隱私說明 Privacy Notice

同意版本 —；本頁內容最後更新 2026-10-26（同意版本升為 2026-10-26：已登入的人下次開站會請你重新同意；雲端存檔的同意也一併升版，因為議題的工地照片會隨設計存進雲端）。本 Demo 不登入也能使用全部功能；只有 AI 功能（「AI 解讀」量體描述、AI 畫布、AI 助手）需要 Google 登入或邀請碼。以下依個人資料保護法第 8 條告知。

Consent version shown above; this page was last updated on 2026-10-26 (the consent version is now 2026-10-26: if you are signed in, you will be asked to agree again on your next visit; the cloud storage consent is also updated because site photos on issues are stored in the cloud with the design). You can use every feature without signing in. Only the AI features ("AI interpretation" of massing descriptions, the AI canvas and the AI assistant) require Google sign-in or an invite code.

本次變更（2026-10-26） What changed (2026-10-26)

• 分享連結分成三種（可編輯、僅供檢視、可備註），各自可以開關、設定到期日或重新產生（見「設計分享」）。
  Share links come in three kinds (can edit, view only, can comment); each can be turned on or off, given an expiry date or regenerated (see "Design sharing").
• 議題可以附工地照片：先去除拍攝位置等中繼資料並縮小，之後隨設計存在分享與雲端存檔裡（見「設計分享」）。
  Issues can carry site photos: location and other metadata are removed and the photo is downsized, then it is stored with the design in shares and cloud storage (see "Design sharing").
• 分享者允許時，別人可以「複製為我的範本」：副本會先清掉個人與關聯資料（見「設計分享」）。
  If the sharer allows it, others can "Copy as my template": the copy first removes personal and linked data (see "Design sharing").
• 使用統計（只計數）開啟：只送動作類型與次數，不含設計、帳號或 IP；開啟「不追蹤」就不送（見「使用統計」）。
  Usage statistics (counts only) are turned on: only the action type and count are sent, with no design, account or IP; turn on Do Not Track to opt out (see "Usage statistics").
• 離線模式（PWA）只快取本站程式檔、首頁、字型與品牌圖示，不快取設計內容或帳號資料（見「離線模式」）。
  Offline mode (PWA) caches only this site's program files, home page, fonts and brand images, not design content or account data (see "Offline mode").
• 程式碼節點的「AI 技能」只送你輸入的技能描述，不送設計或節點圖（見「AI 功能」）。
  The code node's "AI skill" sends only the skill description you type, not your design or node graph (see "AI features").
• 同意版本升為 2026-10-26：已登入的人下次開站會看到重新同意（可選擇不同意並登出）；雲端存檔要再同意一次才繼續同步。
  The consent version is now 2026-10-26: signed-in users are asked to agree again on their next visit (or decline and sign out); cloud storage needs to be agreed to again before syncing continues.

四句重點 In four sentences

• 運算在瀏覽器：幾何、法規與環境分析都在你的瀏覽器裡計算，本站伺服器不計算你的幾何。
  Computing happens in your browser: geometry, code checks and environmental analysis run in your browser; our server does not compute your geometry.
• 未登入只存本機：設計只存在這台電腦的這個瀏覽器。
  Signed out, designs stay on this computer, in this browser only.
• 登入後同步雲端：登入並同意「雲端存檔」後，設計會在背景同步到你的帳號（見下方「雲端存檔」）。
  Signed in, once you agree to cloud storage, designs sync to your account in the background (see "Cloud storage" below).
• 只有分享、共編、AI 會傳出資料：除了上面的雲端同步，只有你建立分享連結、加入即時共編（已開放；共編時設計內容會送到本站的協作伺服器，依下方「即時協作」說明保存與清除）或使用 AI 時，才把那次需要的資料傳到本站伺服器或 AI 供應商。AI 目前使用 Google Gemini API 的未付費方案，Google 可能用送出的內容改進其產品（見「AI 功能」）。地圖底圖、周邊建物與地址查詢會向圖資服務取資料，不含設計內容（見「其他第三方服務」）。
  Only sharing, co-editing and AI send data out: apart from cloud sync above, data goes to our server or an AI provider only when you create a share link, join live co-editing (available now; while co-editing, design content goes to our collaboration server and is kept and cleared as described under "Live collaboration") or use AI, and only what that action needs. AI currently runs on Google's unpaid Gemini API tier, where Google may use submitted content to improve its products (see "AI features"). Map basemaps, surrounding buildings and address search fetch data from map services without any design content (see "Other services").

離線模式：瀏覽器的 service worker 只快取本站的程式檔（檔名含版本雜湊）、首頁、2D 文字用的字型與品牌圖示，讓你離線也能開啟工作區與這台電腦裡的設計；它不快取設計內容、帳號資料、分享頁或伺服器的回應。
Offline mode: the browser's service worker caches only this site's program files (file names carry a version hash) the home page, the fonts used for 2D text and the brand images, so the workspace and the designs on this computer open offline; it never caches design content, account data, share pages or server responses.

