Privacy Policy

Last updated: November 3, 2026

YUCTS (櫻佑旅遊) (hereinafter the "Service" or "we") is operated by an individual operator and values your privacy. This Privacy Policy explains how we collect, use, share, and protect your personal data when you use the Service (including yucts.com, forum.yucts.com, the Yucts Travel App, yucdu.com, the YucDu App, status.yucts.com, coupon.yucts.com, transit.yucts.com, docs.yucts.com, the iMessage sticker app "狐狸犬汪星人" (もふもふスピッツ), and related backend services).

Our processing complies with the Personal Data Protection Act (PDPA) of the Republic of China; for users in regions such as the European Economic Area (EEA), we also comply with the General Data Protection Regulation (GDPR) to the extent applicable.

1. Data We Collect

We collect data only to the extent necessary to provide the Service, and we strive to achieve data minimization.

1.1 Account Data

When you register for or use a forum account, we process: your username, email address, date of birth, registration date, profile fields (such as your bio, location, signature, and avatar), and activity statistics (number of posts, reactions received), among others. Forum accounts are created and managed at forum.yucts.com.

• You may choose to sign in with a social account (Facebook, X, Google, GitHub, LinkedIn, Microsoft, Yahoo, Apple) or a passkey. When you use a social account, we only receive the basic information needed to create and link your account (such as an account identifier, name, and email address); when you use a passkey, we store only the public key and never receive your biometric data.
• When you sign in to the Yucts Travel App with a username and password, your password is sent over an encrypted connection to our servers to be verified with the forum; the App does not store your password, and your sign-in state is kept as a token in your device's Keychain.

1.2 Device and Connection Information

• Device model and platform (such as iPhone, iPad or Android phone model), App version, and language.
• Connection IP address and the country inferred from it (via Cloudflare GeoIP).
• Session records of logged-in devices (device label, platform, last activity time, and the full IP address at sign-in with the country, region and city inferred from it), available for you to review and revoke under "Logged-in Devices." These records are not cleared periodically; they are kept until you delete your account (see Section 7 for how deletion works).
• Forum online status: while you are signed in and the app is in the foreground, the app periodically (at least 30 seconds apart after you switch sections, otherwise every 120 seconds) has the forum update your "Last Activity" time, together with the kind of section you are currently in (for example articles, the forum or Transit Planner). This is only a fixed section code and does not include which content you viewed, titles, URLs or search terms. The online list on the forum website shows the section you are browsing in the app and your device type (for example iPhone or iPad, not the model); when you open forum threads and other content, what you are viewing is also shown, just as on the website. You can hide your online status in the privacy settings on the forum website; reporting stops when you sign out or the app goes to the background.

1.3 Push Notification Data

If you consent to receiving push notifications, we process a device identifier (hashed) and a push token (stored in encrypted form; plaintext is not retained), as well as your push preferences (topics, do-not-disturb hours, time zone).

1.4 Travel Data (In-App)

Itineraries, itinerary locations, expense records, photos (and their metadata, which may include capture time and GPS location embedded in the photo), favorite places, travel journals, packing and shopping lists, travel companions, and booking records that you create in the App. This data is stored on your device and may be synced across your devices via your iCloud private database; we cannot access the contents of your iCloud private database.

Cloud copies of trip photos: If you are signed in to a YUCTS account, photos you add to a trip are also uploaded to our servers and stored in the cloud object storage service we use (Cloudflare R2), so that they can be shown on your other devices and in trip collaboration. Both the iOS/iPadOS and macOS apps remove the photo's metadata (including capture location) and reduce its size before uploading; if the metadata cannot be removed safely, the photo is not uploaded (version 1.0 of the macOS app uploads the original file, which may include the capture time and GPS location embedded in the photo; please update to the latest version). Photos are not uploaded while you are signed out.

Apple Wallet passes: When you use "Add to Apple Wallet" for a booking, the app sends the booking details shown on the pass (such as the trip and booking names, departure and arrival places, dates, platform and amount) to our servers to generate and sign the Wallet pass. This does not include the confirmation code or passenger names, and our service's code does not write this content to a database (version 1.0 of the macOS app also sends the confirmation number).

Cloud collaboration: If you turn on cloud collaboration for a trip, that trip's shared content (plans, places, bookings, expenses, companions, and so on) and its member list are stored on our servers and synced to the members you invite. Once collaboration stops, nothing further is synced; content already on each member's device is kept.

Itinerary share links: When you create a share link, the content you choose to share is uploaded to our servers, and anyone with the link (and password) can view it on the web. The trip name, dates, and places are always included; other items (notes, place coordinates, transport and stays, expenses, companion names, diary entries, photo thumbnails) are included only if you turn them on, and never include confirmation codes, seats, or ticket numbers. The link stops working when the expiry you set is reached, and you can revoke it at any time.

