本政策說明 GSAT Study Tracker 如何處理讀書紀錄、帳號資料與 Google Calendar 資料。
生效日期：2026 年 11 月 5 日
一、適用範圍
本政策適用於 GSAT Study Tracker（以下稱「本網站」）的讀書紀錄、雲端同步及 Google Calendar 連線功能。營運者為 GSAT Study Tracker 個人專案營運者，聯絡信箱為 a8744895@gmail.com。
若使用者不同意提供 Calendar 相關資料，仍可使用不需要 Google Calendar 的 Tracker 功能，但無法使用 Calendar 同步。
二、蒐集及處理的資料
帳號與讀書紀錄
- 登入電子郵件、Supabase 使用者識別碼、登入與同步狀態。
- 每日讀書項目、完成狀態、完成率、讀書時間、學習進度及使用者自行輸入的備註。
Google Calendar 資料
使用者主動授權後，本網站以 calendar.events.readonly 唯讀權限讀取主要 Calendar 中指定期間內的資料。目前同步範圍約為過去 60 天至未來 240 天，可能包含：
- 行程標題、說明及地點。
- 開始與結束日期、時間及全天行程狀態。
- 事件識別碼、更新時間、重複行程資訊及 Calendar 行程連結。
本網站不會透過 Calendar API 新增、修改或刪除 Google Calendar 內的原始行程。
為在 Calendar 連線或讀取失敗時保留排程，本網站會在此瀏覽器按 Tracker 帳號保存最後成功讀取的排程快照。快照只包含上述排程欄位及讀取時間，不包含 OAuth 憑證；錯誤期間優先保留同帳號既有 Tracker 項目。下一次完整成功讀取會替換快照，成功手動解除 Calendar 連線或清除瀏覽器網站資料會刪除本機快照；先前已保存的 Tracker 紀錄依原保存流程處理。
OAuth 與技術資料
為維持 Calendar 連線，Supabase 會保存 OAuth Client ID、access token、refresh token、到期時間、授權範圍、同步時間與錯誤資訊。服務供應商也可能處理維持安全及排錯所需的 IP 位址、瀏覽器類型、請求時間與系統紀錄。
使用者主動要求的字典查詢
自動帶入優先使用本站提供的 ECDICT，在瀏覽器內比對；編輯模式的「取得翻譯」仍為本機 ECDICT 預覽。本機查詢不需登入，不傳送查詢詞到外部字典。所有已登入 Tracker 的正式帳號，於輸入單字並離開欄位後，若 ECDICT 確認沒有中文結果，會透過 Supabase 的翻譯函式將該單一英文單字傳給 Google Cloud Translation API，取得繁體中文備援翻譯。自動流程僅傳送英文單字，手動按鈕另可傳送使用者選取的組合／句子；不傳送整份讀書紀錄、備註、Calendar 行程或 Calendar OAuth 憑證；Tracker 登入憑證僅交由 Supabase 驗證，不轉送 Google。訪客、組合、句子及 ECDICT 載入失敗時不使用備援翻譯。未設定或無法使用時仍可手動輸入。
單字、組合及句子編輯時也可手動點「Google 翻譯」整段查詢，預覽後確認才追加中文、保留原有意思；組合／句子不推測詞性。手動查詢沿用同一登入限制與每月額度。Google Translate 結果標示為自動翻譯，中文及來源沿用本機、匯出／匯入與 Cloud 保存，允許手動修改。Google 僅提供中文，詞性另依本機 ECDICT／大考中心的同拼法資料帶入；無資料時保留手動設定，不使用 Natural Language API，也不推測學測級數。查詢結果暫存在瀏覽器及函式執行個體的有限記憶體快取，不另建翻譯資料庫。Google Cloud Translation 及 Google 隱私權政策 說明其服務處理方式。
候選釋義暫時顯示在頁面，使用者選擇並確認後，才將所選翻譯及來源加入自己的紀錄，沿用本機儲存、匯出／匯入與雲端同步。既有手動中文與歷史字典來源保留，不批次覆寫或改標為 ECDICT。ECDICT 授權及資料範圍見單字資料來源頁。使用者主動開啟 Oxford 等外部連結時，由該網站依其政策處理瀏覽請求。
Google Translate 用量
