Help Center ／ woowtech smart App ／ 繁體中文・English
隱私權政策
生效日期：2026 年 10 月 30 日
渥屋科技股份有限公司（WOOW TECH CO., LTD.，以下稱「我們」）提供渥屋智能（woowtech smart）手機 App（iOS、Android）、桌面 App（macOS）和網頁版（https://smart.woowtech.io）。本政策說明這些 App 會處理哪些資料、送到哪裡，以及你可以怎麼做；本政策說的「App」也包括網頁版。
1. App 怎麼運作
渥屋智能讓你從手機或桌面 App，遠端操作你自己電腦上執行的 AI 程式工具（agent）。你的電腦執行我們的 daemon 程式，App 直接連到它；你不在同一個網路時，App 可以經由我們營運的中繼伺服器（relay.woowtech.io）連線。我們不提供帳號，你不需要註冊或登入。
網頁版是由 Cloudflare Pages 提供的一組靜態網頁檔案；你的內容不經過這個網站，網頁版跟其他 App 一樣，直接或經由中繼伺服器連到你的電腦。你打開 smart.woowtech.io 時，Cloudflare 會看到你的 IP 位址和瀏覽器送出的資訊，並依其隱私權聲明處理。
2. 你的內容只送到你自己的電腦
你在 App 裡輸入給 agent 的文字、附加的照片與檔案、聽寫的錄音、終端機的內容，都只送到你自己電腦上的 daemon：
- 在同一個區域網路時，App 直接連到你的電腦，不經過我們。
- 網頁版在你自己的電腦上可以直接連到 daemon；瀏覽器可能會先詢問是否允許這個網站存取這部裝置上的應用程式和服務。
- 經由中繼伺服器時，內容是端對端加密的。中繼伺服器只轉送加密後的資料，我們無法讀取，也不保存。連線期間，中繼伺服器會看到你的電腦和手機的 IP 位址，以及配對用的伺服器 ID；我們沒有開啟中繼伺服器的連線記錄。
你電腦上的 agent（例如 Claude Code、Codex）如何處理這些內容，依你自己設定的 agent 服務及其條款而定，不經過我們。
3. 推播通知
你允許通知後，App 會從 Google 的 Firebase Cloud Messaging（FCM）取得這支手機的推播代碼（token），交給你電腦上的 daemon。agent 完成工作或需要你的授權時，daemon 把下列資料送到我們的推播中繼（push.woowtech.io），由它經 FCM（iOS 再經 Apple 的推播服務）送到你的手機：
- 推播代碼、App 的介面語言（繁體中文或英文）、通知的原因（例如「完成」「需要授權」），以及點通知時要開啟的畫面的識別碼（daemon 隨機產生的 ID）。
- 不包含任何你的內容：沒有 agent 的回覆、專案或資料夾名稱、檔名或路徑。通知文字由中繼依原因選用固定的句子。
為了限制每支手機每天的推播數量，中繼會保存推播代碼的雜湊值（SHA-256），到當天（UTC）結束後自動刪除。中繼的程式記錄不包含推播代碼和 IP 位址。
網頁版不取得推播代碼，它的通知由瀏覽器在那部裝置上顯示（見第 8 節）；沒有顯示出來時，daemon 可能改推播到你允許過通知的手機，送出的資料同上。
4. Google Firebase
推播使用 Google 的 Firebase 服務。為了送達推播，Firebase SDK 會收集並傳給 Google：Firebase 安裝 ID、推播代碼、裝置型號、語言、時區、作業系統版本、App 的識別碼和版本，以及 Firebase SDK 的版本資訊。Google 依其條款處理這些資料：https://firebase.google.com/support/privacy
在 iOS 上，你允許通知、而且 App 連上我們的 daemon 之前，App 不會向 Firebase 取得推播代碼。在 Android 上，Firebase 可能在 App 啟動時就取得推播代碼。
5. AI 內容回報
App 在每則 AI 回覆下面有「回報」按鈕。AI 回覆是你電腦上的 agent（例如 Claude Code、Codex）產生的；如果其中有冒犯、危險或欺騙的內容，你可以在 App 裡直接回報給我們，不必離開 App。
你按「送出回報」時，我們會收到：
- 你選的回報原因（騷擾或仇恨、色情內容、暴力或自我傷害、危險或欺騙、其他）。
- App 版本、平台（iOS、Android、桌面或網頁版）、App 的介面語言，以及 App 隨機產生的回報識別碼。回報識別碼每次回報都重新產生，不用來辨識你或你的裝置。
- 只有在你打開「附上這則訊息」、並看過可以編輯的預覽之後，才會送出你保留下來的那則 AI 回覆文字，最多 8 KiB。預設不附上。這段文字是你電腦上的 agent 產生的，可能含有你的專案或程式碼內容，送出前請檢查，刪掉不想分享的部分。
我們不會收到：你輸入給 agent 的文字、那則回覆前後的訊息、附件、工具輸出、專案或檔案的名稱與路徑、你的電腦或 daemon 的位址、配對資訊，以及任何帳號或憑證。
回報用 HTTPS 送到我們的回報服務（reports.woowtech.io）。這個服務架在 Google Cloud 的台灣機房（Cloud Run 與 Firestore），前面有 Cloudflare 負責擋濫用與限流；Cloudflare 為了限流會看到連線來源的 IP 位址，並依其隱私權聲明處理。我們的回報服務不保存 IP 位址，回報紀錄裡沒有，服務的程式記錄也只有收據編號，不包含回報內容。收到回報時，Google Cloud 的監控服務會寄內容固定的通知信給我們的處理人員，信裡只有收據編號，沒有回報原因、版本或內容。
在網頁版送出時，回報由你的瀏覽器直接用 HTTPS 送到 reports.woowtech.io，內容和手機、桌面 App 送出的相同。瀏覽器會自動在請求附上網頁版的網址（https://smart.woowtech.io）作為來源；我們在 Cloudflare 上的轉送程式只用它決定要不要回應瀏覽器的跨來源請求，不會轉給回報服務，也不保存。
我們用回報來處理內容安全與產品問題，不用於廣告或追蹤，也不分享給第三方；Google Cloud 與 Cloudflare 是替我們處理資料的服務供應商。回報紀錄保留 30 天，到期後自動刪除（通常在一天內完成），沒有備份。因為沒有帳號，我們也不收你的電子郵件，所以沒辦法個別回覆。App 顯示的收據編號只代表回報已保存，不代表已審查完畢。
