Overcomer
Privacy Policy
隐私协议
Part I — English
Interface language statistics (default on, opt-out)
Personal interface-language opening frequency addendum (language-open-frequency-v1, 13 October 2026): This new purpose remains on by default with opt-out and erasure in Settings → Privacy permissions, but has its own rollout switch, initially off. Only future genuine openings from signed-in native iOS/Android apps carrying this notice, with initialised interface language and all three relevant operational switches on, can be accepted. Neither default participation nor protocol compatibility is active consent. Before production rollout the responsible owner must confirm the processing basis, whether prior consent is required, public notice, store declarations, a new native package and separate approval. This notice does not claim that real-device records have been collected. An opening means a cold start entering the foreground (authentication hydration only supplies the identity for that same opening), or a genuine return from background to foreground. Each record contains an account-linked random event identifier, British day, Chinese/non-Chinese interface class, opening and server acceptance times, preference revision and rollout generation. The random identifier is not a persistent device ID. Multiple openings on one day and across devices count separately; retries do not. Inactive interruptions such as notification centre, duplicate active notifications, refresh, changing language, reconnecting, token renewal, enabling the preference and remaining open across midnight add no openings. Guests and Web are excluded. There is no long-term offline queue: retries are bounded and short-lived, never backfilled on a later day; unaccepted openings are excluded. Administrators and super administrators, not moderators, may see Chinese and total valid opening counts, percentage, window and latest record time for the last 30 British calendar days, including today and the previous 29 (Europe/London, including daylight saving). Chinese openings divided by all valid openings must be strictly greater than 60% for the Chinese-interface label. Otherwise the label says the Chinese share does not exceed 60%; zero records is unrecorded. 3/5 does not qualify, 4/5 does, and 1/1 qualifies without a minimum sample requirement, but small samples do not establish a stable long-term preference. These are accepted opening counts, not duration, coverage of all installed packages, nationality or other inferred identity. They are not combined with IP-region labels for profiling. Records expire within 30 British calendar days. Turning language statistics off stops local collection immediately; server confirmation erases linked opening records and labels and fences late requests from other devices. An offline withdrawal intent persists locally and deletion is retried. Re-enabling allows only future genuine openings. Expiry and account deletion also erase records. Old packages, daily samples and old personal labels never backfill frequency. Registration language, first daily language samples and the strictly >80% daily aggregate, daily App-open counts and IP-region rules are unchanged. The aggregate-only/no-personal-list restrictions below describe the original aggregate purpose only. Personal opening frequency is the separate exception explicitly described here; other definitions and rights remain unchanged: Version language-statistics-v1, 11 October 2026. This separate purpose is on by default (opt-out) for supported native iOS/Android apps, with an initially disabled operational collection switch. The registration and login screens show no choice, and there is no mandatory first-launch prompt. New accounts, and existing accounts that never explicitly turned it off, participate by default; accounts that explicitly turned it off stay off. You can turn it off and erase the data at any time in Settings → Privacy permissions. Default participation is not active consent, and protocol compatibility is not consent. Production rollout requires separate confirmation of the processing basis and applicable notice; store declarations do not replace it. Only the initialised, actual App interface language is used. Successful new-account requests may record Chinese/non-Chinese and collection time. Login, turning it back on, upgrades and language changes never backfill or overwrite registration language. On active days, the server accepts only the first valid foreground language sample per account per British calendar day (Europe/London, including daylight saving), across devices. We retain an erasable account-linked pseudonym, date, language class and necessary choice/version information. These data are not anonymous. This adds no IP, GPS, system-language, chat-language, duration, page-trail or device-ID analytics; it does not join country samples or change profile country. Registration aggregates show all new non-deleted accounts in the report period as Chinese, non-Chinese or unknown/uncollected; unknown remains in the total denominator. Over the most recent 30 British calendar days including today, Chinese sampled active days divided by all sampled active days must be strictly greater than 80% for the operational high-frequency Chinese group. 9/10 qualifies; 8/10 does not; 1/1 qualifies but is only limited observation, not a proven long-term habit. Inactive and unsampled dates are excluded. The group percentage denominator is accounts with valid day samples, not all registered accounts or the daily-open metric. Below-threshold does not mean non-Chinese-speaking; no grouping establishes nationality, ethnicity or residence or affects regional access. Administrators have aggregates only, without personal lists, drill-down or exports. Optional email metrics use the registration report period or, separately, a British-date active-language snapshot at sending time, never a daily/weekly/monthly range count. Both registration language and day samples are retained for at most 30 British calendar days. Expired or erased registration language is unknown and is never backfilled. Turning this purpose off in Settings → Privacy permissions stops local reporting immediately. Server confirmation stops collection across devices and erases both kinds of record; account deletion also erases them. Offline or failed withdrawal remains pending, with local collection stopped after restart, until deletion is confirmed. Re-enabling permits future active records only, never restores old samples or registration language. Necessary withdrawal preferences remain to honour the choice. Old apps, website and admin requests do not collect. Existing daily-open, country and chat statistics retain their separate purposes, samples and choices.