Cross-Platform Trip Sync (optional, off by default): After you sign in to your YUCTS account and tap "Agree and Turn On" in the App, that device's trips, places, bookings (without confirmation codes), expenses (without receipts), companions (without email addresses), shopping lists, and travel journal (without photos) are uploaded to our servers (Cloudflare) and tied to your account, to sync with your other devices that have sync turned on. Travel documents, receipt images, trip and journal photos, extra flight details such as seats, and packing lists are never uploaded. You can turn sync off, or turn it off and delete the cloud data, at any time; if you delete your account, the synced cloud data is deleted as well.

1.5 Document Vault

If you use the "Document Vault" feature, sensitive information such as passport numbers, visa numbers, insurance policy numbers, booking reference codes, and driver's license numbers is stored in encrypted form only in your device's secure storage (Keychain) and is not uploaded to our servers and does not sync across devices.

1.6 Location Information

If you grant location permission, the App obtains your location when you use related features:

• Explore nearby and nearby stations in transit search: the Android app sends approximate location coordinates to our servers for the lookup and does not keep them (coordinates for transit searches are rounded to 3 decimal places); on other platforms, nearby exploration and local content use your location only on your device, or convert it to a country/region code.
• "Nearby" in Transit Planner (iOS/iPadOS): your location is obtained only once, when you tap "Get"; it is rounded to 3 decimal places (about 100 m) and sent to our servers to find nearby stations, bus stops or public bike stations, and is not kept after the lookup. Locations outside Taiwan are not sent. If you choose a place in your trip instead, or search for trains in your itinerary, the coordinates of those places are sent (also at about 100 m precision and not kept).
• Weather: the coordinates of your saved places are sent to Open-Meteo to look up the weather, without any identifying data.

Your chosen location is sent in the following cases:

• Check-ins: the place name and coordinates you choose for a check-in are stored on the forum. How much of the location others can see depends on the "location precision" you select (exact location, city only, region only, or hidden). The Android app only obtains your approximate location; you pick the exact place on the map.
• Itinerary share links: place coordinates are shared only if you turn on "locations and map links".

On the YUCTS Transit website, "Use current location" is used only to find nearby public bike stations, to about 100 meters, and is not saved. You can turn off location permission at any time in your system or browser settings.

1.7 AI Assistant Conversations

When you use the AI travel assistant or translation feature, the content you enter is sent to our AI service providers to generate responses; for logged-in users, conversation content is stored on our backend to provide conversation history and service improvement. Before you use AI features for the first time, the Android app explains how this data is handled and asks for your consent. If you report an AI reply, we keep the reported reply, your previous question, and the reason and description you give for up to 180 days for review and improvement. See Section 4 on third parties for details.

1.8 User-Generated Content (UGC)

The topics, replies, private messages, profile comments, reviews, uploaded image/video attachments, reactions, and emoji you post on the forum, as well as your report records. Topics and replies publicly show, and private messages show to the other participants, the device you posted from (for example the phone model) and a country/region flag; the Android app also explains this before your first post. The list of members you block (their IDs, the reason and the time) is stored on our servers to hide their content.

1.9 Newsletter

If you subscribe to the newsletter, we collect your email, language, and source, and use a "double opt-in" mechanism; every email includes an unsubscribe link.

1.10 Purchase and Subscription Data

• In-App Purchases (Yucts Plus): Billed through the Apple App Store. We receive only the transaction identifier and plan code provided by Apple in order to verify your subscription entitlements; we do not access or store your credit card, Apple ID, or receipt details.
• Forum Web Payments: If you make a payment on the forum website, it is processed by a third-party payment service (ECPay/OPay), and the related transaction records are handled in accordance with that service's rules.

1.11 Phone Verification (Forum)

If you use the phone verification feature on the forum, we process your phone number and send a verification code via an SMS service provider.

1.12 Browsing and Preferences

Reading history, bookmarks, and preference settings within the App are stored primarily on your local device, used for offline reading and content recommendations, and are periodically cleared automatically.

You can also choose, under "iCloud Sync Items" in the App, to sync settings such as reading history, color theme, and layout through your iCloud; this data is stored in your iCloud, and we cannot access it.

1.13 YucDu App (Read-Only Reader)

The YucDu App is a read-only blog reader that does not require an account, does not display ads, does not perform tracking, and has no in-app purchases. It processes only the following minimal data:

• Push identifier: If you allow notifications, we process your device's push token to notify you when there are new articles; this identifier is not linked to your identity and is not used for tracking.
• Favorites: Your Favorites are stored in your own iCloud private database and synced across your devices; we cannot access their contents.
• Reading history, reading progress, search history, and offline cache: Stored only on your local device, never uploaded, with the offline cache periodically cleared automatically.
• View counts: When you open an article, the App sends one background request to that article's web page on yucdu.com, in the same way a browser would, to increment the view count shown on the site; the site's server therefore receives ordinary connection information such as your IP address. The random parameter added to the request is different every time and is used only to bypass caches.

