Privacy Policy
UniStops is a route-planning and delivery-assistant app for independent parcel drivers, made by Timevult, LLC ("we", "us"). This policy explains what we collect, why, who we share it with, how long we keep it, and your choices. It applies to the UniStops apps for iOS and Android and to this website. If the English and Chinese versions conflict, the English version controls.
1. What we collect and why
| Category | Examples | Source | Purpose |
|---|---|---|---|
| Account identifiers | Email address (may be an Apple private relay address), account ID; with Google sign-in, also your name and profile photo URL | Sign in with Apple or Google, or with your email address and a one-time code we email you | Sign you in; keep your data tied to your account; contact you about your account |
| Team phone number | Your mobile number, if you join a captain's team (asked for on the join page), or entered for you by that team's captain | You, or your team's captain | Lets your team's captain contact you about the team's work, for example by texting you the day's dispatch sheet. Visible only to that team's captain. You can change it in Me → Team while you are on the team; it is removed when you delete your account |
| Drivers without the app (captains only) | The name and phone number of a driver who does not use UniStops, entered by a captain | The team's captain | Assign work to that driver and send them the dispatch sheet. Kept with that team's records until the team is deleted or the captain removes the driver |
| Parcel and route data | Tracking numbers, platform, delivery address (and the address text as imported), map coordinates and pin corrections, work date, load number and van zone, platform reference fields you import (task ID, box/bag number, driver label, receipt status, original sequence), stop order | Files, pasted text or screenshots you import; your edits | Build, optimize and sync your routes; end-of-day reports |
| Delivery records | Status changes (delivered, attempted, returned), failure reasons, stop IDs, timestamps | Your actions in the app | Keep your route and reports accurate across devices; delivery evidence |
| Location (precise) | Your current position when you choose to start from your location. In personal mode, your precise position (with the accuracy your phone reports) is attached to each delivery record automatically, whenever you have granted location permission, when you mark a stop delivered, attempted or returned. In personal mode, the location recorded with your own deliveries (when location is on) and the pin corrections you make are also saved to your account, so the same address can be placed next time without looking it up again; they are never shown to any team or captain, and they are deleted with your account. In team mode, delivery-record location is on by default for that team and recorded only at the moment you record a delivery or a failed attempt — one point, never a trail; you can turn it off for that team at any time, and doing so does not change any other team's setting. | Your device, only while the app is in use and only with your permission | Set your route's start point (sent to our servers only to compute the route and not stored there; saved on your phone as your default start point); delivery evidence; in personal mode, placing addresses you have delivered to or corrected yourself on later routes (saved to your account only) |
| Optional local trip recording | Accumulated distance, start/end times, coverage status and the most recent accepted location sample; no saved trail of coordinates | Your device, only after you enable recording for a delivery session and grant location permission, and only while the app is open on your screen | Estimate delivery mileage on this phone. Not uploaded or shared with captains. You can stop recording without stopping delivery |
| Parcel notes | Short notes you write about a delivery address (for example, where to park, a gate or door code, or delivery times), with the address the note belongs to, its type, and when it was written, edited, confirmed as still valid or reported as wrong | What you type in the app | Help you — and, only if you choose to share a note, your team — deliver to that address again. A note is private by default: only you can see it — your captain cannot — unless you choose to share it. Notes are stored on our servers so they sync across your devices, and they are never included in notifications, reports, exports or logs. Do not put recipients' names, phone numbers or email addresses in a note; the app refuses text that looks like a phone number, an email address or a web link |
| Return hand-back records (team captains) | When a captain records that returned parcels were handed back: where they were handed to, the name or staff number of the person who received them, the time, the number of parcels, the receiver's own count, and a receipt number — all as typed by the captain. No photo or signature is collected | What the captain types in the app | Give the team a record that its returned parcels were handed back. Visible to that team's captain in the returns list, the day close, delivery evidence and exports. If you receive parcels from a team that uses UniStops, the captain may enter your name or staff number here |
| Proof-of-delivery photos | Photos you take in the app (may show a doorway, parcel or address), with the camera's own metadata such as time and GPS | Your camera | Delivery evidence. Kept only on your phone — never uploaded — until you delete it (Section 5); you can delete any photo at any time or save a copy to your Photos |
| Label photos for address reading | A photo of a parcel label you choose to scan in the Review center | Your camera | Read on your phone to suggest the street address; the text is only shown for you to pick from. The photo is not stored, uploaded or added to your Photos |
| Recipient name and phone (if in your import) | Name, phone number | Your import | Shown masked; passed to your dialer or messaging app only when you tap Call or Text. Stored on your device only — never uploaded. |
| Device and technical data | IP address, device model, operating system and app version, crash stack traces, request logs | Automatically, from your device and our servers | Security, debugging, preventing abuse, service cost limits |
Screenshot text recognition (OCR) runs on your device. We do not collect contacts, browsing history or advertising IDs. UniStops does not use location in the background: optional local trip recording pauses while you use another app or the screen is locked, and it does not upload location samples or a route history.