Personal IP-derived country/region labels
Personal IP-derived country/region labels addendum (user-governance-labels-v1, 13 October 2026): In native apps carrying this notice, when this new purpose is approved for rollout and the corresponding statistics setting is on, we also retain your account-linked latest accepted IP-derived country/region (possibly unknown) and server collection time. Only administrators and super administrators can view these labels in user governance; moderators cannot. Labels come from the first accepted foreground sample of a day, not live tracking, and the two types may be sampled at different times. They remain independent and are not combined to infer nationality, ethnicity, residence or other profiles. No full IP is stored and no GPS is added. Each label is kept for at most 30 British calendar days and erased on server-confirmed withdrawal of its statistics setting or account deletion. Re-enabling collects only future data; old apps and historical aggregates never backfill labels. The separate operational label switch starts off. Protocol compatibility is not consent or a legal basis; applicable notice and processing grounds must still be confirmed. The aggregate-only/no-personal-list restrictions below describe the original aggregate purpose; the labels above are the sole exception in this updated notice. Other definitions and rights are unchanged:
1. Introduction
This Privacy Policy explains how Overcomer (the "App") collects, uses, stores, and protects your personal information. We process your data on the principles of lawfulness, fairness, and necessity, and comply with applicable data protection laws, including the UK GDPR.
2. Information We Collect
(a) Account information: phone number or email address (for registration and login verification), display name, avatar, and bio; (b) Public or shared social content you choose to publish; (c) Usage data: language preference and basic app usage records; (d) Device information: a per-install identifier and device label used for message delivery. Since version 1.1.3, all private and group chat messages and attachments are processed and stored by the server in plaintext. Chat is not end-to-end encrypted. End-to-end encryption for chat has been permanently withdrawn: there is no encrypted chat channel, chat cannot fall back to an encrypted chat channel, and later versions will not provide one. HTTPS still protects transmission to the service; HTTPS is not end-to-end encryption.
3. How We Use Information
We use collected information to provide chat and social features, verify your identity, keep the service secure, handle reports and content violations, improve the product experience, and fulfil legal obligations. We will not use your personal information for purposes not stated in this policy.
4. Sharing of Information
We do not sell your personal information to third parties. We may share information only: (a) with technical service providers necessary to deliver the service (such as SMS/email verification code delivery), limited to what is necessary; (b) when required by law or competent authorities; or (c) with your explicit consent.
5. Storage and Protection
Since version 1.1.3, all private and group chat messages and attachments are processed and stored by the server in plaintext. Chat is not end-to-end encrypted. End-to-end encryption for chat has been permanently withdrawn: there is no encrypted chat channel, chat cannot fall back to an encrypted chat channel, and later versions will not provide one. HTTPS still protects transmission to the service; HTTPS is not end-to-end encryption. Messages and attachments are kept by the server for 30 days under the existing chat retention policy and then deleted. Local stored-data encryption remains in place; storage encryption is not chat end-to-end encryption. Notifications contain a generic new-message notice, not message text. Old encrypted chat history, attachments and unsent encrypted messages from versions before 1.1.3 are not retained and cannot be restored or migrated by this or any later version. Before upgrading from an earlier version, save any old messages and attachments you need yourself, for example to your photo library or files. Copies already saved outside the app are unaffected. Signing in cannot restore old encrypted history. Sign-in, registration records and contract entitlements are unaffected. This change concerns chat only; other privacy protections and non-chat data are unchanged. Earlier-version history: version 1.1.2 and earlier offered an end-to-end encrypted chat channel. That channel has been permanently withdrawn, and its history cannot be read, restored or migrated by any current or later version.
