The short version

SleepShutter records and analyzes sound — and, if you choose, video — while you sleep, entirely on your iPhone. Your recordings never leave the phone. Four small things can travel, and three of them only if you choose: the app asks which version is the newest; it can send back the corrections you make when the detector gets something wrong; it sends the feedback you write in the form, together with an email address and one night’s log if you add them; and it can send a one-line count when you reach a step, such as your first recorded night. Your audio and video are never among them. There is no account, no tracking, no third-party analytics code, and no advertising. Clips older than 7 days are removed from your phone the next time you open the app.

What the app records

What leaves your phone

One number, downloaded. SleepShutter asks one question: which version is the newest. An App Store copy asks Apple, on Apple’s public page for this app; a TestFlight copy asks a small file on spicetek.com, because TestFlight has no public page to ask. Either way the answer is a version number, and if it is newer than yours the app shows a line on the home screen that takes you to the App Store or to TestFlight. The request sends nothing about you — no identifiers, no cookies, nothing the app recorded. The address names the app, never you. As with any request to any website, the server that answers it sees the IP address the request came from and the user agent iOS adds, which names the app, its build number and the iOS version. That is all it can see. It runs when you open the app or return to it, at most once every six hours, and never while a night is recording.

Your corrections, if you say yes. When you mark a mistake — Not snoring here, or Missed a snore — the app can send that correction back to us. It asks the first time, and there is a switch in Settings; if you never say yes, nothing is sent. What travels is the type of correction, where it was in the clip, what the detector scored at that moment, your app version, your phone type — whether it has a TrueDepth camera, never which model — and the date, with no time of day. A random ID groups your corrections together; it is made on your phone, is derived from nothing about you, and you can reset it any time in Settings. No audio, no video, and no name are ever sent. We use this only to improve detection in the app. We do not use it for research or publication. As with any request, the server sees the IP address it comes from; nothing we store with your corrections includes it. Each correction is deleted three years after it reaches us.

Your feedback, when you send it. The app has a form for telling us something is wrong, or asking for something. Nothing is sent until you tap Send — typing in the form sends nothing, and closing it without sending leaves nothing behind. What travels is what you typed and which of the four kinds you picked. Not your app version, your build or your iOS version.

Tapping Send does not always mean it has left your phone. If there is no connection, or something goes wrong at our end, the message waits on your phone — as a file in the app’s own storage, holding everything you put in it, your email address and any attached log included. It keeps trying: up to five times if our server answers with an error, and up to 14 days if nothing answers at all. If our server refuses it, it does not try again. Then the app asks you what to do, rather than waiting silently for ever.

What it asks is: send it by email instead, or discard it. Discard deletes it from your phone, and we never see it. If you choose email, the app hands the text to your own mail app — you still have to press send there — and any log you attached is left out of that email; only what you typed goes. Because it is ordinary email, we see the address you send it from, the way anyone does. While a message is still waiting, it lives in the app’s container like your clips do, so it is included in your own iCloud device backup if you have one.

Your email address is optional. Leave it blank and the feedback is anonymous, and we have no way to reply. Fill it in and we use it for one thing: answering this one message. It is not added to any list, and we send nothing else to it.

What we use it all for. Answering you, and improving the app. We do not use it for research or publication.

Attaching last night’s log is a separate choice, and it is off until you turn it on. The log is the app’s own record of what it did during the night — what the camera and the microphone saw, how warm the phone got, what the detector scored, what went wrong. Before it is attached, your phone strips it: none of the words you typed, none of the names you gave your devices, none of your clip file names, and no time of day — each line is stamped with how many seconds it was after the start of the night, not with the clock. What is left includes the detector’s own lines, and those say when during the night it thought you snored and how loud it scored it. No audio, no video, and no frames. A log is tied to your message by a number made for that one message — not by the ID that groups your corrections, and nothing that links it to your other nights. A log is never sent whole if it is very long: at most 512 KB travels, and it is the end of the night that is kept, because that is the part a problem usually shows in.