如果要提前刪除一則回報，請寄信到 [email protected]，附上 App 顯示的收據編號，我們會依收據編號查找並刪除。
6. 其他連線
App 的「新功能」頁會從 GitHub 讀取公開的更新記錄；桌面 App 會從 GitHub 檢查和下載更新。這些連線直接到 GitHub，由 GitHub 依其隱私權聲明處理。AI 內容回報的連線見第 5 節。
7. 我們不做的事
- 不收集你的姓名、電子郵件、電話、位置、聯絡人（你在 AI 內容回報裡自己選擇附上的 AI 回覆文字除外，見第 5 節）。
- App 裡沒有廣告，沒有分析或追蹤工具，也不把資料賣給或分享給第三方用於廣告。
- 不追蹤你在其他公司的 App 或網站上的活動。
8. 權限
App 只在你使用相關功能時要求權限：相機（掃描配對用的 QR Code）、麥克風（聽寫）、照片（附加圖片）、區域網路（iOS，連線到區域網路上的電腦）、通知（推播）。桌面 App 只在聽寫時要求麥克風。照片、錄音和掃描結果只送到你自己的電腦，或只在手機上處理。
網頁版的權限由瀏覽器詢問：麥克風（聽寫）、通知（例如 agent 完成工作或需要你的授權時，由瀏覽器在這部裝置上顯示），以及存取這部裝置上的應用程式和服務或區域網路上的裝置（直接連到你的電腦）。網頁版不使用相機。
9. 資料保存與刪除
- 推播代碼的雜湊值在當天（UTC）結束後自動刪除。
- AI 內容回報保留 30 天，到期後自動刪除（通常在一天內完成），沒有備份（見第 5 節）。
- 你關閉 App 的通知後，App 下次連上你的電腦時會請 daemon 撤銷推播代碼。解除安裝 App 後，推播代碼會失效，daemon 在下次推播收到失效回應時刪除它；App 超過 48 小時沒有續約的推播代碼，daemon 也會停止使用。
- 網頁版把你加入的主機（包括配對資訊和你輸入的直接連線密碼）、設定、草稿和對話快取存在這個瀏覽器裡，不會送給我們（連線時中繼伺服器會看到伺服器 ID，見第 2 節）；清除這個網站的瀏覽資料就會刪除它們。
- 除此之外（AI 內容回報見第 5 節），我們沒有可以連結到你個人的資料。如有疑問或要求刪除資料，請寫信到 [email protected]。
10. 兒童
本 App 不是設計給 13 歲以下的兒童使用。
11. 政策變更
政策變更時，我們會更新本頁和生效日期。
12. 聯絡我們
渥屋科技股份有限公司（WOOW TECH CO., LTD.，統一編號 84006751）
地址：114 台北市內湖區陽光街92巷31號1樓
電子郵件：[email protected]
網站：https://aiot.woowtech.io/
woowtech smart Privacy Policy
Effective date: October 30, 2026
WOOW TECH CO., LTD. ("we") provides the woowtech smart (渥屋智能) mobile app (iOS, Android), desktop app (macOS) and web app (https://smart.woowtech.io). This policy explains what data the apps handle, where it goes, and your choices. In this policy, "the app" also means the web app.
1. How the app works
woowtech smart lets you control AI coding tools (agents) that run on your own computer, from your phone or from the desktop app. Your computer runs our daemon, and the app connects to it directly. When you are not on the same network, the app can connect through a relay server we operate (relay.woowtech.io). We do not offer accounts; you never sign up or log in.
The web app is a set of static files served by Cloudflare Pages; your content does not pass through the site. Like the other apps, the web app connects to your computer directly or through the relay. When you open smart.woowtech.io, Cloudflare sees your IP address and the information your browser sends, under Cloudflare's own privacy statement.
2. Your content goes only to your own computer
The text you send to agents, the photos and files you attach, your dictation audio and terminal content go only to the daemon on your own computer:
- On the same local network, the app connects to your computer directly, not through us.
- On your own computer, the web app can connect to the daemon directly; your browser may first ask whether to let the site access apps and services on this device.
