本政策說明 GSAT Study Tracker 如何處理讀書紀錄、帳號資料與 Google Calendar 資料。
生效日期：2026 年 11 月 6 日
一、適用範圍
本政策適用於 GSAT Study Tracker（以下稱「本網站」）的讀書紀錄、雲端同步及 Google Calendar 連線功能。營運者為 GSAT Study Tracker 個人專案營運者，聯絡信箱為 a8744895@gmail.com。
若使用者不同意提供 Calendar 相關資料，仍可使用不需要 Google Calendar 的 Tracker 功能，但無法使用 Calendar 同步。
二、蒐集及處理的資料
帳號與讀書紀錄
- 登入電子郵件、Supabase 使用者識別碼、登入與同步狀態。
- 每日讀書項目、完成狀態、完成率、讀書時間、學習進度及使用者自行輸入的備註。
Google Calendar 資料
使用者主動授權後，本網站以 calendar.events.readonly 唯讀權限讀取主要 Calendar 中指定期間內的行程資料。目前同步範圍約為過去 60 天至未來 240 天，可能包含：
- 行程標題、說明及地點。
- 開始與結束日期、時間及全天行程狀態。
- 事件識別碼、更新時間、重複行程資訊及 Calendar 行程連結。
本網站不會透過 Calendar API 新增、修改或刪除 Google Calendar 內的原始行程。
OAuth 與技術資料
為維持 Calendar 連線，Supabase 會保存 OAuth Client ID、access token、refresh token、到期時間、授權範圍、同步時間與錯誤資訊。服務供應商也可能處理維持安全及排錯所需的 IP 位址、瀏覽器類型、請求時間與系統紀錄。
三、資料使用目的
- 提供每日讀書紀錄、完成率與進度統計。
- 從 Google Calendar 建立及更新 Tracker 排程。
- 保存與同步使用者自己的讀書紀錄。
- 維護帳號、授權、資料安全與處理支援要求。
Calendar 資料會在初次連線、使用者手動要求同步，以及已啟用的排程同步執行時讀取。
本網站不會將 Google Calendar 資料用於廣告、精準行銷、出售資料、訓練或改進一般用途 AI／ML 模型、分析其他使用者作為營運者的升學成果，或其他與 Tracker 功能無關的用途。
四、AI／ML 與 Google Limited Use
GSAT Study Tracker 不整合任何第三方 AI 或機器學習 API，也不會自動將 Google Workspace API 的原始、彙整、匿名化或衍生資料傳送給 AI／ML 服務。Google Workspace API 資料不會用於訓練、改進或評估一般用途 AI／ML 模型。
網站中的排程格式說明是靜態文字頁面及複製工具，不會呼叫 AI 服務，也不會自動附加或傳送 Google Calendar 資料。使用者如自行匯出、複製或分享資料，該動作由使用者主動決定。
五、升學成果之自主分享
使用者可以自行選擇將本人於 Tracker 產生的讀書成果摘要，以截圖、PDF 或其他文件形式，透過招生學校指定管道提交。本網站不會自動將資料傳送給學校或公開發布升學成果。
分享內容由使用者自行決定。提交前應移除 OAuth 憑證、Google 帳號技術識別資訊、與升學成果無關的 Calendar 私人行程，以及其他不希望提供的個人資訊。資料提交至招生單位後，其保存及刪除方式依該單位規定辦理。
六、儲存、服務供應商與分享
使用者登入後，可在英文單字複習頁面的字卡編輯區主動按下「Google 翻譯」。網站只將該段選定英文傳送給 Google Cloud Translation API，翻成繁體中文，不會自動傳送整份讀書紀錄、Calendar 行程或筆記。結果由使用者確認後才追加到本機及既有帳號同步資料；詞性依原有勾選、同拼法本機詞庫或使用者指定填入，不由翻譯服務推測，也不判定學測級數。Google 依其服務條款處理翻譯請求，詳見 Cloud Translation。本功能使用 Google Translate 機器翻譯。
為限制用量，Supabase 另保存帳號識別、台灣時區的月份、UTC 日期、請求次數及字元數，不在額度表保存查詢或翻譯文字。為避免重複預留，另保存服務端產生的請求識別碼及用量結果，超過 35 天的收據會於後續請求清理。成功翻譯可暫存在依帳號隔離的執行個體記憶體快取，最多 256 筆，快取命中不扣額。每帳號每月上限 5,000 字元，台灣時間每月 1 日重設。每日額度紀錄在後續請求時清理超過 35 天的資料，每月紀錄則清理過去月份；帳號刪除時刪除其個別用量資料。使用者自行保存的翻譯及來源標示，依一般讀書紀錄的保存與刪除方式處理。
資料可能由使用者瀏覽器、Supabase、Google OAuth、Google Calendar API 與 Cloudflare 等維持網站所需的服務處理。部分服務供應商的伺服器可能位於臺灣以外地區。
本網站不出售或出租個人資料。資料僅會在維持服務所必需、使用者主動要求或同意、法律依法要求，或保護使用者與系統安全所必要時提供。
七、保存、解除連線與刪除
使用者可隨時在 Tracker 中解除 Google Calendar 連線。解除後，本網站會停止使用保存的憑證、刪除 Supabase 中的 Calendar connection、OAuth token 與 Calendar 同步快取；Google Calendar 原始行程不受影響。