6. Optional Chat Statistics
Chat statistics are off by default, including for older app versions, and start only after your separate, explicit opt-in in Settings. For consenting users, we count only successful message sends on the server-processed chat service and range-based distinct sender counts. We do not store message content, recipients, or conversations for analytics. Pseudonymous daily sender marks and a separate deduplication digest are retained for no more than 180 days; anonymous aggregate send totals are retained. Withdrawal is available in the same setting, stops collection, and removes sender-day records associated with you, but does not undo already anonymous aggregate totals. Standalone deduplication hashes may remain for up to 180 days solely for idempotency. Deduplication data is not chat history and is separate from the 30-day server retention of chat content. This account-level choice is synced with the server.
6a. App Usage Statistics (default on, opt-out)
App usage statistics are collected by default for signed-in accounts on an upgraded supporting client, and you can turn them off at any time in Settings > Privacy permissions (your right to object). Our legal basis is our legitimate interest in operating and maintaining the service. Only accounts that use such a client and successfully report an app open while the server rollout switch is enabled are counted; accounts that have turned collection off, and registered accounts that have not reported, are not counted. One pseudonymous account-day marker per Europe/London calendar day supports a distinct daily open count, including opening to browse without chatting. Background synchronisation, push delivery, the admin dashboard, and the official website do not count. We do not collect heartbeat, session leases, time spent, last-seen or online status, device details, IP addresses, location, page-view trails, chat content, recipients or conversations for these metrics; online counts are deprecated and unavailable, not zero. We retain pseudonymous account-day markers for at most 180 days. Turning collection off stops it immediately and deletes your account-linked usage markers; turning it back on later counts only from that day. Account deletion also removes them. Your separate chat-statistics choice is unchanged and remains off by default. Older clients and periods before this collection started are not backfilled.
6b. Visit Country/Region Statistics
This is a separate, default-on account setting, not an extension of daily-open or chat statistics or a system location permission. Supporting signed-in iOS/Android apps report foreground opens without a confirmation pop-up when server rollout and regional legal review permit. A local GeoIP database infers a rough country from the trusted connection IP; this feature stores no full IP, city, coordinates, device details or trails, and sends no IP to an external geolocation service. We retain an erasable account-linked pseudonym, British calendar date and country code for at most 30 British calendar days. The first accepted sample per account per day wins. Administrators see aggregates only for today or the last 30 days including today, using the latest sample per account in that period. Unknown is included in the denominator and does not fall back to an older country. These are sampled accounts, not all registered users; country is not nationality, residence or precise location, and VPNs/proxies affect accuracy. Turn off in Settings → Privacy permissions: local reporting stops immediately; once the server confirms, it stops across devices and all country samples for your account are deleted, while the necessary opt-out preference remains. A failed/offline save is not confirmation across devices. Re-enabling collects only future samples; account deletion erases the records. Older apps, website and admin visits and uncollected history are excluded. Daily-open and chat statistics, Nearby and idle-item location functions remain unchanged. Default on is a product preference, not a legal basis: unreviewed or prior-consent-required regions are blocked from this default collection. Production collection remains off pending legal-basis review, policy/store declarations and release checks. Community registration-contract country: if separately enabled by administrators, the first time you complete the community registration contract the server infers a two-letter country code once from that connection and keeps it permanently on your registration record (no IP, city or coordinates), solely to aggregate per-region platform registration counts in the simulation market’s “A friendly race” (for example Overcomer · UK, count / 10,000); it is never shown with your name. When first enabled, retained registration countries are copied once to registration records that have none. It shares this page’s country-statistics preference: turning it off deletes the code immediately and re-enabling does not backfill; older apps, web registrations and uncollected records are not counted.