雲端存檔 Cloud storage

未登入時，設計只存在你的瀏覽器。登入後另外詢問是否開啟「雲端存檔」（另行同意，版本 2026-10-12；不同意仍可使用其他功能，設計只存在這台電腦）。同意後：

• 存放位置：設計內容存在 Cloudflare R2 物件儲存（亞太區 APAC 資料中心），設計名稱、專案、縮圖、版本與大小的索引存在 Cloudflare D1。物件鍵只用帳號識別碼的雜湊，不含 email 或姓名。
• 內容範圍：你的 3D 與 2D 設計（量體圖、基地圖形、場景、2D 圖面）、縮圖、設計與專案名稱、單位、建立與修改時間。未登入時在這台電腦建立的設計，登入並同意後也會上傳到你的帳號。底圖影像與匯入的網格只存在你的瀏覽器，不上傳。
• 保留期間：直到你刪除設計或帳號；帳號連續 365 天未使用會連同雲端設計自動刪除。
• 刪除與還原：刪除的設計在 30 天內可在帳號面板「最近刪除」還原，期滿由排程刪除內容；設計名稱與刪除紀錄再保留到第 90 天，讓你其他離線的裝置也會跟著刪除，之後一併清除。你也可以在「最近刪除」選擇永久刪除，立即刪除內容。
• 刪除帳號：會先刪除雲端上的全部設計（含最近刪除），成功後才刪除帳號；雲端刪除失敗時帳號保留並提示你重試。
• 在各台電腦上：登入後只下載設計清單與縮圖，開啟設計時才下載內容並暫存在該瀏覽器；登出時先上傳尚未同步的修改，再清除這台電腦上屬於這個帳號的所有暫存。若你在別台裝置登出（會撤銷所有裝置的登入）或登入已過期，這台電腦下次開啟時會清除沒有改過的暫存；尚未上傳的修改會鎖定、不顯示給其他人，直到你用原帳號登入上傳，或在首頁選擇捨棄。「與我共享」清單與分享的管理權限只存在原本的瀏覽器，不會跨裝置同步。
• 容量：免費方案每個帳號 1 GB（含最近刪除），最多 2,000 個設計、200 個專案。
• 「下載我的資料」會列出雲端設計的清單（含最近刪除的名稱）。

Before you sign in, designs stay in your browser. After signing in you are asked separately whether to turn on cloud storage. If you agree: design content is stored in Cloudflare R2 (Asia-Pacific data centres) and the index (names, projects, thumbnails, versions, sizes) in Cloudflare D1, keyed by a hash of your account ID. It covers your 3D and 2D designs, site outlines, scenes, thumbnails and names; designs you made on this computer before signing in are uploaded too. Kept until you delete them or your account (accounts unused for 365 days are deleted with their designs). Deleted designs can be restored for 30 days, then their content is deleted; names are kept until day 90 so your other devices delete them too. Deleting your account deletes all cloud designs first. Each computer downloads only the list until you open a design; signing out uploads pending changes and then clears this account's cached designs from the computer. If you sign out on another device (which signs out all devices) or the sign-in expires, the next launch on this computer clears unchanged cached designs; changes not yet uploaded are locked and hidden from others until you sign in with the same account again or discard them. Free plan: 1 GB, 2,000 designs, 200 projects.

版本歷史（測試中，目前未開啟） Version history (in testing, currently off)

這項功能目前在本站是關閉的，不會保存任何版本；開啟與否由本站設定決定，開啟後檔案選單與首頁設計卡片選單才會出現「版本歷史…」。以下說明開啟後的做法：

• 存什麼：雲端存檔要覆蓋設計內容時，把被覆蓋的那一份複製保存為一個版本（不是每次自動存檔都存：你自己編輯時大約每段編輯一版；經資料夾可編輯連結的存回、即時協作回寫與還原時一律保存）。版本存在同一個 Cloudflare R2（亞太區），附帶的資料只有版本號、大小、時間、內容雜湊與「來源類型」（你自己、連結、協作或還原）——不記錄是誰改的；鍵只用帳號識別碼的雜湊。
• 保留多久：最近 10 版一律保留；其餘 30 天內每天保留最新一版，超過 30 天刪除；每個設計最多 40 版、64 MB，單一版本超過 10 MB 不保存，每個帳號約 256 MB 上限。沒有再存檔的設計，過期的版本要等下次產生版本或排程清理時才刪。
• 誰看得到：只有設計擁有者（登入後）。分享連結、資料夾連結、即時協作的其他參與者與 AI 讀取權杖都讀不到版本。
• 刪除：永久刪除設計時一併刪除它的全部版本；刪除帳號時刪除帳號下的全部版本（功能關閉後才刪帳號也一樣）；設計已不存在的版本由每日排程清除。之後若關閉這項功能，已存的版本仍會照上述規則清除。

This feature is currently turned off on this site and no versions are stored. When enabled, overwriting a cloud design keeps the overwritten copy as a version (roughly one per editing session for your own edits; always for edit-link saves, live-collaboration write-backs and restores), in the same Cloudflare R2 bucket (Asia-Pacific), with only revision, size, time, content hash and source type (you, link, collaboration or restore) — not who made the change; keys use a hash of your account ID. Retention: the latest 10 versions, plus the newest version of each day for 30 days; at most 40 versions / 64 MB per design, versions over 10 MB are not kept, about 256 MB per account. Expired versions of designs that are no longer saved are removed at the next version or by the daily clean-up. Only the owner (signed in) can see versions; share links, folder links, other collaborators and AI read tokens cannot. Permanently deleting a design deletes its versions; deleting your account deletes all of them (even if the feature was turned off); versions of designs that no longer exist are purged daily.