2. Recipient information you import
Parcel lists can contain personal information about parcel recipients, such as delivery addresses. We process that information only on your behalf and on your instructions, to provide UniStops to you — as your service provider. We do not use it for our own purposes, sell it, share it for advertising, or combine it with other data. You are responsible for importing only data you are allowed to use, and for using it only to deliver parcels. Recipient information you import is kept with the parcel it belongs to: for your own (personal-mode) parcels, until you delete your account; for parcels in a team's records, until the team is deleted, or until that team's captain asks us to delete them sooner. Recipient names and phone numbers never leave your phone, and map coordinates from Google are removed sooner (Section 5). Recipients who have questions about their information should contact the sender or delivery platform; we will help drivers, captains and platforms respond where we can.
3. Sensitive personal information
Precise location is "sensitive personal information" under California law. We use it only to provide the features you request (route start point, delivery evidence and optional local trip mileage) and do not use it to infer characteristics about you. You can turn off location access at any time in your phone's settings; route planning still works if you enter a start address.
4. Who we share data with
We share personal information only with service providers that help us run UniStops, under terms that require them to protect it and use it only to provide services to us:
- Supabase — sign-in and database (United States)
- Railway — application servers and route optimization (United States)
- Google Maps Platform — converting addresses into map coordinates, and displaying maps on Android (Google Privacy Policy)
- U.S. Census Bureau Geocoder — a free U.S. government service we may ask first to convert delivery addresses into map coordinates, before Google Maps Platform (we send only the building's address — street, city, state and ZIP code, with unit designators written in the street line such as "Apt", "Unit" or "#" removed — and never names, phone numbers or tracking numbers; an address it cannot place exactly is looked up with Google Maps Platform instead)
- Apple — sign-in, and maps on iPhone
- Google — sign-in
- Brevo — sends the one-time sign-in code by email (we send it your email address and the code only)
- Sentry — crash reporting, configured to exclude addresses, tracking numbers, names and phone numbers from error messages
If you join a captain's team in the app, that team's captain is the controller of the data the team collects about your work — they decide why it is collected, and it is kept until the team is deleted or they ask us to delete it sooner (Section 5) — and UniStops acts as the processor, handling it on the captain's instructions to run the service (see also Section 7). The captain can see: your name and team phone number in the team; the parcels your captain assigned to you, whether you delivered or failed each one, and the time you recorded that result; and your warehouse loading (check-in) records. This part is not a switch — it is always visible to that captain for parcels they assigned you, and you cannot turn it off. Your captain can also see parcels you added yourself outside team dispatch and the location recorded with a delivery report; both are on by default and both are switches you control in the app at any time. When the location switch is on, the location recorded with a delivery report may also be used — without your name — to remember where that address is for your team, so later deliveries there can be routed without looking the address up again; such a remembered point is kept until the team is deleted.
If you share a parcel note with your team, everyone on that team — the captain and the other drivers — can see it (door codes stay hidden on screen until tapped). The captain also sees who wrote, edited, confirmed or reported each shared note; other drivers do not see names. The captain can edit a shared note or take it off the team, which returns it to you as a private note (or deletes it, if you have already left the team). A note you keep private is not visible to your captain or anyone else on the team. Section 6 explains what happens to shared notes when you delete your account.