7. Contacts and Invitations
Contact matching is optional and happens only when you explicitly choose it. In new Android versions, the system contact picker grants temporary access to the selected phone-number URI, and the App reads only the selected phone number and its display name, not the whole address book. Only selected, normalised phone numbers are submitted to our server in an authenticated, limited request to match existing accounts. On iOS, and in older Android versions that used contacts permission, the App reads phone numbers from the address book only after you authorise access, and submits normalised phone numbers for matching. Contact names and other details remain on your device and are never uploaded. Submitted phone numbers are used solely for this match and are not retained afterwards. When you invite someone, the App opens your device's system SMS composer with a prefilled message, and you decide whether to send it; Overcomer never sends SMS messages silently or on your behalf.
8. Your Rights
You have the right to access, correct, export, or delete your personal information. You can manage your profile in Settings or request account deletion. Deletion starts a 30-day cooldown, after which your personally identifiable information is permanently erased; registering again with the same email or phone number during the cooldown counts as abandoning the old account, whose data is permanently erased immediately. You may separately give or withdraw consent for optional analytics. For a data request, email contact@consumerwill001.com.
9. Data Retention
We retain your information only as long as necessary for the purposes described in this policy. Thirty days after account deletion (or immediately, if you abandon the account by registering again with the same email or phone number during the cooldown), personally identifiable information is irreversibly purged; records that must be kept for legal compliance (such as audit logs) are retained in minimised form.
Chat content and routing metadata