Counts of which steps you reached. The app can send us one line when you pass a step — your first time opening it, the first night you record, the first clip you play, and a few more like them. Each line is the name of the step and the date, and nothing else: no identifier, not even a random one, no device, no time of day, nothing the app recorded. There is no way for us to tell that two steps came from the same phone, or to tell which phone any of them came from. Only the App Store version sends these at all — a TestFlight build and any development build never do, whatever the setting says. In the App Store version it is the setting described next that decides.

You can turn the counting off, on the first screen and later in Settings. It starts switched on, except in the European Economic Area, the United Kingdom and Switzerland, where it starts off. Turning it off stops it immediately; the app works exactly the same either way, and it has no effect on the free year. Because these lines carry nothing that points at you, we cannot find yours in order to delete them — which is the same reason they cannot be traced back to you. If you would rather we never had them, switch the counting off; nothing further is sent from then on.

What never leaves the phone. Those four things above are the only ones. No upload or cloud sync of your recordings, no crash reporting, no third-party analytics code, nothing else that phones home. Your recordings and summaries stay on the device: the only way they leave is if you export them yourself using iOS features (for example, saving a clip to Files or sharing a screenshot), or through your own iCloud device backup, which is governed by Apple’s terms and encrypted by Apple.

If a future version adds any form of sync or upload of what the app records, it will be optional, off by default, and this policy will be updated before that version ships — as it was for the update check, the corrections, the feedback form and the counts above.

How long data is kept

• Audio and video clips, diagnostic logs and night-vision frames: removed the next time you open the app, once they are older than 7 days. You can also delete any clip, or an entire night, from the Journal at any time.
• Per-night summaries (times, counts, score, mood): kept until you delete the night or the app.
• Deleting the app deletes everything on the phone. It does not reach anything you have already sent us — for that, see the next three lines.

What we hold, once you have sent it. Your message, your email address and the log are stored separately from one another, so one can be deleted without touching the others. Your message, the log and your email address are all deleted 12 months after they reach us. If you claimed the free year, your address is kept until we have sent you the code, because it is the only way we can send it; what you wrote is still deleted at 12 months, like anyone else’s. If 24 months go by and paid features still have not launched, we write to you before we delete your address — you get 30 days to tell us to keep it. Each correction is deleted three years after it reaches us. The step counts carry nothing that points at anyone, so there is nothing in them to delete on request, and nothing to look anyone up by.

If you want something deleted sooner, write to us from the address you gave and say so — that is how we find it, because we keep no index to look you up by. As with any request, the server sees the IP address it comes from and the user agent iOS adds; we store neither, and nothing we keep with your feedback, your corrections or the counts includes them.

Permissions the app asks for

• Microphone — required; without it there is nothing to analyze.
• Camera — only asked for when you switch to Audio + Video mode.
• Notifications — only asked for when you turn the wake alarm on, and only so that the alarm can still sound if iOS has suspended the app by the time it is due. The notification is scheduled on your phone for the wake time you set: there is no push from us, and no server is involved. Its text is fixed — “Time to wake up”, and one line saying either to open the app to stop the night, or that the night ended early because the battery ran low. Decline it and everything else still works, but the alarm then rings only if that night’s recording is still running at the wake time — a night that stopped early, on a low battery or because iOS closed the app, has nothing left to ring. Granting it covers that case without being a guarantee: iOS may still quiet the notification, for instance under a Sleep Focus or the silent switch, and a flat battery ends it either way.
• The app never asks for Apple Health, location, contacts or photos, and it sends no marketing notifications. It does not read anything from the Health app and writes nothing to it.
• Why the App Store privacy label nonetheless lists Health: because a night log you choose to attach to feedback contains the detector’s own snore scores, and Apple counts that as health data wherever it came from. It is our measurement, made on your phone — not anything taken from Apple Health. Attach no log and nothing of that kind is sent.

Children

SleepShutter is not directed at children under 13 and we do not knowingly collect information from them. The app asks for nothing by itself: everything described above is optional, and the feedback form, the email field and the log are sent only when someone chooses to send them. We have no account system and no way to tell one sender from another, so if you are under 13, please do not send us feedback or an email address.

