搜尋附近房間：你的裝置會在區域網路發出一個不含任何個人資料的搜尋訊號；開房中的裝置只回覆「已入座人數／座位數／等待或對局中／連線版本」，不含暱稱或其他個人資料。回覆時，雙方裝置會知道彼此在區域網路內的 IP 位址。

加入房間時傳給房主裝置：暱稱、房間碼、重連憑證、連線版本、是否以觀戰身分加入，你存檔中已解鎖的角色、招式、等級與熟練摘要，以及這台裝置是試玩版還是完整版（房主用來判斷你在房間裡能使用什麼；試玩版的摘要只含前三章的內容）。完整版另會出示一次性的正版證明：公開憑證（憑證編號、平台、發行日、發行方簽章與這份序號的公鑰，不含個人資料）加上用你的序號在本機對這次連線產生的簽章；序號與專屬私鑰不外傳；公鑰會隨公開憑證送出，這份證明只對這一次連線有效，別人收到也不能拿去冒用。你加入房間時，要先驗過房主的證明才會出示你的；房主裝置離線驗證後即丟棄，只在記憶體留下憑證編號以避免同一序號同桌重複使用。你開房時，同樣只出示一次性證明。試玩版不送也不收任何憑證或證明；完整版玩家加入試玩版房主的房間時也不出示。牌局畫面、診斷紀錄與連線紀錄匯出都不包含序號或證明。

對局中：你的選角、招式配置、準備、出牌、出招與離開等操作；房主裝置依規則把每個人該看到的牌局畫面送回各裝置（每台只收到自己的手牌與公開資訊）。同房的玩家與觀戰者會看到你的暱稱。

網路位址：連線在技術上必然讓房主裝置知道你裝置的區域網路 IP 位址。房主可以用 QR code 或複製文字分享「房主位址＋房間碼」邀請朋友，這段邀請由房主自行決定傳給誰。

加密：區域網路對局的傳輸沒有另外加密。同一網路上有能力監看流量的人，理論上可能看到暱稱與牌局內容。請只在你信任的網路上使用，暱稱不要使用真實姓名或其他敏感資訊。

這些資料只在該房間的裝置之間傳遞，房間結束後不保留（各裝置本機的診斷紀錄除外，見第 4 節）。我們不會收到這些資料。

我們目前沒有營運任何線上房間服務，遊戲也沒有預設的服務位址。你沒有自己輸入位址，就不會發生任何線上連線。

你輸入的位址屬於你自己或你的朋友架設、或其他第三方提供的服務，由該服務的架設者或營運者負責，不是我們。使用前請確認你信任對方。

輸入位址後，遊戲會向該服務讀取房間列表；若你按「在伺服器建立房間」，會送出房間名稱，房間名稱由你的暱稱加上「的牌桌」組成。房間列表對所有能連到該服務的人公開。

入座後，第 2 節所列資料（暱稱、房間碼、重連憑證、角色與招式配置、進度摘要、一次性正版證明、對局操作）會送到該服務主機上的遊戲伺服器，而不只在玩家裝置之間傳遞。

連線時，該服務必然會得知你的 IP 位址，以及網路請求的一般標頭（例如遊戲引擎名稱、版本與作業系統類別）。該服務會保存或記錄哪些資料、保存多久，依其架設者或營運者的做法而定，我們無法控制。

若位址以 http:// 開頭，傳輸沒有加密；對局連線本身也沒有另外加密。

基本紀錄（預設）：關卡與牌局的編號與結果（章節、關卡、名次、星數、回合數、牌局種子等數字）、存檔切換與修復事件；完整版另有多人連線的狀態事件（隨機產生的房間紀錄代號、對局編號、角色為房主或玩家、座位、階段、斷線原因、持續時間、按鈕類別、角色台詞代號）。紀錄檔另附遊戲版本、引擎版本、作業系統名稱與版本、裝置型號、語言與畫面大小。基本紀錄不寫入暱稱、房間碼、IP 位址、重連憑證或你在輸入框打的文字：按鈕文字含數字或符號（例如位址、房間碼）時，只記「位址或代碼」這個類別；房主移除座位時只記座位編號。

詳細紀錄（預設關閉，只在你於「問題診斷」頁手動開啟時記錄）：另外記錄每一手的手牌、出牌、出招與角色台詞等完整牌局事件。詳細紀錄只在當次遊戲有效，重新啟動遊戲或你把它關閉時，已記下的詳細內容會被縮減回基本紀錄。

上限：一般事件 200 筆、關卡結果 1,000 筆，較舊的自動淘汰。

不會自動傳送。 遊戲沒有任何上傳診斷資料的功能。只有你在遊戲內按「匯出診斷報告」（或多人連線畫面的「匯出紀錄」）並自己選擇存放位置，才會產生一份加密的 .dmhreport 檔；之後要不要寄給我們、怎麼寄，由你決定。