The 30-day server retention period for plaintext chat messages and attachments applies to content, not to the minimal routing and deduplication ledger. That ledger contains account, conversation and message identifiers and the transport used, but no message body or attachments. It is retained beyond plaintext content expiry to preserve routing and prevent duplicate message handling. Entries for a sender are removed when that sender's final GDPR erasure is completed. This does not extend retention of chat content or restore expired content.
10. Children
The App is intended for users aged 13 and over and does not offer services directed at children. If we learn that we have inadvertently collected personal information from a child under 13, we will delete it promptly.
11. Updates and Contact
This policy may be updated from time to time, and material changes will be communicated prominently in the App. If you have any questions or requests regarding this policy or the handling of your personal information, please contact us at contact@consumerwill001.com.
第二部分 — 中文
界面语言统计（默认参与、可关闭）
个人界面语言打开频率补充说明（language-open-frequency-v1，2026-10-13）：此新增用途沿用默认参与、可在设置→隐私权限关闭并删除的模式，但有独立、初始关闭的放量开关。只有携带本说明的原生 iOS／Android App、有效登录、语言初始化完成且三个相关运营开关均开启时，才接受未来的真实打开记录。默认参与和协议兼容均不是主动同意；生产开放前仍须负责人确认处理依据、是否需要事先同意、公开说明、商店声明、新安装包和独立批准。本说明不表示已收集真实设备记录。 一次有效打开是冷启动进入前台（认证水合仅补齐该次身份）或真正从后台回到前台。每次保存账号关联的随机事件标识、英国日期、中文／非中文界面分类、打开时间、服务端接受时间及偏好修订号／放量代次；随机标识不是持久设备 ID。同日多次、跨设备分别计数，重试不重复。通知栏等 inactive 中断、重复 active、界面刷新、切语言、网络恢复、令牌续期、开启偏好或常驻跨日都不新增次数。不采游客或 Web，不建长期离线历史队列；仅短时有界重试，当日过期不补传，未被接受的打开不入分母。 管理员和超级管理员在用户治理页可看最近30个英国自然日（含今天及此前29天，Europe/London 含夏令时）的中文次数、有效总次数、比例、窗口和最近记录时间；审核员不可见。中文次数／全部有效次数严格大于60%才标为“使用中文”，否则为“中文使用占比未超过 60%”；无次数为“语言：未记录”。3/5不达标，4/5达标，1/1也达标且无最少次数门槛，但少量样本不证明长期稳定偏好。这是有效记录的打开次数，不是使用时长、全部安装包覆盖率、国籍或其他身份推断，不与 IP 属地合并画像。 记录最多保留30个英国自然日。关闭语言统计立即停止本机采集；服务器确认后删除关联按次记录和标签，其他设备迟到请求不能恢复。离线关闭意图在本机持久保存并继续请求删除。重新开启仅记录后续真实打开，注销及超期同样删除；旧安装包、旧日样本、旧个人标签均不回填频率。原注册语言、每日首次语言样本及严格>80%的日汇总、每日打开人数和 IP 属地及地区规则不变。 以下“仅汇总／无个人名单”限制仅描述原有汇总用途；新增个人频率是本说明明确列出的独立例外，不改变其他定义和权利： 版本 language-statistics-v1，2026年10月11日。此独立用途默认参与、可随时关闭，仅支持新版原生 iOS／Android，运营采集开关初始关闭。注册、登录页不再出现选择项，也不设强制首启弹窗。新账号及从未明确关闭过的已有账号默认参与；曾明确关闭的账号保持关闭。可随时在设置→隐私权限中关闭并删除。默认参与不等于主动同意，兼容字段亦不代表同意。生产放量须另行确认处理依据及适用告知方式，商店声明不能替代。 仅使用已初始化的实际 App 界面语言。成功新建账号当次可记录中文／非中文及采集时刻，登录、后来开启、升级或切语言均不补写、不改写。活跃日只采用服务端首次接受的有效前台语言样本，同账号跨设备每天只计一天，按英国自然日 Europe/London（含夏令时）计算。保存可擦除的账号关联假名、日期、语言分类及必要选择／版本信息，不声称匿名；不增加 IP、GPS、系统语言、聊天语言、时长、页面轨迹或设备 ID 分析，不关联国家样本画像、不修改个人资料国家。 