先前已保存為 Tracker 讀書紀錄的內容及瀏覽器本機資料，可能不會隨解除連線自動刪除。使用者可自行清除瀏覽器網站資料，或透過聯絡信箱要求刪除相關雲端資料，也可在 Google 帳號中撤銷第三方應用程式授權。
八、使用者權利
在適用法律允許的範圍內，使用者可要求查詢、閱覽、取得副本、補充、更正、停止蒐集或利用，以及刪除個人資料。為避免冒用，本網站可能要求合理的身分確認。
九、資料安全
本網站採取合理的帳號驗證、資料存取控制及伺服器端憑證保存措施。任何網路服務均無法保證絕對安全；如發生依法需要通知的重大安全事件，將依適用法律處理。
十、政策變更與聯絡方式
本政策可能因功能、服務供應商或法規變更而更新，重大變更將於網站公告並更新生效日期。
This policy explains how GSAT Study Tracker processes study records, account information, and Google Calendar data.
Effective date: November 6, 2026
1. Scope
This policy applies to the study-record, cloud-sync, and Google Calendar connection features of GSAT Study Tracker (the “Service”). The Service is operated as a personal project. Privacy and data requests may be sent to a8744895@gmail.com.
Users who do not authorize access to Google Calendar may continue using Tracker features that do not require Calendar synchronization.
2. Information We Process
Account and study records
- Sign-in email address, Supabase user identifier, and sign-in and synchronization status.
- Daily study items, completion status, completion rates, study time, learning progress, and notes entered by the user.
Google Calendar data
After a user provides authorization, the Service uses the read-only calendar.events.readonly scope to read events from the user’s primary calendar within a defined period. The current synchronization window is approximately 60 days in the past through 240 days in the future. Data may include:
- Event title, description, and location.
- Start and end dates and times, including all-day status.
- Event identifiers, update timestamps, recurrence information, and the Google Calendar event link.
The Service does not create, modify, or delete original Google Calendar events through the Calendar API.
OAuth and technical information
To maintain the Calendar connection, Supabase stores the OAuth client ID, access token, refresh token, expiration time, granted scope, synchronization time, and error information. Service providers may also process IP address, browser type, request time, and system logs required for security and troubleshooting.
3. How Information Is Used
- Provide daily study records, completion rates, and progress statistics.
- Create and update Tracker schedules from Google Calendar events.
- Store and synchronize the user’s own study records.