設計分享 Design sharing

你按「分享」時，該設計的內容（量體圖、基地、場景）會上傳到 Cloudflare D1，任何拿到連結的人都能依你設定的權限檢視、備註或編輯；備註者自填的暱稱與內容也存在同一處。管理分享的祕密只存在你的瀏覽器，伺服器只存其雜湊；登入狀態下建立的分享會記錄你的帳號識別碼，刪除帳號時會解除關聯。切回「不分享」即立刻刪除內容與備註；超過 365 天未更新的分享也會自動刪除。「與我共享」清單只存在你的瀏覽器。伺服器支援時，一個分享可以有三條連結（可編輯、僅供檢視、可備註），每條各有自己的網址，可以各自開關、設定到期日或重新產生（舊網址立刻失效）；連結與這些設定存在同一個 Cloudflare D1，停止分享時一起刪除。可備註或可編輯的人可以在議題上附工地照片：照片在對方的瀏覽器先去除 EXIF 等中繼資料（含拍攝位置）並縮小，之後就是設計內容的一部分，隨分享存在伺服器（Cloudflare D1，較大的分享在 R2），也隨擁有者的雲端存檔存在雲端儲存空間，跟著設計一起刪除。分享者允許「複製為我的範本」時，拿到連結的人可以把設計複製成自己的新設計；副本會先清掉議題、照片、分享、專案資訊與標題欄的人名、地址與聯絡方式、基地經緯度等個人與關聯資料，存在對方的瀏覽器（對方登入時存進他自己的雲端存檔），本站不另外記錄是誰複製的。
Sharing uploads that design to Cloudflare D1; anyone with the link can view, comment or edit per your setting. Comments (self-chosen name and text) are stored there too. Stopping sharing deletes everything immediately; shares not updated for a year are purged. Deleting your account unlinks shares created while signed in. Where supported, a share can have three links (can edit, view only, can comment), each with its own address that you can turn on or off, give an expiry date or regenerate (the old address stops working at once); the links and these settings are stored in the same Cloudflare D1 and deleted when you stop sharing. People with a comment or edit link can attach site photos to issues: their browser first strips EXIF and other metadata (including location) and downsizes the photo, after which it is part of the design content, stored with the share on our server (Cloudflare D1, larger shares in R2) and with the owner's cloud save in storage, and deleted with the design. If you allow "Copy as my template", people with the link can copy the design as a new design of their own; the copy first removes issues, photos, sharing, names, addresses and contact details in project info and title blocks, site coordinates and other personal or linked data, and is stored in their browser (or in their own cloud save if they are signed in); we do not record who made a copy.

即時協作 Live collaboration

雲端存檔裡的設計可以多人同時編輯（是否開放依本站設定而定）。能加入的人：設計擁有者，以及已登入且持有該設計分享連結的人，權限照連結設定（檢視、備註或編輯）；每個房間最多 12 人在線、6 人編輯；只有 5 MB 以內的設計會開協作。

• 房間存什麼：每個設計一個協作房間（Cloudflare Durable Object，內建 SQLite）。房間裡有：設計內容的快照、協作期間的修改紀錄（每筆修改附上修改者帳號識別碼的雜湊與分頁代號，不是原值）、元件暫借與衝突比對用的紀錄，以及回寫用的擁有者帳號識別碼與設計 id。另在 Cloudflare D1 記一列「哪個帳號的哪個設計有協作房間」與最後活動時間，供排程清理與刪除帳號時找房間。不存 email、姓名或頭像。
• 在線的人看到什麼：同一房間的人會看到彼此的角色標籤（例如「擁有者 1」「編輯者 2」）與顏色、游標位置、選取與拖曳中的元件。這些「在線狀態」只即時轉送給房間裡的其他人，不寫入房間紀錄；標籤是伺服器依角色與順序產生的，不顯示你的 Google 名稱或 email。
• 回寫雲端存檔：有人在線時約每 5 分鐘、最後一人離開約 30 秒後，把協作內容寫回擁有者的雲端存檔（計入擁有者的容量）；每次協作第一次回寫前的版本會保留一份「協作前」版本，擁有者可還原（保留方式同下方「資料夾分享」的被覆蓋版本）。協作期間雲端存檔若被別處改過，那一份會另存成「衝突副本」設計，不會遺失。
• 保留與刪除：房間閒置 7 天、而且所有修改都已回寫、雲端存檔與最後一次回寫相符時，由每日排程整個清除；不符合時房間保留到條件符合為止。設計已從雲端刪除的房間閒置 7 天後連同未回寫的紀錄一起清除。刪除帳號時最先清除你所有設計的協作房間，成功後才刪雲端設計與帳號；帳號已不存在的房間由排程強制清除。
• 撤銷：停止分享或降低連結權限時，本站會盡力立即中斷從那條連結進來的連線；連線憑證最長 1 小時到期，到期後要重新驗證，已撤銷的連結無法再加入。
• 日誌：本站的協作日誌只記角色、進入方式（擁有者或分享連結）與結果等中繼資料，不記身分或設計內容。