Article content is loaded anonymously through our content service (api.yucdu.com). In addition, the Privacy Policy, Terms of Service, and service status shown in the App are sourced from docs.yucts.com and status.yucts.com, respectively, and then presented natively within the App.

1.14 Website Accounts and Comments (yucts.com, yucdu.com)

To comment on articles at yucts.com or yucdu.com, you need to sign in to a website account (username and password, a Google account, or—at yucts.com—your forum account). We process your name, email address, comment content, and connection information at the time of commenting (such as your IP address) to display comments and to prevent spam and abuse.

1.15 YUCTS Coupon (coupon.yucts.com)

No account is needed. The first time you open the home page, the display language is chosen from the country or region you are connecting from; the information used for this is not stored. A cookie remembering your language (kept for one year) is set only when you choose a language yourself. The site does not do ad tracking. Some links are affiliate links; after you open one, the destination site may record where you came from, under its own policy.

1.16 YUCTS Transit (transit.yucts.com)

No account is needed. We keep access logs (time, page, and errors, without the URL query string) and use Cloudflare Web Analytics (cookie-free traffic analytics) to count page views and measure loading speed. The display language is set by the URL; cookies, browser language, and location are not used to decide it. The stations and trips you search for are used only to show results and for short-term caching. When the site shows ads, it uses Google AdSense (see Section 5).

1.17 YUCTS Docs (docs.yucts.com)

No account is needed. We use Cloudflare Web Analytics (cookie-free) to count page views. If you add the docs site to your Home Screen, pages you have viewed are stored in your browser for offline reading.

1.18 iMessage Sticker App

The iMessage sticker app "狐狸犬汪星人" (もふもふスピッツ) collects no personal data.

2. How We Use Data

• To provide, operate, and improve the Service (including content presentation, itinerary tools, the forum, push notifications, the AI assistant, and subscriptions).
• For account management, identity verification, and security protection (fraud prevention, abuse prevention).
• To send notifications you request, the newsletter, and important service messages.
• To provide personalized content and advertising within the scope of your consent (see Section 5).
• To comply with legal obligations and handle disputes.

3. Cookies and Similar Technologies

The Service's websites (yucts.com, forum.yucts.com, etc.) use cookies for functions such as maintaining login, security, and preferences; the App and the backend API use token-based authentication and do not use cookies. For details, please refer to our Cookie Policy.

4. Data Sharing and Third Parties

We do not sell your personal data. We share necessary data with third parties only in the following circumstances:

Third Party	Purpose	Data Involved
Apple	App distribution, push notifications (APNs), in-app purchase billing, iCloud sync, weather (WeatherKit, iOS/iPadOS apps)	Push tokens, Apple transaction identifiers, etc.
Google AdMob (Alphabet)	In-app advertising, measurement, and ad consent management in the iOS/iPadOS app	Advertising identifier and consent choices (depending on your tracking permission and consent; see Section 5)
Google Firebase (Alphabet)	Push notifications in the Android app (Firebase Cloud Messaging)	Push tokens and device information
Google Maps Platform (Alphabet)	The check-in map in the Android app	IP address, crash and device information
Google Play services (Alphabet)	Obtaining approximate location in the Android app	Location and device information
Anthropic, OpenAI, Google (Gemini), Cloudflare (Workers AI)	Language model computation for the AI travel assistant and translation	The conversation/content to be translated that you enter
Open‑Meteo	Weather information (the weather source for the macOS app; a fallback for the iOS/iPadOS apps)	Query coordinates only; no identifying data
Exchange rate data sources (such as frankfurter.dev, Bank of Taiwan, Taiwan Futures Exchange)	Currency conversion tool	No personal data
SMS service providers (such as Mitake, Twilio, Chunghwa Telecom)	Forum phone verification SMS	Phone number
ECPay/OPay	Forum web payments	Payment transaction data
Cloudflare	Infrastructure, security, and content delivery for the websites and APIs; cookie-free traffic analytics (Web Analytics); storage of trip photos, collaboration, share links, and Cross-Platform Trip Sync data	Connection metadata (such as IP address and country); data you upload or choose to sync or share
Social sign-in services (Facebook, X, Google, GitHub, LinkedIn, Microsoft, Yahoo, Apple)	When you choose to sign in to the forum or websites with a social account	Basic account information provided by that service
Google AdSense (Alphabet)	Advertising and consent management on the YUCTS Transit website	Cookies and device information (see Section 5)
Transport and weather data sources (Taiwan MOTC TDX, Central Weather Administration, etc.)	Timetables, service status, and weather on YUCTS Transit	No personal data
KKday, Klook, Lion Travel	Affiliate links on YUCTS Coupon	Handled by the destination site under its own policy, only when you open a link

In addition, where required by law, a competent authority, or judicial process, or in order to protect the rights, property, and safety of the Service and its users, we may disclose necessary data as permitted by law.