When you tap Navigate, the stop's address is handed to the map or navigation app you choose (Google Maps or Waze), which handles it under its own policy. We may also disclose information if required by law, to protect rights and safety, or as part of a merger or sale of our business (with notice to you). We do not share your data with delivery platforms. We have not sold or shared personal information for cross-context behavioral advertising in the past 12 months, and we do not do so.
5. How long we keep data
| Data | Retention |
|---|---|
| Account identifiers | Until you delete your account |
| Personal-mode parcels, routes and delivery records (including their location) — records you create outside a team | Until you delete your account, because restoring a new phone depends on them. Map coordinates from Google in them are removed sooner (see "Map coordinates from Google" below) |
| Records created inside a team — parcels, addresses, locations, loading and delivery records, dispatch sheets | Kept until the team is deleted, or until your captain asks us to delete them sooner. If you delete your account, your name as a team member becomes "Former member," names in the team's imported lists that were matched to you are cleared, and your free text and delivery coordinates in them are removed (Section 6). Map coordinates from Google in them are removed sooner (see "Map coordinates from Google" below) |
| The name you use in a team, and the team's memory of which imported name is yours (so a future import recognizes you automatically) | This mapping is removed as soon as you leave the team, are removed from it, or delete your account, and it is also removed when the team is deleted. A driver name that is part of an imported parcel or manifest line is a separate record that stays with the team's records (row above); names there that were matched to you are cleared when you delete your account |
| Day-close totals for a team (counts only — no addresses or tracking numbers) | Kept while the team exists; removed when the team is deleted |
| Earnings records for a team, if your team uses earnings tracking — daily totals, pay adjustments and rate cards (counts and amounts per driver per day — no addresses or tracking numbers) | Kept until the team is deleted; a captain can also change or remove an adjustment or rate card sooner. If you delete your account, these records stay with the team under "Former member," and the captain's notes on your pay adjustments are removed |
| Remembered delivery points for a team (a location without your name — see Section 4) | Kept until the team is deleted (a captain can also clear one sooner) |
| Parcel notes | Personal-mode notes: until you delete them or your account. Team notes: until they are deleted, or until the team is deleted. When you leave a team or are removed from it, your private notes for it are deleted; notes you shared stay with the team. A deleted note's text is removed at once; a record that it existed (no text or address) is kept for 30 days so your other devices remove their copy |
| Return hand-back records | Kept until the team is deleted; the captain can undo a record. When a record is undone, the receiver's name or staff number and the receipt number are removed from it. When the captain who recorded it deletes their account, the same two are removed. In both cases the time, the counts and the kind of place the parcels were handed to stay with the team |
| Proof-of-delivery photos | On your phone only, until you delete them, delete your account, sign in with a different account on the same phone, or uninstall the app. Some app versions still remove photos automatically after 30 days, except for stops you mark "Keep evidence." Copies you save to your Photos or share are yours and are not managed by us |
| Map coordinates and place details from Google (the map points and place information Google Maps Platform returns for an address or place), including the Google entries in our address-lookup cache | At most 30 days in total; the address-lookup cache on our servers keeps coordinates for up to 15 days, and place details such as a team warehouse's Google address are kept for at most 29 days. After that they are deleted and looked up again the next time they are needed. A Google place ID (a reference to a place, not its coordinates) may be kept with a place you saved |
| Map coordinates from the U.S. Census Bureau Geocoder in our address-lookup cache (not Google content) | Not subject to Google's 30-day limit: a team's entries are kept until the team is deleted, and your personal entries until you delete your account |
| Local trip statistics | Kept only on this phone until app data is erased, you delete your account or a different account signs in. The last coordinate is cleared when recording stops, the delivery session ends or you sign out; distance and coverage totals remain for your report |
| Route start position | Not stored on our servers (used only to compute the route); kept on your phone as your default start point until you change it or delete your account |
| Recipient names and phone numbers | On your device only, until you delete the account, sign in with a different account on the same phone, or uninstall the app |
| Sync and audit diagnostics (technical records our servers use to keep your devices in step and to resolve sync conflicts). Markers that are part of your team's records, such as whether a load was confirmed as a whole bag or a day-end step was skipped, are kept with those records instead | Up to 180 days; a sync conflict, up to 90 days after it is resolved (an unresolved sync conflict is kept until it is resolved) |
| Crash reports | Up to 90 days |
| Server logs and backups | Up to 30 days, on a rolling basis |
| Usage counters (for service cost limits) | Deleted when you delete your account |
If a different account signs in on the same phone, the previous account's data on that phone is erased.