Cloud designs can be edited by several people at once when this site enables it. Who can join: the design owner and signed-in holders of that design's share link, with the link's permission (view, comment or edit); up to 12 online and 6 editors per room; only designs up to 5 MB. Each design has one room (a Cloudflare Durable Object with SQLite) holding a snapshot of the design, the log of changes made during collaboration (each tagged with a hash of the editor's account ID and a tab code, not the raw ID), records for element borrowing and conflict checks, and the owner's account ID and design ID for writing back; a Cloudflare D1 row records which account's design has a room and when it was last active, so clean-up and account deletion can find it. No email, name or avatar is stored. People in the same room see each other's role label (e.g. "Owner 1", "Editor 2"), colour, cursor, selection and dragging; this presence is relayed live only and not written to the room's records, and labels are generated by the server, not your Google name or email. Changes are written back to the owner's cloud storage about every 5 minutes while someone is online and about 30 seconds after the last person leaves (counted toward the owner's storage); the version before a session's first write-back is kept as a "before collaboration" version the owner can restore (kept the same way as the overwritten version under "Folder sharing" below), and if the cloud copy was changed elsewhere meanwhile, that copy is saved as a separate "conflict copy" design. A room is cleared by the daily clean-up after 7 idle days once every change has been written back and the cloud copy matches the last write-back; otherwise it is kept until that holds. Rooms whose design was deleted from the cloud are cleared after 7 idle days, including unwritten changes. Deleting your account clears the collaboration rooms of all your designs first, then your cloud designs and account; rooms of accounts that no longer exist are force-cleared. Stopping a share or lowering its permission disconnects people who joined through that link on a best-effort basis; connection tickets expire within 1 hour and must be re-validated. Our collaboration logs record only metadata such as role, entry type (owner or share link) and result — no identity or design content.

資料夾分享 Folder sharing

開啟雲端存檔後，你可以把雲端裡的某個資料夾做成連結分享（「可以檢視」或「可以編輯」）。這項功能是否開放依伺服器設定而定。建立後：

• 範圍：拿到連結的任何人都能讀取該資料夾的全部內容——子資料夾與裡面的設計（名稱、單位、縮圖、內容），包含你之後才放進去的設計。把設計或子資料夾移出該資料夾，或停止分享，對方立即失去存取。
• 可編輯連結：對方經連結存回的修改會直接寫進你雲端裡的那個設計，並計入你的雲端容量；對方送出的名稱、所在資料夾與縮圖一律不採用。被覆蓋前的版本會保留 30 天（存在同一個 Cloudflare R2，索引在 D1），你可以在首頁還原；你自己上傳新版本、永久刪除該設計或保留期滿後即刪除。
• 對方的資料：經連結讀取或寫入不需要登入；本站不保存對方的身分，只在 Cloudflare 的速率限制計數器中短暫使用其 IP 位址。
• 停止：停止分享或刪除該資料夾即撤銷連結（撤銷紀錄保留 30 天後清除）；撤回雲端存檔同意會同時撤銷你全部的資料夾分享；刪除帳號會刪除所有分享紀錄。
• 連結代碼：連結裡的代碼等同於存取憑證，會出現在 Cloudflare 的請求紀錄（見下方「伺服器紀錄」）與對方瀏覽器的瀏覽紀錄中；請只把連結交給你信任的人。「下載我的資料」會列出你目前有效的資料夾分享。

After turning on cloud storage you can share a cloud folder by link ("can view" or "can edit"), when the server has this feature enabled. Anyone with the link can read everything in that folder — its subfolders and designs (names, units, thumbnails, content), including designs you add later; moving items out or stopping the share cuts their access immediately. With an edit link, changes saved by link holders are written straight into that design in your cloud and count toward your storage; the names, folder and thumbnails they send are ignored. The version overwritten through a link is kept for 30 days (same Cloudflare R2 bucket, index in D1) and can be restored from the home page; it is deleted when you upload a new version, permanently delete the design, or when that period ends. Link holders do not need to sign in; we store no identity for them and use their IP address only briefly in Cloudflare rate-limit counters. Stopping the share or deleting the folder revokes the link (the revocation record is cleared after 30 days); withdrawing cloud-storage consent revokes all your folder shares; deleting your account deletes all share records. The code in the link acts as the access credential and appears in Cloudflare request logs and in link holders' browser history — share links only with people you trust. "Download my data" lists your active folder shares.