5. Advertising and Tracking

The iOS/iPadOS version of Yucts Travel displays advertising through Google AdMob (the Android and macOS versions have no ads). On iOS, the App seeks your consent in accordance with the App Tracking Transparency (ATT) framework:

• If you consent to tracking, advertising may provide personalized content based on your advertising identifier (IDFA).
• If you do not consent, you will still see advertising, but it will be non-personalized.

You may change the authorization at any time under iOS "Settings → Privacy & Security → Tracking." Upgrading to a Yucts Plus subscription removes in-app advertising.

The YucDu App displays no advertising and performs no tracking whatsoever, so the ATT tracking prompt described above does not appear.

In some regions (such as the European Economic Area and the United Kingdom), the Yucts Travel App first shows Google's ad consent screen; you can change your choice later under "Profile & settings" → "App Permissions" → "Ad Privacy Options".

When the YUCTS Transit website shows ads, it uses Google AdSense and first shows a consent management screen in the European Economic Area, the United Kingdom, and Switzerland. Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this site or other websites; you can opt out of personalized advertising in Google's Ads Settings, or opt out of third-party vendors' use of cookies for personalized advertising at aboutads.info. When no ads are set up, Google's code is not loaded.

YUCTS Coupon does not do ad tracking, and the iMessage sticker app shows no ads and does no tracking.

6. International Data Transfers

The Service's servers and some third parties (such as Apple, Google, Anthropic, OpenAI, and Cloudflare) may be located outside Taiwan. When data is transferred across borders, we take appropriate safeguards to ensure compliance with applicable data protection laws.

7. Data Retention Period

We retain your personal data only for the period necessary to achieve the purposes described in this Policy, or for the period required by law. For example: local reading history is periodically cleared automatically; after you delete your account or withdraw consent, we will delete or anonymize personal data that is no longer needed within a reasonable period (except where retention is required by law).

Itinerary share links stop working when the expiry you set is reached; Cross-Platform Trip Sync cloud data is kept until you turn sync off and delete the cloud data, or delete your account.

Account deletion: your account is deleted 30 days after the request, and you can cancel during that time. Your forum account and profile are removed from the database; topics, replies, media and profile posts you published stay in the discussions under your original username, and private messages remain visible to the other participants. The App's cloud data (push devices and preferences, sign-in session records, AI conversation history and usage records, Cross-Platform Trip Sync cloud data, and in-app purchase entitlement records) is deleted as well: immediately if you request deletion in the App, or, for a request made on the website, automatically when your forum account is actually deleted (when the 30-day period ends, or when an administrator deletes the account). Before deleting, we confirm with the forum that the account no longer exists; this usually finishes within minutes and is retried automatically for up to 7 days if the service is temporarily unavailable. Only disabling an account does not delete this data. Itinerary share links, member data in collaborative trips and photos uploaded with check-ins are not yet deleted automatically with your account. Reports and AI-reply reports you submitted are kept for up to 180 days; records we must keep for security or legal reasons are kept as those requirements specify. See Delete Your Account and Data for how to request deletion.

Push tokens for the YucDu app are kept for 180 days after they were last updated and are deleted automatically if they are not updated within that period.

8. Data Security

We take reasonable technical and administrative measures to protect your data, including: storing all tokens in hashed form, storing push tokens encrypted, and storing sensitive documents only in encrypted form on your device. However, please understand that no method of transmission or storage can guarantee absolute security.

9. Your Rights

To the extent provided by applicable law (PDPA/GDPR), you have the following rights regarding your personal data:

• To inquire about, review, and request copies;
• To supplement or correct;
• To request deletion or cessation of collection, processing, or use;
• To object to processing or request restriction of processing;
• Data portability (to the extent technically feasible);
• To withdraw previously given consent (without affecting the lawfulness of processing before withdrawal).

You may manage your account data yourself in the App or on the forum (such as changing your email, password, avatar, or profile), or exercise the above rights via Contact Us. You also have the right to file a complaint with the competent authority.

10. Children and Minors

The Service is not intended for children. If you are under the age prescribed by applicable law, please use the Service with the consent and accompaniment of your legal guardian.

11. Third-Party Links and Content

The Service may contain links or promotional content from third-party websites or partners (such as KKday). These third parties have their own privacy policies; this Policy does not apply to such third parties, and we recommend that you review theirs separately.

12. Policy Changes

If this Policy is revised, the revision will be posted on this page and the "Last updated" date will be updated. In the event of material changes, we will notify you by appropriate means.

13. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your rights, please contact us via Contact Us.