每個正式登入帳號每月可使用最多 5,000 個英文單字的 Google 備援翻譯，依送出的英文單字數計算，look after 計 2、Practice makes perfect. 計 3，縮寫與連字複合詞各計 1，純數字不計；不按字母長度計算。單次整段查詢最多 200 個單字及 1,000 個字元；每月 1 日台北時間 00:00 重新計算。ECDICT、瀏覽器及伺服器快取命中不計入用量。已送往 Google 的查詢即使失敗或逾時仍計入額度，英文及手動編輯功能保留。Supabase 按帳號保存月份、累計單字數、更新時間及扣額請求識別碼，以便跨裝置執行上限及避免重試重複扣額；額度資料表不保存查詢原文或譯文。超過 7 天的扣額識別碼於該帳號後續成功扣額時清理，月份用量摘要保留至帳號刪除。
三、資料使用目的
- 提供每日讀書紀錄、完成率與進度統計。
- 從 Google Calendar 建立及更新 Tracker 排程。
- 保存與同步使用者自己的讀書紀錄。
- 維護帳號、授權、資料安全與處理支援要求。
Calendar 資料會在初次連線、使用者手動要求同步，以及已啟用的排程同步執行時讀取。
本網站不會將 Google Calendar 資料用於廣告、精準行銷、出售資料、訓練或改進一般用途 AI／ML 模型、分析其他使用者作為營運者的升學成果，或其他與 Tracker 功能無關的用途。
四、AI／ML 與 Google Limited Use
GSAT Study Tracker 不整合任何第三方 AI 或機器學習 API，也不會自動將 Google Workspace API 的原始、彙整、匿名化或衍生資料傳送給 AI／ML 服務。Google Workspace API 資料不會用於訓練、改進或評估一般用途 AI／ML 模型。
網站中的排程格式說明是靜態文字頁面及複製工具，不會呼叫 AI 服務，也不會自動附加或傳送 Google Calendar 資料。使用者如自行匯出、複製或分享資料，該動作由使用者主動決定。
五、升學成果之自主分享
使用者可以自行選擇將本人於 Tracker 產生的讀書成果摘要，以截圖、PDF 或其他文件形式，透過招生學校指定管道提交。本網站不會自動將資料傳送給學校或公開發布升學成果。
分享內容由使用者自行決定。提交前應移除 OAuth 憑證、Google 帳號技術識別資訊、與升學成果無關的 Calendar 私人行程，以及其他不希望提供的個人資訊。資料提交至招生單位後，其保存及刪除方式依該單位規定辦理。
六、儲存、服務供應商與分享
資料可能由使用者瀏覽器、Supabase、Google OAuth、Google Calendar API 與 Cloudflare 等維持網站所需的服務處理。ECDICT 比對在本機完成；上述自動備援及使用者點選的整段查詢會透過 Supabase 將相應英文內容傳給 Google Cloud Translation API。部分服務供應商的伺服器可能位於臺灣以外地區。
本網站不出售或出租個人資料。資料僅會在維持服務所必需、使用者主動要求或同意、法律依法要求，或保護使用者與系統安全所必要時提供。
七、保存、解除連線與刪除
使用者可隨時在 Tracker 中解除 Google Calendar 連線。解除後，本網站會停止使用保存的憑證、刪除 Supabase 中的 Calendar connection、OAuth token 與 Calendar 同步快取；Google Calendar 原始行程不受影響。
先前已保存為 Tracker 讀書紀錄的內容及瀏覽器本機資料，可能不會隨解除連線自動刪除。使用者可自行清除瀏覽器網站資料，或透過聯絡信箱要求刪除相關雲端資料，也可在 Google 帳號中撤銷第三方應用程式授權。
八、使用者權利
在適用法律允許的範圍內，使用者可要求查詢、閱覽、取得副本、補充、更正、停止蒐集或利用，以及刪除個人資料。為避免冒用，本網站可能要求合理的身分確認。
九、資料安全
本網站採取合理的帳號驗證、資料存取控制及伺服器端憑證保存措施。任何網路服務均無法保證絕對安全；如發生依法需要通知的重大安全事件，將依適用法律處理。
十、政策變更與聯絡方式
本政策可能因功能、服務供應商或法規變更而更新，重大變更將於網站公告並更新生效日期。
This policy explains how GSAT Study Tracker processes study records, account information, and Google Calendar data.