Not a medical device

SleepShutter is a wellness and self-observation tool. It does not diagnose sleep apnea or any other condition, and its numbers should not be used to make medical decisions. If you are concerned about your sleep or breathing, talk to a clinician.

Changes

We will post any change here with a new effective date. We have no way to tell you that it changed: we send no email, the new-build notice appears only inside the app when you open it, and the only notification the app ever sends is the wake alarm described above, scheduled on your own phone. So please check this page when you update the app.

Contact

Spicetek LLC · hanswuprogrammer@gmail.com · spicetek.com

SleepShutter 隱私權政策

Spicetek LLC · 生效日 2026-11-06 · 適用於 SleepShutter iOS app（TestFlight 與 App Store 版本）

簡短版

SleepShutter 在你睡覺時錄音（若你選擇，也錄影）並分析，全部在你的 iPhone 上完成。你的錄音永遠不會離開手機。會離開手機的只有四樣小東西，其中三樣要你自己選才會送：app 問「最新的版本是哪一個」；你標記偵測錯誤時那筆更正；你在表單裡寫的回饋，以及你自己加上去的 email 和某一晚的記錄；還有你走到某一步時的一行計數（例如第一次錄完一晚）。你的錄音和影像永遠不在裡面。沒有帳號、沒有追蹤(tracking)、沒有第三方分析程式碼、沒有廣告。超過 7 天的錄音會在你下次開啟 app 時從手機移除。

App 會記錄什麼

什麼會離開你的手機

只下載一個數字。SleepShutter 只問一件事：最新的版本是哪一個。從 App Store 裝的版本去問 Apple（Apple 為這個 app 公開的查詢頁）；從 TestFlight 裝的版本則是讀 spicetek.com 上一個小檔案，因為 TestFlight 沒有公開的查詢頁可問。不管哪一種，回來的都只是一個版本號；比你的新，app 就在首頁顯示一行提示，點了帶你去 App Store 或 TestFlight。請求不會送出任何關於你的資料——沒有識別碼、沒有 cookie、沒有任何 app 錄到的東西。網址裡帶的是這個 app 的編號，不是你的。就像連上任何網站一樣，回應它的伺服器看得到請求來自哪個 IP 位址，以及 iOS 自動加上的 user agent（裡面有 app 名稱、build 號和 iOS 版本）。它能看到的就只有這些。它在你開啟 app 或回到 app 時執行，最多每六小時一次，錄夜期間不執行。

你的更正，在你同意的前提下。當你標記偵測錯誤——「Not snoring here」或「Missed a snore」——app 可以把那筆更正送回我們。第一次會先問你，設定裡也有開關；你沒有同意過，就什麼都不會送。送出的是：更正的種類、它在片段中的位置、偵測器當下的分數、app 版本、你的手機類型（有沒有 TrueDepth 相機，不是機型），以及日期——不含一天中的時間。一組隨機編號把你的更正歸在一起；它在你的手機上產生、不是從任何關於你的資料推導出來的，而且你隨時可以在設定中重設。不會送出任何錄音、影像或姓名。這些資料只用來改進 app 的打呼偵測，不用於研究或發表。就像任何網路請求，伺服器看得到它來自哪個 IP；我們存下的更正資料裡沒有它。每一筆更正在送達我們之後滿三年就會刪除。

你的回饋，在你送出的時候。App 裡有一個表單，讓你告訴我們哪裡不對，或是想要什麼。在你按下送出之前，什麼都不會送——在表單裡打字不會送出任何東西，沒送就關掉也不會留下任何東西。送出的是：你打的內容，以及你選的四種類型中的哪一種。不含你的 app 版本、build 或 iOS 版本。

按下送出,不一定表示它已經離開你的手機。如果沒有網路,或是我們這邊出了問題,那則訊息會留在你的手機上——以一個檔案存在 app 自己的儲存空間裡,裡面包含你填的每一樣東西,你的 email 和你附上的記錄都在內。它會繼續嘗試:我們的伺服器回錯誤時最多試 5 次,完全沒有回應時最多等 14 天。如果我們的伺服器拒絕了它,就不會再試。之後 app 會問你怎麼辦,而不是無聲無息地一直等下去。

