於「個人設定」中修改。
• 刪除(「被遺忘權」)
• 限制或反對處理
• 撤回同意：就以同意為基礎之處理,你可隨時撤回,惟不影響撤回前之處理效力。

如欲行使上述權利(自助功能未涵蓋之部分),請依第 15 條與我們聯繫。我們將於合理期間內回覆。你亦有權向主管機關提出申訴。

12. 團隊資料與可見範圍

本服務為多人協作工具,請注意:

• 你於團隊中的角色名稱、職業與出席回報,會對同團隊之其他成員與管理者可見。
• 團隊管理者(隊長)可能可檢視、彙整其團隊成員之出席資料。
• 若你不希望特定資訊被團隊成員看到,請斟酌是否填寫該等選填欄位,或退出該團隊。

13. 兒童隱私

本服務不適用於未滿 13 歲之兒童(或你所在地使用 Discord 之最低年齡)。我們不會在明知情況下蒐集兒童之個人資料。若你認為我們誤蒐集了兒童資料,請與我們聯繫,我們將儘速刪除。

14. 政策變更

我們得不時修改本政策。修改後將更新本頁「最後更新」日期並以適當方式公告;涉及重大變更者,我們將盡合理努力更明顯地通知。請定期查閱本政策。

15. 聯絡方式

如需行使權利或就本政策有任何疑問,請透過以下方式聯繫我們:

• 電子郵件:[email protected]
• 資料控管者:Mesker @ 鳳凰

1. Introduction

This Privacy Policy explains how "光之點名簿" (the "Service", at https://xivrc.com) collects, uses, stores, and protects your personal data. By using the Service, you acknowledge that you have read and understood this Policy. This Policy forms part of our Terms of Service.

2. Data Controller

The controller of personal data for the Service is Mesker @ 鳳凰. To exercise your rights or for any privacy-related question, please contact us as set out in Section 15.

3. What Data We Collect

3.1 Obtained through Discord login

The Service uses Discord OAuth for login only. When you authorise login, we obtain and store from your Discord account:

• Your Discord user ID (a unique identifier)
• Your Discord display name / username (global name or username)
• Your Discord avatar image URL

We do not obtain your Discord password, nor do we access your direct messages or server content.

3.2 Data you actively provide

• Your FFXIV character name (optional)
• Your game world / server (optional)
• Your default job (optional)
• Your appearance theme preference (light / dark / system)
• Your attendance responses: your reply to each session (attending / not attending / undecided), and, for "undecided", the available time window you may fill in
• Team-related data: the Teams you create or join, your role within a Team (leader / member), and your job setting

3.3 Technical data collected automatically

• Login session: stored as an encrypted session token (JWT) in a cookie, used to keep you signed in.
• Operation (audit) logs: for security and administration, the system records certain administrative actions (for example, suspensions and data changes) together with their time, actor, and target.
• Technical connection information: such as IP address and browser type, which may be temporarily processed at the server level or by the front-end protection service (Cloudflare) to maintain connectivity, provide security protection, and support real-time synchronisation (Server-Sent Events).

4. Purposes and Basis of Collection

We collect and use the above data in order to:

1. provide login and identity verification;
2. provide and operate core features such as attendance management, scheduling, formation determination, and statistics;
3. display the necessary identifying and attendance information to other members within the Teams you belong to;
4. maintain the security of the Service, prevent abuse, and carry out necessary administration; and
5. comply with legal obligations.

The bases for processing include: necessity for performing the service relationship between you and us, your consent (for optional data), and our legitimate interest in operating the Service.

5. Cookies and Similar Technologies

The Service uses a strictly necessary cookie to maintain your login session (named, for example, __Secure-authjs.session-token). This cookie is essential for the Service to function; disabling it will prevent normal login. The front-end protection service (Cloudflare) may also set strictly necessary cookies for security purposes. The Service does not use marketing or tracking cookies.

6. How We Use Your Data

We use your data only for the purposes described in Section 4 and to the extent necessary. We do not sell or rent your personal data, nor do we use it for marketing unrelated to the Service.

7. Sharing and Third Parties

We do not disclose your personal data to third parties, except in the following cases:

• Third parties necessary for operating the Service:
  • Discord: used for login authentication (processing is subject to Discord's privacy policy).
  • Cloudflare: acts as CDN, DNS, and security protection, so your connection passes through its network (subject to Cloudflare's privacy policy).
  • Certificate authorities (Let's Encrypt / Google Trust Services, etc.): used to issue HTTPS certificates.
• Disclosure within a Team: your character name, job, and attendance status are displayed to other members and managers within the Teams you join (this is within the necessary scope of the Service's core features).
• Legal requirements: we may disclose data to the extent necessary where required by law, or by a competent authority or judicial process.

8. Data Storage Location and Cross-Border Transfer

The Service's database is self-hosted on the operator's server (a NAS) located in Taiwan, with periodic backups. However, because the Service uses services located outside Taiwan (for example, Discord and Cloudflare, which may operate in the United States), certain technical data may be processed or transferred abroad. By using the Service, you understand and consent to such necessary cross-border processing.

9. Data Retention

• Your account and related data are retained for as long as you use the Service and for the period necessary to achieve the purposes described above.
• Attendance and statistical data are retained for the duration of a Team's existence, in order to preserve the integrity of historical statistics.
• Audit logs are retained for a reasonable period for security purposes.
• When you request deletion, your account is removed, or the data is no longer needed, we will delete or de-identify it, except where the law requires otherwise. Data held in backups will be removed within the backup rotation cycle.

10. Data Security

We take reasonable technical and organisational measures to protect your data, including: site-wide HTTPS encrypted transmission, authentication via Discord OAuth, access controls (tiered among ordinary members, leaders, and platform administrators), and protection of externally exposed service ports. Please note, however, that no method of transmission or storage over the internet can be guaranteed to be absolutely secure.

11. Your Rights

To the extent provided by applicable law, you have the following rights regarding your personal data:

• Access and obtain a copy
• Rectification or supplementation: you can modify your character name, world, default job, theme, and so on yourself in "Personal Settings".
• Deletion(the "right to be forgotten")
• Restriction of, or objection to, processing
• Withdrawal of consent: for processing based on consent, you may withdraw at any time, without affecting the lawfulness of processing before withdrawal.

To exercise the above rights (for matters not covered by self-service features), please contact us as set out in Section 15. We will respond within a reasonable period. You also have the right to lodge a complaint with the competent authority.

12. Team Data and Visibility

The Service is a multi-user collaboration tool. Please note:

• Your character name, job, and attendance responses within a Team are visible to other members and managers of the same Team.
• A Team Manager (Leader) may be able to view and aggregate the attendance data of members of their Team.
• If you do not wish certain information to be visible to Team members, please consider whether to fill in those optional fields, or leave that Team.

13. Children's Privacy

The Service is not intended for children under 13 years of age (or the minimum age to use Discord in your jurisdiction). We do not knowingly collect personal data from children. If you believe we have inadvertently collected a child's data, please contact us and we will delete it as soon as possible.

14. Changes to this Policy

We may amend this Policy from time to time. Amendments will be reflected by updating the "Last updated" date on this page and announced through appropriate means; for material changes, we will make reasonable efforts to give more prominent notice. Please review this Policy periodically.

15. Contact

To exercise your rights or for any question about this Policy, please contact us at:

• Email: [email protected]
• Data Controller: Mesker @ 鳳凰