- Maintain accounts, authorization, data security, and user support.
Calendar data is read during the initial connection, when the user manually requests synchronization, and when enabled scheduled synchronization runs.
Google Calendar data is not used for advertising, targeted marketing, sale of data, training or improving generalized AI/ML models, analysis of other users for the operator’s academic-admission results, or purposes unrelated to Tracker functionality.
4. AI/ML and Google Limited Use
GSAT Study Tracker does not integrate with any third-party artificial intelligence or machine learning API. Raw, aggregated, anonymized, or derived Google Workspace API data is not automatically transferred to an AI/ML service. Google Workspace API data is not used to train, improve, or evaluate generalized AI/ML models.
The scheduling-format reference available on the website is a static text page and copy tool. It does not call an AI service and does not automatically attach or transmit Google Calendar data. Any export, copy, or sharing action is initiated and controlled by the user.
5. User-Initiated Sharing for Academic Applications
Users may choose to submit summaries of their own Tracker study results to educational institutions through screenshots, PDFs, or other documents. The Service does not automatically transmit information to schools or publicly publish academic-application results.
Users control what they share. Before submitting material, users should remove OAuth credentials, technical Google account identifiers, unrelated private Calendar events, and any other information they do not wish to disclose. Information submitted to an institution is retained and deleted according to that institution’s policies.
6. Storage, Service Providers, and Disclosure
After signing in, users may explicitly choose Translate with Google in a card editor on Vocabulary Review. Only the selected English text is sent to the Google Cloud Translation API to translate it into Traditional Chinese. Entire study records, Calendar events, and notes are not sent automatically. Results are appended to local records and existing account synchronization only after confirmation; parts of speech follow existing selections, exact-spelling local dictionary labels, or an explicit user choice, rather than being inferred by Google, and no GSAT level is inferred. Google processes translation requests under its service terms; see Cloud Translation. This feature uses Google Translate machine translation.
For usage limits, Supabase separately stores the account identifier, Taiwan calendar month, UTC date, request count, and character count, without query or translation text in the quota table. Server-generated reservation IDs and usage snapshots are also retained and cleaned on later requests after 35 days to avoid duplicate reservations. Successful translations may be held in account-scoped instance memory caches of at most 256 entries; cache hits consume no quota. Each account is limited to 5,000 characters per month, resetting at midnight Taiwan time on the first day. Later requests purge daily entries older than 35 days and monthly entries from earlier months. Deleting an account deletes its individual usage entries. Translations and attribution saved by users follow the retention and deletion process for ordinary study records.
Information may be processed by the user’s browser, Supabase, Google OAuth, Google Calendar API, and Cloudflare as necessary to operate the Service. Some service-provider systems may be located outside Taiwan.
The Service does not sell or rent personal information. Information is disclosed only when required to operate the Service, when requested or authorized by the user, when legally required, or when necessary to protect users and system security.
7. Retention, Disconnection, and Deletion
Users may disconnect Google Calendar at any time from the Tracker. After disconnection, the Service stops using the stored credentials and deletes the Calendar connection, OAuth tokens, and Calendar synchronization cache stored in Supabase. Original Google Calendar events are not affected.
Information previously saved as Tracker study records and information stored locally in the browser may not be deleted automatically when Calendar is disconnected. Users may clear browser site data, request deletion of relevant cloud data by email, and revoke third-party application access from their Google Account.
8. User Rights
Where permitted by applicable law, users may request access to, a copy of, correction or supplementation of, restriction of processing of, or deletion of personal information. Reasonable identity verification may be required to prevent unauthorized requests.
9. Data Security
The Service uses reasonable account authentication, access control, and server-side credential storage measures. No online service can guarantee absolute security. Material security incidents will be handled in accordance with applicable law.
10. Policy Changes and Contact
This policy may be updated when features, service providers, or legal requirements change. Material changes will be announced on the website with an updated effective date.