SNAPBRIFY（下稱「本服務」）是一款在瀏覽器中運作的 PBR 材質產生工具。本政策說明本服務如何處理您的資料。本服務由 Z1jay 個人營運（operated by Z1jay，個人）。
您的原始照片不會離開您的裝置
拍攝、裁切、調整以及所有 PBR 通道（basecolor、roughness、AO、height、metallic、normal）的產生，完全在您的瀏覽器中進行。您的原始照片不會上傳到任何伺服器。在本機產生與下載材質永遠免費且不受限，不會觸及雲端或任何配額。
雲端儲存的資料
只有當您選擇上傳時，產生的 PBR 貼圖（打包後的無損 PNG：basecolor、ORM、height、normal）才會被儲存於 Cloudflare R2，並依帳號分隔命名空間，且會在建立後 48 小時自動刪除。
誠實告知：在該 48 小時期間，這些檔案儲存於 R2 上，且營運者在提供與維護服務的技術層面上可以存取；這些檔案不會被販售或分享。
帳號與驗證資料
- 帳號資料：使用者名稱、電子郵件地址，以及經 bcrypt 雜湊的密碼。
- 工作階段識別碼：儲存於伺服器端，並鏡射至資料庫（附 TTL 到期時間）。
- 用於註冊、密碼重設與管理者二次驗證的一次性電子郵件驗證碼，皆以 bcrypt 雜湊儲存，並於數分鐘內到期。
AI 功能
您輸入的文字提示會傳送至 Cloudflare Workers AI 以產生圖片。若提示包含中日韓文字，會在產生前於伺服器內部自動翻譯為英文。產生的圖片會回傳至您的瀏覽器，不會儲存於伺服器。
產品分析與提交內容
- 分析事件記錄的是經雜湊的使用者識別碼（SHA-256 userHash），而非您的原始使用者名稱，並附上事件類型（註冊 / 登入 / 雲端上傳 / 下載）；不含任何影像內容，個人資料極少。
- 意見回饋問卷與聯絡表單的提交內容會被儲存（附 userHash；聯絡表單包含您所提供的電子郵件，以便回覆您）。
技術與安全資料
您的 IP 位址（透過 Cloudflare 取得）用於速率限制與濫用防範；登入嘗試紀錄與標準的請求日誌會被保留。
Cookie
本服務使用必要的工作階段／驗證 Cookie；Cloudflare 可能設定安全性 Cookie；Cloudflare Web Analytics 為無 Cookie／注重隱私的分析。本服務不使用第三方廣告 Cookie。
次要處理者／第三方
- Cloudflare（R2 儲存、CDN／代理、Web Analytics、Workers AI）
- MongoDB Atlas（資料庫）
- Render（主機代管）
- Brevo / Resend（交易型電子郵件）
資料保存期限
- 上傳的雲端材質於建立後 48 小時自動刪除。
- 帳號資料保存至您刪除帳號為止。
- 工作階段依 TTL 到期。
- 一次性驗證碼於數分鐘內到期。
您的權利
您可以存取、更正或刪除您的資料；隨時刪除您的雲端專案（以釋出名額）；或要求刪除帳號。以上皆可透過聯絡表單（/contact.html）提出。
不販售、不投放廣告
本服務不販售您的個人資料，也不投放第三方廣告。
安全性
本服務採用合理的保護措施（HTTPS 傳輸、bcrypt 密碼雜湊、帳號鎖定、存取控制），但沒有任何傳輸或儲存方法是完全安全的，本服務無法對此提供絕對保證。
兒童
本服務並非以 13 歲以下兒童為對象；未成年人應取得監護人同意後使用。
管轄法律與聯絡方式
本政策依中華民國（台灣）法律解釋；相關爭議以台灣法院為管轄法院。如有隱私相關問題，請透過網站聯絡表單（/contact.html）與我們聯繫。
SNAPBRIFY (the "Service") is a browser-based PBR texture generation tool. This policy explains how the Service handles your data. The Service is operated by Z1jay, an individual.
Your source photos never leave your device
Capture, crop, tune, and all PBR channel generation (basecolor, roughness, AO, height, metallic, normal) happen entirely in your browser. Your source photos are NOT uploaded to any server. Generating and downloading textures locally is always free and unlimited and never touches the cloud or any quota.
Data stored in the cloud
Only the generated PBR texture maps that you choose to upload (packed lossless PNGs: basecolor, ORM, height, normal) are stored, on Cloudflare R2, namespaced per account, and are automatically deleted 48 hours after creation.
To be candid: during that 48-hour window these files are stored on R2 and are technically accessible to the operator for the purpose of providing and maintaining the Service; they are not sold or shared.
Account & authentication data
- Account data: username, email address, and a bcrypt-hashed password.
- Session identifiers: stored server-side, mirrored in the database with a TTL (expiry).
- One-time email codes for registration, password reset, and admin step-up are stored bcrypt-hashed and expire within minutes.
AI features
Text prompts you enter are sent to Cloudflare Workers AI to generate images. Prompts containing CJK characters are auto-translated to English internally before generation. Generated images are returned to your browser and are not stored on the server.
Product analytics & submissions
- Analytics events record a hashed user identifier (SHA-256 userHash), not your raw username, plus an event type (signup / login / cloud upload / download) — no image content and minimal personal data.
- Feedback-survey and contact-form submissions are stored (with userHash; the contact form includes the email you provide so we can reply).
Technical & security data
Your IP address (via Cloudflare) is used for rate-limiting and abuse prevention; login attempts and standard request logs are kept.
Cookies
The Service uses an essential session/authentication cookie; Cloudflare may set security cookies; Cloudflare Web Analytics is cookieless and privacy-friendly. There are no third-party advertising cookies.
Sub-processors / third parties
- Cloudflare (R2 storage, CDN/proxy, Web Analytics, Workers AI)
- MongoDB Atlas (database)
- Render (hosting)
- Brevo / Resend (transactional email)
Retention
- Uploaded cloud materials auto-delete 48 hours after creation.
- Account data is kept until you delete your account.
- Encrypted database backups (which include your account email and hashed password) are stored on Cloudflare R2 for disaster recovery, retained as a rolling set of the most recent 14 backups.
- Sessions expire by TTL.
- One-time codes expire within minutes.
Your rights
You may access, correct, or delete your data; delete your cloud projects anytime (freeing a slot); or request account deletion — all via the contact form (/contact.html).
No sale of data, no ads
We do not sell your personal data and do not serve third-party ads.
Security
We use reasonable safeguards (HTTPS transport, bcrypt password hashing, account lockout, access controls), but no method of transmission or storage is completely secure, and we cannot guarantee absolute security.
Children
The Service is not directed to children under 13; minors should have guardian consent before using it.
Governing law & contact
This policy is governed by the laws of the Republic of China (Taiwan); any disputes shall be subject to the jurisdiction of the courts in Taiwan. For privacy questions, please reach us through the contact form (/contact.html).