它問的是:改用 email 寄,還是丟掉。丟掉就從你的手機上刪除,我們永遠不會看到。選 email 的話,app 會把文字交給你自己的郵件 app——還是要你自己按寄出——而且你附上的那份記錄不會放進那封信裡,只有你打的字會去。因為那就是一般的電子郵件,我們會看到你寄件的那個地址,和任何人收信時一樣。訊息還在等的期間,它和你的 clip 一樣放在 app 的容器裡,所以如果你有 iCloud 裝置備份,它也會在備份裡。

Email 是選填的。留空白，這則回饋就是匿名的，我們也沒有辦法回覆你。填了，我們只用它做一件事：回覆這一則訊息。它不會被加進任何名單，我們也不會寄其他東西給你。

這些資料我們用來做什麼。回覆你，以及改進 app。我們不會用於研究或發表。

「附上昨晚的記錄」是另外一個選擇，你沒有打開它就不會送。那份記錄是 app 自己寫下它整夜做了什麼——相機和麥克風看到什麼、手機變多熱、偵測器打了多少分、哪裡出錯。在附上之前，你的手機會先把它過濾過：不含你打的任何字、不含你替裝置取的名字、不含你的 clip 檔名，也不含一天中的時間——每一行標的是「從入睡開始算起第幾秒」，不是幾點幾分。留下來的內容包含偵測器自己的紀錄，而那些紀錄會說出它在這一夜的哪個時候認為你打呼、以及評了多大聲。不含任何錄音、影片或畫面。那份記錄是用一組「只屬於這一則訊息」的編號對回你的訊息——不是上面那組把你的更正歸在一起的編號，也沒有任何東西能把它連到你其他的夜晚。記錄太長時不會整份送出：最多送 512 KB，而且留的是那一夜結尾的部分，因為問題通常出現在那裡。

你走到了哪幾步的計數。當你通過其中一步——第一次打開 app、第一次錄完一晚、第一次播放片段，以及另外幾個類似的步驟——app 可以送給我們一行紀錄。每一行只有那一步的名稱和日期，沒有別的：沒有識別碼（連隨機的都沒有）、沒有裝置、沒有一天中的時間、沒有任何 app 錄到的東西。我們沒有任何辦法判斷兩步來自同一支手機，也沒辦法知道任何一步來自哪支手機。而且只有 App Store 版本會送——TestFlight 版和任何開發版都不會送，不管設定開著或關著。在 App Store 版本，決定的是下面講的那個設定。

計數可以關掉，在第一個畫面上，之後也可以在設定裡關。它預設是開著的，但在歐洲經濟區(EEA)、英國與瑞士預設是關的。關掉就立刻停止；不管開或關，app 的運作完全一樣，而且不影響那一年免費。因為這些紀錄裡沒有任何指向你的東西，我們也就找不到屬於你的那幾行來刪除——這和它們無法被追溯到你，是同一件事的兩面。如果你寧願我們從來沒有拿到，把計數關掉即可；從那一刻起就不會再送出任何一行。

什麼永遠不會離開手機。上面那四樣就是全部。不會上傳或雲端同步你的錄音、沒有 crash 回報、沒有第三方分析程式碼，也沒有任何其他會回傳資料的東西。你的錄音與摘要留在裝置上：它們離開的唯一方式，是你自己用 iOS 功能匯出（例如把 clip 存到「檔案」或分享截圖），或是你自己的 iCloud 裝置備份——那受 Apple 的條款規範並由 Apple 加密。

若未來版本加入任何同步或上傳「app 所錄內容」的功能，將會是選用、預設關閉，且本政策會在該版本發布前更新——就像上面的版本檢查、更正回傳、回饋表單與計數一樣。

資料保留多久

• 音訊／影片 clip、診斷 log、夜視畫面：超過 7 天之後，在你下次開啟 app 時移除。你也可以隨時在 Journal 刪除任一 clip 或整晚。
• 每晚摘要（時間、次數、分數、心情）：保留到你刪除該晚或刪除 app。
• 刪除 app 即刪除手機上的一切。它碰不到你已經送給我們的東西——那部分看下面三行。