6. Deleting your account
In the app, go to Me → Delete account — this works even if you are on a delivery team. Or request deletion without the app at unistops.vercel.app/delete-account. Deleting your account permanently removes your sign-in account and your personal-mode data on our servers: parcels, routes, delivery records, sync logs, address-lookup cache and your saved delivery spots (the locations saved from your own personal-mode deliveries and pin corrections); proof-of-delivery photos exist only on your phone and are erased with the app's data. If you have worked on a delivery team, your name as a member of that team becomes "Former member," names in the team's imported lists that were matched to you are cleared, and any free text you typed there (such as a dispute note) and your delivery coordinates are removed — but the team's own record of the work (counts, times, loading records and delivery results) stays with that team until the team is deleted or your captain asks us to delete it (Section 5), because it is the team's record of what happened, not only yours. One exception: a parcel note you chose to share with your team stays with that team after you delete your account, shown as written by "Former member," until a captain deletes it or the team is deleted; notes you kept private are deleted with your account. If you are a captain who still owns a team, delete the team first — in the app, Captain → Me → Delete this team, when that option is available in your version of the app, or by emailing ops@unistops.com — which permanently deletes that team's records for everyone who worked in it; you can then delete your own account. If you delete in the iPhone app after signing in with Apple, we also revoke UniStops' access to your Apple ID; otherwise you can remove it in your Apple ID settings (Sign-In & Security → Sign in with Apple). In-app deletion takes effect immediately; email requests are completed within 30 days. Copies in backups and logs expire within 30 days after deletion. For email requests we keep our email exchange confirming the deletion, and anything else the law requires us to keep. Data on your phone is erased when you delete the account in the app, or when you uninstall it.
7. Your rights and choices
- Access, correction, deletion, portability: you can correct most data directly in the app. To get a copy of your data or make any other request, email ops@unistops.com. We will verify your request by confirming it from the email address on your account, and respond within 30 days. If your request concerns records created inside a team, we may need to route it to that team's captain, who controls those records — we will help and act as the processor.
- California residents have the right to know what personal information we collect, use and disclose; to access, correct and delete it; to opt out of sale or sharing (we do not sell or share); to limit use of sensitive personal information (we use it only for the permitted purposes described above); and not to be discriminated against for exercising these rights. You may use an authorized agent; we may ask the agent for proof of authorization and ask you to verify your identity.
- Do Not Track: UniStops does not track you across third-party sites or apps, so it does not respond differently to Do Not Track signals.
- Location, camera and photos permissions can be turned off in your phone's settings.
8. Security
Data is encrypted in transit (HTTPS). Access controls keep one account's data from being read by other users, except what a team captain can see as described in section 4. Access by our staff is limited to operating and supporting the service. No system is perfectly secure; if a breach affects your personal information, we will notify you as required by law.
9. Children
UniStops is a work tool for drivers 18 and older. It is not directed to children under 13, and we do not knowingly collect their data. If you believe a child has given us data, contact us and we will delete it.
10. Changes to this policy
We will post changes on this page and update the date above. For material changes, we will notify you in the app before they take effect.