Effective date: November 5, 2026
1. Scope
This policy applies to the study-record, cloud-sync, and Google Calendar connection features of GSAT Study Tracker (the “Service”). The Service is operated as a personal project. Privacy and data requests may be sent to a8744895@gmail.com.
Users who do not authorize access to Google Calendar may continue using Tracker features that do not require Calendar synchronization.
2. Information We Process
Account and study records
- Sign-in email address, Supabase user identifier, and sign-in and synchronization status.
- Daily study items, completion status, completion rates, study time, learning progress, and notes entered by the user.
Google Calendar data
After a user provides authorization, the Service uses the read-only calendar.events.readonly scope to read events from the user’s primary calendar within a defined period. The current synchronization window is approximately 60 days in the past through 240 days in the future. Data may include:
- Event title, description, and location.
- Start and end dates and times, including all-day status.
- Event identifiers, update timestamps, recurrence information, and the Google Calendar event link.
The Service does not create, modify, or delete original Google Calendar events through the Calendar API.
To retain schedules when Calendar connection or reading fails, the Service stores the last successfully read schedule snapshot in this browser, separately for each Tracker account. The snapshot contains only the schedule fields above and the read time, without OAuth credentials. Existing Tracker items for the same account take priority during failures. A complete successful read replaces the snapshot; successful manual Calendar disconnection or clearing browser site data removes the local snapshot. Previously saved Tracker records follow the existing retention flow.
OAuth and technical information
To maintain the Calendar connection, Supabase stores the OAuth client ID, access token, refresh token, expiration time, granted scope, synchronization time, and error information. Service providers may also process IP address, browser type, request time, and system logs required for security and troubleshooting.
User-initiated dictionary lookups
Automatic fill first matches ECDICT data provided by this site in the browser. The edit-mode lookup button remains a local ECDICT preview. Local matching requires no sign-in and sends no query to an external dictionary. After a registered, signed-in Tracker account enters a word and leaves its field, a confirmed ECDICT miss may send that single English word through a Supabase function to Google Cloud Translation API for a Traditional Chinese fallback. Full study records, notes, Calendar events and Calendar OAuth credentials are not sent to Google. Tracker session credentials are verified by Supabase and are not forwarded to Google. Guests, combinations, sentences and failed ECDICT downloads do not use this fallback. Manual input remains available when translation is not configured or unavailable.
In edit mode, signed-in users can request Google translations for words, combinations and sentences, sending the whole selected English text and confirming the preview before appending Chinese. Existing Chinese is retained; combination and sentence previews do not infer parts of speech. Manual lookups share the same sign-in requirement and monthly allowance. Google Translate results are identified as automatic translations. Chinese text and its source follow the existing local-storage, export/import and Cloud flows, remain editable. Google supplies Chinese only; parts of speech use exact local ECDICT/CEEC records when available, otherwise remain manual. No Natural Language API is used, and no GSAT Level is inferred. Limited in-memory caches are used in the browser and function instance; no separate translation database is created. See Google Cloud Translation and Google's Privacy Policy for the provider's processing information.
Candidate meanings are displayed temporarily. Only after the user selects meanings and confirms are those meanings and their source added to the user's records, following the existing local-storage, export/import, and cloud-sync flows. Existing manual translations and historical dictionary provenance are preserved without bulk replacement or relabeling as ECDICT. The vocabulary sources page documents ECDICT's license and data coverage. When users choose to open an external link such as Oxford, that website processes the browsing request under its own policy.