你可以隨時在「問題診斷」頁清除診斷紀錄。

本遊戲沒有任何遊戲內購買、解鎖或恢復購買功能，遊戲不會為了購買或驗證而連線，也不會傳送任何購買資料。完整版的正版序號只存在你的裝置上；連線時只出示用它產生的一次性證明，由同桌玩家的裝置（使用線上房間時另包括該服務的遊戲伺服器）離線驗證；序號與專屬私鑰不會傳給同桌，也不會傳給我們，證明只含公開憑證（包括其中的公鑰）與一次性簽章。完整版是另一個安裝包，請在商店（目前預計 itch.io，之後可能包含 Steam、Google Play）付費購買下載。

試玩版的「前往商店購買完整版」按鈕只會用你裝置上的瀏覽器開啟我們的商店頁面，遊戲本身不傳送任何資料。之後在商店頁面上的瀏覽、登入與付款，由該商店及其金流服務處理，適用其隱私權政策（例如 itch.io：https://itch.io/docs/legal/privacy-policy ）。

商店可能依其政策與你的設定提供我們訂單資料，例如訂單編號、購買日期、品項、金額、國家或地區，以及視商店而定的買家名稱或電子郵件。我們只將這些資料用於對帳、會計與稅務、退款與客服，不用於行銷，並依第 7 節保存。我們不會收到你的付款卡號或商店帳號密碼。

你寄到客服信箱的郵件（包括你自行附上的診斷報告、截圖、訂單編號），我們只用於回覆你的問題、處理退款、排除錯誤與改善遊戲平衡。

請不要在信中提供密碼、完整付款卡號或商店收據中的下載連結與金鑰。

客服信箱使用 Google 提供的 Gmail 服務，來信會存放在 Google 的伺服器上，可能位於中華民國境外，並受 Google 的資料保護措施約束。

客服來信（包括附件與診斷報告）在該事項處理完畢後，最長保存三年，期滿刪除；你也可以來信要求提前刪除。法令另有規定者（例如會計、稅務憑證的保存義務），從其規定。

商店提供的訂單資料，依會計與稅務法令規定的期間保存，期滿刪除。

存在你裝置上的資料，由你自己決定保存或刪除（見第 1 節）。

不放廣告，不使用廣告識別碼。

不使用第三方分析、追蹤、行為統計或當機自動回報工具。

不建立帳號、不要求登入；遊戲不收集你的姓名、電子郵件、電話、精確或大概位置、聯絡人、相片、相機或麥克風資料，也不讀取裝置的唯一識別碼。

不販售、出租或交換個人資料。

Android 權限：安裝包宣告「網路存取」（用於區域網路連線；完整版另用於你自行輸入的線上房間）與「Wi‑Fi 多播」（讓手機收得到區域網路找房的廣播訊號，不傳送資料到網際網路）兩項一般權限；試玩版只在你使用區域網路多人連線時用到這兩項權限。本遊戲不要求定位、相機、麥克風、聯絡人或儲存空間等權限。掃描邀請 QR code 時，使用的是你手機自己的相機 App，遊戲本身不開啟相機。

Finding nearby rooms: your device sends a search message on the local network that contains no personal data; a hosting device replies only with "players seated / seats / waiting or in play / connection version" — no nickname or other personal data. In doing so the two devices learn each other's local-network IP address.

Sent to the host device when you join: your nickname, the room code, a rejoin token, the connection version, whether you join as a spectator, a summary of the characters, techniques, level and mastery unlocked in your save, and whether this device runs the trial or the full version (the host uses it to check what you may use in the room; a trial summary covers chapters 1–3 only). The full version also presents a one-time licence proof: a public certificate (certificate ID, platform, issue date, the publisher's signature and this key's public key, no personal data) plus a signature your device makes from your key for this one connection. The key and its private key are never sent; the public key is sent as part of the public certificate; the proof is valid for this connection only, so whoever receives it cannot reuse it. When you join, your device checks the host's proof before presenting its own; the host device verifies yours offline and then discards it, keeping only the certificate ID in memory to stop the same key being used twice at one table. When you host, your device likewise presents only a one-time proof. The trial never sends or receives any certificate or proof, and a full-version player joining a trial host does not present one. Table views, diagnostic logs and exported connection logs never contain keys or proofs.

During play: your character choice, technique setup, ready, plays, techniques and leaving. The host device applies the rules and sends each device only the view it is allowed to see (each device receives only its own hand plus public information). Other players and spectators in the room see your nickname.

Network address: connecting necessarily reveals your device's local-network IP address to the host device. The host may share an invitation ("host address + room code") as a QR code or copied text; the host decides whom to send it to.