AI 功能（AI 畫布與 AI 助手） AI features (AI canvas and AI assistant)

本節適用於「AI 畫布」與 2D「AI 助手」；「AI 解讀」（量體描述）的供應商與 1 小時結果快取見上方表格的「利用地區與對象」。使用「AI 畫布」（手繪草圖、照片或掃描平面轉成牆與門窗、手繪筆畫分類、對 3D 設計下指令）或 2D「AI 助手」時，需要 Google 登入或邀請碼，第一次使用前會先顯示這段說明並請你確認（確認只記在你的瀏覽器，可在帳號面板的「AI 功能」撤回）。每次使用：

• 送出的內容：你選的影像（草圖、照片、掃描圖或 PDF 的一頁；送出前在你的瀏覽器裡縮小到長邊約 1,568 像素並轉成 JPEG，原檔不上傳）、手繪筆畫的座標、你輸入的文字，以及完成這次要求所需的設計資料摘要（例如樓層、牆、門窗與節點參數、2D 圖層與選取物件的外框）。不送設計名稱、帳號識別碼、email；文字中的 email、電話與身分證字號樣式會先換成佔位字。
• 對象：內容（包括影像、草圖、手繪筆畫、你輸入的文字與設計資料摘要）經本站在 Cloudflare 上的伺服器轉送給伺服器設定的 AI 服務供應商處理：Google（Gemini API，模型由伺服器設定）或 Anthropic（Claude 模型，例如 Claude Sonnet 5.5 或你選的 Claude Opus 5.5）。兩家都設定時用 Anthropic；第一次使用前的告知會寫明本站目前使用哪一家。呼叫使用的是本站在伺服器上設定的該供應商 API 金鑰；金鑰不會傳到你的瀏覽器，也不會被記錄。Google 依 Gemini API 服務條款與其隱私政策處理 API 資料；Anthropic 依其商業服務條款與隱私政策處理 API 資料。在 Google 未付費的 Gemini API 方案下，Google 可能使用送出的內容（包括影像與文字）來改進其產品，過程中可能有人工審查；付費方案不適用這項做法。
• 保存：本站不保存這些影像、筆畫、文字或 AI 的回覆——它們只在這次請求期間經過伺服器（不快取、不寫入資料庫或 R2）；伺服器日誌只記中繼資料（時間、任務種類、模型、影像尺寸、字數、結果與毫秒數）。影像只留在你瀏覽器裡開著的 AI 畫布面板，關閉面板即丟棄；你接受預覽後產生的牆、門窗、線條等元素才成為設計的一部分，和其他設計內容一樣存放（見上方「雲端存檔」）。
• 次數：每次呼叫模型（含自動修正的重試）計入你當月的 AI 使用次數。
• 結果需要檢查：AI 可能看錯線條、比例或門窗位置；結果一律先以預覽呈現，由你接受或拒絕，接受後可用一次復原退回。

「AI 技能」（節點圖的程式碼節點，目前只在開發環境開啟）：送出的只有你輸入的技能描述（email、電話與身分證字號樣式先換成佔位字）與介面語言，經同一個伺服器轉送給同一家 AI 服務供應商，同樣需要登入或邀請碼、計入月額度、本站不保存；不送你的設計、節點圖或任何模型資料。AI 回的是一段程式碼，你看過按「加入並執行」後才在你的瀏覽器沙箱裡執行，之後不再呼叫 AI；技能庫只存在你的瀏覽器。
"AI skills" (code nodes in the node graph, currently enabled only in development builds) send only the skill description you type (email, phone and ID-number patterns replaced with placeholders) and the interface language, through the same server to the same AI provider, with the same sign-in, monthly quota and no storage on our side; your design, node graph and model data are never sent. The AI returns code that runs only in your browser's sandbox after you review it and press "Add and run", with no further AI calls; the skill library is stored only in your browser.

This section covers the AI canvas and the 2D AI assistant; the provider and the 1-hour result cache of "AI interpretation" (massing descriptions) are described in the "Where" row of the table above. The AI canvas (hand sketch, photo or scanned plan to walls and openings, freehand stroke classification, instructions on a 3D design) and the 2D AI assistant require Google sign-in or an invite code, and show this notice for confirmation before first use (the acknowledgement is stored only in your browser and can be withdrawn under "AI features" in the account panel). Each use sends: the image you choose (sketch, photo, scan or one PDF page, downscaled in your browser to about 1,568 px on the long side and converted to JPEG; the original file is not uploaded), freehand stroke coordinates, the text you type, and a summary of the design data the request needs (e.g. levels, walls, doors/windows and node parameters, 2D layers and the outlines of selected objects) — never the design name, account ID or email; email, phone and ID-number patterns in text are replaced with placeholders. It (including images, sketches, freehand strokes, the text you type and the design-data summary) is forwarded through our Cloudflare server to the AI provider configured on the server: Google (Gemini API, model set by the server) or Anthropic (Claude models such as Claude Sonnet 5.5, or Claude Opus 5.5 if you choose it). Anthropic is used when both are configured, and the notice shown before first use names the provider this site currently uses. Calls use that provider's API key configured on our server; the key is never sent to your browser and never logged. Google processes API data under the Gemini API terms of service and its privacy policy; Anthropic processes API data under its commercial terms and privacy policy. On Google's unpaid Gemini API tier, Google may use submitted content (including images and text) to improve its products, which may include human review; this does not apply on the paid tier. We do not keep the images, strokes, texts or AI replies: they pass through the server only during the request (no cache, no database or R2 writes), and our logs record metadata only (time, task, model, image size, character counts, result, timing). The image stays only in the open AI canvas panel in your browser and is discarded when you close it; only elements you accept from a preview become part of your design and are stored like the rest of it. Every model call (including automatic correction retries) counts toward your monthly AI usage. AI output can be wrong, so it is always shown as a preview you accept or reject; one undo reverts an accepted result.