11. Contact
Timevult, LLC · Los Angeles, California · ops@unistops.com
隐私政策
UniStops 是面向独立快递司机的路线规划与配送辅助 App，由 Timevult, LLC（"我们"）开发。本政策说明我们收集什么、为什么收集、与谁共享、保存多久以及你的选择，适用于 iOS、Android App 及本网站。中英文版本如有出入，以英文版为准。
1. 我们收集什么、为什么
- 账号标识：邮箱（可能是 Apple 隐藏邮箱）、账号 ID；使用 Google 登录时还包括姓名和头像链接。来源：Apple / Google 登录，或用邮箱验证码登录（我们把一次性验证码发到你的邮箱）。用途：登录、将数据归属到你的账号、就账号事宜联系你。
- 车队联系电话：你加入队长车队时在加入页填写的手机号，或由该车队队长代你填写。来源：你或队长。用途：方便队长就车队工作联系你，例如用短信把当天的派工单发给你。只有该车队的队长能看到。在车队期间可在"我的 → 车队"修改；删除账号时一并删除。
- 无 App 司机（仅队长）：队长为不使用 UniStops 的司机录入的姓名和手机号。来源：队长。用途：给该司机分配工作、发送派工单。随该车队记录保存，直至车队被删除或队长移除该司机。
- 包裹与路线数据：单号、平台、配送地址（及导入时的地址原文）、地图坐标与标点修正、工作日期、装车号与车厢分区、你导入的平台参考字段（任务 ID、箱/袋号、司机标注、签收状态、原始序号）、站序。来源：你导入的文件、粘贴文本或截图，以及你的编辑。用途：生成、优化、同步路线，日终报告。
- 配送记录：送达、未送达、退回等状态变化及原因、站点 ID、时间。用途：多设备同步、日终报告、投递凭证。
- 可选的本机行程记录：你为配送主动开启记录并授予定位权限后，仅在 App 显示在屏幕上时，手机记录累计里程、起止时间、记录完整性和最近一个有效定位点，不保存完整轨迹，不上传给服务器或队长。你可以停止记录并继续配送。
- 位置（精确位置）：你选择"从当前位置出发"时的当前位置。个人模式下，只要你已授权定位权限，标记送达、未送达或退回时会自动附上该条配送记录的精确位置（含手机报告的精度）。个人模式下，你自己的送达记录上的位置（定位开启时）和你手动校正的定位点也会保存到你的账号中，以便下次无需重新查询就能定位同一地址；它们绝不会显示给任何车队或队长，并随你的账号一并删除。车队模式下，配送记录的位置对该车队默认开启，只在你记录送达或投递失败的那一下记一个点，绝不生成轨迹；你可以随时为该车队关闭，且不影响你在其他车队的设置。起点位置仅发送到我们的服务器用于计算路线，服务器不保存；在你的手机上保存为默认起点。用途：设置路线起点；投递凭证；个人模式下，在之后的路线中定位你送过或自己校正过的地址（只保存到你的账号）。
- 包裹备注：你为某个配送地址写的简短备注（例如停车位置、大门或门禁码、可投递时间），以及它所属的地址、备注类型和写入、编辑、确认"仍然有效"或报告失效的时间。来源：你在 App 内输入。用途：帮你——以及在你选择分享时帮你的车队——下次投递这个地址。备注写下时默认私人：只有你自己能看到，队长也看不到。备注保存在我们的服务器上，以便在你的多台设备间同步；绝不会进入通知、报告、导出或日志。请勿在备注中写收件人的姓名、电话或邮箱；App 会拒绝看起来像电话号码、邮箱地址或网址的内容。
- 退件交回记录（车队队长）：队长记录退件已交回时填写的内容——交给了哪里、接收人的姓名或工号、时间、件数、对方清点的件数、回执号，均由队长手动输入；不收集照片或签名。来源：队长在 App 内输入。用途：让车队留下"退件已交回"的记录；该车队的队长可以在退件列表、日结、投递凭证和导出文件中看到。如果你从使用 UniStops 的车队接收包裹，队长可能在这里填写你的姓名或工号。
- 投递照片：你在 App 内拍摄的照片（可能拍到门口、包裹或门牌），含相机自带的时间、GPS 等元数据，用作投递凭证。只保存在你的手机上，不会上传，保存到你删除为止（第 5 节）；你可以随时删除，或存一份到手机相册。