Encryption: local-network game traffic is not additionally encrypted. Someone able to monitor traffic on the same network could in principle read nicknames and table contents. Play only on networks you trust, and do not use your real name or other sensitive information as a nickname.

This data travels only between the devices in that room and is not kept after the room ends (except each device's own local diagnostic log, section 4). We do not receive it.

We do not currently operate any online room service, and the game has no default service address. Unless you type an address yourself, no online connection happens.

The address you enter belongs to a service set up by you, your friends or another third party. That service is run, and its data handled, by whoever operates it — not by us. Make sure you trust it before use.

With an address entered, the game asks that service for its room list; if you press "Create online room", it sends a room name made of your nickname followed by "'s table". The room list is public to anyone who can reach that service.

Once you take a seat, the data listed in section 2 (nickname, room code, rejoin token, character and technique setup, progression summary, one-time licence proof, actions) goes to the game server on that service's host, not only between players' devices.

Connecting necessarily gives that service your IP address and the ordinary headers of a network request (such as the game engine's name, version and operating-system type). What that service stores or logs, and for how long, depends on its operator and is outside our control.

If the address starts with http://, the connection is not encrypted; the game connection itself is not additionally encrypted either.

Basic log (default): numbers and outcomes of stages and hands (chapter, stage, placement, stars, turn counts, deal seed, etc.) and save switch/repair events; in the full version, also multiplayer status events (a randomly generated room-log ID, match ID, host or guest role, seat, phase, disconnect reasons, durations, button categories, character-line IDs). The log file also includes the game build, engine version, operating system name and version, device model, language and screen size. The basic log does not record nicknames, room codes, IP addresses, rejoin tokens or text you type into fields: when a button's text contains digits or symbols (such as an address or room code), only the category "address or code" is logged; when a host removes a seat, only the seat number is logged.

Detailed recording (off by default; recorded only if you switch it on in the Diagnostics page): additionally records full hand events such as the cards in hand, cards played, techniques and character lines. It lasts for the current session only: when you restart the game or switch it off, what was recorded is trimmed back to the basic log.

Limits: 200 general events and 1,000 stage results; older entries are discarded automatically.

Nothing is sent automatically. The game has no function that uploads diagnostic data. An encrypted .dmhreport file is created only when you press "Export diagnostic report" (or "Export log" on the Multiplayer screen) and choose where to save it. Whether you send it to us, and how, is up to you.

You can clear the log at any time in the Diagnostics page.

The game has no in-game purchase, unlock or restore-purchase function; it never connects for purchasing or verification and sends no purchase data. The full version's licence key stays on your device; when you connect, only a one-time proof made from it is checked offline by the devices at your table (and, in an online room, by that service's game server). The key and its private key are never sent to them or to us; the proof carries only the public certificate (including its public key) and a one-time signature. The full version is a separate installer that you buy and download from a store (currently planned: itch.io; later possibly Steam and Google Play).

The trial's "Get the full game" button only opens our store page in your device's web browser; the game itself sends nothing. Browsing, signing in and paying on the store page are handled by that store and its payment providers under their own privacy policies (for itch.io: https://itch.io/docs/legal/privacy-policy ).

A store may, under its policies and your settings, give us order data such as the order number, purchase date, item, amount, country or region and, depending on the store, the buyer's name or email address. We use it only for reconciliation, accounting and tax, refunds and support — never for marketing — and keep it as described in section 7. We never receive your card number or store password.

Emails you send to our support address (including diagnostic reports, screenshots or order numbers you attach) are used only to answer you, handle refunds, fix bugs and improve game balance.

Please do not send passwords, full card numbers, or the download link or key from a store receipt.

Our support mailbox uses Google's Gmail service, so emails are stored on Google's servers, which may be outside Taiwan, under Google's data-protection measures.

Support emails (including attachments and diagnostic reports) are kept for at most three years after the matter is closed and then deleted; you may ask us to delete them sooner. Where the law requires otherwise (for example, accounting and tax record-keeping), the law prevails.

Order data from stores is kept for the period required by accounting and tax law and then deleted.

Data stored on your device is kept or deleted as you choose (section 1).

No advertising and no advertising identifiers.

No third-party analytics, tracking, behavioural statistics or automatic crash reporting.

No accounts or sign-in. The game does not collect your name, email, phone number, precise or approximate location, contacts, photos, camera or microphone data, and does not read device unique identifiers.

We do not sell, rent or trade personal data.

Android permissions: the installers declare two ordinary permissions, "Internet access" (used for local-network play, and by the full version also for online rooms whose address you enter) and "Wi-Fi multicast" (so the phone can receive local-network room-search broadcasts; it sends nothing to the internet). The trial uses them only when you play local-network multiplayer. The game requests no location, camera, microphone, contacts or storage permission. Scanning an invitation QR code uses your phone's own camera app; the game never opens the camera.