注册汇总显示所选周期全部新增未注销账号的中文、非中文、未知／未采集三类，未知保留在总数分母。最近30个英国自然日（含今天），中文采样活跃日／全部已采样活跃日严格大于80%才属于运营分组“高频中文用户（>80%）”；9/10达标、8/10不达标，不设最少天数，1/1也达标但只代表有限观察样本、不证明长期习惯。未活跃或未采样日期不入分母。分组占比以有有效日样本的账号为分母，不是全部注册用户或原每日打开人数。未达阈值不等于非中文用户，所有分类不代表国籍、民族或居住地、不影响地区权限。管理员仅看汇总，无个人名单、下钻或导出。邮件指标独立可选：注册语言按报告周期，活跃语言是发送时英国日期窗口快照，不冒充日／周／月区间统计。 两类记录最多保留30个英国自然日，注册记录超期或删除后显示未知，不回填。在设置→隐私权限关闭立即停本机上报，服务器确认后跨设备停止并删除注册语言与日样本；注销也删除。离线／失败显示待确认，本机持续停采，重启后继续请求删除直到确认。重新开启只允许未来活跃记录，不恢复旧样本或注册语言；保留必要退出偏好以尊重选择。旧包、网页和后台请求不采集。原每日打开、国家及聊天统计用途、样本和选择均保持独立。
个人 IP 属地标签补充说明
个人IP 属地标签补充说明（user-governance-labels-v1，2026-10-13）：在此版本说明的原生 App 中，服务端批准此新增用途放量且对应统计保持开启时，除下述汇总外，还会保存账号关联的最近一次有效IP 推断国家／地区（可能未知）和服务端采集时间，供管理员、超级管理员在用户治理页查看，审核员不可见。标签来自每日首次接受的前台采样，不是实时跟踪；不同类型可能采于不同时间。各类标签独立，不合并推断国籍、民族、住址或其他画像，不保存完整 IP，不新增 GPS。最多保留30个英国自然日，关闭对应统计并获服务器确认或注销账号时删除。重新开启只采未来数据；旧包和旧汇总历史不会回填标签。标签采集另有初始关闭的运营开关；新协议标记不代表同意或法律依据，仍须确认适用告知与处理依据。 以下“仅汇总／无个人名单”限制描述原有汇总用途；新版的唯一例外是上述标签，未改变其他统计定义和权利：
1. 引言
本《隐私协议》说明 Overcomer（以下简称“本应用”）如何收集、使用、存储和保护您的个人信息。我们遵循合法、正当、必要的原则处理您的数据，并遵守适用的数据保护法律（包括 UK GDPR）。
2. 我们收集的信息
（a）账号信息：手机号或邮箱（用于注册和登录验证）、用户名、头像、个人简介；（b）您选择发布的公开或共享社交内容；（c）使用数据：语言偏好、基本的应用使用记录；（d）设备信息：用于消息投递的每次安装标识和设备名称。自 1.1.3 版起，所有私聊和群聊消息与附件均由服务器以明文处理和存储。聊天不采用端到端加密。聊天的端到端加密已永久取消：不再有加密聊天通道，聊天不能回退到加密聊天通道，后续版本也不会再提供。与服务之间的传输仍受 HTTPS 保护；HTTPS 不等于端到端加密。
3. 信息的使用
我们将收集的信息用于：提供聊天与社交功能、验证您的身份、维护服务安全、处理举报与违规内容、改进产品体验，以及履行法律义务。我们不会将您的个人信息用于本协议未载明的其他用途。
4. 信息的共享
我们不会向第三方出售您的个人信息。仅在以下情形下可能共享：（a）为提供服务所必需的技术服务商（如短信/邮件验证码发送服务），且仅限必要范围；（b）依据法律法规或主管机关的强制性要求；（c）获得您的明确同意。
5. 信息的存储与保护
自 1.1.3 版起，所有私聊和群聊消息与附件均由服务器以明文处理和存储。聊天不采用端到端加密。聊天的端到端加密已永久取消：不再有加密聊天通道，聊天不能回退到加密聊天通道，后续版本也不会再提供。与服务之间的传输仍受 HTTPS 保护；HTTPS 不等于端到端加密。 消息与附件按现有聊天保留策略由服务器保留 30 天，到期后删除。本机存储数据的加密保护仍然保留；存储加密不等于聊天端到端加密。通知只显示不含正文的通用新消息提示。 1.1.3 之前版本的旧加密聊天记录、附件和未发出的加密消息不再保留，本版本及后续版本都无法恢复或迁移这些内容。从旧版本升级前，请自行保存需要的旧消息与附件，例如保存到相册或文件。已另行保存在应用外的副本不受影响。仅凭登录无法恢复旧加密历史。 登录、登记记录和合约权益不受影响。本次变更仅涉及聊天，其他隐私保护和非聊天数据不变。 旧版本历史说明：1.1.2 及更早版本曾提供端到端加密聊天通道。该通道已永久取消，其历史记录在任何现行或后续版本中都无法读取、恢复或迁移。
6. 可选聊天统计
聊天统计默认关闭（包括旧版应用），只有您在“设置”中单独明确选择加入后才会开始。对于已同意的用户，我们仅统计在服务端处理的聊天服务上成功发送消息的次数和一定范围内的不重复发送者数量。分析不会存储消息内容、收件人或会话。假名化的每日发送者标记与独立去重摘要最长保留 180 天；匿名汇总发送量会保留。您可在同一设置中撤回同意；撤回会停止收集并删除与您关联的发送者每日记录，但无法撤销已形成的匿名汇总总数。独立去重哈希可仅为幂等目的继续保留最长 180 天。去重数据不是聊天历史，与聊天内容的服务端 30 天保留相互独立。此选择按账号与服务器同步。