AI 讀取權杖（MCP，測試中，目前未開啟） AI read tokens (MCP, in testing, currently off)

這項功能目前在本站是關閉的，帳號面板不會出現，也無法產生權杖。以下說明開啟後的做法：你可以在帳號面板產生「個人存取權杖」，貼到你自己使用的 AI 工具（例如支援 MCP 的 Claude Code），讓它唯讀地讀取你自己的雲端存檔設計（設計清單、摘要、數量表、法規檢討輸入）。

• 本站存什麼：D1 只存權杖的 SHA-256 雜湊、你取的名稱、權杖前 12 字的提示、建立／到期／上次使用時間與當日呼叫次數；完整權杖只在建立時顯示一次，本站不保存。需要先同意「雲端存檔」。
• 能讀什麼：只讀你自己帳號下、未刪除的雲端設計；讀不到分享給你的設計、協作房間或版本歷史；沒有任何寫入功能。
• 資料去向：設計資料會回傳給持有權杖的 AI 工具，之後如何處理依該工具與其 AI 供應商的條款；本站不會主動把資料送給 AI 供應商。
• 期限與撤銷：權杖有效 7、30 或 90 天，每個帳號最多 5 把；在帳號面板撤銷立即失效；過期超過 30 天的紀錄會清除。刪除帳號時刪除全部權杖；撤回雲端存檔同意後權杖暫停使用。
• 日誌：只記方法、工具名稱、結果與毫秒數，不記權杖、帳號識別碼、設計 id、名稱或內容。
• 請保管好權杖：權杖外洩到你撤銷之前，持有者可以唯讀讀取你帳號下的全部雲端設計。

This feature is currently turned off on this site; it does not appear in the account panel and no tokens can be created. When enabled, you can create a personal access token in the account panel and give it to an AI tool you use (e.g. Claude Code with MCP) so it can read your own cloud designs read-only (list, summary, schedule, regulation-review inputs). We store in D1 only the token's SHA-256 hash, your label, a 12-character hint, creation / expiry / last-used times and the day's call count; the full token is shown once at creation and never stored. Cloud-storage consent is required. Tokens read only your own non-deleted cloud designs — not designs shared with you, collaboration rooms or version history — and cannot write anything. Design data is returned to the AI tool holding the token and is then handled under that tool's and its AI provider's terms; we do not send it to AI providers ourselves. Tokens last 7, 30 or 90 days, at most 5 per account; revoking in the account panel takes effect immediately; records expired for over 30 days are removed; deleting your account deletes all tokens, and withdrawing cloud-storage consent suspends them. Logs record only method, tool name, result and timing — no token, account ID, design ID, name or content. Keep tokens safe: until revoked, a leaked token lets its holder read all cloud designs in your account.

Speckle 連接器（測試中，功能未開啟） Speckle connector (in testing, feature not enabled)

這項功能目前在本站是關閉的（功能未開啟），選單不會出現。以下說明開啟後的做法：你可以把 3D 設計傳到 Speckle，或接收 Speckle 上的版本當參考網格。資料會送到你指定的 Speckle 伺服器（預設 app.speckle.systems，或你填的自架伺服器），依該服務的條款與隱私政策處理。

• 傳送什麼：牆、帷幕、樓板、柱、梁、門窗、房間的網格，以及名稱、品類、樓層、類型、材料、元素 id 與你填的版本訊息；不送專案資訊、業主、地址、帳號或分享連結。由你的瀏覽器直接送出，不經過本站伺服器。
• 權杖：你在 Speckle 建立的個人存取權杖只用來連那一台 Speckle 伺服器；預設只在這個分頁的記憶體，你勾選「記住」才存在這個瀏覽器的 localStorage。本站伺服器不會收到或保存它。撤銷請到 Speckle。
• 接收：下載的網格存在你的設計裡（與匯入檔案相同），經過相同的檢查與清理。

This feature is currently turned off on this site (feature not enabled); it does not appear in the menus. When enabled, you can send a 3D design to Speckle or receive a Speckle version as reference meshes. Data is sent to the Speckle server you specify (app.speckle.systems by default, or a self-hosted server you enter) and handled under that service's terms and privacy policy. What is sent: meshes of walls, curtain systems, floors, columns, beams, doors, windows and rooms with name, category, level, type, material, element ID and the version message you write — no project info, client, address, account or share links. Your browser sends it directly; it does not pass through our servers. The personal access token you create in Speckle is used only for that Speckle server; by default it stays in this tab's memory, and only if you tick "Remember" is it kept in this browser's localStorage. Our servers never receive or store it; revoke it in Speckle. Received meshes are stored in your design like imported files and go through the same checks and clean-up.