- Through the relay, the content is end-to-end encrypted. The relay only forwards encrypted data; we cannot read it and we do not store it. While connected, the relay sees the IP addresses of your computer and phone and the server ID used for pairing; we keep no connection logs for it.
How the agents on your computer (for example Claude Code or Codex) handle that content depends on the agent services you set up and their terms; it does not pass through us.
3. Push notifications
When you allow notifications, the app gets this phone's push token from Google's Firebase Cloud Messaging (FCM) and gives it to the daemon on your computer. When an agent finishes or needs your permission, the daemon sends the following to our push relay (push.woowtech.io), which delivers the notification through FCM (and, on iOS, Apple's push service):
- The push token, the app's language (Traditional Chinese or English), the reason for the notification (for example "finished" or "needs permission"), and IDs that the daemon generated for the screen a tap opens.
- None of your content: no agent replies, project or folder names, file names or paths. The relay picks a fixed sentence for each reason.
To cap how many notifications a phone gets per day, the relay keeps a hash (SHA-256) of the push token until the end of that day (UTC), when it is deleted automatically. The relay's logs contain neither push tokens nor IP addresses.
The web app gets no push token; its notifications are shown by your browser on that device (see section 8). If one is not shown, the daemon may push it to a phone where you allowed notifications, with the same data as above.
4. Google Firebase
Notifications use Google's Firebase. To deliver them, the Firebase SDK collects and sends to Google: the Firebase installation ID, the push token, device model, language, time zone, operating system version, the app's identifier and version, and Firebase SDK version information. Google handles this data under its terms: https://firebase.google.com/support/privacy
On iOS, the app does not ask Firebase for a push token until you allow notifications and the app connects to our daemon. On Android, Firebase may get a push token when the app starts.
5. Reporting AI content
The app shows a "Report" button under each AI reply. The replies come from the agent running on your own computer (for example Claude Code or Codex). If one is offensive, dangerous or deceptive, you can report it to us from inside the app, without leaving it.
When you press "Send report" we receive:
- The reason you picked (harassment or hate, sexual content, violence or self-harm, dangerous or deceptive, or other).