Google Translate usage
Each registered account may submit up to 5,000 English words per calendar month, counting the English words submitted rather than letters or characters: “look after” counts as two and “Practice makes perfect.” as three. Contractions and hyphenated compounds each count as one; number-only tokens do not count. Whole-text requests are limited to 200 words and 1,000 characters each. The allowance renews at 00:00 Asia/Taipei on the first day of each month. ECDICT and browser/server cache hits do not consume allowance. A query sent to Google still counts if it fails or times out; English input and manual editing remain available. Supabase stores the account ID, month, word count, update time and debit receipt IDs to enforce the allowance across devices and prevent duplicate debits on retries. Quota tables do not store query text or translations. Receipts older than seven days are cleaned up on that account's later successful debit; monthly usage summaries remain until account deletion.
3. How Information Is Used
- Provide daily study records, completion rates, and progress statistics.
- Create and update Tracker schedules from Google Calendar events.
- Store and synchronize the user’s own study records.
- Maintain accounts, authorization, data security, and user support.
Calendar data is read during the initial connection, when the user manually requests synchronization, and when enabled scheduled synchronization runs.
Google Calendar data is not used for advertising, targeted marketing, sale of data, training or improving generalized AI/ML models, analysis of other users for the operator’s academic-admission results, or purposes unrelated to Tracker functionality.
4. AI/ML and Google Limited Use
GSAT Study Tracker does not integrate with any third-party artificial intelligence or machine learning API. Raw, aggregated, anonymized, or derived Google Workspace API data is not automatically transferred to an AI/ML service. Google Workspace API data is not used to train, improve, or evaluate generalized AI/ML models.
The scheduling-format reference available on the website is a static text page and copy tool. It does not call an AI service and does not automatically attach or transmit Google Calendar data. Any export, copy, or sharing action is initiated and controlled by the user.
5. User-Initiated Sharing for Academic Applications
Users may choose to submit summaries of their own Tracker study results to educational institutions through screenshots, PDFs, or other documents. The Service does not automatically transmit information to schools or publicly publish academic-application results.
Users control what they share. Before submitting material, users should remove OAuth credentials, technical Google account identifiers, unrelated private Calendar events, and any other information they do not wish to disclose. Information submitted to an institution is retained and deleted according to that institution’s policies.
6. Storage, Service Providers, and Disclosure
Information may be processed by the user’s browser, Supabase, Google OAuth, Google Calendar API, and Cloudflare as necessary to operate the Service. ECDICT matching runs locally; the automatic fallback and explicit whole-text lookup described above send the corresponding English input through Supabase to Google Cloud Translation API. Some service-provider systems may be located outside Taiwan.
The Service does not sell or rent personal information. Information is disclosed only when required to operate the Service, when requested or authorized by the user, when legally required, or when necessary to protect users and system security.
7. Retention, Disconnection, and Deletion
Users may disconnect Google Calendar at any time from the Tracker. After disconnection, the Service stops using the stored credentials and deletes the Calendar connection, OAuth tokens, and Calendar synchronization cache stored in Supabase. Original Google Calendar events are not affected.
Information previously saved as Tracker study records and information stored locally in the browser may not be deleted automatically when Calendar is disconnected. Users may clear browser site data, request deletion of relevant cloud data by email, and revoke third-party application access from their Google Account.
8. User Rights
Where permitted by applicable law, users may request access to, a copy of, correction or supplementation of, restriction of processing of, or deletion of personal information. Reasonable identity verification may be required to prevent unauthorized requests.
9. Data Security
The Service uses reasonable account authentication, access control, and server-side credential storage measures. No online service can guarantee absolute security. Material security incidents will be handled in accordance with applicable law.
10. Policy Changes and Contact
This policy may be updated when features, service providers, or legal requirements change. Material changes will be announced on the website with an updated effective date.