第三方雲端硬碟 Third-party cloud drives

你可以選擇把設計以 .lsm 檔存到自己的 Google Drive、Microsoft OneDrive 或 Dropbox，並從那裡開啟。這是與「雲端存檔」分開、各自獨立的功能：不需要 Synhedra 登入，是否開放依本站設定而定（未設定的供應商不會出現）。

• 授權在你的瀏覽器與供應商之間完成：按「連結」會開啟該供應商的登入／同意視窗。取得的存取權杖只保存在你這個瀏覽器分頁的工作階段儲存空間，關閉分頁即消失；本站伺服器不會收到、轉送或保存權杖，也不申請長效的重新整理權杖（refresh token）。按「中斷連結」會立即丟掉權杖；要撤銷 Synhedra 的授權，請到該供應商的帳戶安全設定移除 Synhedra 應用程式。
• Synhedra 能存取的範圍（最小權限）：Google Drive 只用 drive.file 範圍——只看得到由 Synhedra 建立、或你親自在 Google 檔案選擇器中選取的檔案；OneDrive 只用 Files.ReadWrite.AppFolder——只看得到「應用程式／Synhedra」資料夾；Dropbox 使用「App folder」類型應用程式——只看得到「應用程式／Synhedra」資料夾。Synhedra 讀不到你雲端硬碟裡的其他檔案。
• 傳輸的內容：儲存時把該設計的內容（3D：量體圖、基地圖形、場景；2D：圖面）與名稱、單位包成 .lsm 檔，由你的瀏覽器直接上傳到供應商；你勾選時另附 DXF 或 IFC 匯出檔。開啟時由你的瀏覽器直接下載。這些資料都不經過本站伺服器。存放、保留與刪除依該供應商的服務條款與隱私政策。
• 本站保存什麼：只在你的瀏覽器（localStorage）記下「這個設計對應雲端硬碟上的哪個檔案與版本」，用來存回同一個檔與偵測遠端是否被改過；不隨 Synhedra 雲端同步到其他裝置，也不送到伺服器。
• 分享：存在雲端硬碟的檔案沒有 Synhedra 分享連結、參數頁或備註；要給別人請用該雲端硬碟自己的分享功能。從雲端硬碟開啟的檔案視為外部資料，會經過與匯入檔案相同的檢查與清理。
• 輸出到 Google 試算表／Google 簡報（2026-10-26）：你在法規檢討報表、面積表、明細表、圖紙或提案板按「輸出到 Google 試算表」或「輸出到 Google 簡報」時，你的瀏覽器會把那份報表的表格（XLSX）或圖紙頁的圖片（PPTX）直接上傳到你自己的 Google Drive，並由 Google 轉成試算表或簡報；同樣只用 drive.file 範圍、同一個存取權杖，不經過本站伺服器、本站也不保存檔案或連結。轉出的檔案之後依 Google 的條款與隱私政策保存，可在 Google Drive 刪除。
• 用戶端識別碼：連結時使用的 OAuth 用戶端 ID 是公開值，由本站設定提供；這些服務提供者（Google、Microsoft、Dropbox）會依各自的政策記錄你對其 API 的請求。

You may choose to store designs as .lsm files in your own Google Drive, Microsoft OneDrive or Dropbox and open them from there. This is separate from "Cloud storage" and independent of Synhedra sign-in; it is available only for providers configured on this site. Authorization happens between your browser and the provider: "Connect" opens the provider's own sign-in/consent window, and the resulting access token is kept only in this browser tab's session storage (gone when the tab closes); our server never receives, relays or stores it, and no long-lived refresh token is requested. "Disconnect" discards the token immediately; to revoke Synhedra's authorization, remove the Synhedra app in the provider's account security settings. Least-privilege scopes: Google Drive drive.file (only files created by Synhedra or that you pick in the Google file picker); OneDrive Files.ReadWrite.AppFolder (only the "Apps/Synhedra" folder); Dropbox "App folder" app (only the "Apps/Synhedra" folder) — Synhedra cannot read your other files. On save, the design's content (3D: massing graph, site outline, scenes; 2D: drawing) with its name and unit is packed into a .lsm file and uploaded by your browser directly to the provider, optionally with a DXF or IFC export; on open, your browser downloads it directly. None of this passes through our server; storage, retention and deletion follow the provider's terms and privacy policy. We keep only, in your browser's localStorage, which drive file and version a design maps to (to write back to the same file and detect remote changes); this is not synced to other devices or sent to the server. Files in a drive have no Synhedra share links, parameter pages or comments — use the drive's own sharing. Files opened from a drive are treated as external data and go through the same checks and clean-up as imported files. "Export to Google Sheets" / "Export to Google Slides" (2026-10-26): when you press these in the regulation review report, area schedule, schedules, sheets or presentation board, your browser uploads that table (as XLSX) or images of the sheet pages (as PPTX) directly to your own Google Drive, where Google converts it into a spreadsheet or presentation; it uses the same drive.file scope and access token, never passes through our server, and we keep no copy or link. The converted file is then kept under Google's terms and privacy policy and can be deleted in Google Drive. The OAuth client IDs used are public values provided by this site's configuration; Google, Microsoft and Dropbox log your requests to their APIs under their own policies.