- 标签照片（识别地址）：你在校对页选择拍摄的包裹标签照片，仅在手机上识别文字供你挑选街道地址；照片不保存、不上传、不进相册。
- 收件人姓名和电话（若导入内容中有）：脱敏显示；仅在你点"打电话/发短信"时交给手机的拨号或短信 App。只存在你的设备上，从不上传。
- 设备与技术数据：IP 地址、设备型号、系统和 App 版本、崩溃堆栈、请求日志，用于安全、排错、防滥用和服务成本控制。
截图文字识别（OCR）在你的设备上完成。我们不收集通讯录、浏览记录或广告 ID。UniStops 不在后台使用位置：可选的本机行程记录在切到其他 App 或锁屏期间暂停；定位样本和路线轨迹不会上传。
2. 你导入的收件人信息
包裹清单可能包含收件人的个人信息（如配送地址）。我们仅代表你、按你的指示处理这些信息，用于向你提供 UniStops，角色是你的服务提供者。我们不将其用于自身目的，不出售，不为广告共享，也不与其他数据合并。你应只导入有权使用的数据，并只用于投递包裹。你导入的收件人信息随其所属包裹保存：你自己的（个人模式）包裹，保存到你删除账号为止；车队记录中的包裹，保存到车队被删除为止，或该车队队长要求我们提前删除时为止。收件人姓名和电话从不离开你的手机，来自 Google 的地图坐标会更早删除（第 5 节）。收件人对其信息有疑问的，请联系寄件方或快递平台，我们会尽力协助司机、队长和平台处理。
3. 敏感个人信息
按加州法律，精确位置属于"敏感个人信息"。我们只把它用于你主动使用的功能（路线起点、投递凭证和可选的本机行程里程），不会据此推断你的个人特征。你可以随时在手机设置中关闭定位，手动输入起点仍可规划路线。
4. 与谁共享
我们只与协助运营 UniStops 的服务提供商共享个人信息，它们须保护数据，并且只能为向我们提供服务而使用：Supabase（登录、数据库，美国）、Railway（应用服务器与路线优化，美国）、Google Maps Platform（地址转坐标、Android 上显示地图，适用 Google 隐私政策）、美国人口普查局地理编码服务（U.S. Census Bureau Geocoder，美国政府的免费服务，我们可能先用它、再用 Google Maps Platform 把配送地址转换成地图坐标；只发送楼栋地址——街道、城市、州和邮编，街道行里写的单元标记（如"Apt"、"Unit"、"#"）会先去掉——从不发送姓名、电话和单号；它无法精确定位的地址改由 Google Maps Platform 查询）、Apple（登录、iPhone 上的地图）、Google（登录）、Brevo（发送登录验证码邮件；只向它发送你的邮箱地址和验证码）、Sentry（崩溃报告，已配置为不在错误信息中包含地址、单号、姓名和电话）。
如果你在 App 内加入队长的车队，该车队的队长是车队所收集的、关于你工作数据的控制者（controller）——由队长决定收集的目的，这些数据保存到车队被删除为止，或队长要求我们提前删除时为止（第 5 节）；UniStops 是处理者（processor），按队长的指示处理这些数据以提供服务（另见第 7 节）。队长能看到：你在车队里用的名字和车队联系电话；队长派给你的包裹，每件的送达或失败结果，以及你记录该结果的时间；你在仓库的装车记录。这一部分不是开关——队长派给你的件，其配送结果对该队长始终可见，你无法关闭。队长还能看到你在车队派工之外自己添加的包裹，以及配送记录上的位置；这两项都默认开启，且都是你可以随时自行关闭的选项。位置开关开启时，配送记录上的位置还可能在不带你名字的情况下，用来为你的车队记住该地址的位置，以后再送这个地址时无需重新查询就能排线；这个记住的位置会一直保存，直至车队被删除。
如果你把包裹备注分享给车队，该车队的所有人——队长和其他司机——都能看到（门禁码在屏幕上点开才显示）。队长还能看到每条分享备注的作者、编辑者、确认人和报失效的人；其他司机看不到姓名。队长可以编辑分享的备注，或把它从车队撤下，撤下后退回为你的私人备注（如果你已离开车队，则直接删除）。你保留为私人的备注，队长和车队里的其他任何人都看不到。删除账号时已分享备注如何处理，见第 6 节。