- The app version, the platform (iOS, Android, desktop or web), the app's interface language, and a random report ID the app generates for each report. The ID is not used to identify you or your device.
- The text of that AI reply, only if you turn on "Include this message" and look at the editable preview first. We receive the text you keep, up to 8 KiB. It is off by default. The text was written by the agent on your computer and may contain your project or code, so check it and remove anything you do not want to share before you send.
We do not receive: what you typed to the agent, the messages around that reply, attachments, tool output, project or file names or paths, the address of your computer or daemon, pairing details, or any account or credential.
The report travels over HTTPS to our report service (reports.woowtech.io). It runs in Google Cloud's Taiwan region (Cloud Run and Firestore), behind Cloudflare, which rate-limits abuse and sees the connection's IP address while doing so, under Cloudflare's own privacy statement. Our service does not store IP addresses: they are not in the report records, and the service's logs hold only the receipt number, never the content. When a report is stored, Google Cloud's monitoring service sends fixed-text notification emails to our reviewers. They contain only the receipt number, with no reason, version or content.
When you report from the web app, your browser sends the report directly to reports.woowtech.io over HTTPS, with the same content the mobile and desktop apps send. The browser automatically adds the web app's address (https://smart.woowtech.io) to the request as its origin; the forwarding code we run at Cloudflare uses it only to decide whether to answer the browser's cross-origin request, and does not pass it on to the report service or store it.
We use reports to handle content safety and product problems. We do not use them for advertising or tracking and we do not share them with third parties; Google Cloud and Cloudflare process data on our behalf. Reports are kept for 30 days and then deleted automatically (usually within a day after that); there are no backups. Because there are no accounts and we do not collect your email address, we cannot reply to individual reports. The receipt number the app shows only means the report was saved, not that it has been reviewed.
To have a report deleted sooner, email [email protected] with the receipt number the app showed, and we will find and delete it.
6. Other connections
The app's "What's new" page reads a public changelog from GitHub, and the desktop app checks for and downloads updates from GitHub. These connections go directly to GitHub, which handles them under its privacy statement. The connections for reporting AI content are described in section 5.
7. What we do not do
- We do not collect your name, email address, phone number, location or contacts (the AI reply text you choose to attach to an AI content report is the exception; see section 5).
- The app has no ads and no analytics or tracking tools, and we do not sell or share data with third parties for advertising.
- We do not track your activity across other companies' apps or websites.
8. Permissions
The app asks for a permission only when you use the feature that needs it: camera (scanning the pairing QR code), microphone (dictation), photos (attaching images), local network (iOS, connecting to computers on your local network) and notifications. The desktop app asks only for the microphone, for dictation. Photos, audio and scan results go only to your own computer or stay on the phone.
In the web app, your browser asks for permissions: the microphone (dictation), notifications (shown by your browser on this device, for example when an agent finishes or needs your permission), and access to apps and services on this device or to devices on your local network (to connect to your computer directly). The web app does not use the camera.
9. Retention and deletion
- The hash of your push token is deleted automatically at the end of the day (UTC).
- AI content reports are kept for 30 days, then deleted automatically (usually within a day after that), with no backups (see section 5).
- When you turn off the app's notifications, the app asks the daemon to revoke the push token the next time it connects to your computer. After you uninstall the app, the token stops working, and the daemon deletes it when a notification comes back as undeliverable; the daemon also stops using a token the app has not renewed for 48 hours.
- The web app keeps the hosts you add (including pairing details and any direct-connection passwords you enter), your settings, drafts and conversation cache in this browser; they are not sent to us (while connected, the relay sees the server ID; see section 2). Clearing this site's data in your browser deletes them.
- Beyond that (see section 5 for AI content reports), we hold no data that can be linked to you. For questions or deletion requests, email [email protected].
10. Children
The app is not directed to children under 13.
11. Changes
When this policy changes, we will update this page and its effective date.
12. Contact
WOOW TECH CO., LTD. (Taiwan business ID 84006751)
Address: 1F., No. 31, Ln. 92, Yangguang St., Neihu Dist., Taipei City 114, Taiwan
Email: [email protected]
Website: https://aiot.woowtech.io/