你送出之後，我們留著的部分。你的訊息、你的 email 和那份記錄是分開存放的，刪掉其中一個不會動到另外兩個。你的訊息、那份記錄和你的 email，都在送達我們之後滿 12 個月刪除。如果你領了那個免費一年，你的 email 會保留到我們把兌換碼寄給你為止，因為那是我們唯一能寄給你的方式；你寫的內容仍然和其他人一樣在 12 個月時刪除。如果過了 24 個月、付費功能還沒上線，我們會在刪掉你的 email 之前先寫信告訴你——你有 30 天可以回信要我們留著。每一筆更正在送達我們之後滿三年刪除。那些步驟計數裡沒有任何指向任何人的東西，所以裡面沒有可以應個人要求刪除的資料，也沒有任何可以反查的東西。

想要提早刪除，用你填的那個 email 地址寫信告訴我們——我們是靠它找到那筆資料的，因為我們沒有保留任何可以反查你的索引。就像任何網路請求，伺服器看得到它來自哪個 IP，以及 iOS 自動加上的 user agent；這兩樣我們都不儲存，我們保留的回饋、更正與計數資料裡也沒有它們。

App 要求的權限

• 麥克風——必要；沒有它就沒有東西可分析。
• 相機——只在你切到 Audio + Video 模式時才詢問。
• 通知——只在你把起床鬧鐘打開時才詢問，而且只為了一件事：萬一到了設定的時間 iOS 已經把 app 暫停，鬧鐘還是響得出來。那則通知是在你手機上排給你自己設的起床時間的，不是我們推送給你的，沒有任何伺服器參與。內容是固定的——標題「Time to wake up」，下面一行是「打開 app 結束這一夜」，或「因為電池快沒電，這一夜提早結束了」。不給這個權限，其他功能照用，但鬧鐘就只有在那一夜的錄音一路持續到起床時間時才會響——如果那一夜提早結束（電池快沒電，或 iOS 把 app 關掉），就沒有東西會響了。給了權限可以補上這種情況，但也不是保證：iOS 仍可能把通知壓下來（例如在睡眠專注模式下、或靜音開關），而手機完全沒電時兩種都沒救。
• App 從不要求 Apple Health、定位、聯絡人或照片，也不會發送行銷用通知。它不從「健康」app 讀取任何東西，也不寫入任何東西。
• 那為什麼 App Store 的隱私標籤上還是有「健康」(Health)這一列：因為你選擇附上的那份夜間記錄裡有偵測器自己打的打呼分數，而 Apple 不管來源為何，都把那算成健康資料。那是我們在你手機上做出來的量測，不是從 Apple Health 拿到的任何東西。不附記錄，就不會送出這一類的任何內容。

兒童

SleepShutter 不以 13 歲以下兒童為對象，我們也不會蓄意收集他們的資訊。App 自己不會主動索取任何東西：上面講的每一樣都是選用的，回饋表單、email 欄位和那份記錄，都只在有人選擇送出時才會送。我們沒有帳號系統，也沒有辦法分辨送出者是誰，所以如果你未滿 13 歲，請不要寄回饋或 email 給我們。

不是醫療器材

SleepShutter 是健康與自我觀察工具，不診斷睡眠呼吸中止症(sleep apnea)或任何疾病，其數字不應用於醫療決策。若你擔心自己的睡眠或呼吸，請諮詢醫師。

變更

任何變更會連同新的生效日公布於此頁。我們沒有辦法通知你這一頁改了：我們不寄電子郵件，新 build 的提示只在你開啟 app 時顯示在 app 裡，而這個 app 唯一會發出的通知就是上面寫的那個起床鬧鐘，排在你自己的手機上。所以請在更新 app 時回來看看這一頁。

聯絡

Spicetek LLC · hanswuprogrammer@gmail.com · spicetek.com