你点"导航"时，该站地址会交给你选择的地图或导航 App（Google 地图或 Waze），由其按自身政策处理。法律要求时、为保护权利与安全，或在公司合并或出售时（会通知你），我们也可能披露信息。我们不与快递平台共享你的数据。过去 12 个月内我们没有出售或为跨情境行为广告"共享"个人信息，今后也不会。
5. 保存期限
| 数据 | 保存期限 |
|---|---|
| 账号标识 | 直至你删除账号 |
| 个人模式的包裹、路线、配送记录（含位置）——即你在车队之外自己产生的记录 | 保存到你删除账号为止——换新手机时恢复数据需要它们。其中来自 Google 的地图坐标会更早删除（见下方"来自 Google 的地图坐标"） |
| 车队内产生的记录——包裹、地址、位置、装车与配送记录、派工单 | 保存到车队被删除为止，或队长要求我们提前删除时为止。你删除账号时，你作为车队成员的名字会变为"已离队成员"，车队导入清单中已匹配到你的姓名会被清除，你在其中填写的文字和你的配送位置会被删除（第 6 节）。其中来自 Google 的地图坐标会更早删除（见下方"来自 Google 的地图坐标"） |
| 你在车队里用的名字，以及车队"记住"哪个导入姓名对应你的映射（方便以后导入时自动识别你） | 你离队、被移出车队或删除账号时，这份映射会立即删除；车队被删除时也会一并删除。导入包裹或清单行里自带的司机姓名是另一条独立记录，随车队记录保存（见上一行）；其中已匹配到你的姓名会在你删除账号时清除 |
| 车队的日终统计数字（仅计数，不含地址或单号） | 车队存续期间保留；车队被删除时一并删除 |
| 车队的收入记录（仅在车队使用收入统计时）——每日汇总、收入调整和单价卡（每位司机每天的计数和金额——不含地址或单号） | 保存到车队被删除为止；队长也可以提前修改或删除某条调整或某张单价卡。你删除账号后，这些记录以"已离队成员"的名义留在车队，队长对你的收入调整所写的备注会被删除 |
| 车队记住的送达位置（不带你名字的位置——见第 4 节） | 保存到车队被删除为止（队长也可以提前清除某个位置） |
| 包裹备注 | 个人模式的备注：直至你删除它或删除账号。车队备注：直至被删除，或车队被删除时为止。你离开车队或被移出车队时，你在该车队的私人备注会被删除，已分享的备注留在车队。备注删除时文字当即清除；仅保留一条不含文字和地址的删除记录 30 天，以便你的其他设备同步删除。 |
| 退件交回记录 | 保存到车队被删除为止；队长可以撤销某条记录。撤销一条记录时，其中的接收人姓名或工号以及回执号会被清除；记录这条交回的队长删除账号时，这两项同样会被清除。两种情况下，时间、件数和交到哪类地方都仍留在车队 |
| 投递照片 | 仅在你的手机上，保存到你删除照片、删除账号、在同一手机换其他账号登录或卸载 App 为止。部分 App 版本仍会在 30 天后自动删除照片（标记"保留证据"的站除外）。你存到相册或分享出去的副本由你自己保管，不由我们管理 |
| 来自 Google 的地图坐标和地点详情（Google 地图平台为某个地址或地点返回的地图点位和地点信息），包括我们地址查询缓存中来自 Google 的条目 | 总共最长 30 天；其中我们服务器上的地址查询缓存最长保存坐标 15 天，车队仓库的 Google 地址等地点详情最长保存 29 天。到期后删除，下次需要时再重新查询。Google 地点 ID（指向某个地点的标识，不是它的坐标）可能随你保存的地点一起保留 |
| 我们地址查询缓存中来自美国人口普查局地理编码服务的地图坐标（不属于 Google 内容） | 不受 Google 30 天期限约束：车队的条目保存到车队被删除为止，你个人的条目保存到你删除账号为止 |
| 本机行程统计 | 仅存于本机，直至清除 App 数据、删除账号或在本机切换其他账号。停止记录、结束配送或退出登录时清除最后一个定位点，保留累计里程和记录完整性供报告使用 |
| 路线起点位置 | 服务器不保存（仅用于计算路线）；在你的手机上保存为默认起点，直至你更改或删除账号 |
| 收件人姓名和电话 | 仅存于设备，直至你删除账号、同一手机换账号登录或卸载 App |