使用統計（只計數） Usage statistics (counts only)

這項功能在本站已開啟。為了知道每週有多少專案真的做出了交付物，你在本站完成下列動作時，瀏覽器會送出一筆「動作類型＋次數」給本站伺服器——匯出 PDF、匯出提案板（工作區域圖片／PDF）、匯出影片、匯出 IFC、匯出法規報表、建立分享連結或參數頁連結、在別人的分享頁把設計「複製為我的範本」；另外，同一個設計在同一週（UTC）第一次完成上述動作時，多計一次「有交付的專案」。

• 送出什麼：只有動作類型（上述八種之一）與次數，例如「PDF 2 次、分享 1 次」。5 秒內的動作合成一次送出，不帶 Cookie。
• 伺服器存什麼：只存「動作類型＋日期（UTC 日）＋當日合計次數」，存放在 Cloudflare Durable Objects，保留 400 天後刪除。所有人的次數加在一起，無法分出是誰、哪台電腦或哪個設計。
• 不收集什麼：不送也不存設計 id、設計名稱或內容、帳號識別碼、email、IP 位址、瀏覽器資訊（User-Agent）、網址或來源頁；這個端點不讀登入 Cookie，登入與未登入的人送出的內容完全相同。
• 「同一設計同一週」怎麼判斷：只在你的瀏覽器裡判斷：localStorage 記下這一週與設計 id 的短雜湊，用來避免重複計算；這份紀錄不會送出，下一週換新。清除網站資料或換瀏覽器時會重新計算。
• 防止濫用：只接受上述八種類型，每次最多 50 次、每種最多 20 次。為了限制每個網路每天的次數，伺服器會在 Cloudflare 的速率限制計數器中短暫使用 IP 位址（以分鐘計），並在記憶體中以「每日更換、不落地的隨機值」雜湊網路位址計數當天次數；這些都不寫入儲存，隔天或伺服器重新啟動就消失。
• 不想被計入：在瀏覽器開啟「Do Not Track（不追蹤）」或「Global Privacy Control」，瀏覽器就不會送出；伺服器收到帶這兩個標頭的請求也一律不計。
• 用途：只用來看全站每週的交付量（產品的北極星指標），不用於廣告、不與帳號資料合併、不提供給第三方。

This feature is on for this site. To learn how many projects actually produce deliverables each week, completing any of these actions makes your browser send "action type + count" to our server: exporting a PDF, exporting a presentation board (artboard images or PDF), exporting a video, exporting IFC, exporting a regulation report, creating a share link or parameter-page link, or using "Copy as my template" on someone else's shared page; in addition, the first such action on a design in a given week (UTC) counts once as "a project with a deliverable". What is sent: only the action type (one of these eight) and a count, batched over 5 seconds, without cookies. What the server stores: only "action type + date (UTC day) + that day's total count", in Cloudflare Durable Objects, deleted after 400 days; everyone's counts are added together and cannot be traced to a person, computer or design. Not collected: no design ID, design name or content, account ID, email, IP address, browser details (User-Agent), URL or referrer is sent or stored; this endpoint does not read the sign-in cookie, so signed-in and signed-out users send exactly the same thing. "Same design, same week" is decided only in your browser: localStorage keeps the current week and short hashes of design IDs to avoid double counting; this record is never sent and resets each week (clearing site data or switching browsers starts it again). Abuse prevention: only the eight types are accepted, at most 50 per request and 20 per type; to cap each network's daily count, the server briefly uses your IP address in Cloudflare rate-limit counters (minutes) and counts the day's events in memory under a hash of the network address with a random value that changes daily and is never written to storage — all of this is gone the next day or when the server restarts. To opt out, turn on "Do Not Track" or "Global Privacy Control" in your browser: it then sends nothing, and the server ignores any request carrying either header. Purpose: only to see site-wide weekly deliverables (the product's north-star metric); not used for advertising, never combined with account data, and not shared with third parties.

其他第三方服務 Other services

底圖：內政部國土測繪中心。周邊建物：OpenFreeMap（OpenMapTiles、OpenStreetMap）；備援時為 OpenStreetMap Overpass。地址查詢：OpenStreetMap Nominatim（經本站轉送，不附帶身分）。詳見 資料處理方法。

伺服器紀錄與分享期限 Server logs and share limits

本站架在 Cloudflare 上。Cloudflare 會為每個請求記錄網址（包含設計分享、參數頁與資料夾分享連結裡的代碼）、你的 IP 位址、時間與瀏覽器資訊，用於除錯、統計與防止濫用；這些紀錄由 Cloudflare 依其服務設定保存（Workers 日誌目前約數天），本站只用來排查問題，不與帳號資料合併。本站自己的日誌只記中繼資料（例如結果、毫秒數、大小），不記 email、帳號識別碼或你的設計與描述內容。為了限速與防止濫用，IP 位址會在 Cloudflare 的速率限制計數器中短暫使用（以分鐘到天計）。未登入時建立的分享限 256 KB、7 天後自動失效，每個網路每天的建立次數也有上限；較大的分享內容存放在 Cloudflare R2，索引存放在 Cloudflare D1。
This site runs on Cloudflare, which logs each request's URL (including the codes in design-share, parameter-page and folder-share links), your IP address, time and browser details for debugging, statistics and abuse prevention; Cloudflare keeps these per its service settings (Workers logs currently a few days). We use them only for troubleshooting and never combine them with account data. Our own logs hold metadata only (results, timings, sizes) — no email, account ID, designs or prompts. IP addresses are used briefly in Cloudflare rate-limit counters (minutes to days). Shares created without signing in are limited to 256 KB, expire after 7 days, and are capped per network per day; larger shared content is stored in Cloudflare R2 with its index in Cloudflare D1.