6a. App 使用统计（默认采集、可关闭）
App 使用统计会为使用支持此功能的升级版客户端的已登录账号默认采集；您可随时在“设置 > 隐私权限”中关闭（异议权）。法律依据是我们运营与维护服务的正当利益。仅统计使用此类客户端、并在服务端放量开关开启时成功上报打开 App 的账号；已关闭采集的账号，以及已注册但未上报的账号，均不计入。按 Europe/London 英国自然日每账号保留一份假名化日标记，用于统计每日不重复打开人数，包括只打开浏览而不聊天。后台同步、推送送达、管理后台及官网访问不计入。此统计不采集心跳、会话租约、使用时长、最后上线或在线状态、设备信息、IP 地址、位置、页面浏览轨迹、聊天正文、收件人或会话；在线人数指标已废弃且不可用，并非零人。假名化账号日标记最多保留 180 天。关闭后立即停止采集并删除与您账号关联的使用标记；之后重新开启只从当天起计算。注销账号也会删除这些数据。聊天统计选择保持独立不变，仍默认关闭。旧版客户端和采集开始前的时段不会回填。
6b. 访问国家／地区统计
这是默认开启的独立账号设置，不扩展每日打开或聊天统计用途，也不是系统定位权限。支持新版协议的已登录 iOS／Android App 无需弹窗确认，在服务端放量及地区法律审查允许时，于前台打开时上报；用户可在设置中自行关闭。服务器通过可信连接 IP 和本地 GeoIP 数据库推断粗略国家；本功能不保存完整 IP、城市、坐标、设备信息或轨迹，也不向外部定位服务发送 IP。仅保留可擦除的账号关联假名、英国自然日和国家代码，最多 30 个英国自然日。每账号每日首个被接受的采样为准。管理员只看今日或含今日的近 30 天汇总，每账号取期间最新采样；未知也占分母，不回退旧国家。这是有采样的账号，不是全部注册用户所在地；国家不代表国籍、住址或精确位置，VPN／代理影响准确性。在“设置 → 隐私权限”关闭后，本机立即停采；服务器确认后跨设备停采并删除该账号全部国家采样，仅保留必要退出偏好。断网或保存失败不代表跨设备已关闭。重开仅恢复未来采样，注销也删除记录。旧包、官网、后台访问及未采集历史均不计入、不回填。每日打开统计、聊天统计、附近的人及闲置物品定位功能不变。默认开启是产品偏好，不是法律依据；未完成法律审查或要求事前同意的地区不得默认采集。法律依据、政策与商店申报及发布核对完成前，生产采集保持关闭。 新增共同体登记合约当次国家：若管理员另行开启，您首次完成共同体登记合约时，服务器会按该次连接推断一次两位国家代码并永久保存在登记记录中（不保存 IP、城市或坐标），只用于在模拟市场「一场友好的竞赛」中汇总各地区平台的登记人数（如 Overcomer · 英国 人数 / 1万），不与姓名一同展示。首次开启时会把仍在保留期内的注册国家一次性复制到尚无国家的登记记录。此项共用本页的国家统计开关：关闭后立即删除该国家代码，再次开启不补采；旧版、网页登记和未采集记录不计入。
7. 通讯录与邀请
联系人匹配是可选的，仅在您主动选择时进行。新版 Android 应用通过系统联系人选择器获得选中电话号码 URI 的临时访问权，仅读取您选中的电话号码及其显示姓名，不读取整个通讯录。仅将选中且规范化后的电话号码通过经过身份验证的受限请求提交到服务器，匹配已有账户。iOS 以及使用通讯录权限的旧版 Android 应用仅在您授权后读取通讯录中的电话号码，并提交规范化后的电话号码进行匹配。联系人姓名及其他详情保留在设备上，不会上传。提交的电话号码仅用于本次匹配，之后不会保留。当您邀请他人时，本应用仅打开设备的系统短信编辑器并预填消息，是否发送由您决定；Overcomer 不会静默发送短信或代替您发送。
8. 您的权利
您有权访问、更正、导出或删除您的个人信息。您可以在“设置”中管理个人资料，或申请注销账号。注销后进入 30 天冷静期，期满后您的个人身份信息将被永久删除；冷静期内用同一邮箱/手机号重新注册视为放弃旧账号，旧账号数据将立即被永久删除。您可就可选分析统计单独作出或撤回同意。数据请求请发送至 contact@consumerwill001.com。
9. 数据保留
我们仅在实现本协议所述目的所必需的期限内保留您的信息。账号注销 30 天后（若冷静期内用同一邮箱/手机号重新注册放弃旧账号，则立即），个人身份信息将被不可逆地清除；为满足法律要求而必须保留的记录（如合规审计日志）将以最小化方式保存。
聊天内容与路由元数据
明文聊天消息与附件的服务端 30 天保留期限适用于内容，不适用于最小化的路由与去重记录。该记录包含账号、会话和消息标识符以及所用传输通道，不含消息正文或附件。明文内容到期后，该记录仍会保留，用于维持路由并防止重复处理消息；发送者最终 GDPR 数据擦除完成时，会删除该发送者的记录。这不会延长聊天内容的保留期限，也不能恢复已到期的内容。
10. 未成年人保护
本应用面向 13 周岁及以上用户，不面向儿童提供服务。若我们发现误收集了未满 13 周岁儿童的个人信息，将尽快删除。
11. 协议更新与联系方式
本协议可能不时更新，重大变更将在应用内以显著方式通知您。如您对本协议或个人信息处理有任何疑问或请求，请发送邮件至 contact@consumerwill001.com 与我们联系。