| 同步与审计诊断记录（我们服务器用来保持你各台设备数据一致、处理同步冲突的技术记录）。属于车队记录的标记，例如某次装车是否按整袋确认、日终某一步是否跳过，随这些车队记录一起保存 | 最长 180 天；同步冲突在解决后最长保存 90 天（未解决的同步冲突保存到解决为止） |
| 崩溃报告 | 最长 90 天 |
| 服务器日志与备份 | 最长 30 天，滚动覆盖 |
| 用量计数（服务成本控制） | 删除账号时一并删除 |
同一台手机换其他账号登录时，上一账号在该手机上的数据会被清除。
6. 删除账号
在 App 内进入"我的 → 删除账号"——即使你在车队里，也可以这样删除。或不通过 App 在 unistops.vercel.app/delete-account 提交删除请求。删除账号会永久移除你的登录账号及你在个人模式下的服务器数据：包裹、路线、配送记录、同步日志、地址查询缓存，以及你保存的送达位置（由你个人模式下的送达和手动校正的定位点保存而来）；投递照片只存在你的手机上，随 App 数据一并清除。如果你曾在车队工作，你作为该车队成员的名字会变为"已离队成员"，车队导入清单中已匹配到你的姓名会被清除，你在其中填写的文字（例如异议备注）和你的配送位置会被删除——但该车队关于这项工作的记录（计数、时间、装车记录和配送结果）会留在车队，直至车队被删除或队长要求我们删除（第 5 节），因为这是车队关于当时发生了什么的记录，而不只是你一个人的。例外：你选择分享给车队的包裹备注，在你删除账号后仍留在该车队，作者显示为"已离队成员"，直至队长删除它或车队被删除；你未分享的私人备注随账号一并删除。如果你是仍拥有车队的队长，请先删除车队——在 App 内，队长 → 我的 → 删除本车队（如果你这个版本的 App 已有此功能），或发邮件至 ops@unistops.com——这会永久删除该车队所有成员的记录；之后你就可以删除自己的账号。若你用 Apple 登录并在 iPhone App 内删除，我们还会撤销 UniStops 对你 Apple ID 的授权；其他情况下你可以在 Apple ID 设置中自行移除（登录与安全 → 通过 Apple 登录）。App 内删除即时生效；邮件申请在 30 天内完成。备份和日志中的副本在删除后 30 天内过期。邮件申请的，我们保留确认删除的往来邮件，以及法律要求保留的其他内容。在 App 内删除账号或卸载 App 时，手机上的数据会一并清除。
7. 你的权利与选择
- 访问、更正、删除、数据可携：大部分数据可以直接在 App 内更正。如需获取数据副本或提出其他请求，请发邮件至 ops@unistops.com。我们会通过你账号邮箱的确认来核验身份，并在 30 天内答复。如果你的请求涉及车队内产生的记录，我们可能需要转交给控制这些记录的队长处理；我们会协助并以处理者身份配合。
- 加州居民有权了解我们收集、使用和披露哪些个人信息；有权访问、更正、删除；有权选择退出出售或共享（我们不出售也不共享）；有权限制敏感个人信息的使用（我们只按上文所述的允许用途使用）；并且不因行使这些权利而受到歧视。你可以委托授权代理人提出请求，我们可能要求代理人提供授权证明，并请你本人核验身份。
- "请勿追踪"（Do Not Track）：UniStops 不跨第三方网站或 App 追踪你，因此不会因 DNT 信号而改变处理方式。
- 定位、相机、相册权限可随时在手机设置中关闭。
8. 安全
数据传输全程加密（HTTPS）。访问控制确保其他用户无法读取你账号的数据，队长按第 4 节所述能看到的车队数据除外。我们的员工仅为运营和支持服务而访问数据。没有系统绝对安全；如发生影响你个人信息的数据泄露，我们会依法通知你。
9. 儿童
UniStops 是供 18 岁及以上司机使用的工作工具，不面向 13 岁以下儿童，我们也不会故意收集儿童数据。如你认为有儿童向我们提供了数据，请联系我们，我们会删除。
10. 政策变更
我们会在本页发布变更并更新上方日期。重大变更会在生效前通过 App 通知你。
11. 联系我们
Timevult, LLC · 加利福尼亚州洛杉矶 · ops@unistops.com